Welcome everyone. This is more than Tor: Shining a Light on
Different Corners of the Dark Web. If you're looking for a different talk
you're actually in the right one. This is the better one, I promise.
So, you have to excuse me if I do yawn. Because of all the flight delays, I
didn't get into the hotel until like 6:00 a.m. So I'm like draggin'. But, my name
is Benjamin Brown and my day job is with Verecode and I'm a principal security
researcher there. So some of my focus is lately, have been darknets and crypto
currencies, emerging digital underground economies, public policy in emerging
technology in general. And how can I make it do stuff it wasn't necessarily
designed to do and what are the ramifications of that? I also want to
start out with some groundwork, some context in terms of definitions. A lot of
times the terms dark net and dark web are used interchangeably, usually by
media or law enforcement. But they do have distinct meanings. One actually
builds on the other. When I'm talking about Darknets, I'm talking about a
framework that has software and configurations that require you to set
it up for you to run and access those networks. And they're not networks that
are separate from the internet, they're actually overlay networks at this point.
There are some alpha and beta networks that are trying to be sort of outside of
the Internet as is, but the major Darknets that we're going to be looking
on, sit on top of what we understand as being the regular Internet or the clear
net. And the Dark Web, that's the composite of web content from all of
these different Darknet frameworks. And again, they require specific software
configurations or authorization to access. Why do I think this talk is worth
giving? Because I think the vast miss portrayals of the Dark Web and
different Darknet frameworks in the media, by law enforcement, or by
government entities can easily lead to a skewed perspective of what that threat
landscape actually is and what sort of budget you should be putting towards it.
Also, there's been a whole lot of new vendors in the space that are trying to
sell you Dark Web insights at ridiculous numbers usually. And understanding what
the threat landscape is actually like and how easy it is to go and look for
yourself, or someone on your team to do so, could really help you in better
molding. Alright how am I going to put resources towards maybe this particular
facet of our threat modeling or threat assessment? So what makes these different
Darknet frameworks unique from one another? Well I can't get away with not
talking about Tor, it is definitely the largest and heaviest trafficked and the
most talked about. And it's in it itself, is privacy oriented. But a lot of the
offerings on it are commercialized. That you can find all kinds of data dumps
and hacker tools and stuff like that but um, you got a pay. OpenBazaar, this one is
purely commercialized and this is a newer one. It's not privacy oriented,
but there are some optional privacy features you can use. To get an idea of
what the user base being targeted is like, the two biggest currencies that are
in use are US dollars and Bitcoin. That's followed by the euros, the pound sterling,
Canadian dollars and a good smattering of verbal use. I2P a rguably the second most
well-known Darknet framework. This one is indeed privacy centric. It's based
not necessarily on keeping the content private, so much is the identity of the
users. And it has a balance between both ideologically
oriented free information and also it does have some commercial aspects as
well. In terms of the content itself and what languages you'll find, if you use
just the major I2P official announcement nodes, the content you'll find there is
mostly English. But if you also include the content on the third party or
unofficial nodes, the Russian language content far outweighs the English
language. And then of course there are enclaves of Chinese language content, of
French language and Japanese as well. There were a couple of Brazilian, but not
not very many. That's Brazilian Portuguese. For Free Net,
that as opposed to necessarily making its focus the privacy of its users, it's
the resiliency of its content. To be able and protect itself and its network
against a censorship by an oppressive regime or by some other entity. And most
of the content there,z there's hardly any commercialization at all on Free Net.
