Dark Web users of a child porn website tracked after visiting file sharing site
1.6.2017 securityaffairs CyberCrime

The U.S. Department of Homeland Security has identified dark web users after they downloaded media through a file sharing services.
The DHS obtained the IP addresses of several suspects that visited a child porn site hosted in the Tor network.

According to court filings, the suspects shared links to password-protected child pornography media on the Ziifile file sharing service available in the Internet.
The court order doesn’t explicitly report the name of the child porn website that was referred by the investigators as “Bulletin Board A,” a popular hidden service with more than 23,000 users.

“Bulletin Board A had over 1,500 “approved users,” who actively posted new content and engaged in online discussions involving the sexual exploitation of minors. In general, members would post preview images and download links to several different cloud-based storage services.” reads the court order. “Among other things, these posts contained the “Bulletin Board” means an Internet-based website that is either secured (accessible with a password) or unsecured, and provides members with the ability to view postings by other members and make postings themselves”
The investigators tracked all the users that accessed the links to obtain the archive containing child porn material hosted in the dark web.

“The Department of Homeland Security was able to gain crucial information on several child pornography website users without resorting to highly specialized methods, such as deploying special exploits or new techniques.” reads Darkwebnews.com.

The technique used by the law enforcement is very trivial and doesn’t rely on any exploit code to de-anonymize Tor users.

This case demonstrated that a wrong use of anonymizing services could expose users’ identities.

The authorities also obtained from the file sharing service data related to the users’ downloads posted by members of the dark web pornography website.

According to Motherboard, law enforcement has already arrested three suspects that accessed the file sharing website to download child port material from the dark web website.