1
00:00:00,580 --> 00:00:06,600
Hello DEF CON and welcome to my talk here at the Recon Village for DEF CON 28 Safe Mode.

2
00:00:06,700 --> 00:00:08,360
Super excited to be here.

3
00:00:08,360 --> 00:00:13,020
This is my first time ever as part of the DEF CON speaker community.

4
00:00:13,020 --> 00:00:14,460
I'm super excited.

5
00:00:14,460 --> 00:00:20,100
So I hope you're excited also while we start talking about Ambly, the smart darknet spider.

6
00:00:21,980 --> 00:00:25,880
So who am I that's talking to you about this really cool project?

7
00:00:25,880 --> 00:00:29,200
I am known by a few names online.

8
00:00:29,360 --> 00:00:34,280
This may or may not be all of them, but it certainly is the few that are most common.

9
00:00:34,780 --> 00:00:37,400
Some people will know me as Cytissus Eurydice.

10
00:00:37,400 --> 00:00:39,400
Others may be CyberSci.

11
00:00:39,580 --> 00:00:44,200
Most people in this community are going to know me as Levitanin or Levi.

12
00:00:44,240 --> 00:00:48,480
This is what I am online where I'm actually interacting with people most often.

13
00:00:49,180 --> 00:00:56,860
By day I am a cybersecurity incident response professional and by night I'm a darknet researcher by choice and trade.

14
00:00:56,920 --> 00:01:03,940
I am a self-proclaimed master of spiders also, which may or may not be both on the computer and off of the computer.

15
00:01:04,740 --> 00:01:10,060
Just keep in mind that spiders in real life out in the wild, they're doing a lot of good stuff for us.

16
00:01:10,160 --> 00:01:17,180
But those online, they're equally hiding in plain sight doing a lot of cool things that we need them to do every day.

17
00:01:17,340 --> 00:01:29,360
And I'm here hoping to create tools that are based off of these spiders and build upon them in order to help us in fields like open source intelligence, threat gathering, and other research areas.

18
00:01:29,680 --> 00:01:36,820
But before we get ahead of ourselves, let's talk a little bit about TOR because we're going to be talking TOR a lot today.

19
00:01:37,020 --> 00:01:43,940
Keep in mind though that TOR is not the only darknet access point, so we're going to be mentioning a few others as well.

20
00:01:44,100 --> 00:01:53,740
Before we get too too far ahead of ourselves, because I could talk TOR, darknet, and spiders all day long, let's talk a little bit about the different layers of this presentation.

21
00:01:53,920 --> 00:01:57,680
We're going to be going over open source intelligence, or OSINT.

22
00:01:57,680 --> 00:02:03,380
We're going to talk about cyber threat intelligence, which you'll often see abbreviated as CTI.

23
00:02:03,880 --> 00:02:07,980
We'll talk about the different layers of the internet, which I've already slightly touched on.

24
00:02:08,060 --> 00:02:13,600
We'll also talk about the difficulties of finding cyber threat intelligence on the darknet specifically.

25
00:02:13,780 --> 00:02:21,960
And finally, this is going to lead us into talking about Ambly, a smart darknet spider specifically designed for cyber threat intelligence.

26
00:02:22,160 --> 00:02:24,040
So let's get started.

27
00:02:24,340 --> 00:02:26,640
What's open source intelligence?

28
00:02:26,640 --> 00:02:35,900
Most people in this village specifically probably have some sort of idea about what open source intelligence is, but we're going to break it down a little bit anyway.

29
00:02:36,320 --> 00:02:44,840
Open source intelligence is anything that is accessible from original sources, broken down as accessible original information or data.

30
00:02:45,240 --> 00:02:55,640
You can also explain this further by saying something that is posted, viewed, or interacted with by a user, which is accessible publicly online or offline.

31
00:02:55,640 --> 00:02:58,760
It doesn't have to be specifically on the internet.

32
00:02:59,180 --> 00:03:05,920
This includes, but it's not limited to, the internet at the clear, deep, and dark levels, which we'll get into later.

33
00:03:06,040 --> 00:03:17,840
Mass media, television, radio, books, journals, print of all kinds, video games, specialized journals, conference materials, and think tank studies.

