The FBI Says How It ‘Legally’ Pinpointed Silk Road’s Server
The theory I posted last year on Stack Exchange [0]:> The above environment variables were being dumped in the source of the login page on Silk Road. They contained the real IP address of the server.notbad.gif.Second - the FBI considering "fiddling" with "miscellaneous" input characters into the login page not illegal access is good - it means the next person charged under the CFAA for "exceeding authorization" by fuzzing will have a precedent to cite.edit: To add a third point: If you are hosting a Tor hidden service, do it inside a virtual machine. Put it behind a gateway that acts as an isolating proxy. Clients/users should be doing the same as well as it protects against the malware attacks (even better freeze a VM snapshot and restore it each time you need it). Whonix[1] does this - although it is easy to setup yourself (I use OpenBSD as the gateway, much slimmer than Whonix and a whole lot less going on)[0] http://security.stackexchange.com/a/43280[1] http://www.whonix.org