Most of the content there absolutely is free and it's a lot of it's ideologically
motivated. In terms of the users, the geographies that they're coming from...
it's mostly the US and the UK, or the US and Europe rather. Followed by Japan,
Russia and Brazil. A little, a little more about Tor to give you an idea about like
how long it's been around and what it uses. It's been around, it's publicly
released in 2002 but it was in development by the US government before
that. Before it was handed over to a public entity. It relies on the onion service
protocol. If you want to learn more about that, I'll put a link to the white paper
at the end of this talk, that goes much more into the technical weeds of the
different topologies and different ways in which these networks are set up and
the technology that it uses. This is mostly
focused on privacy and security for Internet users. Specifically Tor wants to
make it really easy for people to have a higher level of privacy while on the
Internet. And they do that by you know, putting their browser bundle together so
you don't have to do a whole lot of configuration yourself. So I'll show
you some numbers for Tor mean daily users and then you can see that compared
to some of the later numbers for the other Darknet frameworks and see just
how much of a bear Tor is in terms of user usage. So the the US, Germany and the
UAE make up a large chunk of where user, users are coming from. The reason why the
UAE is so high on that list, is because for just about all of the Arab states in
the in the area, they're all funneling through the UAE major Tor
nodes. And then again, Russia's following that up. As you've heard on
media were for law enforcement announcements you can find drugs, weapons,
really overpriced weapons, hacking tools and guides. The hacking tools and guides
that are for sale, most of them you can find for free on the clear net so... Ahh.
There's definitely malware. Most of it is malware that's been cracked before and
if you do have it, find any listings for you know, a piece of malware that's newer
and hasn't really been reversed, it's gonna cost you a lot more. Leaked
databases you can find for sure. Usually those are used for account stuffer
activities or account checker activities. But again, all this is at a price, no one's
giving these away for free really on Tor. Also, whenever you read or hear
something about hitmen on the dark web, it's bullshit.
Like no professional contract killer is gonna take some bitcoins from some kid
angry on xbox live. Like he's gonna stay with organized crime because that's
less liability
Besides all the gnarly stuff that you hear about, there's also some pretty cool
other offerings on Tor. Like a lot of whistle blower support. If they're finding
they're not getting traction internally with the entity that they work for, then
they can anonymously give some evidence and some idea to these different
whistle blower organizations that are external.
There's also projects for censorship evasion from oppressive regimes and
privacy from surveillance in general. A lot of those are still pretty much in
their infancy and there are ways for a deterrent state backed entity with enough
resources to, to get around those. There's a lot of personal blogs and forums. Most
of the forums are like mundane talk topics that people might not feel real
well revealing who they are talking about it like... Maybe some rather raunchy
fanfics or something like that. But also there's
a lot of medical forums where people who have a certain you know, medical issue
and want to be able to talk to others that also have it. But they are
embarrassed or don't want their name connected to that. There's also a
Facebook portal for some reason Facebook stood it up so you can anonymously log
in to your account that has all of your information I don't know the new kid on
the block opened Bazaar again this is like focused solely on e-commerce
specifically that what they want to do is get away from the model of eBay and
of you know Amazon and other outlets where you have to pay fees whenever
you're selling things so they don't have any fees for their transactions and
their system is peer to peer the network itself uses the IP FS the interplanetary
file system again the longer may produce more into that and how it works but
transactions themselves between buyers and sellers are based on Ricardian
contracts that's been around for quite awhile I think like 12 years now
and it's been tested in quite a different number of applications for
transactions in terms of who's using this the main language support that the
developers have out and how is for English Brazilian Portuguese and French
but they are currently developing more languages and starting to try and crowd
source it more I believe the next one is Spanish and then after that Russian in
terms of the listings as I mentioned before it's mostly US dollars and
Bitcoin and you can see that you know just just what your numbers those are
what most users are transacting in so what sort of stuff can you buy on with
them bazaar right now you can party I mean the prices are outrageous but yeah
there's definitely just about any illicit substance you can find on there
you can get some IDs passports you could say that you graduated from Harvard and