34
00:03:17,840 --> 00:03:18,920
These are out there.

35
00:03:18,920 --> 00:03:20,560
People are talking about them all the time.

36
00:03:20,560 --> 00:03:23,620
We're going to be posting about DEF CON for months after this, right?

37
00:03:24,060 --> 00:03:30,160
Then there's photos and videos, not just on YouTube or Snapchat, but in general that are posted publicly online.

38
00:03:30,560 --> 00:03:42,080
Finally, another area is geospatial information, such as where they actually are located, their GPS, where on a map they may be, or even their IP addresses.

39
00:03:43,860 --> 00:03:46,980
So, what is OSINT good for?

40
00:03:47,180 --> 00:03:49,100
Absolutely everything.

41
00:03:49,100 --> 00:03:56,620
And if you thought about that with a tune in your head, you thought right, because I was talking about that song that's now stuck in your head.

42
00:03:56,620 --> 00:03:58,300
You're welcome for the earworm.

43
00:03:58,880 --> 00:04:16,160
So, OSINT can be utilized in an array of situations, including, but again, never limited to, designing internal training for a company, understanding your threat profile, beating Keith and Joe at an open source CTF that may or may not be hosted by, you know,

44
00:04:16,160 --> 00:04:19,000
Trace Labs today, later on after this presentation.

45
00:04:19,000 --> 00:04:19,820
Maybe, maybe not.

46
00:04:19,820 --> 00:04:20,680
I don't know.

47
00:04:21,180 --> 00:04:30,340
Volunteering, finding out the title of your favorite book from when you were nine, but you forgot existed for about 10 years and you desperately wanted to read again sometime later.

48
00:04:30,640 --> 00:04:38,900
Yeah, all of these are actual areas that I have used OSINT for on the clear net and down into the dark net.

49
00:04:39,540 --> 00:04:45,540
And that book, for anyone who was interested, was called Goddess of Yesterday, which I highly recommend.

50
00:04:45,760 --> 00:04:47,060
It's a good book.

51
00:04:48,800 --> 00:04:56,080
But, now you may be asking, if you're not used to this field just yet, is open source intelligent gathering legal?

52
00:04:57,160 --> 00:04:58,660
Short answer is yes.

53
00:04:58,980 --> 00:05:03,960
Long answer is depends, which is a longer word than yes.

54
00:05:04,160 --> 00:05:10,720
The longest answer is, if you're in a country outside the United States, I don't know.

55
00:05:10,720 --> 00:05:11,520
It's going to depend.

56
00:05:11,520 --> 00:05:13,920
You're going to have to look into your own local laws.

57
00:05:13,920 --> 00:05:18,860
Even in the United States, you're going to have to look into your laws per capita, per state.

58
00:05:19,420 --> 00:05:21,740
This may be different in some areas.

59
00:05:21,740 --> 00:05:30,800
In Europe, I'm expecting that there's probably a lot stricter regulations on what is or is not open source intelligence than there may be here in the United States.

60
00:05:31,040 --> 00:05:48,660
That being said, in the U.S., there's a public law that open source intelligence is produced from publicly available information, collected, analyzed, and disseminated in a timely manner to an appropriate audience, and addresses a specific intelligence requirement.

61
00:05:48,660 --> 00:05:53,560
This is what's publicly posted on the CIA's website regarding open source intelligence.

62
00:05:53,560 --> 00:06:04,000
Now, there are a few other sources that you can look into, including the public law number 108-458, posted in December 2004.

63
00:06:04,080 --> 00:06:10,340
We also have the FOIA B3 exceptions from the 50 U.S.C.

64
00:06:10,800 --> 00:06:15,500
403-1, which is on intelligence sources and methods.

65
00:06:15,540 --> 00:06:23,700
And finally, ATP 2-22.9, which is the Establishment of Open Source Intelligence for the Army.

66
00:06:23,700 --> 00:06:32,180
These are all laws that are out there that you can read up on, and they will help you understand what is and is not legal in the United States.

67
00:06:32,340 --> 00:06:34,680
Again, certain states may vary.

68
00:06:36,060 --> 00:06:39,360
All right, we're going on to the next section now.

