HugBunters Deadman has been Switched

~8 min read | Published on 2019-09-27, tagged DreadHugBunter using 1996 words.

More than a week after Dread went down for maintenance, HugBunter’s deadman switch was triggered, indicating that the owner of the largest darkweb forum no longer had control over the forum or his own equipment. His staff, in a message on the Dread homepage, said to assume the worst.
Dread, the darkweb’s version of Reddit, has been offline for nine days at the time of publication, leaving many users concerned about the forum’s admin. The admin, HugBunter, has unexpectedly vanished in the past for “health reasons” or “equipment malfunctions.” In those cases, though, he made an effort to check in with a Dread staff member about his sudden disappearances.
This time, though, a Dread staffer confirmed that they had not received a message from HugBunter in three days. Although we do not know what specifically triggered the deadman’s switch, the trigger could have been something as simple as a certain number of days without an update from HugBunter. The worst case scenario for users of Dread (and HugBunter) is death or law enforcement intervention. While both are possible explanations, it is far too early to make such a conclusion without additional information.
Jump to this part if you only want the deadman’s switch info.

Don't Panic... dreadditevelidot.onion


What is a Deadman’s Switch?

A deadman’s switch, as explained by one darkweb marketplace administrator, “is a type of security system that is put in place to ensure the individual who set up said system is alive.” The admin gave us some examples from television and real life as well. “This sounds very dramatic, like something you would see in an episode of Mr Robot but they have various uses as we have seen with both Edward Snowden and Wikileaks where if a predefined step or measure was not taken in a predefined amount of time files would be sent to a predefined location. It doesn’t always refer to the living status of an individual or being but the fact that if that person is not freely able to essentially flick off the switch something will be triggered.”
The administrator also provided us with the details of a deadman’s switch that would have worked for HugBunter:
Now here is a more digestible example of what a deadman switch would look like in relation to Dread; Hug purchased a cheap server, a script was put in place to send an email to every Dread moderator if no login was made on that server within X amount of days. Hug instructed (during a time where he was not compromised) his staff to publish this message without fail if they ever received this email/alert, that was their duty and Paris fulfilled it. Multiple of these types of systems could have been put into place, but the simple process is; if a step is not taken within a certain period of time the switch would go off. There is no way to activate a deadman switch it is all predefined with whatever variables there are, the only way to prevent said switch from going off would be to delete the system or fulfill the requirement set to delay or prevent it from going off.

HugBunter’s (Original) Message

More than a week ago HugBunter posted a message on the frontpage of Dread about working on upgrades “to provide increased stability” to Dread. The upgrade would also “reduce a whole lot of spam and phishing.” After that update, HugBunter logged into his private jabber account for several days before logging back out. He logged in and out again for a little while before logging out “for good.” More than three days and five hours have passed since HugBunter last accessed the jabber account used to communicate with his staff members and other members of the community.

The Original Downtime Message on Dread


In the past, HugBunter posted about Dread downtimes and maintenance on the /r/DreadAlert sub. He posted about downtimes that lasted only hours. It was important to HugBunter to inform Dread users that he still had control of the platform. The platform rarely went down without an explanation on /r/DreadAlert.

More than three days have passed since HugBunter last accessed jabber


This downtime—the longest one yet—is the only recent exception. He never posted on the subreddit dedicated to Dread downtime and he never updated the message on the Dread homepage. Instead, on September 27, one of his staff members posted that the absence (or something related to the absence) had triggered the HugBunter’s deadman switch. Another member of Dread’s staff has confirmed that HugBunter had a deadman’s switch in place for when something bad had happened.
“HugBunter’s Deadman Has Been Switched”

The message was posted on the frontpage of Dread by Paris, one of the only people capable of accessing Dread servers. Paris signed the message with the public key associated with Paris’ account on Dread. The signature is valid. And the message is below:
HugBunter’s deadman has been switched. It has been three full days without any contact when in all purposes the site update should have been pushed already. Hug does disappear at times and recently he disappeared for just over a day do to personal problems. All I can hope is he is alive and well. Not harmed, captured, or dead.

