Defcon 22-metacortex-grifter-darkside-of-the-internet
4 likes2,829 views
This document provides an overview and introduction to the dark web and Tor network. It summarizes Grifter and Metacortex's background and expertise, then outlines what topics will be covered which include how to connect to and navigate Tor and the dark web safely and anonymously. Potential legal and ethical issues are also briefly discussed.
Defcon 22-metacortex-grifter-darkside-of-the-internet
- 1. Grifter and Metacortex @grifter801 @metacortex A TOUR THROUGH THE DARKSIDE OF THE INTERNET
- 4. THESE GUYS • Grifter (@grifter801) • DEF CON Goon • Multiple time DEF CON Speaker • DC801 Founder • Founder of 801 Labs Hacker Space in SLC • Metacortex (@metacortex) • DC801 Organizer • Founder of the 801 Labs Hacker Space in SLC • Seen us running around: DEF CON, Black Hat, BSides-SLC, SaintCON, ToorCon, ShmooCon
- 5. WARNING!! • We WILL talk about some questionable content. • We can not promise that you won’t be offended. • Content may include but not limited to • Drugs • Pornography • Counterfeit Material • Murder for Hire (hit men) • Money Laundering • Arms • Hacking • Cracking • Profanity
- 6. HERE IS WHAT WE WILL TALK ABOUT • Tor • Connecting to it • Using it • Onion Sites • Bitcoin • How Bitcoin works • How to use it • Mining bitcoin
- 7. HERE IS WHAT WE WILL TALK ABOUT • How to find what you are interested in • Darknet Forums • Hacker/Carder Forums • Darknet Search Engines • Darknet Marketplaces • Purchasing things you are interested in • How to stay anonymous when doing so • Tips and tricks to be more anonymous and secure than nubs
- 8. TOR* • The Onion Router • Primary Purpose: Anonymize Internet activity • Series of routers that anonymously forward traffic • Routers only knowledgeable about 1 hop in either direction * Caution: Search of software classifies you as an “Extremist” in the eyes of the NSA, but honestly, what doesn’t?
- 10. HOW DO YOU CONNECT TO THE TOR NETWORK • CLI Daemon • apt-get install tor • /etc/tor/torrc • /etc/tor/tor-tsocks.conf • Starts socks5 proxy that you can point applications towards • Defaults to port 9050 • TorBrowser • Simple executable • Launches portable Firefox browser with select plugins
- 11. CLI CONNECTION • /etc/init.d/tor start • Point Browser to 9050 • Visit http://check.torproject.org for confirmation • Configure tor through /etc/tor/torrc • Set up hidden services • Set up the port to listen on • Setup basic access lists for allowing other systems to connect to tor through you
- 13. TORBROWSER • Download at https://www.torproject.org/projects/torbrowser.html.en • Support for Windows, OSX, and Linux • Run “Start Tor Browser.exe”
- 15. DEMO CONNECTING TO TOR
- 16. HTTPS EverywhereTor Options No Script
- 17. TAILS* • Linux Live distro (Debian) dedicated to staying anonymous. • Forces all traffic through TOR • Will not touch the hard disk (without a fight) • Ability to disguise UI as Windows XP so it doesn’t raise suspicions in public areas • Comes with preinstalled software • HTTPS Everywhere plugin • OpenPGP • Pidgin OTR • Truecrypt • KeePassX * Caution: Search of software classifies you as an “Extremist” in the eyes of the NSA
- 20. WE ARE CONNECTED…NOW WHAT? • Browse the internet anonymously • Tunnel out of restricted networks • Fight Censorship • Criticize Government/Government Officials • Generally just stay anonymous • Tor Hidden Services
- 21. TOR HIDDEN SERVICES • Services that live only in the Tor Network • Turns Tor into a Darknet • Services use .onion as TLD • Put a pin in it mother fucker • Fairly complex to explain how it still keeps anonymity so just see: • https://www.torproject.org/docs/hidden-services.html.en
- 22. FINDING HIDDEN SERVICES • Hidden Wiki • http://zqktlwi4fecvo6ri.onion/wiki/index.php/Main_Page • Torfind • http://ndj6p3asftxboa7j.onion/ • TorSearch • http://kbhpodhnfxl3clb4.onion/ • Grams – Google like search of the TOR darknet • http://grams7enufi7jmdl.onion/ • Deep Web Links NOT IN TOR • http://deepweblinks.org/ • Reddit NOT IN TOR • /r/onions • Word of mouth
