Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

The Dark web - Why the hidden part of the web is even more dangerous?

15,070 views

Published on

Bad Actors (cyber criminals, terrorists, foreign spies) and their Tactics, Techniques, and Procedures (TTPS).
How is evolving the criminal underground in the Dark Web?
The response of the law enforcement.

Published in: Technology
  • See how I make over $7,293 a month from home doing REAL online jobs! ➤➤ http://ishbv.com/ezpayjobs/pdf
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Paid To Write? Earn up to $200/day on with simple writing jobs. ●●● http://t.cn/AieXS62G
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

The Dark web - Why the hidden part of the web is even more dangerous?

  1. 1. Dublin October 1st, 2015 Pierluigi PAGANINI Dark  web  -­‐  Why  the  hidden  part  of  the  web  is  even  more   dangerous?  
  2. 2. AGENDA The Response of Law Enforcement Law enforcement Current Scenario Cybercrime
  3. 3. Current scenario Deep Web vs Dark Web 3 •  Deep Web –  It represents the part of the web that has not yet been indexed by common search engines •  Dark Web –  Set of publicly accessible content that are hosted on websites whose IP address is hidden but to which anyone can access it as long as it knows the address –  Set of private content exchanged in a closed network of computers for file sharing Deep     Web       Dark   Web   Bright  o   clear  Web  
  4. 4. Current scenario Dark Web 4 •  The Onion Router (TOR) –  Tor directs Internet traffic through a free, worldwide, volunteer network consisting of more than six thousand relays to conceal a user's location and usage from anyone conducting network surveillance or traffic analysis.  •  I2P - The Invisible Internet Project –  Network “Peer-to-Peer” (P2P) –  I2P is an anonymous overlay network - a network within a network, Ordinary services running on a secure network •  Freenet - A Distributed Anonymous Information Storage and Retrieval System. •  anoNet is a decentralized friend-to-friend network built using VPNs and software BGP routers
  5. 5. Current scenario Why  Tor  is  so  popular  in  the  criminal  ecosystem?   5 •  Anonymity •  TOR provides "hidden services" that could be used for several illegal activities. •  Law enforcement face difficulties in de- anonymizing TOR users. •  Impossible to conduct monitoring on a large- scale. •  Excellent aggregator - It hosts principal underground communities. •  TOR allows bypassing Internet Filtering (i.e. Censorship).
  6. 6. Current scenario Bad Actors 6    
  7. 7. “Cybercrime is a fast-growing area of crime. More and more criminals are exploiting the speed, convenience and anonymity of the Internet to commit a diverse range of criminal activities that know no borders, either physical or virtual.” INTERPOL Cyber crimes can be grouped in the following categories: •  Attacks against computer hardware and software •  Financial crimes •  Abuse (i.e. child pornography) Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Cybercrime Dark  Net  as  a  facilitator  for  cybercrime   7 Darknets  are  the  right  place  where  search   for  anything  related  above  crimes  
  8. 8. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Malware and DarkNets The  offer  of  Darknets   8 •  Darknets are a privileged environment for malware authors and botmasters. •  Hiding C&C infrastructure •  Availability of authenticated hidden services •  Availability of black markets to buy and sells their products.
  9. 9. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Cybercrime The  offer  of  Darknets   9
  10. 10. 2012:  One   C&C  server  for   data   exfiltraHon   (Skynet)   2013:  3  C&C   servers   controlled  a   botnet  of  million   machines   2014:   OnionDuke   Campaign  -­‐  3   C&C  servers   cyber  espionage   2015:  2  C&C   server  in  tor   and  2  on    I2P   (Ransomware)   Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Malware and DarkNets The  offer  of  Darknets   10
  11. 11. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Malware and DarkNets What’s  about  2015   11 •  A new variant of the popular Zeus banking trojan dubbed was Sphinx is appeared for sale on the black market, it operates entirely through the Tor network. •  Security experts at Sensecy have uncovered ORX-Locker, a Darknet Ransomware-as-a-service platform that could allow everyone to become a cyber criminal.
  12. 12. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor  Tor network abuse in financial crimes Tor  Anonymity  and  Financial  Frauds   12 •  Dec. 2014 - non-public report realized by the US Treasury Department found that a majority of bank account takeovers exploits the anonymizing the Tor network. •  6,048 suspicious activity reports (SARs) filed by financial organizations between August 2001 and July 2014, focusing for those involving one of more than 6,000 known Tor network nodes. •  975 hits corresponding to reports totaling nearly $24 million in likely fraudulent activity. •  From October 2007 to March 2013, filings increased by 50 percent,” the report observed. “During the most recent period — March 1, 2013 to July 11, 2014 — filings rose 100 percent.”
  13. 13. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Tor network abuse in financial crimes Tor  Anonymity  and  Financial  Frauds   13