69
00:06:39,360 --> 00:06:41,860
We're going to start diving into cyber threat intelligence.

70
00:06:41,860 --> 00:06:49,720
But first, let's take a step back, let's relax a second, and let's think through a scenario that's going to come up again and again to this presentation.

71
00:06:50,380 --> 00:06:52,860
One, let's go.

72
00:06:53,000 --> 00:06:55,900
During a pandemic, you're working from home.

73
00:06:56,140 --> 00:06:58,040
Everyone's working from home, we hope.

74
00:06:58,040 --> 00:06:59,380
Stay safe, right?

75
00:06:59,600 --> 00:07:06,120
Your company, which is global, just announced it's working on processing pandemic data to help drive towards a cure.

76
00:07:06,420 --> 00:07:08,060
Great, that's awesome work.

77
00:07:08,060 --> 00:07:14,080
But does that open you up to some threat that may be out there, some cyber threat actors?

78
00:07:14,800 --> 00:07:28,740
As part of the cybersecurity team, your job and your goal is to identify if there are any actors out there that you need to be aware of, and anyone who may be actively targeting not only your company, but companies in your industry.

79
00:07:29,240 --> 00:07:30,100
So what do you do?

80
00:07:30,100 --> 00:07:31,500
How do you find that out?

81
00:07:31,940 --> 00:07:34,240
Keep this in mind, we're going to come back to this.

82
00:07:35,860 --> 00:07:38,740
All right, what's cyber threat intelligence?

83
00:07:38,740 --> 00:07:42,160
I just kind of threw a scenario at you, but what are we even talking about?

84
00:07:42,300 --> 00:07:51,160
Well, cyber threat intelligence is the collection and analysis of threat actors' motives, targets, and attack behaviors in the realm of cybersecurity.

85
00:07:51,820 --> 00:07:57,340
Often automatic machine learning and techniques implemented for data collection and processing.

86
00:07:57,480 --> 00:08:00,340
This is how we are gathering this information.

87
00:08:00,340 --> 00:08:02,460
However, you can do it manually.

88
00:08:02,460 --> 00:08:14,960
This is helping to shed some light on preemptive actions, or for preemptive actions, and reveals adversarial motives and tactics, techniques, and procedures, or TTPs, which we'll be talking about a lot.

89
00:08:15,900 --> 00:08:23,220
The reason we do this is to help in three areas within a company or possibly even the government.

90
00:08:23,280 --> 00:08:34,520
And what these areas are tactical, which is where you're performing a malware analysis and enrichment, you're collecting threat indicators, and you're trying to help out with defensive cyber teams.

91
00:08:34,720 --> 00:08:40,620
The goal here is to be able to talk to a semi or more technical audience.

92
00:08:40,760 --> 00:08:42,880
Then you have the operational team.

93
00:08:42,880 --> 00:08:49,200
You have a team that's trying to understand adversarial capabilities, infrastructure, TTPs.

94
00:08:49,200 --> 00:08:55,140
You want to leverage this information to conduct targeted prioritization operations.

95
00:08:55,240 --> 00:09:06,080
This team is probably more technical with the details and they want to know about attacks and campaigns from the past, the present, and possibly, if you can anticipate it, the future.

96
00:09:06,840 --> 00:09:09,780
Finally, we're talking to the strategic team.

97
00:09:09,840 --> 00:09:13,960
This is the team that needs to know all of this information at high level.

98
00:09:13,960 --> 00:09:16,340
They want to know about adversarial motives.

99
00:09:16,340 --> 00:09:18,640
They want to know who's targeting your industry.

100
00:09:18,720 --> 00:09:23,220
They want to be able to leverage this information to engage in strategic security.

101
00:09:23,580 --> 00:09:33,440
This is for a non-technical audience in most cases, but it's really important that we make sure that they understand what's going on and why it's important to focus in on this information.

102
00:09:34,540 --> 00:09:37,020
Now, are there companies out there that are focused on this?

103
00:09:37,080 --> 00:09:37,960
Absolutely.

104
00:09:37,960 --> 00:09:44,180
A few of the top ones are Recorded Future, CrowdStrike, FireEye, Mandiant, and SANS.