- 23. TORIFIED SITES/SITES OF INTEREST • The Pirate Bay • http://jntlesnev5o7zysa.onion/ • Caution: • Does no good if your Bittorrent client doesn’t go through Tor • Assassination Market • http://www.assmkedzgorodn7o.onion/ • Crowd Funded Assassinations • Rent-A-Hacker • http://2ogmrlfzdthnwkez.onion/
- 24. HACKER FORUMS • TCF – Tor Carding Forum • Trading CC’s, CCV’s, Identities • Some basic hacking info about RATS and shit • Requires ~ $50 purchase for access • http://6oa276dur6udwykp.onion/ • Intel Exchange • Mostly Trolling. Some decent information • http://rrcc5uuudhh4oz3c.onion • HackBB • General Hacking/Tutorials/Nubs • http://jv7aqstbyhd5hqki.onion
- 25. MARKET PLACES • What Tor Hidden Services are known for • http://www.reddit.com/r/DarkNetMarkets • Most up to date listing in the sidebar • Most Popular is Silkroad • Silkroad 2 is currently up after the takedown of the original • http://silkroad6ownowfk.onion/ • Agora • Decent selection of products • http://agorahooawayyfoe.onion • Evolution • Our current favorite • http://k5zq47j6wd3wdvjq.onion
- 27. CARDING SITES/FORUMS • Tor Carding Forums (TCF). • http://6oa276dur6udwykp.onion • Requires ~ $50 purchase for access • CC • http://carding2bil6j7ja.onion/cc
- 29. FAKE IDS • Fake US Drivers Licenses • Scannable, Holograms, UV • http://en35tuzqmn4lofbk.onion/ • Fake Passports/Drivers Licenses • http://fakeidscpc4zz6c4.onion/ • Fake Passports • http://fakepasvv3holddd.onion/ • /r/fakeid • Not Tor specifically but you might want to use Tor
- 30. DEMO GRAMS
- 31. HOW DO YOU ACTUALLY GET ITEMS • Bitcoin (BTC) • Transfer BTC to the wallet on your marketplace account • Pay for items with that money • Money goes into Escrow • Ship to pickup location • See the following OPSEC for further details
- 32. BITCOIN • You’ve heard about it • Online cryptocurrency • You set up a digital wallet • Either local software or a web based wallet • I do not recommend a web based wallet. • You can send up to 10 millionth of a bitcoin (8 decimal places or 0.00000001 BTC) • Not including fees • You send to wallet addresses such as 146uk64ZP2iLsSBBPLzkY3xtCnuJg4yFsE
- 33. BUT REALLY • BTC (or any cryptocurrency) boils down to a global transaction ledger maintained by the computational power of a P2P network. • The more people who participate in BTC the more secure it gets • Every transaction is logged by the peers in the P2P network • Relies on PKI for authentication • Each wallet has a public and private key • When transactions are sent, they are signed with the private key
- 34. BITCOIN TUMBLING • Tumbling or Mixing is the process of anonymizing bitcoin usage • Many parties put coins into communal pool • Pool distributes to different wallets • You get back the original amount of coins you put in (minus fee)
- 35. SOME CONSIDERATIONS FOR TOR • Tor can in some cases reveal your true identity • Correlation • If someone owns both an entry and exit node, they can correlate between the two • Browser Exploits • Browser JavaScript engine • XSS • Pingbacks over non Tor connections
- 36. SOME CONSIDERATIONS FOR BITCOIN • BTC is not a fully anonymous currency • Blockchain is PUBLIC • Use a tumbling service to further obfuscate the original source of your bitcoins • Don’t withdraw from a tumbler exactly what you put in • Spread out withdrawal amounts and send them to new wallet addresses
- 37. OPSEC • Stay updated on the Tor Blog • https://blog.torproject.org • Always keep Tor/TorBrowser updated • Stay updated on status of current markets. The subreddit is FANTASTIC for that • Browser segregation • Don’t be logging into social media sites in the same browser you don’t want to be tracked on • Use a VM specifically for Tor connections (Tails) • Even better: • Specifically boot into a trusted OS instead of VM as host OS has full VM visibility
