Forum libero

Scritto da: Giambo
> http://krebsonsecurity.com/2014/10/silk-road-lawye...
>
> L'FBI puo' bucare TOR, Seu ha ragione.

Dove l'hai letto?
Lì si mette solo in dubbio che la versione data dall'FBI sia corretta.
Ma se leggi fra i commenti c'è un certo Michael Koziarski che sostiene che il file di configurazione di nginx abbia un bug che permette proprio quello che l'FBI ha detto che ha fatto. Io non so niente di nginx, magari la suora può verificare.

Scritto da: Giambo
> http://krebsonsecurity.com/2014/10/silk-road-lawye...
>
> L'FBI puo' bucare TOR, Seu ha ragione.

The nginx configuration file being mentioned has a bug. In particular location blocks are exclusive, a request only matches one. See http://nginx.org/en/docs/http/request_processing.h...

As a result while the configuration blocks almost all requests from IPs other than the one configured, it *allows* php requests from everywhere as that block doesn’t contain the deny command.

So yeah, DPR fucked up and got owned, doesn’t seem like there’s a whole lot of mystery here. Especially when you combine it with the contemporaneous reddit posts where people noticed the IP in the html of the login page

https://www.reddit.com/r/SilkRoad/comments/1dmznd/...

We all love to think this was some elaborate conspiracy involving NSA and the illuminati, but maybe it was just some arrogant kid who underestimated the patience and capabilities of law enforcement?