105
00:09:44,420 --> 00:09:50,860
And this is an area that more and more people are getting involved in, especially right now and in this scenario.

106
00:09:50,860 --> 00:09:56,200
When there's a pandemic or there's a work-from-home situation, you have to be aware of your cybersecurity.

107
00:09:56,680 --> 00:10:01,960
So , the more people who are looking at this, the more we need to know about it and know how we can dig into it.

108
00:10:03,520 --> 00:10:11,140
So, what are some tools that we can use right now if we wanted to get into open-source intelligence and cyber threat intelligence?

109
00:10:11,480 --> 00:10:20,540
Well, we've got Maltego, Spiderfoot, MalShare, the Open Source Framework, which everyone should start at at some point.

110
00:10:20,540 --> 00:10:25,600
It's right there and it will lead you through the tree path to whatever you may need.

111
00:10:25,860 --> 00:10:33,080
We have the Check Usernames or Been Verified, which is a great tool to see if a username is used across platforms.

112
00:10:33,080 --> 00:10:40,940
You can use it to track people's movements if you need to find a target or if you're working on something like a CTF or Trace Labs.

113
00:10:41,400 --> 00:10:51,300
Or you can even use it for yourself to see if the username you want that you want to kind of trademark as your official account or handle is used anywhere that you may need to grab.

114
00:10:52,200 --> 00:10:53,160
Have I Been Pwned?

115
00:10:53,160 --> 00:10:54,640
Excellent resource.

116
00:10:54,720 --> 00:10:59,340
See if you or anyone else has been pwned , if their email addresses have shown up in any leaks.

117
00:10:59,560 --> 00:11:05,660
We've got Census, Shodan, which is one of my favorite sites, built with Google Dorks.

118
00:11:05,660 --> 00:11:11,100
If you know how to Google Dork, you probably are a leg ahead of a lot of people.

119
00:11:11,640 --> 00:11:19,840
Google Dorking, or which is Google Hacking, or just knowing the syntax of how to do a proper search with Google, is an amazing, amazing ability.

120
00:11:19,980 --> 00:11:21,860
And it's magic.

121
00:11:21,860 --> 00:11:23,700
I don't really know any way else to say it.

122
00:11:23,700 --> 00:11:24,660
It's magic.

123
00:11:24,920 --> 00:11:32,840
We have Recon NG, The Harvester, Nmap, Creepy, which is a little creepy, but you know, it knows it's branded well.

124
00:11:32,840 --> 00:11:34,560
There's so many tools out there.

125
00:11:34,780 --> 00:11:36,980
TraceLab has a VM full of them.

126
00:11:37,120 --> 00:11:43,340
OSINT Combine is another course where you can learn stuff about OSINT, and they have a lot of tools they talk about.

127
00:11:43,420 --> 00:11:48,960
Tools are popping up over and over and over again, all over the place, and most of them are open source.

128
00:11:49,020 --> 00:11:57,620
Some of them may have paid features that you can or cannot get if you want, but you can do a lot of this stuff without paying a dime, and they're very useful.

129
00:11:57,620 --> 00:12:01,100
So I highly recommend digging into these tools.

130
00:12:01,480 --> 00:12:04,500
And if we want to talk about these at all, please let me know.

131
00:12:04,500 --> 00:12:07,240
I'd be happy to chat with anyone about any of these.

132
00:12:07,540 --> 00:12:10,200
But for right now, we're going to move on.

133
00:12:10,860 --> 00:12:12,840
We're getting to one of my favorite parts.

134
00:12:12,840 --> 00:12:19,160
I could talk about this way too long, so I'm going to limit myself to three slides.

135
00:12:19,360 --> 00:12:20,280
Four slides, I lied.

136
00:12:20,280 --> 00:12:21,120
Four slides.

137
00:12:21,240 --> 00:12:23,280
We're going to talk about the layers of the internet.

138
00:12:23,640 --> 00:12:25,440
Number one, out of the box.

139
00:12:25,440 --> 00:12:30,080
Please, please, do not believe everything you see in infographs.

140
00:12:30,080 --> 00:12:37,440
Because honestly, I don't know how many times I see this whole igloo... is that the word?