get it on fancy paper or three flattering and everything also if
somebody is selling a passport for a thousand dollars especially a US
passport it's gonna be a piece of shit like you're gonna be looking more like
six to ten thousand dollars for a legit one so I write I don't have a bug-out
bag or anything so there are some other things you get like hacked accounts for
snapchat and if you want to do a stroke mostly this is for Astroturf a so you
buy a whole bunch of LinkedIn Facebook and snapchat accounts and then you know
you can make it look like you have a whole bunch of followers and your
business is totally legit streaming services you can go ahead and buy those
for cheaper than the monthly costs would be but chances are it's gonna get shut
down in a few months so your mileage may vary some hacking tools you can
definitely buy those I understand why it says
if there were some lead NSA hacking tools but they got a little happy with
the three-letter acronyms and added FBI and CIA I guess to seem legit but yeah
it's it's mostly outdated software like that what's that finder bug has been
patched though that blue screen is really interesting because this is an
account checker program that also has bought fingerprint evasion techniques so
human emulation techniques that like randomly move the mouse around both the
website and like we'll skip between different dialog boxes maybe not in
order and we'll slow down how it's entering things over time so it's not
like oh it's obviously Bacchus is doing everything in split second and so I
thought I thought that was pretty neat because those are the sorts of things
that a lot of the bots stopping about tracking then their software usually
looks at so this was fun this was somebody that was offering hacking
services hacking emails bank accounts school results and so it was interesting
to see that probably about a month later instead of having their listing for
hacking you know all these accounts and stuff
now they offer consultation services for business intelligence marketing
operations projects and security as the exact same contact information so I
thought that was interesting and the reason why I started seeing these
changes is because open Bazaar is starting to block some of these more
illicit listings so it's not necessarily a free-for-all I tried to find weapons
I found a grease gun and a nerd from average it looks like it's been painted
it's pretty good quite sexually I did find a flame thrower so I mean you can
get that you know on the clear head from somebody who bought it from Elon Musk's
company yes yeah or or clearing snow whatever so there's this those things
are cute and funny and like Oh drugs hacking but the vast majority of stuff
on open Bazaar by far is like really Monday stuff like
people selling their jewelry or people selling you know their own original
artwork excuse me phone cases speakers now I don't know if those speakers fell
off a backwards rocker not like I'm gonna go with its public legit
there was one store that I was super excited about because they sold
hard-to-find antique collectors books and some of them were reasonably priced
pretty good there's another couple vendors that all they sell are cactuses
diffusers and then somebody that makes their own clothing as I mentioned before
open Bazaar starting to block the illicit offerings but it's really weird
how they're doing it because they're just blocking it from the main search
results the listings are still there so if you have the direct link you can
still go to it and so third-party searches have started to pop up they
very scrape and find all of those listings that have been taken down from
the main search Frieda this one there is love interesting stuff I found on here
it's been around for a while it was originally released in 2000 and it's
really trying to be censorship resistant and the way it does this is by using
treated data stores and so if you take down one or a handful of nodes you'll
still be able to access the network's content or people's free sites just by
contacting a different mode in terms of user demographics you can see these
numbers are quite a bit lower than then tours but still I mean a good chunk of
people are using it the United States and then Europe followed by Japan Russia
and Brazil and the leaked data that you can find is all free and nobody's trying
to get a Bitcoin out of you for it if you want to look up Ashley Madison dumps
or adult friend finder dumps to see how many pots were on there or to suit your
bosses on there do that the emails from the French head
of state Emmanuel Macomb though I do want to put a little caveat and note
here it has been confirmed that some of these emails before they were released
were altered likely by Eastern European actors during the TTIP negotiations for
for trade rules and for copyright rules and stuff like that the Greenpeace had
an insider that was able to leak all of the confidential documents from that so
if you want to go back and read those you can this one's scary so these are
this is a dump of internal emails from Diebold employees who work on Diebold's
voting machines and essentially the employees saying like these voting
machines are terrible they're really insecure I don't know why people keep
