Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim

Light Up The Korean Dark Web
HOGUWARTS
X

HITCON 2017 Dec - TAIWAN
Table of Contents
● What is the Dark Web
● Introduction to the Korean Dark Web & Surface Web
● How to use the Data from Korean Dark Web
● Case study of Korean Dark Web
● Link analysis with the Dark Web & Surface Web

What is the Dark Web?
● The “Dark Web” is a part of the world wide web
that requires special software to access.
● Once inside, web sites and other services can be accessed
through a web browser in much the same way as the normal web.
Source URL:
https://simplyluculent.com/accessing-the-hidden-deep-Dark Web/

● Some Dark Web sites require joining the website with the PGP public key in
their personal profile.
● Most of the Dark Web membership forums will have to do grade-up.
● There are several prerequisites for grade up, one of which is to add own
PGP public key in profile.
Communication using PGP key

Communication using PGP key
● Eg.
○ High Korea

How to protect my identity when browsing
● Note that links *.onion.link, *.onion.to don’t use tor service.
● In particular, if you click image file links on PHP-BB posts
such as High Korea, a security flaw in Tor where an actual IP address
can be sent to the server when clicking on an address beginning with file: //.
● Do not sign up for the id of the portal site used on the surface web.
● Do not use scripts or plug-ins in browser.

Importance of archiving
● It's important to get a page at a certain point in time
because the server is quickly disappearing or moving.
● Data is lost by the administrator.
(eg. Such as promoting a specific link in a forum)

Introduce to Korean Dark Web & Surface Web
“Korean Dark Web”
● Communication & Sharing Information of Dark Web
Agora ( 아고라 )
The Hidden Wiki Korea ( 히든위키코리아 )
● Dark Web Drug Marketplace
High-korea ( 하이코리아 )
Unknown-crew ( 언노운크루 )
Eastern-front ( 동부전선 )
“It sells more diverse products including drugs”
+ add

Introduce to Korea Dark Web & Surface Web
Agora ( 아고라 )
Total 4,000+ posts
● Information of Drug
● Issue of Today
● Leakage of personal information

“Dark Web of Korea”
Agora ( 아고라 )

“Dark Web of Korea”
Agora ( 아고라 )
Fake ID, passport sales
Hey, If I bought passport and fake id,
can I pass security check in airport?
If I have a fake passport, can I become british citizen?
It depends on fortune.

Marihuana sales
It is possible
to trade all over the country
15 per 1g,
10 per 1g for purchases over 2g Torch Chat : 7bb34cjp*********
telegram, wickr : withwee******
Several kinds of drugs are sold.

I sold it for three times, promoting it for a week
in here.
If you can buy marihuana,
contact me.

Spilled out
the information of
ex-girlfriend.
Her birthday is the card password.
Her birthday is on passport.
I need a password to make a payment.
you can be paid by CVC number at Foreign market.
Jeon Seung-jun=his name(ex-girlfriend) KimXX, who lives in Songpa-gu.

Passport
credit card
ID card
credit card
credit card

The Hidden Wiki Korea
Total 4,000+ posts
● Guide of Using Dark Web
● Issue of Today
● List of Korea Dark Web

Korean hidden wiki

High-korea ( 하이코리아 )
The total number of posts is countless
● How to buy Drug / Cultivating Drug / Take Drug
● Issue of Today
● Medical Marihuana Legalization Movement

Mainmenu before login..
Announcement
News from surface-web
Plan for legalize medical marihuana
Information of bitcoin
Protect to private in dark-web
Chat….

Main menu after login..
Chat for Member
Q&A for newbie
Discuss on marihuana related product
How to cultivating marihuana
Sharing experience to abroad
Discuss on marihuana trade
1:1 chat with neo ( using PGP )

Normal grade / Special market
Auction
Best grade/ Special market
Review of Best class market
Apply grade up to Best grade
Register a seller
Bitcoin loundry
Dicuss for special grade
Request of confirm
Discuss for donate
Request opinion to admin
Collection of grade up member

Seller always indicates price and PGPkey.
Sellers records a PGPkey for a sale request from the buyer.

Bitcoin laundry service(mixing)
Mixing
→ 비빔밥(Bibimbap; Patter)

An organization’s Facebook page
to legalize medical marihuana

Unknown-crew ( 언노운크루 ) - opened at around October 20th
Total 30+ posts
● How to buy Drug / Cultivating Drug / Take Drug
● Issue of Today
● Medical Marihuana Legalization Movement
● Same to the High-korea Format

Sites created along high korea.
New site, fewer members yet.

Eastern-front ( 동부전선 )
“It sells more diverse products including drugs”

We could not see the inside
because the eastern front prevented it from joining.
But, the agora provided us with approximate data.
(eg. Looking for a broker to cast a couch.)

