Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read this article a moment ago: http://www.geek.com/news/the-pirate-bay-is-now-hosted-anonymously-in-the-cloud-1522725/

But it was very light on details. Is an architecture as described in this article even feasible? If so, what are the benefits opposed to using a self-owned/hosted server with no logs and encrypted hard drives?

Far as I can tell it's only the "obfuscation" of where the TPB data is stored, but wouldn't it be relatively easy for a powerful government organization to "follow" the traffic from the TPB load balancer/router to the VPSs that store the encrypted data?

Sorry, that's a lot of questions, and this should probably be wiki'd.

TL;DR: Is this real, if so, could someone explain the architecture and its benefits in more detail?

share|improve this question

closed as off-topic by Adnan, NULLZ, TildalWave, AviD Oct 3 '13 at 10:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Adnan, NULLZ, TildalWave, AviD
If this question can be reworded to fit the rules in the help center, please edit the question.

    
Have you read original article linked at the end? torrentfreak.com/… There's load balancer, a number of routers, and a couple of VMs with data. –  НЛО Oct 1 '13 at 12:13

1 Answer 1

The TorrentFreak article explains enough about the architecture to understand that while it's possible to shut TPB down, it's much more difficult now. The steps involved are:

  1. Locate transit router.
  2. Obtain warrant for access to transit router.
  3. Watch to see where traffic is going to locate load balancer.
  4. Obtain warrant for access to load balancer.
  5. Watch to see where traffic is going to locate cloud provider(s).
  6. Obtain warrant(s) for access to cloud provider(s).
  7. Shut all three locations down simultaneously.

In the past, only steps 1. and 2. were necessary. Seeing as steps 2. 4. and 6. are likely to be in different countries and 6. could be in several countries at once on its own, this is likely to be comparatively very difficult.

It is also quite likely that TPB have cold spares of every part of this infrastructure. A spare transit router can be brought online with a simple DNS change. The new transit router can be pointed to the new load balancer quickly and cloud providers boast that new instances can be spun up in minutes. Even if everything were brought down at once by authorities, the website could be up and running again in a few minutes. There is no reason for there to be any link from the live infrastructure to the cold spare infrastructure so that would be undiscoverable by the authorities before the shutdown.

Yes, it is quite feasible.


Servers with encrypted disks leave at least two possibilities for accessing the data:

  1. Access the server while it's still running and the disks/keys are available in RAM.
  2. Break the encryption. While in the past we would have said this is infeasible, recent revelations of the NSA's long-term goals in subverting cryptography standards and software leaves this point uncertain.

Servers with no disks don't have this possibility.


TPB has already weathered what looks like a linchpin: the domain. This vulnerability has also been given a similar treatment with too many options (some hidden) for any authority to shut down.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.