Live data from Hacker News

Dropgangs, or the future of darknet markets

opaque.link

161–170 of 195 posts

Re: Dropgangs, or the future of darknet markets

#161
post #121

Dead drop based drug distribution doesn’t scale to retail levels. It is used in Moscow and I know of people who will order from a dealer, then search the surrounding area and clear out all the drops they find. It works for them, although one questions the sanity of stealing from Russian drug dealers. For more practical guides on how people who sell drugs avoid the negative repercussions: • AlpraKing’s business guide…

some really great links thanks! >although one questions the sanity of stealing from Russian drug dealers. I'd conjecture that the value of the booty would be quite limited too? (small envelopes not kilograms exchanging hands). A smack-head probably wouldn't care about the risks just as long as they get their next fix? EDIT: "4. Don't hire people under 30 years old" that is great advise. You want Mike Ehrmantraut like…

Sure, they aren’t stealing to supply their own business but to supply their partying. Apparently there’s some trick involved in selecting a dealer who offers a variety of options, not just one substance. They cache one or more of each in an area, so you buy a mid size quantity of something and the surrounding block probably has 5x as much plus other things... because the dealers are humans, they develop patterns of drop locations. Once these guys learn the pattern, they know where to look.

The drops get ripped so frequently there is a process for handling a drop that has been unloaded before the customer get there. The customer has to supply pictures of the drop location and the empty drop, then the dealer will send them to another place. Dead drops provide some security, but they’re a trade off.

I think the Gary Cooper videos are massively underrated for security principles. He explains how the adversary operates, how they think, and what their capabilities are, then based on that he distills core security strategies to exploit their operational limitations and mitigate their capabilities.

This is really great stuff for understanding how to counteract a threat, how to do proper counterintelligence analysis and apply it for security. The problem is that people see these as “stoner videos” rather than “the design and implementation of counter law enforcement techniques, by a former cop.” There is a lot to be learned, both from general security principles (such as compartmentation, cover, and concealment) But also how to analyze an adversary and develop a plan to mitigate their capabilities.

I was going to do a write up them years ago but someone scooped me by seeing my recommendation and then doing a (crappy) writeup before me. Just one of the things that killed my enthusiasm for sharing recommendations. But, I should do a write up. For a counterintelligence analysis they are sublime.

Re: Dropgangs, or the future of darknet markets

#162
post #112
post #50

Anonymous, decentralized transactions using dead drops only works with side-channels for reputation, or with security deposits. Side-channels for reputation like posting cryptographic proof on darknet forums isn't scalable or reliable. And security deposits without a third-party adjudicator just move the trust issue around without eliminating it. One ideal solution could be a cryptocurrency with on-chain confirmation…

> One ideal solution could be a cryptocurrency with on-chain confirmation of the real-world transaction by both parties after the fact. How do you prevent merchants from just creating a thousand fake transactions to make them look reputable?

This is where the web of trust comes in.

You give the greatest trust to reviews provided by the anonymous identities you have transacted with.

You give progressively less trust to reviews by identities 1, 2, ..., n hops away from those you have transacted with.

If a merchant creates 1000 sock-puppet consumers, they won't be reachable from your trust network, so you'll give them little if any weight.

Re: Dropgangs, or the future of darknet markets

#163
post #97

Earlier quoted context omitted.

How could the citizens trust the government to do only that?

A strong judiciary, high bar to change the law, and harsh accountability. Still a fine line to walk.

The Patriot Act and Snowden's revelations show how quickly and drastically the government can misappropriate powers granted to it.

Re: Dropgangs, or the future of darknet markets

#164
post #143

Earlier quoted context omitted.

odd goods like you might find in craiglist's for sale section. shared passwords or accounts for streaming websites. books. paintings. collectibles. there are often good deals on any dark net marketplace that pops up. All the way back to Silk Road 1.0. cheaper than listing on ebay.

Without the ebay protections in place it should be cheaper or it would make little sense to use them.

Multisig escrow is the protection

Its just cheaper mate

Re: Dropgangs, or the future of darknet markets

#165
post #78

Earlier quoted context omitted.

