Hundreds charged in internet’s biggest child-abuse swap-shop site bust: IP addy leak led cops to sys-op’s home

US prosecutors say a South Korean man was behind the largest child-abuse image-swapping operation yet found on the internet.

Uncle Sam’s legal eagles today claimed Jong Woo Son, 23, was the administrator of the now-defunct “Welcome to Video” dark-web-hosted website frequented by hundreds if not thousands of perverts in the US and internationally, and advertised itself as having served more than a million image and video downloads.

Son, already serving a lengthy prison sentence in South Korea for masterminding the site, was indicted in the US on nine counts related to the creation and distribution of child sexual abuse images as well as money laundering.

(Beware: the indictment, filed last year and unsealed this week, is disturbing and graphic.)

Son and 337 other defendants were charged with operating Welcome to Video, a massive underage-sex-abuse-image-sharing Tor-hidden site, which at its peak had roughly eight terabytes of media and 200,000 video files. Users either paid 0.03 Bitcoin for download rights or earned credits by uploading new child-abuse material.

The site, designed from its creation in 2015 until its takedown in March 2018 to be dedicated to peddling sex abuse imagery – including instructions to fiends not to upload any legit adult pornography – was accessed through Tor, and instructed netizens to pay for files with Bitcoin through unique email addresses.

Follow the money

It is estimated roughly one million Bitcoin wallets were affiliated with the site. Those accounts proved useful in helping government agents and police, with the help of blockchain analytics outfit Chainalysis, track down the individual users who were behind the spread of this horrific content by tracing the flow of bitcoin from the site to various exchanges and wallets.

In addition, investigators got lucky when the Welcome to Video server was briefly misconfigured and revealed a couple of public IP addresses linked to the server. These were backtraced to a system hosted at Son’s own home by South Korean telcos.

In addition to dismantling the site and charging alleged users, prosecutors said they were able to rescue 23 children in the US, UK, and Spain from abusers.

“Through the sophisticated tracing of bitcoin transactions, IRS-Criminal Investigation special agents were able to determine the location of the dark-net server, identify the administrator of the website and ultimately track down the website server’s physical location in South Korea,” said IRS-Criminal Investigation Chief Don Fort. Yes, that’s IRS as in the US tax collection authority.

“This large-scale criminal enterprise that endangered the safety of children around the world is no more. Regardless of the illicit scheme, and whether the proceeds are virtual or tangible, we will continue to work with our federal and international partners to track down these disgusting organizations and bring them to justice.”

Along with the criminal charges, prosecutors are looking to recover any money Son and 23 other conspirators allegedly made through the operation. Between June 2015 and March last year, the site is thought to have earned over $370,000 in Bitcoin.

In announcing the takedown, the US government made a point of going after not only the people who traded in the abuse images and videos, but also slamming the Tor and Bitcoin services that were used to support the site.

“Operators of anonymization services like Tor must ask themselves whether they are doing their part to protect children and make their platform inhospitable to criminals,” said deputy US attorney general Richard Downing.

“Society must decide whether it will accept these lawless online spaces, whether American taxpayers should fund them, or whether we will instead demand that providers act to prioritize protecting children from online predators.” ®

Sponsored: How to Process, Wrangle, Analyze and Visualize your Data with Three Complementary Tools

READ MORE HERE