141
00:12:37,440 --> 00:12:38,040
Ice cube?

142
00:12:38,120 --> 00:12:46,060
Iceberg that we want, that we see for the internet, for these three layers, or in some cases up to 12 layers I've seen.

143
00:12:46,500 --> 00:12:54,960
But I don't necessarily agree with this one based on my interaction with the layers of the internet, my understanding of it.

144
00:12:55,160 --> 00:13:04,580
But even more so than that, just like you can kind of do with stats, you can do almost anything with an infograph and be convincing.

145
00:13:04,580 --> 00:13:06,820
You can really get people's attention.

146
00:13:07,340 --> 00:13:09,120
So just keep that in mind.

147
00:13:09,140 --> 00:13:15,980
I'll get off my horse about that for right now and just let you know that we're going to be talking about the clear net, the deep web, and the dark net.

148
00:13:18,060 --> 00:13:19,020
Clear net.

149
00:13:19,660 --> 00:13:22,760
Everybody's favorite layer of the internet, even if you don't know it.

150
00:13:23,480 --> 00:13:26,480
The clear net is... oh, that might not be true.

151
00:13:26,480 --> 00:13:27,280
We'll see.

152
00:13:27,480 --> 00:13:32,340
The clear net is where you can access things like Google and Bing and DuckDuckGo.

153
00:13:32,340 --> 00:13:38,020
And if you look for something on Google and you can find the page, you're on the clear net.

154
00:13:39,540 --> 00:13:56,740
Otherwise, if you can find the front page but you can't find specific data, let's say you joined a forum and you're trying to figure out what's going on with one of the users, you might be able to search that user and see that that forum has a post, but probably not going to be able to see that post.

155
00:13:56,940 --> 00:13:59,960
Not without getting through an access point.

156
00:14:00,020 --> 00:14:02,540
And that brings you into the deep web.

157
00:14:03,020 --> 00:14:06,540
The deep web is anywhere where you're talking to people online.

158
00:14:06,540 --> 00:14:09,440
You're on Discord, you're at DEF CON, you're probably on Discord.

159
00:14:09,540 --> 00:14:13,100
By the way, DEF CON, you've gone to the DEF CON forums?

160
00:14:13,280 --> 00:14:14,340
Deep web.

161
00:14:14,340 --> 00:14:15,820
Like to play video games?

162
00:14:15,820 --> 00:14:17,360
Twitch or Steam?

163
00:14:17,360 --> 00:14:18,320
Deep web.

164
00:14:18,320 --> 00:14:21,640
How about ever log into a university or school portal?

165
00:14:21,640 --> 00:14:22,540
Ever.

166
00:14:22,540 --> 00:14:23,680
Deep web.

167
00:14:24,360 --> 00:14:27,100
You have a bank account anywhere?

168
00:14:27,240 --> 00:14:28,540
Deep web.

169
00:14:28,540 --> 00:14:38,800
All of these areas also have a front-facing website that is accessible via the Google, Bing, DuckDuckGo, whatever your preferred search engine.

170
00:14:39,240 --> 00:14:49,360
But because you have to have an access point, you have to go into this, you're running into this area where it actually is the deep web.

171
00:14:49,360 --> 00:14:57,880
It's not as accessible, it's not as indexable for those spiders and crawlers behind Google and other search engines.

172
00:14:58,100 --> 00:15:00,080
Which is what makes it the deep web.

173
00:15:00,080 --> 00:15:07,260
Which if you go back to that infograph, this should be the largest section of the iceberg.

174
00:15:08,220 --> 00:15:10,500
Which leaves us with the darknet.

175
00:15:10,500 --> 00:15:12,480
My favorite, personally.

176
00:15:12,780 --> 00:15:18,820
There's a few different ways of getting onto the darknet, but the top three access points are those we see here.

177
00:15:18,960 --> 00:15:27,200
We've got the Tor Project, which is the Onion Router Network, or just Tor, like we said, we're going to talk Tor today.

178
00:15:27,200 --> 00:15:31,100
And the focus is going to be on Tor from here on out for right now.

179
00:15:31,440 --> 00:15:33,780
But keep in mind that we also have the Freenet.