In the current system, you have to have dealers hanging out on the corners. To take territory, you shoot at the dealers and either kill them or scare them away. In this system, you have drops. How does a rival gang know where they are? They'd have to buy the product to discover the drop and drops shouldn't be used multiple times. They could watch a user find one, but then that drop wouldn't be used again so they coul…

It's not clear to me how much gang violence is specifically driven by fights over corners, rather than other kinds of inter-gang fighting. But let's assume it's significant. I think it's very unlikely a drug business can get to scale without reusing drops; the cost of scouting a good drop is significant, and the number is finite. Regardless, the value of a drop declines the farther it is from customers and from the d…

If gangs are claiming turf and excluding other dealers, then those aren't dead drops, which by definition are undetected drops by anonymous parties. It's an open question whether effective dead drops are even possible, but if they are, and come to be widely adopted for trade in contraband, then a significant portion of the source of territorial conflicts between criminal organizations vanishes.

Re: Dropgangs, or the future of darknet markets

#166

Earlier quoted context omitted.

How could identity theft need fixed?

"Identity Theft" is a marketing spin on "broken identification". An identity is unique by definition and can't be stolen. But if you use an inadequate identification technique, like my birthday that's on my facebook and everywhere else in combination with my social security number that I have to give out to just about everybody, anyone can aquire those two pieces of information and impersonate me. The ways to fix it…

> my birthday that's on my facebook and everywhere else in combination with my social security number that I have to give out to just about everybody

And that's generally the best case. Name, state, and birthday are considered unique in a terrifying number of settings, including traffic stops, DMV records, and voter registrations. It's baffling to me that a police officer can 'run a license' and act on the results without making use of the unique ID already provided on the license, but it apparently happens.

https://www.theguardian.com/us-news/2017/apr/03/identity-the...

Re: Dropgangs, or the future of darknet markets

#167
post #88

Earlier quoted context omitted.

There's nothing to be worry dangers of this network. I don't believe that our intelligence agencies haven't found a way break this anonymized distribution network. Its a well known fact that IA is indirectly sponsoring this network to get funds for their illicit operations. And I am pretty sure that they have planted backdoor in this network.

What is IA?

Presumably, "intelligence agencies".

Re: Dropgangs, or the future of darknet markets

#168

Earlier quoted context omitted.

Well, it was Adamflowers "long before". And its OPSEC was over-the-top lame. I mean, Hushmail? But then, DPR was also very sloppy.

If you really look at how the big names have gotten busted, you will see that their opsec is bad with no exceptions. Apparently people that actually know the craft don't see enough upside to running a marketplace like that, which should make you wonder about the ones that still exist.

Yes, indeed. I did look, rather carefully, a couple years ago. And OPSEC failure (sometimes spectacular) explained all of the the major busts that were widely reported.[0]

However, I did not research criminal court records. Accessing that data is nontrivial, especially for someone using a pseudonym, who can't show up physically, has no ID, and can't pay with a mainstream credit/debit card. Few, if any, courts accept Bitcoin etc.

Also, I made no effort to check for parallel construction, except by looking for inconsistencies among published accounts of investigations. And I do understand that the US DEA's Special Operations Division (SOD) funnels information from the NSA, CIA, etc to federal investigators.[1] With the understanding that "the utilization of SOD cannot be revealed or discussed in any investigative function".[2] And that includes outright perjury, if necessary. Just as we've seen regarding the use of Stinger intercepts.

It's hard to say whether people who know tradecraft well just prudently avoid running dark markets, as you say. Or whether they do, but don't get caught. Time will tell, I guess. At least, if remaining ones do get busted. But if they don't, there's the implication that the operators practice good OPSEC. Or, that they're honeypots ;)

0) https://www.ivpn.net/privacy-guides/online-privacy-through-o...

1) https://www.deamuseum.org/wp-content/uploads/2015/08/042215-...

2) http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...

Re: Dropgangs, or the future of darknet markets

#169
Yes, I am also quite impressed at the amount of thought that has been put into this concept. I would be quite interested in helping in designing these systems, as I have been following some of the necessary technologies for years. Jim

I foresee a stiff plastic or metal pipe, tapered to a point at one end, which can be driven by force into soil or into a lawn, so that it ends up to be approximately flush with the plane of the soil. Once placed, a smaller cylindrical container, as well as active elements, if needed, can be slid into the metal pipe, from above.

