FBI hacked over 1,000 computers in TOR-site takedown

Child-pornography is a heinous crime, so when the FBI managed to close down one of the worst sites on the the TOR network it gained well-earned praise. However, as the backstory starts to emerge, with court documents becoming public, some human rights groups are raising eyebrows. It should be stressed that the two main sites targeted by the FBI, Playpen and Lolita, were by far the most depraved (and popular) sites of this type on the dark web; the former had over 200,000 members and 11,000 unique visitors per week. To apprehend the individuals behind the sites the FBI not only had to use sophisticated spyware, but when the servers were finally located had to transfer the "service" to their own servers and essentially trap ongoing users. Lawyers expect "at least" 1,300 cases to be filed against individual users in the coming months on the back of the evidence collected.

The case received some media attention , and snippets of information about other , related arrests started to spring up as the year went on. But only now is the true extent of the FBI's bulk hacking campaign coming to light.

In the summer of 2015, two men from New York were charged with online child pornography crimes. The site the men allegedly visited was a Tor hidden service, which supposedly would protect the identity of its users and server location. What made the case stand out was that the Federal Bureau of Investigation (FBI) had used a hacking tool to identify the IP addresses of the individuals.

An FBI complaint described the site as "the largest remaining known child pornography hidden service in the world."

Just a month after launch, Playpen had nearly 60,000 member accounts. By the following year, this number had ballooned to almost 215,000, with over 117,000 total posts, and an average of 11,000 unique visitors each week. Many of those posts, according to FBI testimony, contained some of the most extreme child abuse imagery one could imagine, and others included advice on how sexual abusers could avoid detection online.

A new bulletin board site on the dark web was launched in August 2014, on which users could sign up and then upload whatever images they wanted. According to court documents, the site's primary purpose was "the advertisement and distribution of child pornography." Documents in another case would later confirm that the site was called "Playpen."

In order to fight what it has called one of the largest child pornography sites on the dark web, the FBI hacked over a thousand computers, according to court documents reviewed by Motherboard and interviews with legal parties involved.

A section of one of the complaints involved in the Playpen investigation, showing that 1300 true IP addresses were obtained.

A month before this peak, in February 2015, the computer server running Playpen was seized by law enforcement from a web host in Lenoir, North Carolina, according to a complaint filed against Peter Ferrell, one of the accused in New York. (Data hosts in Lenoir contacted by Motherboard declined to comment. One of them, CentriLogic, wrote "We have no comment on the matter referenced by you. Our obligations to customers and law enforcement preclude us from responding to your inquiry.")

Fieman has three cases pending in his defenders office, he said. According to court documents, charges have also been filed against defendants in Connecticut, Massachusetts, Illinois, New York, New Jersey, Florida, Utah, and Wisconsin.

"There will probably be an escalating stream of these [cases] in the next six months or so," Fieman added. "There is going to be a lot in the pipeline."

"Fifteen-hundred or so of these cases are going to end up getting filed out of the same, underlying investigation," Colin Fieman, a federal public defender handling several of the related cases, told Motherboard in a phone interview. Fieman, who is representing Jay Michaud, a Vancouver teacher arrested in July 2015, said his estimate comes from what "we've seen in terms of the discovery."

The legal counsel for one of the accused believes that the number of eventual cases may even be slightly higher.

While Playpen was being run out of a server in Virginia, and the hacking tool was infecting targets, "approximately 1300 true internet protocol (IP) addresses were identified during this time," according to the same complaint.

"There will probably be an escalating stream of these [cases] in the next six months or so"

But after Playpen was seized, it wasn't immediately closed down, unlike previous dark web sites that have been shuttered by law enforcement. Instead, the FBI ran Playpen from its own servers in Newington, Virginia, from February 20 to March 4, reads a complaint filed against a defendant in Utah. During this time, the FBI deployed what is known as a network investigative technique (NIT), the agency's term for a hacking tool.

But the case of Playpen appears to be much, much broader in scope.

When WIRED reported on that operation in 2014, "over a dozen alleged users of Tor-based child porn sites" were headed for trial. And within a two-week period, the FBI reportedly collected IP addresses for at least 25 of the site's US visitors.

In 2011, "Operation Torpedo" was launched, which saw the agency place an NIT on the servers of three different hidden services hosting child pornography, which would then target anyone who happened to access them. The NIT used a Flash application that would ping a user's real IP address back to an FBI controlled server, rather than routing their traffic through the Tor network and protecting their identity.

NITs come in all sorts of different forms, and have been used since at least 2002 . Malware has been delivered to bomb threat suspects via phishing emails, and the FBI has also taken over hosting services and surreptitiously exploited a known bug in Firefox to identify users connecting with the Tor Browser Bundle.

In court filings, Fieman describes the use of this broad NIT as an "extraordinary expansion of government surveillance and its use of illegal search methods on a massive scale."

A section of an affidavit in support of application for a search warrant, as part of the Playpen case, showing what sort of data the NIT sent to the FBI.

"We're not talking about searching one or two computers. We're talking about the government hacking thousands of computers, pursuant to a single warrant," said Soghoian, the ACLU technologist.

With earlier cases, the FBI's broad NIT attacks had used already known and patched vulnerabilities. But because the Tor Browser Bundle had no auto-update mechanism in August 2013—around the time of one of the FBI's attacks—only those users who bothered or remembered to patch their systems were safe. Evidentially, some people forgot.

The same might be true of the Playpen NIT: automatic updates to the Tor Browser Bundle were introduced in August 2015, months after the FBI had already obtained over a thousand IP addresses.

"There is no public information revealing whether or not the FBI used a zero-day in this case, or an exploit that targeted a known flaw," Soghoian said.

It's not totally clear exactly how it was deployed, but the warrant allowed for anyone who logged into the site to be hacked.

Some clues about the Playpen NIT exist however. The NIT is likely different to the one used in Operation Torpedo because according to court filings that one is "no longer in use." As for how the Playpen NIT operates, it's not totally clear exactly how it was deployed, but the warrant allowed for anyone who logged into the site to be hacked.