The FBI Says How It ‘Legally’ Pinpointed Silk Road’s Server
The theory I posted last year on Stack Exchange [0]:<p>> The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server.<p>notbad.gif.<p>Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite.<p>edit: To add a third point: If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. Clients/users should be doing the same as well as it protects against the malware attacks (even better freeze a VM snapshot and restore it each time you need it). Whonix[1] does this - although it is easy to setup yourself (I use OpenBSD as the gateway, much slimmer than Whonix and a whole lot less going on)<p>[0] <a href="http://security.stackexchange.com/a/43280" rel="nofollow">http://security.stackexchange.com/a/43280</a><p>[1] <a href="http://www.whonix.org" rel="nofollow">http://www.whonix.org</a>