Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

De-anonymizing ransomware domains on the dark web

blog.talosintelligence.com

Post reply on HN
Print view View original

41–50 of 55 posts

Re: De-anonymizing ransomware domains on the dark web

#41

Post by amelius »

FredPret wrote: post #24
ziddoap wrote: post #9

#1 and #2 really should just be a part of #3: catastropic opsec. I don't know what it is about people who run these criminal enterprises on the darknet, but they constantly seem to be failing even the most basic of opsec. Re-using identities across multiple services, using e-mail addresses with real names, posting photos with identifiable information (and before websites stripped metadata for them, often posted with…

The genius is the one selling the shovels to the gold diggers

It's still illegal, so they might be exposed at some point through their "non-genius" clients.

Re: De-anonymizing ransomware domains on the dark web

#43

Post by neurostimulant »

flatiron wrote: post #33
orthoxerox wrote: post #3

This should come in handy if I ever have to run a website on the dark web

I know absolutely nothing about the subject but I would at least run nginx and tor in a docker container. Make sure no traffic comes out of the container on my public ip. Wouldn’t solve every problem but seems like it would solve…a lot of them? That and I could move it around a lot. Not sure if that’s good opsec or bad though lol.

There are plenty of noob mistakes to make when using docker such as accidentally exposing their database port. A lot of mongodb "hacks" in the past was due to this.

Re: De-anonymizing ransomware domains on the dark web

#44

Post by hnlmorg »

sterlind wrote: post #39
hnlmorg wrote: post #38

Earlier quoted context omitted.

You’d probably want some traffic going out on your public IP because everything going via Tor is itself a suspicious activity and likely to draw attention. They key is to ensure only legal stuff goes out on your IP and the illegal stuff is anonymised. Which is easier said than done.

tunnel all the Tor traffic out through a VPN? I feel like there's probably a bunch of servers operating like that for legit reasons. they'd probably assume you're just seeding torrents or something. you can do the same trick to connect to it from home - VPN use is common. you'd want a burner laptop, of course, and some physical box preventing the laptop from hitting anything other than the VPN. I've thought about set…

> tunnel all the Tor traffic out through a VPN?

Same problem. Tunnelling all of your traffic will look suspicious and thus stand out from the thousands of other people who don't tunnel all of their traffic. If I recall correctly, one of the documents Snowden released even specified that people who tunnel all of their traffic via VPC land themselves on government lists for closer monitoring. Regardless of whether this is true or not, creating a lot of legitimate traffic on your same gateway should still make it harder to fingerprint you as someone who exercises in activities that warrant closer inspection.

Re: De-anonymizing ransomware domains on the dark web

#45

Post by varispeed »

pcthrowaway wrote: post #36
ziddoap wrote: post #9

#1 and #2 really should just be a part of #3: catastropic opsec. I don't know what it is about people who run these criminal enterprises on the darknet, but they constantly seem to be failing even the most basic of opsec. Re-using identities across multiple services, using e-mail addresses with real names, posting photos with identifiable information (and before websites stripped metadata for them, often posted with…

I suspect anywhere in the world, if you're capable of avoiding all 3 of these, you can get a job that pays in the 85th-99th percentile for your country, and 60th percentile globally. It's not a particularly high bar, but I suspect the majority of technically apt people would fail it. People with lucrative work available legally have more to lose and less desperation to engage in activities that are both illegal and m…

> you can get a job that pays in the 85th-99th percentile

Being in 85th-99th is no longer attractive. Because of extreme level of taxation people who earn real money are not included in those statistics, as in they are not paid a salary.

In my country (UK) being in 85th-99th percentile, means you'll have okay-ish life. After years of saving you may be able to afford an old terraced house, second hand, couple of years old car. Oh and if you decide to have family and your spouse won't be working, then you are screwed.

These indicators are no longer what they used to be.