However we must assume the worse in this case. If something happened and he is alive he will be able to validate himself with a signed PGP message and some internal information.

If he does not return in one weeks time from his message all server’s content will be removed and the source code for dread will be released to the open public. In it’s current state (without the upgrades that HugBunter was supposed to push three days ago) the site would be full of spam and phishing in no time. On the final days before dread’s maintenance system was turned on, hours of time per day was spent removing content and accounts spamming the forum. It was unusable.

This downtime was only supposed to be a few days at most to get the final touches to the codebase upgrade done without needing to handle all the spam at the same time. While HugBunter at times does disappear for days he generally doesn’t do it when dread is down and can’t be brought back up. I just hope he is alive.

There might be a simple explanation for this (health problems for example) but until that time we must assume the worse.

Paris’ key is available here (.txt) and on Dread at dreadditevelidot.onion/paris.asc. The signed message is available below and the front page of Dread.

The Message Posted by Paris on Dread


As Paris wrote, something as innocent as HugBunter’s health problems could have prevented the forum administrator from accessing a computer. There is no way to prove that HugBunter did not simply shut down his machines after overwhelming himself with the Dread update. The update is an important piece of the puzzle too; Paris pointed out that “HugBunter at times does disappear for days he generally doesn’t do it when dread is down and can’t be brought back up.” And another former Dread staff member backed up the claim by Paris, adding that HugBunter never disappeared during an update to Dread.
What Now?

The message posted by Paris does not provide evidence in support of any of the theories surrounding HugBunter’s disappearance. That does not mean users of Dread should react as if nothing happened though, according to DarkDotFail. “Dread users should assume Dread is compromised. Rotate all passwords you have ever used there immediately,” DarkDotFail wrote in an encrypted conversation. “Assume private messages are being read by an adversary right now. We have no proof of this. All we know is that Hugbunter is missing, but for OPSEC it is always best to assume the worst.”
“Hugbunter’s contributions to the darknet are unparalleled since the original Dread Pirate Roberts. To a good friend: I hope you are well and I wish you the best.” - DarkDotFail
The market administrator who explained deadman switches also added a comment about the situation:
Now I don’t want to speculate because I am sure we all have our own interpretations of what that message means. We need to know what type of system was put in place before we can come to any solid conclusions, however I just cannot help but think was this announcement made purely on the basis that Paris has never experienced Hug go MIA while the site has been placed in maintenance mode or otherwise not accessible or was there an actual deadman switch in place. Given Hug used to go MIA for extended periods of time I really don’t think there was any system in place or else we would have seen this before? I really don’t know.

“But what I do know is there will be a power struggle, a lot of stories, a lot of trolls to take advantage of this situation and cause chaos. Be careful, and be mindful as to which platforms you all switch to because some will have their own agendas and where you shop, who you trust, and ultimately who controls what is up for grabs.”
Regardless, I hope Hug turns up because as much shit as people like to give him the service he created really did enable the community to regroup and if Dread was to end here it would be a huge blow to the cryptomarket scene given the number of genuine hidden services is at an all time low

This story is still developing and likely warrants followup articles. I appreciate those who helped sort this out.

