The FBI has been using malicious surveillance programs for over a decade, and when it's not catching school bombers, it's using them to catch child pornography suspects.
Their most recent victim is Luis Escobosa, a U.S. citizen living in Staten Island, New York, who, according to FBI documents, has used Tor to access, view, and download sexually explicit images of children.
The documents reveal an FBI operation in which the Bureau deployed spyware on a Web server hosting images of child pornography, a server that had previously been seized pursuant to a court order.
Because the server was hosted on the Dark Web and its logs contained no useful clues to lead other users, rather than shutting down the site and moving on to the next case, the FBI investigation team decided to embed a variant of the Metasploit Decloaking Engine internally in the server’s Web pages.
The Metasploit kit is a basic NIT (Network Investigative Technique), the “legal” definition of what most security experts would call spyware.
The kit, hidden on the website, exploited a flaw found in the Tor browser, which sometimes establishes direct connections when dealing with Flash content, rather than using the Onion protocol.
FYI, the Flash plugin is disabled by default in all Tor Web browsers. For this reason, if you have ever read a tutorial on how to properly use a Tor browser to browse the Dark Web, in most cases, you would have seen a suggestion to not enable the Flash plugin.
In his search for images of children, Mr. Escobosa downloaded the NIT as a Flash file from the seized FBI server, which exploited this vulnerability and revealed the suspect’s real location, despite using Tor to hide his identity. This tells us that the website contained videos and not just images, since Mr. Escobosa had to manually enable the Flash plugin.
The FBI quickly obtained his location from his ISP, raided his home, and seized his computer. In his Tor browser cache, FBI agents also found thumbnails of images from the seized website. This is also strange, since the Tor browser is supposed to erase all browsing history and neighboring files.
The FBI also subjected Mr. Escobosa to a lie detector test to find out if he had ever engaged in physical acts with a child. He passed the test and is now free on bail in the amount of $150,000 / €134,350.
