Ross Ulbricht’s Lawyers Point to Another Corrupt Agent in Silk Road Case
Go1dfish undelete link
unreddit undelete link
Author: CaptainMegaJuice

source link: Bitcoin Exchange CEO Pleads Guilty to Enabling Silk Road Drug Deals | Threat Level | WIRED
poster: bigp3rm, original conspiracy link
Discourse level: 100%
Shills: 0%

It looks like some more info is coming out about the "hits" that Ross allegedly ordered on Silk Road years back. No victims in that case have ever been identified. Things get real weird though... In the trial the Canadian government claimed that victim 34-year-old Blake Krokoff user "friendlychemist" did not exist in Canadian records. They claim there was no evidence of a 34-year-old Blake Krokoff having lived or currently living anywhere in Canada.
​
Recently some new info came to light (see articles below). A man was arrested in Vancouver BC by the name of James Ellingson. Police have confirmed that he is "redandwhite". They claim he is the same man found in photos located on Ulbricht's laptop.
​
... this entire part of the case is very odd to me. Upon reading the transcript something feels off. We are still left with questions....
Is "friendlychemist" the same guy as "redandwhite" ? Did the Canadian Security Intelligence Services have anything to do with this? If so why? What are your thoughts on all this new info?
​
Here is a great write up I dug up on the entire thing: http://web.archive.org/web/20190130211307/http://antilop.cc/s#lucy
​
links you guys can read to dig more:
https://www.wired.com/2015/02/read-transcript-silk-roads-boss-ordering-5-assassinations/
https://arstechnica.com/tech-policy/2018/11/silk-roads-alleged-hitman-redandwhite-arrested-in-vancouve
http://www.antimoneylaunderinglaw.com/2019/03/alleged-drug-dealer-in-vancouver-tied-to-silk-road-sought-for-extradition.html
https://www.reddit.com/SilkRoad/comments/37smni/who_was_behind_the_silk_road_username/
https://www.reddit.com/Bitcoin/comments/2ulkv7/read_the_transcript_of_silk_roads_boss_ordering_5/

