Operation Darknet ; Vigilante Hackers Wage War on Underground Kiddie Porn

Operation Darknet (also known as #OpDarknet) is the code name for a series of distributed denial-of-service (DDoS) attacks carried out by Anonymous on Lolita City, a child pornography sharing website that is accessible in anonymity via The Tor Project’s encrypted service. 

This campaign is not to be confused with two earlier Anonymous operations that have shared the same name, one from January 2010 to provide a solution to the censorship threatened by the ACTA (Anti-Counterfeit Trade Agreement) and another initiative from April 2011 to inform Anonymous members to start using I2P to protect their anonymity.

Background

The operation began in early October 2011 with a mission to expose the underground pedophile community known as “Lolita City”. The website was built via Tor, a software that allows users to host and browse websites anonymously. It is built to protect the anonymity of Internet users under regimes that do not allow free internet access, The program has seen its use in least four other forum communities accused of hosting child porn, as well as a drug marketplace known as “Silk Road” where users could buy illegal drugs with Bitcoins.

Notable Developments
October 14th – 15th: PasteBin Release

The major events of the Operation took place between October 14th and 15th, as archived in a Pastebin document. On October 14th, Anonymous hackers began their mission by removing links to pornographic images and videos on the Hidden Wiki, located on Tor’s Hidden Service Protocol. Shortly after the links returned online, the site became inaccessible entirety, presumably as a result of DDoS attack initiated by the group.

October 15th: Target Freedom Hostin

Following the initial attack, Anonymous members found out nearly all of the pornography had the Freedom Hosting digital fingerprint and thus issued the host a warning to remove the content from its server at 9 p.m.

 Freedom Hosting refused to comply and two and a half hours later, Anonymous completely shut down Freedom’s services with DDoS attacks that created a 1GB SQL and 100,000 ASCII files of Guy Fawkes masks every five minutes.

Around 5 p.m. (CST) the next day, Freedom was able to restore service completely via backup servers. Anonymous issued several additional warnings to the company, giving them 3 hours before taking down the server again, this time using an attack codenamed “Chris Hanson,” which uploaded episodes of “To Catch a Predator” labeled as “CP” on to the site.

October 17th: Anonymous Releases Communique

On October 17th, YouTuber Become Anonymous uploaded a video with the Anonymous manifesto, explaining the motivations behind Operation Darknet and its future plans.

October 18th: Userbase Exposed

On October 18th, Anonymous released the names of the 1589 users of Lolita City via PasteBin, including their username, volume of images uploaded, and age of the account. They invited Interpol and the FBI to investigate the records further.

October 20th – 24th: News Media Coverage

News of the operation spread quickly, with the earliest news story appearing on the Examiner on October 20th, Gawker on the 21st, the Huffington Post and PC World on the 22nd, and Geekosystem on the 23rd. The Examiner story was shared on Reddit on October 22nd, where it received 2475 points in two days.

By October 24th, the news had reached the Wall Street Journal, Information Week, and the BBC. Techie Buzz also published an interview with a user named “arson” in the #OpDarknet IRC channel. Arson stated that their mission was only to take down illegal materials and the operation was not triggered by any particular event:

We vowed to fight for the defenseless, there is none more defenseless than innocent children being exploited.

November 2nd: Final Release

The last official PasteBin communique from #OpDarknet was uploaded on November 2nd, 2011. They stated that the whole plan behind the operation was not to take down Tor or the darknet in general, but specifically to attack the CP sharing occurring on these sites. It revealed “The Honey Pawt,” a modified TorButton for Firefox, which, when used, would log users information if they tried to access the Hard Candy wiki or Lolita City.

On October 27th, Operation Paw Printing went into effect for 24 hours, marking the end of the DDoS attacks on The Hidden Wiki and implementation of the modified TorButton, which was only available on the Hard Candy page. When a user of HC updated the button, their IP information was logged. Over the course of the day, 190 unique users and IP addresses were logged, mapped out below.

The PasteBin document noted that November 5th, 2011, Guy Fawkes Day, would mark the end of the Operation and Anonymous would be “sailing away for another Lulz.”

If you like this article, share it with your friends in google plus, twitter and facebook. And let us know your opinions and comments below.