  14. 14. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Black Markets What’s  about  2015   14 •  Black Markets are places on the web where it is possible to acquire or rent “malicious” services and products. •  Anonymity and virtual currencies. •  Efficient facilitators of criminal activities. •  Most commercialized products are drugs, user’s PII, stolen card data and hacking services. •  The Feedback mechanism and escrowing services increase mutual trust between buyers and sellers. •  Competition (Mr Nice Guy hired a blackmailer to hit TheRealDeal and its competitors. TheRealDeal hacked back.)
  15. 15. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Black Markets Dark  markets  are  crowded  places   15
  16. 16. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Black Markets Tor  Black  Markets   16 Black  Markets   Onion  address   Abraxas   abraxasdegupusel.onion   Agora   agorahooawayyfoe.onion     AlphaBay   pwoah7foa6au2pul.onion   Nucleus   nucleuspf3izq7o6.onion   Outlaw   ouIor6jwcztwbpd.onion   Italian  DarkNet  Community   2qrdpvonwwqnic7j.onion   Dream  Market   ltxocqh4nvwkofil.onion   Haven   havenpghmfqhivfn.onion   Middle  Earth   mango7u3rivtwxy7.onion  
  17. 17. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Black Markets Product  Pricing  List  Sample   17 •  PII record for $1. (Trend Micro) •  PayPal and eBay go up to $300 each. (Trend Micro) •  Bank account offered for a price ranging from $200 and $500 per account (balance, history). •  Document scans from $10 to $35 per document. (Trend Micro) •  Credit card fraud CVVs ($3-$25), Dump ($20-$60), Fullz ($25-$125) [Data Preview -Annual Card Fraud Report IT Ministry of Treasury and Finance] •  Counterfeit documents, including non-US passports, from $200 to $1000. Fake US driver’s licenses run for $100-$150, meanwhile counterfeit Social Security cards run between $250 and $400 on average.
  18. 18. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Black Markets Services  -­‐  Pricing  List   18 •  Hacking services ü  Social media account hacking $50-$100 (FB, Twitter, etc.) ü  Remote Access Trojan $150-$400 (FB, Twitter, etc.) ü  Banking Malware Customization (i.e. Zeus source code) $900 - $1500 ü  Rent a botnet for DDoS attack (24 hours) $900 - $1500 •  Carding •  Money Laundering Services •  Assassinations services •  Training and Tutorials
  19. 19. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Black Markets A  successful  Business  Model   19 •  Silk Road realized $22 Million In Annual Sales only related to the drug market. (Carnegie Mellon 2012) •  USD 1.9 million per month Sellers’ Total revenue •  Silk Road operators earned about USD 143,000 per month in commissions. •  Principal Dark 35 marketplaces raked from $300,000 to $500,000 a day. •  About 70% of all sellers never managed to sell more than $1,000 worth of products. Another 18% of sellers were observed to sell between $1,000 and $10,000 but only about 2% of vendors managed to sell more than $100,000 2012   2015  
  20. 20. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Pedophilia Pedos  in  the  dark   20 •  A study conducted by the University of Portsmouth revealed that over 80% of Tor network visits is related to pedo sites. •  The portion of Tor users who search for child abuse materials is greater that the one that use it to buy drugs or leak sensitive documents to a journalist. •  “Unstable sites that frequently go offline might generate more visit counts. And sites visited through the tool Tor2Web, which is designed to make Tor hidden services more accessible to non- anonymous users, would be underrepresented. All those factors might artificially inflate the number of visits to child abuse sites measured by the University of Portsmouth researchers” said Tor executive director Roger Dingledine.  
  21. 21. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Pedophilia Pedophilia  in  the  dark   21 •  Trend Micro Research identified 8,707 “suspicious” pages. The analysis of the “Surface Web” sites that those sites linked to revealed that the majority of them fall into the following categories: ü  Disease vector (drive-by download) sites (33.7%). ü  Proxy avoidance sites (31.7%). ü  Child exploitation (26%). •  Diffusion of Pedo material in the Deep Web is anyway serious phenomenon.      
  22. 22. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Terrorism Terrorists  in  the  Dark  Web   22 •  Propaganda videos and images •  The Dark Web is difficult to monitor for intelligence agencies and it is not so easy to de-anonymize members of terrorist organizations. •  Hidden services used as repository of mobile apps used by the jihadists to communicate securely.
  23. 23. Lorem  ipsum  dolor  sit  amet,  consectetur   adipisicing  elit,  sed  do  eiusmod  tempor   Terrorism Terrorists  in  the  Dark  Web   23 •  Donations to fund cells by using virtual currencies (i.e. Bitcoin) •  Law enforcement fear possible abuses of crypto currencies that could facilitate bad actors, including terrorists. •  Bitcoin wa Sadaqat al-Jihad which translates to: “Bitcoin and the Charity of Violent Physical Struggle” that explains how it is possible to buy weapons for the Mujahideen. •  The ISIS released a manual for its militants titled “ How to Tweet Safely Without Giving out Your Location to NSA.”  
