Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

De-anonymizing ransomware domains on the dark web

blog.talosintelligence.com

Post reply on HN
Print view View original

31–40 of 55 posts

Re: De-anonymizing ransomware domains on the dark web

#31

Post by yieldcrv »

ziddoap wrote: post #16
Closi wrote: post #15

Earlier quoted context omitted.

You only have to slip up once to get caught. Some of the people caught on those listed examples had great Opsec... until that one time where they messed up and then suddenly ended up in jail.

Which ones of my list had great opsec? I'm not denying what you said, it only takes one slip up, but in the cases I mentioned by name: AlphaBay used their regular hotmail account to send password reset emails, and that email was tied to their LinkedIn. Freedom Hosting was taken down because the operators used outdated FF with javascript enabled. Silk Road's Ross Ulbricht posted his personal Gmail address, linking the…

Okay, how about that darknet market where their frontend got seized by the Feds with the big "website seized" plaster, and then the market operator seized it back, that was hilarious

the server was never seized and the operator was never sei

what about the currently existing markets still up? just one trip to dark.fail to check

Re: De-anonymizing ransomware domains on the dark web

#33

Post by flatiron »

orthoxerox wrote: post #3

This should come in handy if I ever have to run a website on the dark web

I know absolutely nothing about the subject but I would at least run nginx and tor in a docker container. Make sure no traffic comes out of the container on my public ip. Wouldn’t solve every problem but seems like it would solve…a lot of them? That and I could move it around a lot. Not sure if that’s good opsec or bad though lol.

Re: De-anonymizing ransomware domains on the dark web

#34

Post by jeroenhd »

ipaddr wrote: post #4

So certificates do not enable privacy they take it away. SSL may stop your roommate or isp but they provide another vector for linking to other entities. I wonder how many are using this technique to link web properties together.

Many security-enhancing technologies have been used to deanonymise websites. For example, by checking the certificate transparency log (the thing that prevents any CA from generating a certificate for Google.com that doesn't get nuked in seconds) it's often possible to find certificates for servers hidden behind Cloudflare. Those certificates can in turn be found using the mechanisms described here, and DDoS protection may quickly be bypassed that way.

Generally, though, TLS is not designed with privacy of the server in mind. The data exchanged between the client and the server is kept private between the two parties, but that's it.

If you wish to anonymise your connection, technologies like Tor will help. You'll still have to pay attention though. In a great many cases, security and usability are polar opposites, and a balance must be struck to find a workable solution. In this case the best balance is probably in-depth knowledge of how web servers work combined with reading through the documentation of the Tor project.

Re: De-anonymizing ransomware domains on the dark web

#35

Post by nick__m »

bragr wrote: post #29
nick__m wrote: post #14

Earlier quoted context omitted.

If you follow the best practices and do not bind your onion service on 0.0.0.0 and use selfsign and don't reuse key, they do provide privacy against snooping exit node.

>do not bind your onion service on 0.0.0.0 Good advice >they do provide privacy against snooping exit node onion services don't use exit nodes. Your client and the service build circuits to nominated middle relays so https only offers very marginal increases in privacy. However, you are right to assume than any exit node may (or probably is) monitored.

Since I never ran a hidden service I never challenged my assumptions that they connected to an exit node, but it make sense that an hidden service would be routed through a middle relay without going through an exit node.

Thanks for the clarification.

Re: De-anonymizing ransomware domains on the dark web

#36

Post by pcthrowaway »

ziddoap wrote: post #9

#1 and #2 really should just be a part of #3: catastropic opsec. I don't know what it is about people who run these criminal enterprises on the darknet, but they constantly seem to be failing even the most basic of opsec. Re-using identities across multiple services, using e-mail addresses with real names, posting photos with identifiable information (and before websites stripped metadata for them, often posted with…

I suspect anywhere in the world, if you're capable of avoiding all 3 of these, you can get a job that pays in the 85th-99th percentile for your country, and 60th percentile globally.

It's not a particularly high bar, but I suspect the majority of technically apt people would fail it.

People with lucrative work available legally have more to lose and less desperation to engage in activities that are both illegal and malicious

Re: De-anonymizing ransomware domains on the dark web

#38

Post by hnlmorg »

flatiron wrote: post #33
orthoxerox wrote: post #3

This should come in handy if I ever have to run a website on the dark web

I know absolutely nothing about the subject but I would at least run nginx and tor in a docker container. Make sure no traffic comes out of the container on my public ip. Wouldn’t solve every problem but seems like it would solve…a lot of them? That and I could move it around a lot. Not sure if that’s good opsec or bad though lol.

You’d probably want some traffic going out on your public IP because everything going via Tor is itself a suspicious activity and likely to draw attention.

They key is to ensure only legal stuff goes out on your IP and the illegal stuff is anonymised. Which is easier said than done.

Re: De-anonymizing ransomware domains on the dark web

#39

Post by sterlind »

hnlmorg wrote: post #38
flatiron wrote: post #33

Earlier quoted context omitted.

I know absolutely nothing about the subject but I would at least run nginx and tor in a docker container. Make sure no traffic comes out of the container on my public ip. Wouldn’t solve every problem but seems like it would solve…a lot of them? That and I could move it around a lot. Not sure if that’s good opsec or bad though lol.

You’d probably want some traffic going out on your public IP because everything going via Tor is itself a suspicious activity and likely to draw attention. They key is to ensure only legal stuff goes out on your IP and the illegal stuff is anonymised. Which is easier said than done.

tunnel all the Tor traffic out through a VPN? I feel like there's probably a bunch of servers operating like that for legit reasons. they'd probably assume you're just seeding torrents or something.

you can do the same trick to connect to it from home - VPN use is common. you'd want a burner laptop, of course, and some physical box preventing the laptop from hitting anything other than the VPN.

I've thought about setting this kind of thing up for fun. you could get really fancy - talking to some hopbox through Tor where you script up actions to take asynchronously, to defeat timing attacks.

Post reply on HN