Bitcoin was released to the world in 2009 by someone (or a group) who authored a technical whitepaper, released the source code to the protocol and commented on a few p2p forums and mailing lists under the pseudonym Satoshi Nakamoto for a few months prior and a few years afterwards before leaving the project. The project was left in the hands of Gavin Andresson who was another cryptographer that satoshi communicated regularly with on the forums and had been one of the first people involved in the project. Some time after satoshi left, one of his accounts was allegedly hacked and bitcointalk (the primary forum) itself was hacked so a meme kind of emerged that satoshi wouldn't be able to post again from his accounts or that posting from them would be dubious. In 2016 an Australian by the name of Craig S Wright was exposed by Wired and Gizmodo as potentially being the inventor of bitcoin. Craig then signed privately for Gavin Andreson, Jon Matonis but then when he was supposed to cryptographically sign to a journalist the method performed did not hold up to public scrutiny because he could have copy pasted a fragment from an earlier known signed message from satoshi and not generated it himself with the private keys. This cast a lot of doubt from many on the man's claims and he published an article saying he wasn't brave enough to sign.
Since then the term cryptocurrency has blown out massively to include anything with a distributed ledger technology, a token, a security, and has really just devolved into a cesspit of buzzwords and disinformation. Once satoshi disappeared in 2011 and left the repo in the hands of Gavin and the open source community, it left a power vacuum in the space for how to interpret the protocol, whitepaper and handle the development. Gavin Andresson brought some other developers on board from the forums and mailing lists, Shortly after Gavin gave some other developers commit access, bitcointalk was hacked and these new developers somehow deleted gavin from the github repo due to apparent concern that his account was compromised from the hack and afterwards once he validated his identity in certain accounts he was never given access again. Gavin stopped being involved with the project after that.
In the time following satoshi's departure a meme had evolved that satoshi had left because Gavin had met with the CIA to discuss bitcoin. This meme combined with the interpretation of what satoshi meant when he included the quote "The Times 03/Jan/2009 Chancellor on brink of second bailout for banks" in the genesis block, the subsequent rise and fall of silk road and darknet markets, and the general lore of the space, his cypherpunk mailing list associations had led the scene to paint/project upon him as some kind of government hating tax dodging l33t h4xor demigod.
Although in the title of the whitepaper it was described as p2p cash, bitcoin as most know it is now is marketed as a store of value. Although it was defined as the longest Proof of Work chain of digital signatures, bitcoin as most know it in actual fact has segregated witnesses (signatures) in the protocol. Although satoshi attests to how bitcoin is designed to scale to giant block sizes hosted and mined in data centers that never really hits a scaling ceiling, it is being sold as that even at 1MB size, the damage has already been done and the blocksize should be 300kB because every user needs to be able to run a full node for bitcoin to validate their own transactions with the lowest hardware and bandwidth requirements possible. A high vertice count with everyone running a (non-mining) full node is said to protect the network against malicious actions by the big bad government while graph theory states that it is the degree of inter connectivity of the vertcies (edge number) that confers security of the network against sybil attacks as it brings the number of hops down.
This decoupling from the original vision has led to development and scaling of bitcoin stalling for many years which led to the proliferation of many alt coins rising up to claim they possess superior attributes to bitcoin or can work in conjunction with bitcoin in a gold and silver type relationship, or serve a different use case to bitcoin. The debate between the groups that represented the opposing roadmaps reached a climax with bitcoin itself forking into two now separate blockchains with the minority chain being declared the imposter by social media claiming hashpower and the market had chosen despite their chain changing on the protocol level to implement segregated witnesses and reject the block size increase. These two now separate chains both forked again to birth bitcoin gold and diamond on the segwit chain and bitcoin cash and bitcoin sv on the non segwit chain. At the non segwit chain fork, bitcoin cash implemented checkpointing at the protocol level whereas bitcoin sv maintained the original nakamoto consensus and sought to scale greater than the 32MB blocksize limit BCH maintained with 64MB blocks.
Following these forking events both BTC (segwit) and BCH (checkpoints) also implemented Schnorr signatures which was marketed as economising the size of a typical bitcoin transaction though in actual fact it can be used to obfuscate signatures and allow for the mixing of coins to mask the chain of digital signatures and essentially "anonymously" launder money. The BSV chain (now Stewarded by Dr Craig Wright) was then declared the loser of that hash war by people heralding the power of the market and the miners to democratize money. The problem with such a claim though is just like current polical democracy, this apparent democratisation of money was just as susceptible to the influence of those who control the cryptocurrency media and just like in politics, there is a cabal like group that exerts a disproportionate influence over the narrative and appears to serve the interests of those in on the racket rather than those it is allegedly informing.
The main forums for discussion of cryptocurrency originally were bitcoin.org, bitcointalk.org and /Bitcoin with all three of them for some time sharing the same moderator theymos. Coindesk and the bitcoinmagazine (started by ethereum devs) were some early sources, talking heads like andreas antonopolos (andreasma), peter todd (petertodd) and greg maxwell (nullc) being propped up as sources of knowledge on what is the best course of action for scaling and endorsing solutions like small blocks, second layer solutions and segwit as a necessarry bitcoin improvement protocol (BIP) while people like Roger Ver (memory dealers) and Dr Craig Wright (craig_s_wright) endorsing a block size increase. Because the core developers had chosen to scale with small blocks and lots of nodes on the network were signalling in support of Segwit any discussion of a big block alternative was considered discussion of an alt coin and deleted and eventually users banned from /bitcoin. Out of that incident /btc emerged as an apparently censorship free forum for the discussion of all scaling plans for bitcoin but was ultimately a partisan sub populated with dejected big blockers. After the BCH fork, discussion for bitcoin sv exists on a few subs /bsv (modded by BCHers), /bitcoinsv (moderated by the lead technician at nChain (Craig Wright's company) and /bitcoincashsv where many users have been banned from both /bitcoin and /btc.
Now this so far is just kind of a synposis of the history of bitcoin covering all three of the main contenders for the legitimate claimant of the name but the part 2 will look more at what kind of drastically different societies would be built upon the different versions of the protocol and what may seem like their subtle differences and which one is likely to succeed.