180
00:15:33,780 --> 00:15:36,860
We have I2P and the Bulletin Board System.

181
00:15:36,860 --> 00:15:44,560
All of these require specialized access and or knowledge in order to get onto and interact with users.

182
00:15:44,820 --> 00:15:49,800
For Tor, you need to get the Tor Browser to access the Onion Routing System.

183
00:15:49,840 --> 00:15:52,880
For Freenet, you need another specialized software.

184
00:15:53,520 --> 00:16:02,180
You can also get specialized software for I2P, which will run your traffic through different tunnels via peer systems.

185
00:16:02,180 --> 00:16:05,460
And BBSs require telnet client software.

186
00:16:05,460 --> 00:16:14,820
All of these require extra software and extra knowledge to even find these websites in most cases, or chat rooms, or what have you.

187
00:16:14,900 --> 00:16:17,740
And that's what makes this the Darknet.

188
00:16:17,740 --> 00:16:24,560
It's not easy to explore, to travel.

189
00:16:24,880 --> 00:16:29,960
If you're trying to get from one site to the other, you need to know someone or something to get there.

190
00:16:30,800 --> 00:16:33,160
So, what does that mean for us?

191
00:16:33,160 --> 00:16:35,900
What is cyber threat intelligence on the Darknet?

192
00:16:36,220 --> 00:16:38,460
Like I mentioned, we're going to focus on Tor.

193
00:16:38,460 --> 00:16:40,980
But first, let's go back and look at this.

194
00:16:41,020 --> 00:16:44,560
How long does it take to find a website for us to use?

195
00:16:44,920 --> 00:16:53,120
If you're on the ClearNet, a website that's newly posted takes about four weeks if you get the SOEs okay.

196
00:16:53,120 --> 00:16:57,540
If you get the SOEs set up really well for that website, it can take about four days.

197
00:16:57,540 --> 00:17:04,080
And then you'll start seeing it populated on Google or other search engines, depending on how it's set up.

198
00:17:04,280 --> 00:17:15,900
So, if I actually go and I log in and I try to find a website on Google, and it's not a hurricane, like it may or may not be outside, then what are we dealing with?

199
00:17:15,900 --> 00:17:17,800
A few seconds, maybe a minute.

200
00:17:17,800 --> 00:17:20,600
It's kind of based on your internet speed at that point, right?

201
00:17:20,680 --> 00:17:22,960
All right, what about the DeepWeb?

202
00:17:22,960 --> 00:17:28,060
Well, let's say the DeepWeb website has a ClearNet facing access point, right?

203
00:17:28,700 --> 00:17:33,140
Maybe you're trying to find a certain forum post.

204
00:17:33,140 --> 00:17:35,460
So, the forum you can find on Google.

205
00:17:35,460 --> 00:17:37,980
So, there's the few seconds to a minute.

206
00:17:38,280 --> 00:17:41,560
Then you have to either make an account or log in.

207
00:17:41,560 --> 00:17:42,720
So, that's the next time.

208
00:17:42,720 --> 00:17:44,240
Let's say that takes two minutes.

209
00:17:44,240 --> 00:17:45,740
So, that's three minutes now.

210
00:17:46,000 --> 00:17:46,940
Then you have to log in.

211
00:17:46,940 --> 00:17:49,980
So, once you're logged in, you then have to find the post you want.

212
00:17:49,980 --> 00:17:55,760
Now, a lot of these sites have internal indexing, which means you can search stuff internally.

213
00:17:56,080 --> 00:17:58,000
And that may take another minute or so.

214
00:17:58,000 --> 00:18:00,420
So, that's four minutes, five minutes.

215
00:18:00,680 --> 00:18:03,440
That's not terrible, so long as you know what you're looking for.

216
00:18:03,440 --> 00:18:06,220
If you don't know what you're looking for, it may take longer.

217
00:18:06,520 --> 00:18:14,880
If you're specifically trying to find information on a user or a subject, you may have to do a lot of digging before you come across what you really want.

218
00:18:15,000 --> 00:18:19,700
And in those cases, it could be extended for a very long amount of time.

219
00:18:20,140 --> 00:18:21,140
That's fine.

220
00:18:21,300 --> 00:18:22,720
What about the DarkNet?