The Message From Paris

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256Bitcoin Blockheight: 596837Block Hash: 00000000000000000001392879d1aa00ceef235690227437315aa003593e594eHugBunter's deadman has been switched. It has been three full days without any contact when in all purposes the site update should have been pushed already. Hug does disappear at times and recently he disappeared for just over a day do to personal problems. All I can hope is he is alive and well. Not harmed, captured, or dead.However we must assume the worse in this case. If something happend and he is alive he will be able to validate himself with a signed PGP message and some internal information.If he does not return in one weeks time from his message all server's content will be removed and the source code for dread will be released to the open public. In it's current state (without the upgrades that HugBunter was suppost to push three days ago) the site would be full of spam and phishing in no time. On the final days before dread's maintance system was turned on, hours of time per day was spent removing content and accounts spamming the forum. It was unusable.This downtime was only suppost to be a few days at most to get the final touches to the codebase upgrade done without needing to handle all the spam at the same time. While HugBunter at times does disappear for days he generally doesn't do it when dread is down and can't be brought back up. I just hope he is alive.There might be a simple explaination for this (health problems for example) but until that time we must assume the worse.At this time if you need a darknet discussion forum there isDarknet Avengers: http://avengersdutyk3xf.onionEnvoy Forum: http://envoys5appps3bin.onionThe Hub Forum: http://thehub7xbw4dc5r2.onionI wish everyone the best,Paris-----BEGIN PGP SIGNATURE-----iQIzBAEBCAAdFiEEbfleES3oPdbct1q5DE1JcU+sN9gFAl2OFxkACgkQDE1JcU+sN9gzyxAAkzxAr6Z1rDh6ozJazCoWIrjDJIkofBYqPIM4XnUAHhEW44v5HcLlR7n6vsmUPXzAH4DrElRac+XxNeFrjjz+yL+HTQq18qOcUkxVBoDZ391+85gJseI54+7QymCJtlKHK+qO6+9MxbAExicCHMBKGbRv4mAZRYFPP+19d8QRpbeGUu+OZEgSQnJ46esQzBjMxu+8m5rmzUhBnXCLFRxsv7OLKjDukKE87uRq33wRrB4NbeqF3sniGxZlydWRMRrl/CiZtTZaknKqHxn1OsO+zZzjMm01SCh8DkXXEKZBvH9XeQ6dDpAUX+zEMrNLzRrmxuWCtvPmhJqIZA9oH5+zoJh8z7Wyk1CRkJKXaFhlxCjV+J/4jL58AsPjC8EfrjWY8FVZM6g6QEUrTay2CNCwCjjX/uSOR3iGDZrcFTue2xrFMe+pwOqunLpnu0Rmvo+bKwaDFbwI6QfNQLvBWXuh9JFVnd84XtIMLVh7C34U87HP21QwXXTcCzDp//Aj2o3F1AWJ7eYIQBu6zH6jG7s5Yxy5bxqqPGUbMTwpfKyYo2cr/GbFGvEHALlIv58LUNFa+owojsPcgFrimkTEa1drA7wCn3Rnjpp/0rQUtKB7uZt6JEtZKZYIikJyE1tAluyOCNsHUhXXX9zPHXPpMwnnMXwD1mv/MPbmsjyWGfxv5AQ==mjsd-----END PGP SIGNATURE-----We are performing upgrades!The site is under maintenance, we will be back up as soon as we can. Sorry for any inconvenience!-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512Working on a huge update to provide increased stability as the platform grows further and will reduce a whole lot of spam and phishing. The update includes a variety of bug fixes and new features and should be ready to go live by this evening. I am extremely sorry for the downtime and lack of communication right now, this is the biggest update to the codebase that I will have performed and completely restructures everything behind the scenes. Thank you for your continued patience.-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEYTOs4fS4fFHb8/6l6GEFEPmm6SIFAl2IpgkACgkQ6GEFEPmm6SKAzQ//bHDUegdtInNBWtDhIKTl9BizmCFC6L555YAdk73nq6FbcMx8WRXmFtvnv48yaxz6MdK2rbMKTIuLwZJH7ytvBIthpOwAJUmaOdnB9fTbyxjXkYym8VxceRVSvZVhYB21BUVICec01x5gJGIFzLUaVpPvdlyrg6oBjppeYxqfQPe8oQT47h3ugGyw/Dh/8UT4dib09U5FYjExzK5JQYZxroFiknSiDkoUC5a+Rr77xD7Sr9gmkWACeU3rfrVn0JA0oPmGBOLLbYRh+ejQHISec9jk5D5Orq3lQVjNBAaCK2CsBKZbsC3wrIv3kdfFeHvwkQzk7cjjR5saHJRYGVXRysNPIjRHCE9jX4IiuBxgTLYOvntHOEsa76WKv53T6mUzd8ceLwlC0ITgMQHnBxA1kmOKyrxm8yM8ufyy2zqkUPVFSZo6LLUr0xTJwxfb0oTkdsjfPgSJK1K+kJARq7ImBch9vd/fimNBFnFmaYcJD7YLJ9RJYQnYA2Dm5QTaTZhdv/aD261OHvtIWMOQSsl/S7bhxZx9z41x1+t+/riz0SYpB/WXDF1LxzhWa1ewX+BixAwciiSKueg35t07qe2ImFLZO98H9Xs4UNKhZNV8By4hLoiJStjNIdKgG/qggxpaoE7ltR6RmMC3ImJ/a9PwaJxWgZfRLg1h682tNK5NxW8==2R+j-----END PGP SIGNATURE-----