First, a bit of introduction before we get into the living drama that is Brian Krebs.
Brian Krebs has been a journalist for decades, starting in the late 90s. He got his start at The Washington Post, but what he's most famous for are his exposes on criminal businesses and individuals who perpetuate cyber crime worldwide. In 2001, he got his interest in cybercrime piqued when a computer worm locked him out of his own computer. In 2005, he shifted from working as a staff writer at The Washington Post's tech newswire to writing for their security blog, "Security Wire". During his tenure there, he started by focusing on the victims of cybercrime, but later also started to focus on the perpetrators of it as well. His reporting helped lead to the shutdown of McColo, a hosting provider who provided service to some of the world's biggest spammers and hackers. Reports analyzing the shutdown of McColo estimated that global spam volume dropped by between 40 and 70 percent. Further analysis revealed it also played host to child pornography sites, and the Russian Business Network, a major Russian cybercrime ring.
In 2009, Krebs left to start his own site, KrebsOnSecurity. Since then, he's been credited with being the first to report on major events such as Stuxnet and when Target was breached, resulting in the leakage of 40 million cards. He also regularly investigates and reveals criminals' identities on his site. The latter has made him the bane of the world of cybercrime, as well as basically a meme, where criminals will include references like Made by Brian Krebs in their code, or name their shops full of stolen credit cards after him.
One of his first posts on his new site was a selection of his best work. While not particularly dramatic, they serve as an excellent example of dogged investigative work, and his series reveal the trail of takedowns his work has documented, or even contributed to.
And now, a selection of drama involving Krebs. Note, all posts are sarcastically-tinged retellings of the source material which I will link throughout. I also didn't use the real names in my retellings, but they are in the source material. This took way too long to write, and it still does massively condense the events described in the series. Krebs has been involved with feuds with other figures, but I'd argue these tales are the "main" bits of drama that are most suited for here.

Fly on the Wall

By 2013, Krebs was no stranger to cybercriminals taking the fight to the real world. He was swatted previously to the point where the police actually know to give him a ring and see if there'd actually been a murder, or if it was just those wacky hackers at it again. In addition, his identity was basically common knowledge to cybercriminals, who would open lines of credit in his name, or find ways to send him money using stolen credit cards.
However, one particular campaign against him caught his eye. A hacker known as "Fly" aka "Flycracker" aka "MUXACC1" posted on a Russian-language fraud forum he administered about a "Krebs fund". His plan was simple. Raise Bitcoin to buy Heroin off of a darknet marketplace, address it to Krebs, and alert his local police via a spoofed phone call. Now, because Krebs is an investigative journalist, he develops undercover presences on cybercrime forums, and it just so happened he'd built up a presence on this one already.

Guys, it became known recently that Brian Krebs is a heroin addict and he desperately needs the smack, so we have started the "Helping Brian Fund", and shortly we will create a bitcoin wallet called "Drugs for Krebs" which we will use to buy him the purest heroin on the Silk Road. My friends, his withdrawal is very bad, let’s join forces to help the guy! We will save Brian from the acute heroin withdrawal and the world will get slightly better!