Re: De-anonymizing ransomware domains on the dark web

#46

Post by anothernewdude »

ziddoap wrote: post #9

#1 and #2 really should just be a part of #3: catastropic opsec. I don't know what it is about people who run these criminal enterprises on the darknet, but they constantly seem to be failing even the most basic of opsec. Re-using identities across multiple services, using e-mail addresses with real names, posting photos with identifiable information (and before websites stripped metadata for them, often posted with…

Developers aren't Ops.

Re: De-anonymizing ransomware domains on the dark web

#47

Post by hoppla »

kmeisthax wrote: post #17
ipaddr wrote: post #4

So certificates do not enable privacy they take it away. SSL may stop your roommate or isp but they provide another vector for linking to other entities. I wonder how many are using this technique to link web properties together.

Anonymity of the origin server is not at all a design goal of SSL/TLS: in fact, the whole point is to tie a web host to a particular identity. Originally it was supposed to be legal identity, but that is actually fairly useless, so now it's just a domain name. For end-users TLS and Tor both provide privacy; since you don't need to identify yourself in order to use https. In fact, with ESNI and DoH the only thing anyo…

What’s the TLS cert for? Tor is already encrypted and the onion address act as the public key

Re: De-anonymizing ransomware domains on the dark web

#48

Post by naniwaduni »

hnlmorg wrote: post #44
sterlind wrote: post #39

Earlier quoted context omitted.

tunnel all the Tor traffic out through a VPN? I feel like there's probably a bunch of servers operating like that for legit reasons. they'd probably assume you're just seeding torrents or something. you can do the same trick to connect to it from home - VPN use is common. you'd want a burner laptop, of course, and some physical box preventing the laptop from hitting anything other than the VPN. I've thought about set…

> tunnel all the Tor traffic out through a VPN? Same problem. Tunnelling all of your traffic will look suspicious and thus stand out from the thousands of other people who don't tunnel all of their traffic. If I recall correctly, one of the documents Snowden released even specified that people who tunnel all of their traffic via VPC land themselves on government lists for closer monitoring. Regardless of whether this…

Okay, tunnel all your Tor traffic through a VPN and also seed Linux ISOs, then, both through the VPN and publicly?

Re: De-anonymizing ransomware domains on the dark web

#49

Post by hnlmorg »

naniwaduni wrote: post #48
hnlmorg wrote: post #44

Earlier quoted context omitted.

> tunnel all the Tor traffic out through a VPN? Same problem. Tunnelling all of your traffic will look suspicious and thus stand out from the thousands of other people who don't tunnel all of their traffic. If I recall correctly, one of the documents Snowden released even specified that people who tunnel all of their traffic via VPC land themselves on government lists for closer monitoring. Regardless of whether this…

Okay, tunnel all your Tor traffic through a VPN and also seed Linux ISOs, then, both through the VPN and publicly?

The best approach really is just to use VPN for specific purposes. Everyday traffic, checking the news, personal email, etc shouldn't be via VPN. You should buy yourself a dedicated laptop for "work" with all that traffic going via VPN+Tor. Don't use your "work" laptop for anything personal and visa versa with your personal devices.

This keeps things simple (conceptually) while also effortlessly creates genuinely normal looking traffic. However eventually you'll still get caught. It doesn't matter how careful you are, you only need to slip up once.

Re: De-anonymizing ransomware domains on the dark web

#50

Post by throwawa-y123 »

varispeed wrote: post #45
pcthrowaway wrote: post #36

Earlier quoted context omitted.

I suspect anywhere in the world, if you're capable of avoiding all 3 of these, you can get a job that pays in the 85th-99th percentile for your country, and 60th percentile globally. It's not a particularly high bar, but I suspect the majority of technically apt people would fail it. People with lucrative work available legally have more to lose and less desperation to engage in activities that are both illegal and m…

> you can get a job that pays in the 85th-99th percentile Being in 85th-99th is no longer attractive. Because of extreme level of taxation people who earn real money are not included in those statistics, as in they are not paid a salary. In my country (UK) being in 85th-99th percentile, means you'll have okay-ish life. After years of saving you may be able to afford an old terraced house, second hand, couple of years…

notwithstanding a slight bump due to covid, taxes across the West are at the lowest levels they’ve been since before WW2
Post reply on HN