“Closed Korean Dark Web”
666 - LETOM
Black market run by “motel666”
● Dark Web Bitcoin Loundry service
LAVADORA

Currently closed...
Recent registered member

Currently closed...

site
name
Sep Oct Nov
1W 2W 3W 4W 1W 2W 3W 4W 1W 2W 3W 4W
하이코리아 (HiGH KOREA)
동부전선(Eastern Front)
666 LETOM
히든갓(HiddenGOD)
라바도라(LAVADORA)
Beetgames
아고라(AGORA)
Hidden Wiki Korea
표현의자유 (Freedom of speech)
언노운크루 (Unknow Crew)
심부름

Introduce to Korean Dark Web & Surface Web
“Why used data of Surface Web ?”
● Korean Dark Web is smaller than international Dark Web
“ There are only 5 active sites. ”
● How to solved this problem ?
“ We tried to collect more data by linking to the surface web. ”
CASE : Linking to Slang-word

“Surface Web of Korea”
● Communication & Sharing Information
Korea Community
Store of Daily Best ( 일간베스트 저장소 )
DCinside ( 디시인사이드 )
Other
Twitter ( 트위터 ) / SNS
Uljin21 ( 울진 21) / Korea Online News-paper

● Korea Community
Store of Daily Best ( 일간베스트 저장소 )
Total 1,443 posts
● Information of Korean Dark Web
● About International Dark Web
● Found posts related to Dark Web
But most of the posts are chat...

● Korea Community
DCinside ( 디시인사이드 )
Total 2,000+ posts
But most of the posts are chat...

● Other
Twitter ( 트위터 ) / SNS
Crime-related Data
Selling Drug & Requests for Hacking
Sharing Information of Drug ...

● Other
Uljin21 ( 울진21 ) / Korea Online News-paper
● Selling Drug & Requests for hacking
Most drug-related articles have posts with NULL title and content.
However, there are Drug-related data in the comments,
so It’s difficult for administrators to manage posts.
Therefore, many Drug-related articles are shared.

How to use Data of Korean Dark Web
“Data analysis of Korea Dark Web”
We collected Slang word / Seller information of contact / Related to URL
Find to Same teller in Dark Web & Surface Web
We collected Slang word / Drugs / Seller information of contact / Related to URL
Find to Account to promote Drugs in Dark Web & Surface Web

How to use Data of Korean Dark Web
“Investigation of Korea Dark Web”
● Currently, the Korean prosecutor has developed a system that searches for
new Dark Web in the page and searches for keywords on the Dark Web.
● Through this, they recently arrested the criminals selling and cultivating
Marihuana on the Dark Web
● However, the Dark Web monitoring system currently targets only drugs
so improvements are needed to monitoring other crimes.

The case study of Korean Dark Web
“Abstract of the case”
● In this talk, we will introduce specifics of the Korean cyber underground
(including Dark Web).
● Share our approaches for investigations and discuss several case studies.

Link Analysis in Korean Dark Web & Surface Web
“How to Link Analysis ?”
CASE ) Linking to Slang-word
eg. Illegal medicine website

CASE
Illegal abortion pill sales

The case study of Korea Dark Web
“Case 2 : Abortion pill sales site / H**a Hospital”
h**aXXX ???
h**a223
h**a989
h**a988

+) How to manipulate comments on Korean portal sites
● Used to write articles that are good or support each other in the group
(Political writings)
● They should use multiple id
○ Get the credibility by making the same claim through several id.
○ To use other id's when deleted by admin or wrote spam comments
● To identify the same group, we use the ID pattern of ‘English + number’
○ kevin1234 → *****1234
○ kevin5678 → *****5678
○ It seems to be irrelevant.
On the dark web, a similar pattern is seen when working in groups.
z***a1313
z***a1314

h**aXXX
h**a111
h**a223
...
h**a988
h**a989
Pattern search of *.hxxa111.*
eg. hxxa111.net

* Mifegyne? : Abortion pills. Can be aborted for less than 9 weeks of pregnancy.
hanaXXX ???
site name
h**a988
h**a223
h**a989

경상북도 문경시 산양면 진정리 430-1 → Not a correct address.
Telephone and bank accounts are not displayed,
So that they can't trace their identity.

● They use a 1: 1 bulletin board to keep in touch
while avoiding tracking.
● They use a service called TocPlus.
● Other similar illegal sites are also using TocPlus.

Line ID(***444, d***007, ***d118)

Keyword
Site
Result of
Tracking IP

● 3,4-Methylenedioxymethamphetamine = MDMA = 엑스터시
Keyword
Contact ID
Result of
Tracking Site

...
Report the contents to the Korean police

Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim

Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim

Recommended

More Related Content

Similar to Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim

Similar to Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim(20)

More from HITCON GIRLS

More from HITCON GIRLS(20)

Recently uploaded

Recently uploaded(20)

Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim