Okay, guys. Let's start our next talk. We shall here. So give him a big
applause, please.
Okay. Everybody hear me okay? Good to go? Cool. So speaking today on operational security
lessons from the dark web, a few kind of mandatory disclaimers before we proceed. The usual views
and materials presented here do not represent any of my employer's past, present, or maybe
future. I'm going to be talking about a number of dark web related criminal cases.
I'm not discussing guilt or innocence. What I'm going to be discussing is evidence that
was provided and what operational security mistakes that outlines and how to apply it
for other enterprises. Also not going to be really discussing much the topic of parallel
construction. For anybody that doesn't know, parallel construction is a practice used by
law enforcement.
Where if they are either unwilling or unable to divulge how information was gathered, say,
by NSA surveillance, that sort of thing, they will essentially construct a parallel explanation
that will be presented in court as to how the information was gathered.
A little bit about myself. About 25 years in technology. Shifted to security about 10
years ago.
Have done a
wide range of public and private sector work. Everything ranging from two person software
startups up to multinationals. Currently working in the D.C. area. As you can see,
I have the cutest dog in the world. Goals of this talk, as I mentioned a little bit,
examine a number of criminal cases, what mistakes were made, and how the lessons learned from
those mistakes can be applied to security. I'm going to be talking a little bit about
some non-criminal activities. Starting with probably the most high profile one, and I
won't go into kind of the build-up to the case that much, and that's the Dread Pirate
Roberts Silk Road case. Been in the news a lot. Most people are probably familiar with
the case, at least at a high level.
Ross Ulbruch was arrested at a library in San Francisco while working on his laptop.
One of the primary security mistakes made there, he'd chosen to work at a library, use their Wi-Fi.
Makes sense.
He was sitting at his table with his back to the room.
Couldn't see anybody come in, couldn't see what was going on.
The FBI agents that were there to arrest him thought they probably needed to make sure they could get his laptop before he could lock it.
So they had a couple of FBI agents essentially getting into a screaming argument.
He, we'd all do this, looked up from his laptop, looked around.
There was someone standing almost right behind him before he knew it.
Laptop's in their hands.
They take it back.
They image the laptop.
He had encrypted the drive on the laptop, which would have helped if he'd been able to keep the FBI from getting to it before locking in.
One of the things he was accused of was ordering.
Actually, it was.
Either five or six murders.
At least one.
All of those were arranged through relatively anonymous means.
At least one of the quote-unquote hitmen turned out to be a DEA agent.
I'll actually talk about him later.
In that instance, they actually faked the murder of the person in question.
To the best of everyone's knowledge, no murders actually occurred.
Payments were made.
But no murders actually occurred.
There's an old New Yorker cartoon that probably everyone has seen that says,
On the Internet, No One Knows You're a Dog.
After this, I'm considering there should be one that says,
On the Internet, No One Knows You're Not Actually a Hitman.
So, FBI was able to successfully image his laptop.
He had copious documentation on Silk Road activities on the laptop.
He had a personal journal on the laptop spanning many years.
Detailed his plans for Silk Road.
Detailed activities on Silk Road.
Also had a large volume of chat logs between him and other administrators on Silk Road
that were stored on his laptop completely unencrypted.
Interestingly enough, in the very early days of Silk Road,
he made a post, I don't remember where it was, using the handle Altoid.
Basically saying, hey, has anybody heard of this Silk Road thing?
I think it's pretty nifty.
Kind of, I guess, very early guerrilla marketing of Silk Road.
He then later on needed some pretty basic coding assistance.
Posted to, I think it was Stack Exchange, a site like that, under the same handle.
But whatever board he was posting on to ask for programming advice
automatically made public the email address that you had registered the account under.
His email address that he used to register the account in that case was rossalbrook at gmail.com.
Some of the initial suspicion around him actually had very little to do with Silk Road itself.
He ordered, I think, nine fake IDs.
From a shipper in Canada.
Very high quality fake IDs.
They were shipped.
The package set off some sort of alarm bells for Customs and Border Protection.
They opened the package.
They discovered what was inside.
He had requested that it be shipped directly to the house he was living in in San Francisco.
They showed up, knocked on his door, said, we'd like to have a little chat with you.
Weren't there to arrest him, just wanted to have a little chat.
He said, no, absolutely not.
Slammed the door in their face.
Which is entirely his right to do.
But maybe shouldn't have had the IDs shipped to his home.
I mentioned earlier I wasn't going to talk about parallel construction.
I'm going to make myself a liar for a moment and talk about parallel construction a little bit.
One of the things the law enforcement agencies investigating needed to do was try to find the actual servers in question.
One of the back-end servers they were trying to find.
Turned out to be in Iceland.
The official story on how that was found was that that server was misconfigured.
So everything was served via Tor except the CAPTCHA on the login screen, which was transmitted over regular internet.
Rob Graham has a really good analysis of that.
Points out why it's actually likely that probably wasn't.
What happened.
But the thing he does point out is through analysis of the evidence the U.S. government released,
the server in question was horribly insecurely configured.
His theory, which makes sense to me, is that the server was actually found through widespread internet scanning by the NSA.
Looking for a couple of things that could link this server back to Silk Road.
The server was allowing regular internet traffic, it just wasn't necessarily through the serving of the CAPTCHA.
So, some lessons learned from this case, configure systems securely.
If you're doing sensitive work and you need for whatever reason to hide what you're doing, don't reuse your personal identifiers.
If you need to ship something securely, think about using a mail drop, something like that.
Don't have it sent to your home.
Also, don't send it from your home, which I'll get into a little bit later in one of the additional cases.
Know who to trust.
Now, this is a very difficult problem when you're dealing with an environment where people are at least somewhat anonymous.
I mean, how do you find, well, I guess the question of how do you find a hitman you can trust, period, is a big one.
But how do you find a hitman you can trust when you can't, do you ask for references for a hitman?
I don't know.
But how do you find a hitman you can trust when anybody can claim to be a hitman and you have no way of knowing if they are or not?
This obviously goes a lot deeper than just hiring people to assassinate other people.
But be aware of your surroundings, as I said.
If you're in a potentially physically hostile environment, don't sit with your back to the room.
And also, if there is a commotion and you need to look up, shut your laptop.
And if you're doing sensitive work as much as possible, don't document your activities.
You're just providing basically free information for whoever your adversary is, be it a nation, state, whatever.
Next case I wanted to look at is called, some that went under the, well, several aliases.
Primary alias is Willie Clock.
Young gentleman in Uganda, legal name Ryan Gustafson, had a pretty successful counterfeiting operation,
which was discovered after someone was found trying to buy a $3.85, I think, cup of coffee with a counterfeit hot dog.
$100 bill in Pittsburgh.
Managed to trace back, they thought it was to Uganda, not sure who it was coming from.
He, again, we see this a lot, reused personal email address.
For one reason or another, I still don't understand why his Jack Farrell alias he set up a pretty full-fledged Facebook page for.
The email address he used for that was the same email he used for his passport application for a legitimate U.S. passport.
In addition, he put a profile picture on this fake Facebook page.
Okay, you know, makes sense.
If you're creating a Facebook page, you want to make it look as realistic as possible.
But he used that.
He used a photo of himself that they were able to match via facial recognition to his state of Texas driver's license.
I have two issues here.
If you're doing something like this, why are you creating a Facebook profile for your alias?
And given that you probably will never be meeting people in person under that name,
if you have to to make it look like a convincing person, just pick a random photo of somebody.
So again, we have the don't reuse identifiers issues.
And if you're trying to set up a cover identity, for the love of God, don't use your real photo.
This kind of now loops back to the Silk Road case.
This, appropriately enough, the fake hitman who turned out to be a DEA agent was incredibly corrupt, among other things.
Ended up stealing hundreds of thousands of dollars.
He was in contact with Dread Pirate Roberts under the alias Knob.
That was a legitimate part of the investigation.
He also, however, created two additional handles to communicate with Ross Ulbrich.
French Made and then one called Death From Above.
Neither the French Made or the French Made,
or Death From Above handles were part of the official investigation.
They weren't endorsed by the people running the multi-agency investigation.
He communicated as both French Made and Death From Above using his DEA work laptop.
Not only that, using his DEA work laptop that was set up because it was being used
for the endorsed communication.
His communication is Knob.
It was set up to log everything.
So they have literal full video recordings of all of his communication.
Pretending to be a hitman, trying to extort money out of him, so on and so forth.
As I mentioned, he ended up attempting to abscond with a pretty large amount of money.
He transferred all of that into bank accounts that were in,
let's just say locations,
with not super strict banking secrecy laws.
And he set them up in his own legal name
with his full legitimate contact information,
home address, phone number, you name it.
So again, we kind of keep coming back to things around segregating your activities.
Whether it's don't reuse identifiers or
don't use,
use a device that you know full well is going to be monitored
to conduct sensitive operations.
Additionally, if you're needing to communicate with someone
and you don't want it traced back to you,
consider the use of aliases.
Although, once again, maybe don't use your personal photograph
if you're creating a social media presence for that.
Next case I want to talk about is Shiny Flakes.
This was a pretty large-scale drug trafficking operation based out of Germany.
It was run by a 20-year-old actually out of his childhood bedroom.
When police arrested him, they confiscated about 48,000 euros in cash,
320 kilograms of various drugs,
and reportedly, although this is somewhat debated,
about 325,000 euros in Bitcoin.
That then led to 38 additional raids following.
Following that arrest.
He's since been convicted.
One of the big mistakes that he made was
almost every single shipment of drugs he sent
was sent from the exact same DHL package station.
It was DHL package station 145,
relatively close to his home.
It was in a location that was under ongoing CCTV surveillance.
Once they figured that that's where the packages were coming from,
narrowed down immediately
what sort of area they needed to look in.
The other mistake that was made was encryption,
or actually complete and total lack thereof.
He stored all of the information about customer transactions,
plans for what he was doing,
all that information in an unencrypted format
on an unencrypted hard drive on his laptop.
Again, kind of linking back to Silk Road,
he also had all of his plans for his activities,
as well as an unencrypted list of all of his logins and passwords
for all of the various selling platforms he was using,
all that sort of information.
So, lessons learned.
If you're shipping something sensitive,
if you're, for instance, a whistleblower,
and you need to send a large volume of paper documents to a reporter,
maybe split those up into multiple shipments
and scatter where you're sending them from.
Encrypt your data, and again, for the love of God,
don't document your activities.
Very recent case was AlphaBay,
which kind of became one of the successors of Silk Road.
That pretty much dominated the marketplace,
mostly in the area of selling and purchasing illicit substances
following the shutdown of Silk Road.
Servers for that were located in Quebec.
The alleged administrator was living in Thailand,
and I say alleged because there was very good evidence against him.
He chose to take his own life while awaiting extradition to the U.S.
That was shut down this month, I think July 4th of this year.
At its peak, they estimated that AlphaBay
was making between $600,000 and $800,000 U.S. in revenue.
Again, welcome messages and password requests
reset messages for AlphaBay were sent
using the administrator's Hotmail account,
which was, I think, his name was Alex.
I think the email address was
pimpalexnumericstring at hotmail.com,
which he also used for lots of other personal communication,
that sort of stuff.
Again, lesson learned.
Segregate your activities and your communications method
if you're performing some sort of sensitive activity.
One last case that I wanted to talk about,
and this was a number of years ago.
It's a little different in that it's not actually a dark web case.
This was all performed on ClearNet.
The arrest was made in 2014.
A gentleman from Russia by the name of Roman Seliznev
went under these various handles.
What he would do is, essentially,
when investigators got close,
he would shut down operations,
open up operations immediately on Carter forums
under a new alias.
One of the ways that they initially started
suspecting that it was the same person
is he would start up under a new alias
on a Carter forum
and immediately be elevated to the highest trust levels,
which normally you wouldn't see in that sort of environment
for a new seller.
He was arrested in 2014, as I said.
He was on vacation in the Maldives,
found with a laptop with just under 2 million
stolen credit cards on it.
As I mentioned, the sites that he ran
for selling stolen credit cards were on the ClearNet.
When he registered the domains for those,
he used his personal email address.
Most of the sites were served from a server
from a provider in McLean, Virginia.
He also used that server as basically his workstation.
He did things like make travel plans,
order tickets,
order tickets transmitting his passport number,
those sorts of things.
And, again, his, like we saw before,
laptop had,
had a large volume of plain text passwords
for his sites, that sort of thing,
just stored unencrypted on the laptop.
Again, I'm apparently just going to keep hammering this point
until I'm done.
Don't document your activities,
unless there's a really good reason for it.
And, again, segregate your activities.
If you're using a system for sensitive activities
that you don't want traced back to you,
maybe don't use it to buy
airplane tickets for you and your wife to go on vacation.
The email address that he used for,
for registering websites was also used
for registering a PayPal account for himself
and sending his wife flowers,
which is a wonderful thing to do,
but maybe use a different email address for that.
So,
ooh, that ended a lot quicker than I expected.
In conclusion,
kind of a summary of the,
the common lessons learned we see here
are configure systems securely,
know who to trust,
which obviously in an anonymized environment
is very difficult to do.
I don't have any solutions on that.
If someone does,
I would love to hear some ideas
during the Q&A section.
Always be aware of your surroundings.
Don't document your activities,
encrypt your data,
and, again, segregate your activities.
And, and communication methods.
Questions?
Comments?
Can you?
Good day.
That last,
last case with the
Yeah.
Now, you mentioned he got elevated
to the highest level of trust
whenever he created a new account.
Any idea on how that was done?
The,
the assumption is that he knew people on,
when he would set up a new identity on a card or forum,
he already knew people on those forums.
Again, we're kind of,
no, they did have established trust relationships.
So,
typically how it works on a card or forum is,
is you register with a relatively low privilege account,
and until you can provide,
you know,
X number of stolen credit cards or something like that,
they're worried you might be a Fed,
so they're not going to give you access to everything.
So, anytime,
you know,
I,
my assumption is that he communicated with,
you know,
administrators of the forum,
said,
hey,
this is actually NCOX.
And they said,
okay,
can you prove it?
And he did whatever to prove it.
And then they said,
okay,
we'll bump you up to the top.
Cool.
Thanks.
Yep.
In the case where he was shipping from one DHL station?
Yeah.
So,
would the recommendation just be to,
like,
drive out,
use a different station?
Well,
I,
I think the recommendation is actually not only,
not just drive out to a remote location,
but a number of remote locations.
You know,
using the whistleblower example,
because,
I mean,
you're all free to do what you want to do,
but I'm kind of focusing this on non-criminal enterprises.
Using the whistleblower example,
you know,
you have 10 reams of paper that you need to get to a reporter.
Maybe,
and I'm just picking,
you know,
a number at random,
maybe split that into 10 separate shipments.
Not necessarily drive to,
you know,
10 cities each 100 miles from you,
but,
you know,
a couple of different towns,
maybe one a bit remote,
that sort of thing.
I know for a number of these cases,
correlation of,
like,
the timing of,
like,
when these users were active was one of the,
like,
factors that led to them being taken away and captured.
So,
what would you recommend for,
like,
defending against correlation attacks?
And,
like,
I know that,
like,
using,
like,
encrypted traffic in a public place is often suggested,
but,
like,
that can still be,
like,
can be,
and,
you know,
this kind of touches on the whole parallel construction thing that I referenced earlier.
You know,
the concern,
obviously,
depending on who you're worried about is,
you know,
do you have a nation-state attacker that is going to be able to easily break whatever
transmission encryption you're using?
I think probably the best thing is,
you know,
I go back to the Ross Ulbrich case and him being arrested at the library.
I honestly think him working from the library was probably a pretty good idea.
Him not being aware of his surroundings was one of the things that led to his conviction.
But,
going somewhere where you can essentially hide in plain sight along with a lot of other
traffic,
coffee shop,
library,
that sort of thing.
And,
but again,
I mean,
this kind of comes back to the shipping issue.
You know,
if you always go to the same Starbucks that's two blocks from your house,
yeah,
you're going to be somewhat hidden in the other traffic occurring at the Starbucks,
but it's not that difficult to go,
okay,
so we watch everybody at the Starbucks,
and we think it's this guy.
Now,
what is,
you know,
what is he doing?
Right,
because if you're the only person on tour at that time.
Right.
Okay.
So,
locations are very important.
Yeah.
Yeah,
and mixing up the locations,
as I,
as I referenced.
So,
you mentioned the segregation of activities.
Do you recommend,
you know,
physical separations,
for example?
Always.
Different computers?
Different,
entirely different computers.
Different networks,
and?
If,
if possible,
yes,
but,
I mean,
at the very least,
different,
very different computers,
different logins,
you know,
different,
use different email addresses.
You know,
I,
almost every single one of these cases,
one of the pivotal things was the reuse of a personal email address.
I,
I also heard someone saying,
we,
we should also set up separate networks,
you know,
network access,
or ISPs at home,
even if you are using VPN.
What would you do?
Yeah,
I mean,
there's,
there's certainly some advantage in,
in that,
although you do run the risk of,
so now they see that there's,
you know,
at this location,
there's basically two different traffic flows.
They still know that one of them is whatever sensitive activity you're,
you're performing.
Again,
I,
I come back,
kind of,
to that hide in plain sight,
strategy.
So,
so,
In fact,
Anyone else?
Okay.
Thank you very much.
And I'll be back with some more end of the conversation.
Thank you for listening.
Bye.
Thank you.