Dark Web and Silk Road

Size: px

Start display at page:

Download "Dark Web and Silk Road"

Amos Walsh
6 years ago
Views:

1 Dark Web and Silk Road The Hidden Place of Internet 暗网和丝綢之路互联网上的隐藏空間 KP Chow, B Zhang, Y Zhang Center for Information Security and Cryptography University of Hong Kong X. Zhang Shandong Police College Apr 2017

2 Your footnote Your Logo

3 暗网, 丝绸之路和毒品 Dark Web, Silk Road & Drugs CISC 3

4 Selling drugs on the Web Will be on the newspaper, and chased by the Police No one will do it like this Are you that stupid? CISC 4

5 Can we buy illegal drugs on the Web? You can buy everything on the Web Dark CISC 5

6 The Silk Road in the Dark Web Silk Road was an online black market and the first modern darknet market, best known as a platform for selling illegal drug CISC 6

7 The Drug Market CISC 8

8 What else besides drugs in the Dark Web? CISC 9

9 Not only drugs CISC 10

10 Services Available CISC 11

11 Web Deep Web Dark Web CISC 12

12 Surface Web, Deep Web & Dark Web Searchable by Google, Baidu, 谷歌百度, 都可以搜索得到 CISC 13

13 Where is the Deep Web? Intranet, contents with privacy protection. 内联网, 隐私保护的内容, CISC 14

14 Where is the Dark Web? Only accessible with TOR 只有使用 Tor Usually illegal contents: illegal drugs market, weapons market, child pornography, 通常违法的内容 : 非法毒品市场武器市场儿童色情, CISC 15

15 WeChat Market Place 微信商圈深网 CISC 16

16 How easy to access the Dark Web? How to pay? Of course, use BitCoin CISC 17

17 What is Dark Web? Why can t they be traced? The TOR!!! CISC 18

18 Traditional Internet Investigation Tracing using the IP address Most forums and e-commerce sites log the IP addresses of the users Most ISPs record the IP addresses assignments IP assigned to Subscriber at Time ISP Post by User from IP at Time Subscriber Forum F 19 CISC

The Onion Router (TOR) A network of virtual tunnels that allows people and groups to improve their privacy on the Internet Users use TOR to keep websites from tracking them, or connect to news sites

19 The Onion Router (TOR) A network of virtual tunnels that allows people and groups to improve their privacy on the Internet Users use TOR to keep websites from tracking them, or connect to news sites that are blocked by their local Internet providers Used by U.S. Navy for open source intelligence gathering Used by law enforcement agencies to visit web sites without leaving their IP addresses in the web logs

20 2 main features of TOR Support anonymous web surfing Support hidden services CISC 21

21 Anonymous Web Surfing TOR can keep websites from tracking individual user s IP address that visits the web site Protect against traffic analysis: TOR protects Internet user against the Internet Surveillance technique called traffic analysis Traffic analysis can be used to infer who is talking to whom over a public network even the communication channel is encrypted

22 Basic Principles of TOR Distribute the connection from you to the server over several places on the Internet, so that no single point can link you to the server To connect you to the server, a circuit of encrypted connections through routers in TOR is created, and each hop is encrypted with different key The TOR uses the same circuit for connections that happen within the same minute; later requests are given a new circuit

23 Minute 1 Exit Router You All these communications are encrypted Server

24 Minute 2 Exit Router You The exit router is not the actual requester for the server: you are hidden from the server Server

25 How the seller tell others where they are? Hidden Service 消失的服务器消失的 IP 地址 CISC 26

26 Hidden Services with.onion Typical top level domain (TLD) :.com,.gov,.edu,.cn,.hk.onion is a special-use TLD suffix designating an anonymous hidden service reachable via the Tor network Not actual DNS names, and not searchable in the normal DNS root To access.onion domain server, one has to install specialized proxy software, and access through the TOR network

27 Characteristics No fixed IP address Not searchable by surface web search engines, e.g. Google, Baidu, Bing Don t know where the server is CISC 28

Shopping and Delivery Bitcoin as a payment method 比特幣

to dust, double vacuum sealed and then put inside an

This is necessary because it allows the item to be

letter which will fit through any size letter box.

28 Shopping and Delivery Bitcoin as a payment method 比特幣 International Customers the cocaine will be crushed to dust, double vacuum sealed and then put inside an MBB bag. This is necessary because it allows the item to be sent as a completely flat and smooth normal business letter which will fit through any size letter box. The shipping price reflects the time, effort and skill which goes into preparing an international letter.

