Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
According to the official complaint, on Page 28 they mention:
on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the site, and listed IP address of the VPN Server.
What does it mean that an IP Address "was leaking" and when would this occur?
It is an information leak on the Silk Road server. It appears somebody located a debug or info screen on the Silk Road server that dumped configuration and environment variables. Some possibilities:
phpinfo() (example)It could have been found by checking known locations of status and debug pages or checking common locations (eg. /phpinfo.php).
It looks like the debug output contained the servers public IP address and the IP address of another server that was being used by the admin as a VPN proxy to administer the Silk Road site (the IP was stored because it was being used to whitelist).
In March of 2013, less than a few months prior to when the FBI took a snapshot of the Silk Road server, a blogger posted a warning to Silk Road users that the server contained a misconfiguration that revealed the servers IP address and other information:
WARNIG TO SILK ROAD USERS: SR is leaking their public IP address
It is possible that this is the same person who messaged and warned Dread Pirate Roberts about the info leak.
From a related thread on reddit that user says:
Last night, while SR was down for maintenance, a brief few moments allowed a certain set of circumstances that caused me to be able to view the public IP of the httpd server of Silk Road. This isn't an obvious flaw, but it is extremely simple if you know where to look - the server basically will publish a page containing all of the configuration data of the httpd server including the public IP address.
While we can't know yet if this is the same user or the same bug it is indicative of potential problems with information leaks on the Silk Road server. The FBI could have later discovered the same information and used it to trace back to the VPN server.
What we do know is that the Silk Road server had a public IP address, which was used by Dread Pirate Roberts to administer the server. Accessing this public interface using a VPN server (which in turn revealed his real IP address) was a good part of the case against the accused.
Most important, this leak had nothing to do with Tor or a flaw in Tor, it was all down to how the site was hosted and how it was accessed for administration.
Edit: I have since been able to confirm this theory
I found the following thread on /r/SilkRoad, it was posted 5 months ago:
Should we be worried? Showing on login page I have removed the IPs Array ( [USER] => X [HOME] => X [FCGI_ROLE] => RESPONDER [QUERY_STRING] => [REQUEST_METHOD] => GET [CONTENT_TYPE] => [CONTENT_LENGTH] => [SCRIPT_FILENAME] => X [SCRIPT_NAME] => /index.php [REQUEST_URI] => / [DOCUMENT_URI] => /index.php [DOCUMENT_ROOT] => X[SERVER_PROTOCOL] => HTTP/1.0 [GATEWAY_INTERFACE] => CGI/1.1 [SERVER_SOFTWARE] => X[REMOTE_ADDR] => xx.xx.xx.xx.xx [REMOTE_PORT] => X [SERVER_ADDR] => xx.xx.xx.xx.xx [SERVER_PORT] => 443 [SERVER_NAME] => _ [HTTPS] => on [REDIRECT_STATUS] => 200 [HTTP_HOST] => xx.xx.xx.xx.xx [HTTP_CONNECTION] => close [HTTP_USER_AGENT] => Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20100101 Firefox/17.0 [HTTP_ACCEPT] => text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 [HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5 [HTTP_ACCEPT_ENCODING] => gzip, deflate [HTTP_COOKIE] => session=X [PHP_SELF] => /index.php [REQUEST_TIME] => 1367610063 )
The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server.
Edit: September 2014 - Confirmed by the FBI
In a filing during Ross Ulbricht's trial and in response to a defense motion the FBI revealed how they located the Silk Road server:
they found a misconfiguration in an element of the Silk Road login page, which revealed its Internet Protocol (IP) address and thus its physical location.
As they typed “miscellaneous” strings of characters into the login page’s entry fields, Tarbell writes that they noticed an IP address associated with some data returned by the site didn’t match any known Tor “nodes,” the computers that bounce information through Tor’s anonymity network to obscure its true source. And when they entered that IP address directly into a browser, the Silk Road’s CAPTCHA prompt appeared
NAT: "Hey server, your external IP is 74.125.224.72, if you bypass me.").
Oct 10, 2013 at 0:27
This is part of an expert witnesses' statement (probably an FBI technician). You can find it in a footnote on page 28 of the original sealed complaint:
The code containing the IP address for the VPN Server is "commented out" on the Silk Road Web Server, meaning that is no longer active as of July 23, 2013, when the image of the server was made. From reviewing DPR's private-message communications recovered from the Silk Road Web Server, I know that, on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the site, and listed IP address of the VPN Server. Based on my training and experience, I believe that in light of this warning DPR deactivated the contents of the VPN Server, and changed the way he access the Silk Road Web Server thereafter.
I think it means that the accused was using a VPN server to interact with the Silk Road hidden Tor site; and this server's identity was leaked/made known to other Silk Road users somewhere on the site.
As to why it leaked, I don't know - you would need to examine a copy of the Silk Road source code, if such exists outside of FBI custody.
