The Federal Bureau of Investigation (FBI) appears to have used a leak in the Captcha to find out where the Silk Road drug market's servers are located, according to documents and witness statements filed in court late last week.
The former FBI agent, Christopher Tarbell claimed that his service managed to locate the anonymous Silk Road servers using an IP leak found on the site's login page, containing Captcha.
Recall that the anonymous online drug market went offline in October last year, and its administrator, Dread Pirate Roberts, also known as Ross William Ulbricht, was arrested at the San Francisco airport.
The Silk Road used the anonymous network Tor network to maintain the true IP address of the web server secret, but according to Tarbell's statement (PDF) the FBI spotted the Silk Road server by using the page's leak website which contained Captcha.
"The leak of the IP address came from Silk Road user login interface, ”said Tarbell. "After examining the individual data packets sent behind the website, we noticed that the headers from some packets reflected a specific IP address that was not associated with any of the known IPs of the Tor nodes and appeared to be the source of the packets. ”
“When we typed the IP address into a regular (non-Tor) web browser, a part of his login page appeared Silk Road (the Captcha prompt). "Based on our training and experience, we learned that the IP indicated the IP address of the SR Server, and that the 'leak' from the SR Server was because the login page code was not properly configured to work through Tor."
Her former columnist The Washington Post and security researcher Brian Krebs, δημοσίευσε τμήματα της δήλωσης του Tarbell στην ιστοσελίδα του Krebs on Security το Σαββατοκύριακο, και ανέφερε ότι το λάθος αυτό μπορεί να χαρακτηριστεί σαν “noob mistake.”