Fly had first caught Krebs' attention by taunting him on Twitter, sending him Tweets including insults and abuse, and totally-legit looking links. Probably either laced with malware, or designed to get Krebs' IP. He also took to posting personal details such as Krebs' credit report, directions to his house, and pictures of his front door on LiveJournal, of all places.
So, after spotting the scheme, he alerted his local police that he'd probably have someone sending him some China White. Sure enough, the ne'er-do-wells managed to raise 2 BTC, which at the time was a cool $200 or so. They created an account on the premiere darknet site at the time, The Silk Road under the foolproof name "briankrebs7". They found one seller who had consistently high reviews, but the deal fell through for unknown reasons. My personal theory is the seller decided to Google where it was going, and realized sending a gram of dope into the waiting arms of local law enforcement probably wasn't the best use of his time. Still, the forum members persevered, and found another seller who was running a buy 10 get 2 free promotion. $165 of Bitcoin later, the drugs were on their way to a new home. The seller apparently informed Fly that the shipment should arrive by Tuesday, a fact which he gleefully shared with the forum.
While our intrepid hero had no doubt that the forum members were determined to help him grab the tail of the dragon, he's not one to assume without confirmation, and enlisted the help of a graduate student at UCSD who was researching Bitcoin and anonymity on The Silk Road, and confirmed the address shared by Fly was used to deposit 2 BTC into an account known to be used for money management on the site.
By Monday, an envelope from Chicago had arrived, containing a copy of Chicago confidential. Taped inside were tiny baggies filled with the purported heroin. Either dedicated to satisfied customers, or mathematically challenged, the seller had included thirteen baggies instead of the twelve advertised. A police officer arrived to take a report and whisked the baggies away.
Now, Fly was upset that Krebs wasn't in handcuffs for drug possession, and decided to follow up his stunt by sending Krebs a floral arrangement shaped like a cross, and an accompanying threatening message addressed to his wife, the dire tone slightly undercut by the fact that it was signed "Velvet Crabs". Krebs' curiosity was already piqued from the shenanigans with the heroin, but with the arrival of the flowers decided to dive deeper into the сука behind things.
He began digging into databases from carding sites that had been hacked, but got his first major breakthrough to his identity from a Russian computer forensics firm. Fly had maintained an account on a now-defunct hacking forum, whose database was breached under "Flycracker". It turns out, the email Flycracker had used was also hacked at some point, and a source told Krebs that the email was full of reports from a keylogger Fly had installed on his wife's computer. Now, because presumably his wife wasn't part of, or perhaps even privy to her husband's illicit dealings, her email account happened to be her full legal name, which Krebs was able to trace to her husband. Now, around this time, the site Fly maintained disappeared from the web, and administrators on another major fraud forum started purging his account. This is a step they typically take when they suspect a member has been apprehended by authorities. Nobody knew for sure, but they didn't want to take any chances.
More research by Krebs revealed that the criminals' intuition had been correct, and Fly was arrested in Italy, carrying documents under an assumed name. He was sitting in an Italian jail, awaiting potential extradition to the United States, as well as potentially facing charges in Italy. This was relayed to Krebs by a law enforcement official who simply said "The Fly has been swatted". (Presumably while slowly removing a pair of aviator sunglasses)
While Fly may have been put away, the story between Krebs and Fly wasn't quite over. He did end up being extradited to the US for prosecution, but while imprisoned in Italy, Fly actually started sending Krebs letters. Understandably distrustful after the whole "heroin" thing, his contacts in federal law enforcement tested the letter, and found it to be clean. Inside, there was a heartfelt and personal letter, apologizing for fucking with Krebs in so many ways. He also forgave Krebs for posting his identity online, leading him to muse that perhaps Fly was working through a twelve-step program. In December, he received another letter, this time a simple postcard with a cheerful message wishing him a Merry Christmas and a Happy New Year. Krebs concluded his post thusly:

Cybercrooks have done some pretty crazy stuff to me in response to my reporting about them. But I don’t normally get this kind of closure. I look forward to meeting with Fly in person one day soon now that he will be just a short train ride away. And he may be here for some time: If convicted on all charges, Fly faces up to 30 years in U.S. federal prison.

Fly ultimately was extradited. He plead guilty and was sentenced to 41 months in jail