From the linked article: https://opaque.link/post/dropgang/

"This challenge is met by Dropgangs in various ways. The primary one is that the documentation of each dead drop is conducted in minute detail, covering GPS coordinates, photos of the surrounding and the location, as well as photos of the concealment device in which the product is hidden (such as an empty coke can). The documentation however increases the risk for the Dropgang since whoever creates it would be more easy to identify by surveillance. In addition, even great documentation still requires the customer to understand it and follow it precisely, which can lead to suspicious behavior around the dead drop location (staring at photos, visually comparing them to the surrounding, etc)." [end of partial quote]

Ordinarily, smartphones that use GPS, don't use accurizing features, such as WAAS. (Wide Area Augmentation System).

See https://en.wikipedia.org/wiki/Wide_Area_Augmentation_System

WAAS correction data is probably already available on the Internet. "Accuracy[edit] The WAAS specification requires it to provide a position accuracy of 7.6 metres (25 ft) or less (for both lateral and vertical measurements), at least 95% of the time.[2] Actual performance measurements of the system at specific locations have shown it typically provides better than 1.0 metre (3 ft 3 in) laterally and 1.5 metres (4 ft 11 in) vertically throughout most of the contiguous United States and large parts of Canada and Alaska.[3] With these results, WAAS is capable of achieving the required Category I precision approach accuracy of 16 metres (52 ft) laterally and 4.0 metres (13.1 ft) vertically. [end of partial quote]

WAAS might be described as a form of differential GPS. If the location as computed by the smartphone was improved by WAAS, the statement above indicates an accuracy within about 1 meter.

IR-specific retroreflectors to greatly simplify things.

The article describes complicated systems using Bluetooth or WiFi to help locate these dead-drops. While they are certainly innovative, they add cost and complexity to the hardware involved. I have thought of a much-cheaper system that I feel is sufficiently secure and simple for common use.

Light-retroreflectors are commonly made from Scotchlite https://en.wikipedia.org/wiki/Retroreflective_sheeting or plastic molded corner-cubes. If a rather small (say, 1/4 in diameter) sphere covered with retroreflector material was held up from the insert, possibly by a short, thin stiff wire, the sphere could be visible, but not excessively obvious even during the daylight. It would be easy to find this device with a flashlight in the dark. For added security, an infrared-transmitting plastic (such as is often used to cover IR-activating remote controls, such as https://www.eplastics.com/plexiglass/acrylic-sheets/ir-trans... ) could be used to ensure that only IR is retroreflected back to a searcher.

Ordinary smart-phone camera arrays are not only sensitive to human-visible light (generally described as 400-700 nanometer wavelength), but are also sensitive to near-IR wavelengths. If a smartphone camera was combined with a directional IR LED, substituting for the white light LED lamp used for photography, and aiming in the same direction, a user would be able to see (through the camera display) the IR-specific reflections from an IR-limited retroreflector, and this would probably be doable both during the day and at night. A person operating such a camera would "look like" he was doing photography, or perhaps playing a game. Somebody watching, even at night, could not see the IR. The IR 'searchlight' could be a narrow-beam device, perhaps with a full-angle of 16 degrees or so (typical for a narrow-beam IR LED), so it wouldn't be particularly obvious even if watched through an IR viewer. (If the IR LED itself was shielded from direct view.)

One advantage of this technique is that the searcher could identify the target from a very long distance away, perhaps many tens of meters, and thus approach it in a more "innocent" fashion. No obvious "searching" would have to be performed in the open. And, the person who placed the dead drop could ascertain its status without later needing to approach it closely.

This technique could be combined with Bluetooth or WiFi techniques, too. The retroreflector could normally be retracted, and only raised if the proper Bluetooth or WiFi signal was heard. Or, perhaps, the target would contain an exposed IR LED, which would activate from an battery only if the proper signals were heard. The resulting dead-drop would be virtually impossible to find.

Re: Dropgangs, or the future of darknet markets

#170
post #39

Earlier quoted context omitted.

The war on drug has to be one of the top contributors and financiers of crime and criminal gangs. Imagine a world where criminal gangs don't have access to the money they make through drugs and a government that doesn't have to spend huge amount of money on drug laws enforcement because drug trafficking would be much less lucrative in the existence of legal access and you get fewer and very cash-strapped drug gangs,…

There are plenty of illegal activities which can be used by gangs to generate revenue. If certain drugs are decriminalized, they still have theft, fencing, prostitution, sex trafficking, intimidation, computer crimes, etc.

Which are no where near as profitable and a lot easier to prosecute. You cant run a cartel on theft and computer crime.
Post reply on HN