Paris’ PGP Key

-----BEGIN PGP PUBLIC KEY BLOCK-----mQINBFzSHcwBEADnEYuy4u4a9kUK98nA4nYdCNHyxNI+3ixXhpSs2zbOebKAvus+zCIhMUi7hDR/02ToUEqMpyo6KFNNjf/We8/iIC76u+Pb0Jqezu/n0RdLgPyXkTXf6Rdjs06nph7yNuM2lJ2huRebggRRGrJ1bhiWQrcaufG2a7nT+GmRiJ0gtpOPcqqgBUAgK6JgcRvEC5hiXQGRksYk0zbEKHbrXJ2X08/unGTCXsioWbfxP0xavqswGqR8rtC/Jd4NqB+OML5EgNDs2+41L2yelnOVksh/iW3JtaOo0VJmPUfBimUDnD7bkhV7RMvj//TIpExhTq+4wJ8BMiLVTREJOxw481la6PDUMW0PEXHX0rm5EPESIXh7nVQSAJRz1aB9hwNpI8odtSok1eciAbbeUK3OjfBJLYBIT8m4E9qYIwGZFONp9bapckJbQ9oEJMSDcvvPOL2ELSlNLYx/iTwRXXiMLqwhBUsGi/YE772hpQBt/I8wY79UFfTxecb0mPq5e/EhtK30o9SFvk3C5RRSJGz0aFjEPKcmBYyj5dowMN3m70t+pZPxLOWlLqgXYHDPMqr9KdBX0IJEXG4cHazlyUoACZ4gVNh+8La8Dzc76ujqUnqEis/ud3cqFEdueJzNP/QAZi4twWBLMIiaaN/sendVR3KJS3qS5sm2f2nlrZfSCFx9lQARAQABtB9wYXJpcyA8YW1hemluZ3NpZ2h0c0BpbnRlci5uZXQ+iQJOBBMBCAA4FiEEbfleES3oPdbct1q5DE1JcU+sN9gFAlzSHcwCGyMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQDE1JcU+sN9hZZg//RaM0O7wBKTOH3wshlUvbfLhbXGP9lGslebeE2bEJo59Bv3iIncpB0DmACdCxkugx46uAecI4IB8T8h5Q7fVMbrhj4uR1eBI1Kd8Czg2nmBxjb8+9GAbnpf3Tmxg3zmAxDeMTQVmjiSMmoXTJ7Gj24iq1GzpZ+oaPKpuU3XLcAJyvWAE/8TZFxdqHtlaaZkniV+VI04WxWQ1LCVFK9kRga9APsK8+Tfct3Ou730VGUAh8LC99TbEmZpRJzBtJJG8yhAtbW41N5b2KcXKY0sh1ycCxKk68RMVc911HcN/cDGgAtqoADu6zPO+ZBGvfmhqSaeCpgLjo51DFrqmqWyclgxmbAHyC4tnhc1APUdVGss7K8JXZj0O2Z98+m9+r7SRv9GKDvCFGmozjqj/pnn+WqnIxmWeyJyDMLpWFEnbKtTUFDGryB5v9fFpiSQ7rPqigpZpWSIiScWTRndlPfRRI+WRhnVIyE1k9UJu44g78qbeliiv+fzBsYQc/Q+tB7qX1pnf3x7NwYb1P1emWoOvIcpRv2VdLgIyiPsZiYV6wddS78matP36hl2yqMHmNjYKCw7rjFkVEpZ21XqDbVmiYhgFCiktyXS399fTQ8bPBqm8xRkc+ArSveRX