In this work we explored the Attacks Landscape in the Dark Web. While in the past FTR looked at good and services offered and traded, here we investigated on the attacks and exposure. We observed hacking groups targeting each other, for example by defacing concurrent web sites in order to promote their -- or stealing Onion's private keys to possibly tampering on encrypted traffic in Tor.

1. Dark Web Impact on
Hidden Services in the Tor-
based Criminal Ecosystem
Dr. Marco Balduzzi @embyte
Sr. Researcher at Trend Micro
Forward-Looking Threat Research

3. A perfect platform for
eCrime

8. Courtesy Ionut Ilascu, Softpedia

9. What do attackers do?

10. What do attackers do? After…

11. How to Study such Attacks?
(In the Dark Web)

12. We simulate a cyber-criminal
installation in Tor

14. Honeypot
I. Black market
II. Hosting/service
provider in Tor
III. Underground forum
IV. Misconfigured server
(FTP/SSH/IRC)
Technology
I. OsCommerce
II. WordPress + Shells
III. Custom
IV. Debian Linux

15. Honeypot #3

16. Registration Only Forum

17. Exposes a Local File Inclusion vuln

18. Role of Tor2web proxies

20. Data Collection and Advertisement
• 7 months experiment
• Month 1: Different advertisement strategies
to honeypot #1
• Month 2: Advertised ALL honeypots using ALL
strategies
• Month 3-7: Restricted access by blocking
incoming Tor2web traffic

21. Daily POST Requests

22. Attacks and Files Uploads
• Phase 2 onwards
• Average of 1.4 malicious uploads per day

23. [Canali et al. NDSS 2013]

24. Traditional Web Attacks

25. Password-protected Shells

26. Obfuscation

28. Abuse of Tor Anonymity for Attacks

30. • Specifically targeting underground services in
Tor like marketplaces, forums
• Our honeypot!
Case of Tor-centric defacement

31. • Cyber-criminal gangs compromising opponents
• Self-promoting their “business”

32. Tor’s private key theft
• Used to compute the hidden service descriptor
Instruction
Points
Public
Key
Private Key
Instruction
Points
Public
Key
XYZ.onion
Signing
Keypair
Generation

33. Tor’s private key theft
• Over 400 attempts
• MiTM, hijack, decryption

34. Discussion
• Tor2web proxies play important role!
– Make the dark web not as private as someone would
think
• Hidden services are equally visible and exposed
as surface services
– Receive attacks within days

35. Discussion
• Dark Web is not safe heaven
– Attackers are actively conducting attacks against
hidden services
– Both automated and manuals
• Cyber-criminals are looking for services
operated by opponent groups
– Voluntarily attack them

36. • This work represents a first result in the
direction of understanding the attacks
landscape in the Dark Web.
Dr. Marco Balduzzi @embyte
Sr. Researcher at Trend Micro
Forward-Looking Threat Research
http://www.madlab.it/papers/sac17_darknets.pdf