buying them there's a lot of problems with them and like these are the
machines that like 37 different states had so cute
a couple of disparate groups that are under the heading Anonymous by their own
say so got together and pulled together from a lot of different activities where
they had gone into sheriff's office networks or into a police precinct
networks and gotten internal documents mostly how to box things like you know
what's the digital forensic process for this particular police office how do
they pull artifacts from wireless routers how do they investigate websites
such as Craigslist so you can know how law enforcement does those things
step-by-step including how they search cell phones have they do captures of
cell phone data and things like that
because it is anti-censorship oriented you do unfortunately find a bit
of a few paid groups on there mostly white supremacists and they'll they say
and about the reason why they're on Freenet
is because on the clear that all of their hosts kept kicking them off
rightly so and so now the only place you will find a lot of their content other
than the strong front is on free net you'll also find a lot of things like
poisoning hand books you want to do that but also the one with far left was much
more interesting to me it's an eco-terrorism hand book like how to ruin
logging equipment how to you know take down the oil pipelines things like that
and it's obviously like some really smart engineers that know what they're
talking about that are going into it Oh a LF the Animal Liberation Front still
has an active presence on Freenet and like mostly they're doing documentation
of like their past activities and stuff like that but there's also still some
updated content from them on there this one was cute
this was a step by Store is a step by step guide and Chinese on how to
assassinate Xi Jinping the head of China and it was weird because it's very very
dispassionate and like just like a checklist of things like oh this part of
you know the buildings that you might be near have CCTV here here here so you'll
want to take this route instead and it's just like a special thought way too much
about this there are blogs for how to write malware and how to avoid D
compilation or reverse engineering of your malware you can find those on the
clear net too but I was just interesting to see them there this one was absurd so
this is an anonymous collective and how they set themselves apart from the rest
of anonymous is their ham radio enthusiasts that are skating the radio
waves for I don't know threats and protecting us from them they never go
into detail about what those threats are so I don't know it could be aliens could
be the government human trafficking they wouldn't say but they really really
like ham radio and masks there's a lot of socio-political sites a lot of
libertarian sites and blogs a lot of anarcho-capitalist sites whatever that
means a lot of book or sites and anarchic communists again those are
funny to me like so no central government but central planning I don't
I don't know how that works maybe somebody can tell me about it but there
are a lot of other things that like aren't scary or quote-unquote dark and
the vast majority of the content is just hobbyist so there are a bunch of
different social networks some of them active some of them just
people continuously saying is anybody here there's a bunch of co-chairing
initiatives github clone where people are actively building stuff together
most of it mundane and there is just a metric crap ton of amateur novelists on
Freenet it's amazing how much content there is and it's not all like weird
very fanfic either it's like there's like legit high fantasy and sci-fi
that's pretty good and I think they should get published but yeah if you if
you want to read some new content that's not like published out widely go check
out Freenet though my favorite site had to be this geo cities looking John Wayne
site I mean this is a static picture so it doesn't show it but it legit had a
scrolling blinking marquee going across it I was surprised I weren't this little
flame that gifts to but it was just like like wave files of John Wayne saying
stuff and like quotes and stuff about his life and where you grew up and it
was just very wholesome ITP is a mixed bag as I mentioned before and it's it's
looking at both commerce options but also there has its fair
I've ideologically motivated free content and it's initially released in
2003 so it's also been around for a while
and it uses an anonymizing PGP distributed communication layer to try
and keep monitoring of its users and its users activity to a minimum though if
you can control enough gnomes like I believe the Dutch government did
very early on in ITV's inception then they candy anonymize people in terms of
numbers more users than Freenet for sure but the best majority of them in the
United States in Russia some interesting things I found the cryptocurrency that's
in most use on ITP was not bitcoins Monaro which was like cool to see then
there was also a large selection of users of cost point I study crypto
currencies I have no idea what Gauss point it's so I'm like what is this but
there are mining pools exchanges and tumbling services for both and Gauss
point is really IGP centric it has hardly any clear net footprint but
