Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

De-anonymizing ransomware domains on the dark web

blog.talosintelligence.com

Post reply on HN
Print view View original

51–55 of 55 posts

Re: De-anonymizing ransomware domains on the dark web

#51

Post by ziddoap »

Closi wrote: post #25
ziddoap wrote: post #16

Earlier quoted context omitted.

Which ones of my list had great opsec? I'm not denying what you said, it only takes one slip up, but in the cases I mentioned by name: AlphaBay used their regular hotmail account to send password reset emails, and that email was tied to their LinkedIn. Freedom Hosting was taken down because the operators used outdated FF with javascript enabled. Silk Road's Ross Ulbricht posted his personal Gmail address, linking the…

It sounds pretty easy to inadvertently visit a site on an old laptop with javascript enabled. Is this what counts as a profound opsec failure these days? Remembering that you only have to make an error like that once. And if all these high-profile people manage to get caught (It seems like pretty much everyone that isn't a nation state ends up getting found eventually!) then maybe it's not that these people are terri…

>And if all these high-profile people manage to get caught (It seems like pretty much everyone that isn't a nation state ends up getting found eventually!) then maybe it's not that these people are terrible at Opsec, it's maybe that it's much harder than it looks,

I tried to make it explicitly clear, over several different comments in this thread, that I'm not saying opsec in general is easy nor am I saying that everyone who has been caught has made these easy-to-avoid mistakes. I am struggling to think of yet another way to word it, but here I go one last time:

A robber goes into a store and steals a bunch of money. On the way out, they leave their drivers license on the counter. Can we agree this would be a dumb mistake? This doesn't mean that all robbers ever caught made dumb mistakes; some robbers are caught through extraordinary police work and with the help of several technologies (DNA, facial rec, whatever). Those robbers, while still potentially making mistakes that lead to their arrest, have not made extraordinarly dumb mistakes like leaving government-issued identification at the scene of the crime.

This concept applies to opsec and computers as well. You can slip up once and be caught through the smallest of mistakes. Or you can literally tell everyone who you are and be caught that way. Both are mistakes, but one is a trivially avoided stupid mistake, and the other is not.

Many other operators (of dark markets, ransomware gangs, etc.) have been caught, but I did not include them because the ways they were caught did not appear to be through dumb mistakes, but through intense technical means.

Re: De-anonymizing ransomware domains on the dark web

#52

Post by kmeisthax »

hoppla wrote: post #47
kmeisthax wrote: post #17

Earlier quoted context omitted.

Anonymity of the origin server is not at all a design goal of SSL/TLS: in fact, the whole point is to tie a web host to a particular identity. Originally it was supposed to be legal identity, but that is actually fairly useless, so now it's just a domain name. For end-users TLS and Tor both provide privacy; since you don't need to identify yourself in order to use https. In fact, with ESNI and DoH the only thing anyo…

What’s the TLS cert for? Tor is already encrypted and the onion address act as the public key

To make the browser show the little lock in the address bar, I suppose?

Granted, that's still kind of pointless because you still have to self-sign, which gives scarier warnings than being unencrypted[0].

A knowledgeable user wouldn't care - they'd know that they installed a Tor gateway that resolves .onion to itself, so they're just as protected as they are on TLS. The catch here is that the ransomware operators are trying to criminally extort less-knowledgeable users and bureaucratic IT staff that are just being told to "run Tor and pay us in Monero to get your files back".

[0] There's nothing preventing these operations from shipping their own browser or root cert - they are, after all, already running on the local machine outside of any sandboxing. No clue if they do this.

Re: De-anonymizing ransomware domains on the dark web

#53

Post by neh_89 »

There is no silver bullet when it comes to protecting against ransomware. A ransomware attack A prime example of this was the WannaCry virus attack in May 2017, where 200,000+ computers worldwide were infected due to a weakness in Windows SMB EnternalBlue, which allowed hackers to hijack computers running on an unpatched Microsoft Windows operating system. Users were asked to pay anywhere from 300-700 bitcoins to decrypt the data in 3 days.

https://www.spiceworks.com/it-security/cyber-risk-management...

Re: De-anonymizing ransomware domains on the dark web

#54

Post by jmprspret »

orthoxerox wrote: post #3

This should come in handy if I ever have to run a website on the dark web

Avoiding all of this is incredibly basic and borderline common sense.

When running a darknet site you don't want associated with the clearnet, step one should be only having the http server listen on the Tor onion domain!

Post reply on HN