About the darkweb

1. Husband, father, blogger, marketer
Nearly 20 years in online marketing
Marketing Technologist (Capgemini)
Master of Science in IT (CMU)
Lobbied against Child Pornography
Paul Wilson
(Charlotte, NC)
Follow me on Twitter
@PaulWilson
Visit me at
http://mymarketer.net

2. THE FORCE vs THE DARK SIDE
The Deep Dark Web

3. The Landscape
The Force
The Dark Side
A Deeper Look

4. Understanding the Landscape of the Dark Web

5. The REAL Web

10. Timing Attack
Entry Monitoring
Intersection Attack
Ddos Attack
Predecessor Attack (Replay)
Exit node Sniffing

11. TOR: The Force or The Dark Side?

15. Home Users: protect themselves when online
Activists: anonymously report abuses from danger
zones
Whistleblowers: safely report on corruption
Journalists: protect their research and sources online
Military and law enforcement: protect
communications, investigations, and intelligence

19. Drug Dealers: Controlled substance marketplaces
Arm Dealer: selling all kinds of weapons
Pedifiler: Child pornography
Traitor: Unauthorized leaks of sensitive information
Thief: Money laundering and Credit Card Fraud
Plagiarist: Copyright infringement

20. Exploring the Dark Web

27. Comments

29. The Extras…

35. TOR Node
Encrypted
Alice
Bob
Jane
Unencrypted
•Each OR maintains a connection
to every other OR
•Users run an onion proxy (OP) to
fetch directories, establish circuits
across the network
•Each OR maintains a long & short
term onion identity key (10 mins)
Port 9001
Port 9090
Port 443

36. TOR Node
Encrypted
Alice
Dave
Bob
Jane
Unencrypted
Step 1: Alice’s TOR Client
obtains a list of TOR
Clients from a directory
server
Port 9001
Port 9030

37. TOR Node
Encrypted
Alice
Dave
Bob
Jane
Unencrypted
Step 2: Alice’s TOR
Client picks a random
path to a destination
server. Green links are
encrypted, red links are
in the clear
Port 443
Port 80

38. TOR Node
Encrypted
Alice
Dave
Bob
Jane
Unencrypted
Step 3: If at a later time
Alice connects to a
different resource then a
different, random route
is selected. Again Green
links are encrypted, red
links are in the clear
Port 80
Port 443

39. TOR Node
Encrypted
Unencrypted
Security Agencies TOR is
a key technology in the
fight against organized
crime on the internet
Illegal Site
Agency IP Address Hidden from Site owner

41. TOR Node
Encrypted
Bob
Unencrypted
Criminal posts
anonymous content
out to Compromised
Server Compromised
Node
Police
Law Enforcement
Monitor suspects
client machine
(Entry Point)

42. TOR Node
Encrypted
Target
Unencrypted
Criminal posts
anonymous content
onto Server
Compromised
Node
Infected with malicious code
Police
Law Enforcement
Monitors Target client
machine (Exit Point)
• An exit node has complete
access to the content being
transmitted from the sender
to the recipient
• If the message is encrypted
by SSL, the exit node cannot
read the information, just as
any encrypted link over the
regular internet

43. TOR Node
Encrypted
Bob
Unencrypted
Criminal posts
anonymous content
out to Compromised
Server
Compromised
Node
Police
Network Analysis
Nodes periodically fail of
the network; any chain
that remains functioning
cannot have been
routed through either
the nodes that left or
the nodes that recently
joined the network,
increasing the chances
of a successful traffic
analysis
Offline Node

45. Tor is vulnerable to DoS attacks because users can
consume more network resources than allowed or
render the network unusable for other users.
Tor deals with these attacks with
Puzzle solving: At beginning of TLS handshake or
accepting create cells, this limits the attack multiplier.
Limiting rates: Limits rates of accepting of create cell
and TLS connections so the computational work of
processing them doesn’t disrupt the symmetric
cryptography operations that allow cells to flow.