there's their description of what it is is a digital currency based on
blockchain technology okay yeah it allows instant payments were wired with
focus on privacy and security of its users alright so tries to master its
users and what they're doing it uses Russian government standard cryptography
that doesn't mean anything but they do have give access to the code base so you
can't go and review it yourself to see if you think that they're using legit
crypto and they're not just like rolling their own primitives like idiots don't
roll your own crypto oh and the vast majority since I've seen for it it was
money laundering if you want to use Specter or meltdown and don't want to
like find out how it works and build it yourself
somebody for free the tool and see how to guide
on using it and for some reason PDF copies of the Wikipedia pages for the
attacks in case you don't want to go to Wikipedia I guess but yeah that's free
then there was some something I saw that had posted on a number of different
forums on ITP or each sites and this is a Russian and English speaker that is
trying to hire botnet herders or bot net owners saying that you know if you have
a mil plus machines on your botnet I'll pay $25 for 15 minutes of use I mean
that's that adds up that's pretty good money
there were people selling o days they were crappy o days like two of them were
O'Day's for Internet Explorer like who wants that and then there's a new hacker
community that's being announced there and that was interesting because for to
get access to that one you can't pay to access it they give you a target that
you don't know beforehand like a website and then you have to prove that you've
hacked that target and then there's also a botnet that you can hire the Deucalion
there's a really crappy button that an easy to block don't buy it the most
interesting thing I found on IGP though was this activist collective they say
that their service for sec ops admins and activists but they provide like that
a couple of tools that are based on their sites ignore that use your own IP
address you know you can go and looked at hacked cameras you can go in spider
and website for vulnerabilities you could go in use their low orbit ion
cannon which is just a terrible tool but they also taught live classes and like
legit interactive live classes on writing malware hacking different
websites but the last two the advances without exploitation and the exotic web
application vulnerabilities I went through and looked at the archive of
those and the teacher definitely knew their stuff and knew what they were
talking about it was really and at the end they posted a link to
their slides now the bend that was holding their slides how to use her name
attached to it a pretty unique one they weren't very good at OPSEC that username
leads directly back to a director in a very large firm in our industry that
sells web protection web application protection software so I mean I guess
it's a sustainable business model like you teach activists that I packed my
back's axe and then you sell you know the web map protection as well but I'm
not gonna help them but yeah OPSEC it's hard and so that stuff's the interesting
stuff the vast majority again the same as the others it's mundane stuff
hobbyists people just playing around there are gateways for cross traffic to
other darknet frameworks Cindy which is mostly file-sharing zero net which is
new doesn't have a whole lot of users yet tour of course and then there's a
telegram portal mostly used by Russian language speakers there are also social
media instances on there no Facebook on this one but they do have a diaspora she
dies for instances over Qian don't Google that one long life box and then
some basic like to treat forums there's I get services free encrypted file
stores there's a Usenet network running on ITP paste bedclothes clones if you
don't want to rely on mi t--'s PGP key server there's one for you there on ITP
I don't know if I would trust it more or less there's a not shady at all dot are
you registrar you can use on ITP yeah it's totally not for malicious
activities the largest and most active forum I found on ITP though was a
gardening forum it was great it was like people talking about like oh my yield of
lavender was time whoa and I think I might have a fungal
infection in the bed it's like oh well you can make this tea and pour it over
there like every two weeks and mental health and I don't know it was very
wholesome that's great if you want to play chess but you want to do so
anonymously you can do that too take that Yahoo games does anybody know
what thinners cards is okay so this is supposedly an ESP test or you have to
guess the next symbol that's going to be on the card and there's an interactive
version of that on there so you can see if you have ESP or not there's a really
cool ASCII art database which I mean the only place I really still see this is in
the demo scene so it was nice to see that there was this really angelfire
looking edgy 13 year old and a basement probably service called Osiris's tomb
and it's all like his like original emo artwork and god I'm glad my stuff is not
still on the internet from that time period but yeah again it was another