vDOS and Mirai Break The Internet

Criminals are none too happy when they find their businesses and identities on the front page of KrebsOnSecurity. It usually means law enforcement isn't far behind. One such business was known as vDOS. A DDOS-for-hire (also known as a "booter" or a "stresser") site that found itself hacked, with all their customer records still in their databases leaked. Analysis of the records found that in a four-month time span, the service had been responsible for about 8.81 years worth of attack time, meaning on average at any given second, there were 26 simultaneous attacks running. Interestingly, the hack of vDOS came about from another DDOS-for-hire site, who as it turns out was simply reselling services provided by vDOS. They were far from the only one. vDOS appeared to provide firepower to a large number of different resellers.
In addition to the attack logs, support messages were also among the data stolen. This contained some complaints from various clients who complained they were unable to launch attacks against Israeli IPs. This is a common tactic by hackers to try and avoid unwanted attention from authorities in their country of residence. This was confirmed when two men from Israel were arrested for their involvement in owning and running vDOS. However, this was just the beginning for this bit of drama.
The two men arrested went by the handles "applej4ck" and "Raziel". They had recently published a paper on DDOS attack methods in an online Israeli security magazine. Interestingly, on the same day the men were arrested, questioned, and released on bail, vDOS went offline. Not because it had been taken down by Israeli authorities, not because they had shut it down themselves, but because a DDOS protection firm, BackConnect Security, had hijacked the IP addresses belonging to the company. To spare a lot of technical detail, it's called a BGP hijack, and it basically works by a company saying "Yeah, those are our addresses." It's kind of amazing how much of the internet is basically just secured by the digital equivalent of pinky swears. You can read some more technical detail on Wikipedia. Anyway, we'll get back to BackConnect.
Following the publication of the story uncovering the inner workings of vDOS, KrebsOnSecurity was hit with a record breaking DDOS attack, that peaked at 620/Gbps, nearly double the most powerful DDOS attack previously on record. To put that in perspective, that's enough bandwidth to download 5 simultaneous copies of Interstellar in 4K resolution every single second, and still have room to spare. The attack was so devastating, Akamai, one of the largest providers of DDOS protection in the world had to drop Krebs as a pro bono client. Luckily, Google was willing to step in and place his site under the protection of Google's Project Shield, a free service designed to protect the news sites and journalists from being knocked offline by DDOS attacks.
This attack was apparently in retaliation for the vDOS story, since some of the data sent in the attack included the string "freeapplej4ck". The attack was executed by a botnet of Internet of Things (or IoT) devices. These are those "smart" devices like camera systems, routers, DVRs. Basically things that connect to the cloud. An astounding amount of those are secured with default passwords that can be easily looked up from various sites or even the manufacturers' websites. This was the start of a discovery of a massive botnet that had been growing for years.
Now time for a couple quick side stories:
Dyn, a company who provides DNS to many major companies including Twitter, Reddit, and others came under attack, leaving many sites (including Twitter and Reddit) faltering in the wake of it. Potentially due to one of their engineers' collaboration with Krebs on another story. It turned out that the same botnet that attacked Krebs' site was at least part of the attack on Dyn
And back to BackConnect, that DDOS protection firm that hijacked the IP addresses from vDOS. Well it turns out BGP Hijacks are old hat for the company. They had done it at least 17 times before. Including at least once (purportedly with permission) for the address 1.3.3.7. Aka, "leet". It turns out one of the co-founders of BackConnect actually posted screenshots of him visiting sites that tell you your public IP address in a DDOS mitigation industry chat, showing it as 1.3.3.7. They also used a BGP Hijack against a hosting company and tried to frame a rival DDOS mitigation provider.
Finally, another provider, Datawagon was interestingly implicated in hosting DDOS-for-hire sites while offering DDOS protection. In a Skype conversation where the founder of Datawagon wanted to talk about that time he registered dominos.pizza and got sued for it, he brings up scanning the internet for vulnerable routers completely unprompted. Following the publication of the story about BackConnect, in which he was included in, he was incensed about his portrayal, and argued with Krebs over Skype before Krebs ultimately ended up blocking him. He was subsequently flooded with fake contact requests from bogus or hacked Skype accounts. Shortly thereafter, the record-breaking DDOS attack rained down upon his site.
Back to the main tale!
So, it turns out the botnet of IoT devices was puppeteered by a malware called Mirai. How did it get its name? Well, that's the name its creator gave it, after an anime called Mirai Nikki. How did this name come to light? The creator posted the source code online. (The name part, not the origin. The origin didn't come 'til later.) The post purported that they'd picked it up from somewhere in their travels as a DDOS industry professional. It turns out this is a semi-common tactic when miscreants fear that law enforcement might come looking for them, and having the only copy of the source code of a malware in existence is a pretty strong indicator that you have something to do with it. So, releasing the source to the world gives a veneer of plausible deniability should that eventuality come to pass. So who was this mysterious benefactor of malware source? They went by the name "Anna-senpai".
As research on the Mirai botnet grew, and more malware authors incorporated parts of Mirai's source code into their own attacks, attention on the botnet increased, and on the people behind it. The attention was presumably the reason why Hackforums, the forum where the source code was posted, later disallowed ostensible "Server Stress Tester" services from being sold on it. By December, "Operation Tarpit" had wrought 34 arrests and over a hundred "knock and talk" interviews questioning people about their involvement.
By January, things started to come crashing down. Krebs published an extensive exposé on Anna-senpai detailing all the evidence linking them to the creation of Mirai. The post was so big, he included a damn glossary. What sparked the largest botnet the internet had ever seen? Minecraft. Minecraft servers are big business. A popular one can earn tens of thousands of dollars per month from people buying powers, building space, or other things. It's also a fiercely competitive business, with hundreds of servers vying for players. It turns out that things may have started, as with another set of companies, two rival DDOS mitigation providers competing for customers. ProTraf was a provider of such mitigation technology, and a company whose owner later worked for ProTraf had on at least one occasion hijacked addresses belonging to another company, ProxyPipe. ProxyPipe had also been hit with DDOS attacks they suspected to be launched by ProTraf.
While looking into the President of ProTraf, Krebs realized he'd seen the relatively uncommon combination of programming languages and skills posted by the President somewhere else. They were shared by Anna-senpai on Hackforums. As Krebs dug deeper and deeper into Anna-senpai's online presence, he uncovered other usernames, including one he traced to some Minecraft forums where a photoshopped picture of a still from Pulp Fiction contained the faces of BackConnect, which was a rival to ProTraf's DDOS mitigation business, and another face. A hacker by the name of Vyp0r, who another employee of ProTraf claimed betrayed his trust and blackmailed him into posting the source of another piece of malware called Bashlite. There was also a third character photoshopped into the image. An anime character named "Yamada" from a movie called B Gata H Hei.
Interestingly, under the same username, Krebs found a "MyAnimeList" profile which, out of 9 titles it had marked as watched, were B Gata H Hei, as well as Mirai Nikki, the show from which Mirai derived its name. It continues on with other evidence, including DDOS attacks against Rutgers University, but in short, there was little doubt in the identity of "Anna-senpai", but the person behind the identity did contact Krebs to comment. He denied any involvement in Mirai or DDOS attacks.