9prTlbugTCF1XJ1t/z2c72NptoIFJMx3zfwOpIlNtg8zcWWzugYy5Ag0EXNIdzAEQAMcX4cC81S8UHc6A5rDDIZm3eKH5qEAl7hJ+/6PUqAhJPAY6T4mItmB0lL6qicEvmJcQ0c7PFeVoHwTsWXt4OvmMtPUHz4PCH3JbYi8PoYO6jXbMph7WA7NZ8DWksIv+RIDjrS8LAHQVglDlsAeSSdISf/vRbaiiCoQTuoeVIPDZWAqrzUY696iqQrpystuUzDW34Ivi+XxvkKXdcFUWKaBCaVawWJ26UboAiCfrpbePXE8LK//4UiodHSdXAY9gwEodI8Yy88FVhNyDftrauRbnWMD8gu6UGT/mNurbJ1GbR0glsC+M614VZiO7a9GqWlPnoxleQX24etBjuB+NYqvSTA+hG13qeTsJZnv+4ZGFpIKv251B5nSKozrtzsjJ+E0Q8ZweX6FxUEQd/p9UBJzVl+sfky1pxaH5nAUv34N8JNLB7G2X1BGv0QNuvPeHUKheyz0wr2zMRkQAhDmmak2uTtBlHvQuzGamK08DzNe4/ml2X8RuXIug2BIQIe7ecS6NHFbbggx4QLyZrR4NRnvKrq1cSEL/7q2J7yCdkMzNX71p4R4BnImrnBZOHWFkrWF0790VHEYvVTzW0IbZx6sQKomFYuk7J3k7lgsN8K6CtdEkfRkwN6v8xDUMC4wu1o2JieDg4DhNQA1wph2N3UWh8s2YTyRXYBm9WDMHLjE9ABEBAAGJAjYEGAEIACAWIQRt+V4RLeg91ty3WrkMTUlxT6w32AUCXNIdzAIbDAAKCRAMTUlxT6w32K4ZEAC4OrHG8yuDYR1BgZMqdHFfl+haIn92+ksLwaeYGA+zOJ3RPkje9bHt/hGShpmO+6YQzmm15HBi0HgErMRxyJds9ro8aX0xWAjAVNf7VP93ksKO731AO1VspQvHiQ4Q5May5vwQsuJvdVf793GUfIWcX/Ld4OxuhheijS7ghdCmJkSXmSoEVx4y1M6xn1GySEQoRGpYNnbyAN/Gi/+DUJbyIU6cw6Yn4ts4kmIi2tRkST8kA79FU2hlD1IsusJ2L+pVtG/VsmDvwUGMiqngWxxq6c6GSw3Lmn8w6JhwIQ0/MDQhULend9PztWrxHyDAb9/8v2tQ5v6lzNya2xS5S6OcvCRjJmezqRqF8JqcyWXht7X/W5p2N1FwbXLaDyR70HH0WsJViYn9wSxeMtLjgNCXXiEmFNAG43LXoqsE4ofEDrPAcMQNd8ArZg4ABVwbYATFMmVTyQmquQPcQcddldDTxm+tCGwAwOA6denmhlKBVgK6vqju8G6eODnTJ5htjndR0wyyrL6nn3WYsk7PVRWy0vffFgXmLKNgWld137vcGVzYKVRNySET7WRLuzorcUNAbJT+eKiMlHvxXQ/6K7ON59H36SUclSDHnqu6NeQqZEwrsI8wvhzD5ccSOo2uKr42IuexpN/lUfaqVxzbGc5xP6/gqz2QvXz6WsFPEpPzFA===0sVn-----END PGP PUBLIC KEY BLOCK-----