Many Tor-Anonymized Domains Seized by Police, Belonged to Imposter Websites

A Large Number of the Tor-Anonymized Domains Recently Seized in a Crackdown on Illegal Darknet Services were Clones or Imposter Websites, according to an Analysis Published Last Monday. That Conclusion is Based on an Indexing of .onion Sites Available through the Tor Privacy Service that Cloaks the Location Where Online Services are Hosted. Australia-Based Blogger, Nik Cubrilovic, Said a Web Crawl he Performed on the Darknet Revealed just 276 Seized Addresses, Many Fewer than the 414 Domains Police Claimed they Confiscated Last Week. Of the 276 Domains Cubrilovic Identified, 153 Pointed to Clones, Phishing, or Scam Websites Impersonating One of the Hidden Services Targeted by Law Enforcement, he Said. If Corroborated by Others, the Findings May be Viewed as Good News for Privacy Advocates Who Look to Tor to Help Preserve their Anonymity. Last Week's Reports that, Law Enforcement Agencies Tracked Down More than 400 Hidden Services Touched Off Speculation that Police Identified and were Exploiting a Vulnerability in Tor itself that Allowed them to Surreptitiously Decloak Hidden Services. The Revelation that Many of the Seized Sites were Imposters May Help to Tamp Down such Suspicions.




In a Blog Post Published Monday, Cubrilovic Wrote:


"That the FBI seized so many clone and fake websites suggests a broad, untargeted sweep of hidden services rather than a targeted campaign. The slapshot nature of how sites were seized suggests that rather than starting with an onion address and then discovering the host server to seize, this campaign simply vacuumed up a large number of onion websites by targeting specific hosting companies. We have tracked down the hosting companies affected and the details will be published in a follow-up."




Officials with the Tor Project Continue to Say they Have No Evidence the Mass Seizures are the Result of a Technical Exploit. In a Blog Post Published Friday, they Wrote: "So far, all indications are that those arrests are best explained by bad opsec for a few of them and then those few pointed to the others when they were questioned".




Info Sources:

https://www.nikcub.com/posts/onymous-part1

https://blog.torproject.org/blog/traffic-correlation-using-netflows