"I don’t think there are enough facts to definitively point the finger at me," [Anna-senpai] said. "Besides this article, I was pretty much a nobody. No history of doing this kind of stuff, nothing that points to any kind of sociopathic behavior. Which is what the author is, a sociopath."

He did, however, correct Krebs on the name of B Gata H Kei.
Epilogue
Needless to say, the Mirai botnet crew was caught, but managed to avoid jailtime thanks to their cooperation with the government. That's not to say they went unpunished. Anna-senpai was sentenced to 6 months confinement, 2500 hours of community service, and they may have to pay up to $8.6 million in restitution for their attacks on Rutgers university.

Other Stories

I don't have the time or energy to write another effortpost, and as is I'm over 20,000 characters, so here's a few other tidbits of Krebs' clashes with miscreants.

• A source and security researcher he was talking to started blabbing about him working with Krebs, and also was selling data to hackers on the side. His example data in his sales post was fucking Brian Krebs'.
• Revealed that the CEO of a popular cryptocurrency mining service which ended up being "hacked" previously ran a hacking forum and perhaps even a botnet
• Was baited by hacking forum admins so they could figure out which accounts he was using to snoop around their forums.
• Pissed off a hacking group by exposing the source they used to pull SSNs to hack Xbox Life accounts.
• Squared off against a doxxer / swatter who ended up in jail. After serving his time, the guy was arrested again for helping his buddy dump the buddy's girlfriend's body.
• "Stole $24 Million But Still Can’t Keep a Friend". A guy who stole from everyone, including his own father. He did pay his father back, in Bitcoin, and made him try to sell it himself.
• He butted heads with Apophis Squad a group who modeled themselves after Lizard Squad, who took down Sony that one time.
• He found out an ethical hacker who helped companies seal up security holes might not have been so ethical after all.
• He's called out an IoT device manufacturer for shitting up the internet with insecure crap.
• Covered a sextortion racket which threatens people with public shaming should they not pay a ransom in Bitcoin using compromised passwords as "proof".
• Revealed that an infamous cybercrime gang was tied to a Russian security firm.
• Researched the hackers behind the breach of Ashley Madison and their weird obsession with AC/DC.
• Wrote up how not to DDOS your former employer with helpful tips such as "don't like a booter site on Facebook if you're going to use it".
• Also, the comment sections usually have at least a little bit of arguing.