- 38. OPSEC CONTINUED • Receiving Items • Don’t send to your house • Send to PO Box or UPS Store. • UPS Store will sign for items on your behalf! • If you have access to an empty house/building, look into sending it there. • NEVER open questionable content anywhere you are visible by others • Wait till you get home • Try waiting a week or two to pick up an item • Foils stakeouts as no one will stakeout a Post Office 24/7 for 2 weeks • If you want, walk in and confirm item is there and come back later
- 39. EVEN MORE OPSEC! • Identities • Don’t reuse identities • Don’t reuse passwords • Use disposable emails • http://www.sharklasers.com/ & https://www.guerrillamail.com/
- 40. MAKING MAILBOXES MORE ANONYMOUS • Purchase mailbox • Buy fake ID using mailbox • Burn mailbox • Open new mailbox at different location using Fake ID • Enjoy more anonymous receiving
- 41. WE BOUGHT SOME STUFF • Mini Discreet…“Baby Monitor” • Runs over the GSM network by inserting a sim card • Call the associated number to instantly listen to the room • Or sms “1111” to turn on auto dial back • Sms “0000” to disable dial back
- 43. Baby monitor
- 44. Hello your item has been shipped to this address: XXXXXXXX Salt Lake City UT XXXXX United States Estimated delivery is between Wednesday, May. 14 and Thursday, May. 22 This is how you use the device: - Open the back cover. Sim card into the deck will automatically boot.boot light is 3 seconds. after the lights go off you can dial the sim card number. Installation:Please confirm the GSM network signal strength.So as not to affect the results cause can not be used - Number of settings: call the sim card numer with mobilephone or telephone,hang up then setting success - Voice feature:Send â1111â0000â - The flash of red light indicates the SIM card is correctly inserted. SIM will completed initialization and
- 46. PARTING THOUGHTS • Clearly a lot of this talk falls into a gray area • Darknets, like anything, can be use for “good” and “evil” • These networks have legit purposes and not just for shady shit • In our view, these networks are the future of how we will communicate online
- 47. SHAMELESS SELF PROMOTION • Come visit us at 801 Labs and DC801 events • Hit us up on twitter @dc801, @grifter801, and @metacortex • Come hang out with us on IRC. #dc801 on the FreeNode network
- 48. APPENDIX A: BITCOIN MINING • To cut down on computation of all the transactions globally, participants (nodes) group transactions unconfirmed transactions into “blocks” and suggests what the next block should be • To keep too many people from creating blocks is to make them difficult to create. • Node creates block of grouped transactions and adds reference to previous block • SHA256 of the previous block • A “nonce” (random number) is appended to the block and hashed twice • SHA256(SHA254(block+nonce)) • Each block hash has to be inferior to the current network difficulty • Once the hash of a block + nonce is less than the network difficulty, the block is submitted to the BlockChain (ledger of transactions) • Mining is the process of brute forcing nonce’s in order to submit a block to the blockchain
- 49. APPENDIX A CONT: BITCOIN MINING REWARD • Reward for successfully submitting a block to the blockchain is 25 BTC
- 50. APPENDIX A CONT2: BITCOIN MINING IS HARD • In the very beginning people were mining on their CPU’s • Network difficulty started rising • CUDA came around • People started mining on their Video Cards (much faster) • Network difficulty kept rising • Mining Pools are created to share the computational load • People started building big mining rigs of several Video Cards • Network difficulty continued to rise • Custom BTC mining FPGA’s were created • Network difficulty is fairly high at this point • Custom BTC mining ASIC’s are created
- 51. MORE APPENDIX A: CURRENT STATE OF MINING • Unless you are running mid to high-end ASIC’s you will be spending more in electricity than what you will gain back in BTC • You will never submit a block to the blockchain on your own • Join a pool