29 Upload a document to WikiLeaks

30 Hidden Service Protocol CISC 32

31 Hidden Service Protocol Seller s Details 卖方的细节 Directory Buyer Seller s Details 卖方的细节 rendezvous point (buyer s agent) Instruction Points (seller s agent) Seller

32 Hidden Service Protocol rendezvous point (buyer s agent) Directory Buyer Buy Request 购买请求 Instruction Points (seller s agent) Seller

33 Hidden Service Protocol rendezvous point (buyer s agent) Directory Buyer The Purchase Instruction Points (seller s agent) Seller

34 Hidden Service Protocol A hidden service needs to advertise its existence in the Tor network before clients will be able to contact it. Therefore, the service randomly picks some relays, builds circuits to them, and asks them to act as introduction points by telling them its public key. Note that in the figures the green links are circuits rather than direct connections. By using a full Tor circuit, it's hard for anyone to associate an introduction point with the hidden server's IP address. While the introduction points and others are told the hidden service's identity (public key), we don't want them to learn about the hidden server's location (IP address).

35 So many illegal activities in the Dark Web, can law enforcement do anything? Nothing? Not a lot. CISC 37

36 Investigate TOR network Practiced by FBI, MI5 and MI6, and others Two possible approaches: Traditional investigation Technical approach

37 Investigate TOR network Traditional Investigation Undercover Virtual identity profiling: correlation user identities in the Dark Web with the surface web Behavior analysis: based on the user behavior on navigating the Dark Web to trace the real identity, e.g. the images posted

38 Under Cover Hidden services set up by law enforcement agencies, e.g. child porn server Law enforcement agents act as buyers CISC 40

39 Investigate TOR network Technical Approach Honeypot router: establish routers to collect TOR traffic data Exit node monitoring Software vulnerabilities, i.e. hacking

40 Monitor Tor Exit Nodes Tor Exit Nodes are the gateways where unencrypted Tor traffic hits the Internet. An exit node can be used to monitor Tor traffic in plain form after it leaves the last onion router The design of the Tor network makes locating the source of that request through the network difficult The exit traffic is unencrypted and may contain identifying information which can be used by the law enforcement

41 How to locate the exit nodes? Exit Router You Not possible, just by set up lots of TOR routers Server

42 Some well-known exit nodes CISC 44

43 Software Vulnerabilities Network Investigative Technique (NIT): a hacking tool used by FBI Used against criminals that use TOR to surf the web anonymously The US Supreme Court amended a procedural rule known as Rule 41 that would allow judges to issue warrants for the government to use NIT to hack computer anywhere, including when users rely on the anonymizing TOR network to hide their CISC physical locations 45

44 What is NIT? Your IP address here Exit Router You Incoming IP address Who knows your IP address? Server

45 3. Criminal access the Playpen site NIT A hacking technique based on drive-by download 4. Hacking code run on the criminal s PC You 5. Hacking code submit the real IP address to Playpen 2. FBI installed hacking code in the Playpen web site 1. FBI gets hold of Playpen (child porn site in Dark Web) 6. FBI finds the criminal using the real IP address Server

46 Some Cases CISC 48

47 Interpol Member of pedophile website How the suspects were found?

48 FBI Traps Silk Road CISC 50

49 Before the conclusion CISC 51

50 Feb 2017 The Dark Web has shrunk by 85%? 1. The biggest host of Dark Web sites, Freedom Hosting II (FHII), got hacked by anonymous hackers and shut down 2. Estimate to host 15% to 20% of all sites on the Dark Web 3. OnionScan detected only 4,400 active hidden services (out of previously known 30,000 services) 4. Why there is a difference in 2 & 3? other providers were hosting some infrastructure on top of FHII 52

51 Conclusion 结论互联网 + Internet + 犯罪 Crime 将在暗网内 Will be at the Dark Web CISC 53

52 谢谢 Thank You A clean version of the ppt will pass to LawTech Center. If you like to have the full version, please contact me at chow@cs.hku.hk and tell me who you are.

53 References 邹锦沛张渊张博, 隐藏空间之暗网初探 (2016) X. Zhang & KP Chow, A Framework for Dark Web Threat Intelligence Analysis (2017).onion - Wikipedia Tor: Hidden Service Protocol Tor Exit Nodes Located and Mapped How the NSA (Or Anyone Else) Can Crack Tor's Anonymity Hacking Tor and Online Anonymity

A to Z of the Darknet

A to Z of the Darknet Professional acknowledgements The Investigator conferences Thomas Olofson Intelliagg author of Shining a Light on the Dark Web Colin Tansley Intelect Solutions Limited A is for Anonymity