Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to the official complaint, on Page 28 they mention:

on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the site, and listed IP address of the VPN Server.

What does it mean that an IP Address "was leaking" and when would this occur?

share|improve this question

2 Answers 2

up vote 30 down vote accepted

It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities:

  1. The output of Apache's mod_status (example)
  2. Output of phpinfo() (example)
  3. A custom debug page that is part of the Silk Road application

It could have been found by checking known locations of status and debug pages or checking common locations (eg. /phpinfo.php).

It looks like the debug output contained the servers public IP address and the IP address of another server that was being used by the admin as a VPN proxy to administer the Silk Road site (the IP was stored because it was being used to whitelist).

In March of 2013, less than a few months prior to when the FBI took a snapshot of the Silk Road server, a blogger posted a warning to Silk Road users that the server contained a misconfiguration that revealed the servers IP address and other information:

WARNIG TO SILK ROAD USERS: SR is leaking their public IP address

It is possible that this is the same person who messaged and warned Dread Pirate Roberts about the info leak.

From a related thread on reddit that user says:

Last night, while SR was down for maintenance, a brief few moments allowed a certain set of circumstances that caused me to be able to view the public IP of the httpd server of Silk Road. This isn't an obvious flaw, but it is extremely simple if you know where to look - the server basically will publish a page containing all of the configuration data of the httpd server including the public IP address.

While we can't know yet if this is the same user or the same bug it is indicative of potential problems with information leaks on the Silk Road server. The FBI could have later discovered the same information and used it to trace back to the VPN server.

What we do know is that the Silk Road server had a public IP address, which was used by Dread Pirate Roberts to administer the server. Accessing this public interface using a VPN server (which in turn revealed his real IP address) was a good part of the case against the accused.

Most important, this leak had nothing to do with Tor or a flaw in Tor, it was all down to how the site was hosted and how it was accessed for administration.

Edit: I have since been able to confirm this theory

I found the following thread on /r/SilkRoad, it was posted 5 months ago:

Should we be worried? Showing on login page I have removed the IPs Array ( [USER] => X [HOME] => X [FCGI_ROLE] => RESPONDER [QUERY_STRING] => [REQUEST_METHOD] => GET [CONTENT_TYPE] => [CONTENT_LENGTH] => [SCRIPT_FILENAME] => X [SCRIPT_NAME] => /index.php [REQUEST_URI] => / [DOCUMENT_URI] => /index.php [DOCUMENT_ROOT] => X[SERVER_PROTOCOL] => HTTP/1.0 [GATEWAY_INTERFACE] => CGI/1.1 [SERVER_SOFTWARE] => X[REMOTE_ADDR] => xx.xx.xx.xx.xx [REMOTE_PORT] => X [SERVER_ADDR] => xx.xx.xx.xx.xx [SERVER_PORT] => 443 [SERVER_NAME] => _ [HTTPS] => on [REDIRECT_STATUS] => 200 [HTTP_HOST] => xx.xx.xx.xx.xx [HTTP_CONNECTION] => close [HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0 [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 [HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5 [HTTP_ACCEPT_ENCODING] => gzip, deflate [HTTP_COOKIE] => session=X [PHP_SELF] => /index.php [REQUEST_TIME] => 1367610063 )

The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server.

Edit: September 2014 - Confirmed by the FBI

In a filing during Ross Ulbricht's trial and in response to a defense motion the FBI revealed how they located the Silk Road server:

they found a misconfiguration in an element of the Silk Road login page, which revealed its Internet Protocol (IP) address and thus its physical location.

As they typed “miscellaneous” strings of characters into the login page’s entry fields, Tarbell writes that they noticed an IP address associated with some data returned by the site didn’t match any known Tor “nodes,” the computers that bounce information through Tor’s anonymity network to obscure its true source. And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared

share|improve this answer
    
Moral of this story (other than the FBI isn't stupid) is: A hidden Tor service shouldn't know its own location. so consider wrapping your hidden service behind the equivalent of a NAT that lies to the server (NAT: "Hey server, your external IP is 74.125.224.72, if you bypass me."). –  LateralFractal Oct 10 '13 at 0:27

This is part of an expert witnesses' statement (probably an FBI technician). You can find it in a footnote on page 28 of the original sealed complaint:

The code containing the IP address for the VPN Server is "commented out" on the Silk Road Web Server, meaning that is no longer active as of July 23, 2013, when the image of the server was made. From reviewing DPR's private-message communications recovered from the Silk Road Web Server, I know that, on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the site, and listed IP address of the VPN Server. Based on my training and experience, I believe that in light of this warning DPR deactivated the contents of the VPN Server, and changed the way he access the Silk Road Web Server thereafter.

I think it means that the accused was using a VPN server to interact with the Silk Road hidden Tor site; and this server's identity was leaked/made known to other Silk Road users somewhere on the site.

As to why it leaked, I don't know - you would need to examine a copy of the Silk Road source code, if such exists outside of FBI custody.

share|improve this answer
2  
I've included the whole extract from the image-based PDF, so others with more familiarity with Silk Road or Tor can have a crack at this question. –  LateralFractal Oct 3 '13 at 2:11
2  
Note that 'deactivated the VPN' means 'erased VPN server content' in this context. I.e. Attempting to delete logs and other origin artefacts from the VPN indirection. –  LateralFractal Oct 3 '13 at 2:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.