  24. 24. We  are  going  in  the  dark The response of the law enforcement. 24 •  “We’re past going dark in certain instances. We are dark,” said Michael Steinbach, assistant director of the FBI’s counter-terrorism division. •  The FBI warned lawmakers there was no way to monitor encrypted online communications exploited by Islamic State militants and sympathizers. (June 2015) •  Michael McCaul, chairman of the committee, confirmed that the inability to monitor communications among members of the ISIS in the dark web represents a “tremendous threat to our homeland.” •  DoJ proposal is trying to legitimate FBI hacking operations against Internet users that make use of any kind of anonymizing technology. (Sept. 2014)    
  25. 25. We  are  going  in  the  dark The response of the law enforcement. 25 •  (Dec. 22nd, 2014) In a court case the investigators were informed about the usage of an FBI’s “Network Investigative Technique” (NIT) to deanonymize suspects while exploiting Tor network. The NIT allowed them to identify the IP address of TOR users. •  Law enforcement relied on the popular Metasploit framework to first de- anonymize operators of child porn websites in the Tor network. •  The operation is coded Operation Tornado and the FBI relied upon an abandoned project of Metaploit dubbed the “Decloaking Engine” to de- anonymized users in the 2012. •  “The NIT was a Flash based application that was developed by H.D.Moore and was released as part of Metasploit. The NIT, or more formally, Metaspolit Decloaking Engine was designed to provide the real IP address of web users, regardless of proxy settings.” states the forensic report.  
  26. 26. “The action aimed to stop the sale, distribution and promotion of illegal and harmful items, including weapons and drugs, which were being sold on online ‘dark’ marketplaces. Operation Onymous, coordinated by Europol’s European Cybercrime Centre (EC3), the FBI, the U.S. Immigration and Customs Enforcement’s (ICE), Homeland Security Investigations (HSI) and Eurojust, resulted in 17 arrests of vendors and administrators running these online marketplaces and more than 410 hidden services being taken down. In addition, bitcoins worth approximately USD 1 million, EUR 180 000 euro in cash, drugs, gold and silver were seized.”reports the Europol.  Operation Onymous The response of the law enforcement. 26
  27. 27. Operation Onymous The response of the law enforcement. 27 •  Operation Onymous (On 5 and 6 November 2014) – Law enforcement and judicial agencies around the globe conducted a joint action against dark markets on Tor networks. •  Over 400 websites were shut down including black markets on Tor network (Silk Road 2.0, Cloud 9 and Hydra). •  The 26-year-old software developer “'Defcon” was arrested in San Francisco and accused of running Silk Road 2.0. •  $1 million in Bitcoin was seized, along with €180,000 in cash, gold, silver and drugs. •  The list of dark markets seized by law enforcement includes Alpaca, Black Market, Blue Sky, Bungee 54, CannabisUK, Cloud Nine, Dedope, Fake Real Plastic, FakeID, Farmer1, Fast Cash!, Flugsvamp, Golden Nugget, Hydra, Pablo Escobar Drugstore, Pandora, Pay Pal Center, Real Cards, Silk Road 2.0, Smokeables, Sol’s Unified USD Counterfeit’s, Super Note Counter, Tor Bazaar, Topix, The Green Machine, The Hidden Market and Zero Squad.
  28. 28. Operation Onymous DeAnonymizing the cyber crime on Tor 28 •  Security experts hypothesized that law enforcement has exploited one of the following scenarios: ü  Lack of Operational Security of hidden services. ü  Exploitation of bugs in the web application. ü  Bitcoin de-anonymization. ü  Attacks on the Tor network (i.e. Traffic Analysis Correlation attacks). •  The number of black markets seized by law enforcement led to speculation that a weakness in the Tor network had been exploited. •  Andrew Lewman, a representative of the not-for-profit Tor project, excluded it by suggesting that execution of traditional police work such as following Bitcoins was more likely.
  29. 29. Intelligence & Deep Web 29 Snowden Revelation Top-secret presentation Tor Stinks leaked by Snowden shows the techniques implemented by the NSA to overwhelm Tor Anonymity with manual analysis. "We will never be able to de-anonymize all Tor users all the time' but 'with manual analysis we can de-anonymize a very small fraction of Tor users'"  
  30. 30. New dedicated cyber units Law enforcement 30 Dec. 2014 - Prime Minister Cameron announced that a newborn cyber unit composed by officials from GCHQ and NCA will fight online pedophiles even in the Deep Web. Interpol’s Cyber Research Lab completed the first training program, as part of the course the participant built its own private “Darknet” network simulating the management of an underground marketplace.
  31. 31. About me 31 About Pierluigi Paganini: Pierluigi Paganini is Chief Information Security Officer at Bit4Id, firm leader in identity management, member of the ENISA ( European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group, he is also a member of the advisory council for The European Centre for Information Policy and Security (ECIPS), Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness lead Pierluigi to find the security blog "Security Affairs" named a Top National Security Resource for US. Pierluigi is a member of the Dark Reading Editorial team and he is regular contributor for some major publications in the cyber security field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “ Digital Virtual Currency and Bitcoin”, coming soon the new book "Spy attack: come aziende, servizi segreti e hacker possono violare la nostra privacy" Ing. Pierluigi Paganini Chief Information Security Officer Bit4id ppa@bit4id.com www.bit4id.com Founder Security Affairs http://securityaffairs.co/wordpress pierluigi.paganini@securityaffairs.co
  32. 32. Thank  you  

×