chat room for people to talk and it was mostly people saying is anybody here
but anybody can figure out what the hell this is I would be grateful
I think it's an art installment I don't think it's a puzzle because I sent it
for like an hour going through each iteration of it and whenever you click
on it it changes the colored dots and I don't know if you can see is the
lighting but each thought has an arrow pointing out of it from to a different
direction and when I was looking through it it seemed to be pretty random I
couldn't find a pattern but I think it's just an art installment but I'd like to
find out if it's something more if you want to I'll put my email at the end and
if you want a link to that I can send it to you all right so what's the
conclusions or the sub conclusions that you know we could draw from these things
the dark web and the dark Nets content in general isn't nearly as
dark as the media or law enforcement would lead you to believe I mean it
makes sense that they would present it that way because they get more you know
losing AHS and cliques and law enforcement our government would then
get you know a better argument for a larger budget next year things like that
so they were definitely incentives for that but if you go and look for yourself
the types of content that's going to be on there that are going to be a direct
threat to your business are pretty low if you aren't bank it might make sense
for you to be on the lookout for credit card dumps but for most other content
you don't really need to spend a whole lot of money on that on getting on fancy
the third-party vendor stuff for it most of the illicit activity is actually
still occurring on the clear night if you're you know looking for human
trafficking you just go well used to be back page but Craigslist things like
that that's where you gonna find the best majority of it so in looking at the
darknet frameworks themselves you can get somebody on your team to just set up
a couple boxes to be able to get access to this stuff and you know every now and
that you might want to check for like is we do one of the dumps have your users
information and you want to give them a heads up to originate that password or
something like that then you don't need to pay out the nose
for another third third party vendor you can do that yourself pretty easily so
essentially don't lose sleep over the dark web I know some CISOs and have
you've been doing that you know I've had people that come come up to me after
this talking somebody hey like you know I had with my C so sit down with me like
show me the dark web right now we need to know about our threats it's like well
first of all I which part equipment but yeah so and looking at your your risk
framework and your threat modeling and your resource investment out of fact you
really want to take into account just how much of this content is mundane
stuff and how few users are still on the dark web it's not a whole lot of people
that use the internet that you also use the dark
there's the lead to the longer paper also if you want to slide into my diems
there's my twitter handle and my email address if you want to add you don't
want to ask a question now or something comes up to you later that were asked
about this so now I'm open for questions yeah it's really useful there is there's
both original works but most of the music is like people just sharing in the
trees there are a couple streaming services but really because of the lack
of so the robustness and the speed of these most of these frameworks that's
tied directly to the number of users because they double its nodes as well
connection notes you're not going to get to speak to be able to stream like a
video but there are some audio streaming services oh yes
yeah so I mean don't come at it from your company I eat pool for fun but also
what some companies have done to get around that is they set up a sort of a
third party entity in like the Cayman Islands or something like that so it's
not directly tied to a parent company and that way they can do their
black-budget stuff that way I know there's a lot of bottom like underground
economy and malware researchers said they want to be able to buy 0 days and
by malware and things like that but they don't want to tie back to the
company budget so they set up a separate entity to do that purchasing and that's
something you could do for that it would use like a VPN that's basically serve
Europe or something like that where a jump box from a bulletproof host
something like that so it says it pretty opted who's who's on there and who's
coming from where yeah it's really what's your risk profile for you and for
your company and is the type of content that's going to be on there really worth
the investment and I don't know a lot of vendors that will let our dark web
vendors that will answer that like if I don't know but you could see into the
dark web well yeah but you don't have access to that forums you don't have
access to you know closed groups you're just doing scraping and keyword searches
like
the worst ones are on IC q QQ telegram and clear that forms like most of the
ones that are on the dark web is just like a large groups of cyber criminals
aren't going to go through that hassle when they part about systems that work
other questions
you