221
00:18:22,900 --> 00:18:24,860
How are you going to find a DarkNet website?

222
00:18:25,540 --> 00:18:27,280
Some of them are posted on Reddit.

223
00:18:27,740 --> 00:18:32,580
If you look up DarkNet websites, you're usually going to get Tor, and they're usually on Google.

224
00:18:34,140 --> 00:18:38,380
Pastebin, GitHub, some of them are on GitHub, yeah.

225
00:18:38,980 --> 00:18:42,620
Well, even if you find it, what do you do with that?

226
00:18:43,200 --> 00:18:45,300
It can take some time to find websites.

227
00:18:45,300 --> 00:18:46,460
Are they really what you want?

228
00:18:46,460 --> 00:18:47,600
What are you looking for?

229
00:18:48,140 --> 00:18:51,640
And what about how do you access them?

230
00:18:51,840 --> 00:18:55,280
And how long does it take to access them as compared to the ClearNet?

231
00:18:55,780 --> 00:19:01,880
Well, let's take a look at our scenario from earlier, and we can try to figure this out.

232
00:19:02,800 --> 00:19:05,220
So, some extra details.

233
00:19:05,480 --> 00:19:11,200
You've uncovered information about a group targeting your company, or in companies like yours.

234
00:19:11,200 --> 00:19:16,280
The information you have indicates that this group is active on Tor, but not where they're active.

235
00:19:16,660 --> 00:19:19,340
How do we go about finding this group's activity?

236
00:19:19,740 --> 00:19:21,260
Let's walk through it.

237
00:19:21,460 --> 00:19:23,040
Manual investigation.

238
00:19:23,040 --> 00:19:24,320
Step one.

239
00:19:24,320 --> 00:19:28,420
Let's figure out what's going on by using Google as an ally.

240
00:19:28,420 --> 00:19:31,040
And I'm going to start with Google, because most of us do.

241
00:19:31,640 --> 00:19:36,300
Personally, it's not my preferred search engine, but it is one of the better ones.

242
00:19:36,600 --> 00:19:37,240
Oops.

243
00:19:38,580 --> 00:19:42,680
So, what do we have?

244
00:19:42,680 --> 00:19:45,360
I just searched here for Tor websites.

245
00:19:45,760 --> 00:19:47,040
I got a few of them.

246
00:19:47,040 --> 00:19:48,420
Here's a quick snippet of them.

247
00:19:48,420 --> 00:19:51,020
We've got nine best onion sites to visit.

248
00:19:51,020 --> 00:19:51,800
Awesome.

249
00:19:52,080 --> 00:19:54,580
List of some sites from Wikipedia.

250
00:19:54,580 --> 00:19:55,140
Cool.

251
00:19:55,140 --> 00:19:56,340
Very nice.

252
00:19:56,540 --> 00:20:00,400
We have best onion sites and how to access them safely.

253
00:20:00,460 --> 00:20:01,480
Awesome.

254
00:20:02,060 --> 00:20:10,740
How to find active .onions darknet sites and why... And finally, we have the best darknet websites you won't find on Google.

255
00:20:11,760 --> 00:20:12,740
Hmm.

256
00:20:13,280 --> 00:20:20,380
I don't know about you, but that one seems a little weird, considering we found the link on Google.

257
00:20:20,860 --> 00:20:22,380
Personally, I think it's funny.

258
00:20:22,380 --> 00:20:24,040
So, I'm going to pick that one.

259
00:20:24,200 --> 00:20:26,240
So, that leads us to step two.

260
00:20:26,740 --> 00:20:34,920
Pick a rabbit hole to dive down, which is what we're going to do with the best darknet websites you won't find on Google, as found on Google.

261
00:20:35,620 --> 00:20:41,100
From there, we're going to go into what does this article or this area have.

262
00:20:41,460 --> 00:20:45,020
So, the first one they listed was the hidden wiki.

263
00:20:46,140 --> 00:20:47,180
Surprise, surprise.

264
00:20:47,180 --> 00:20:49,500
There are a lot of hidden wikis.

265
00:20:49,500 --> 00:20:50,600
Some of them are mirrors.

266
00:20:50,600 --> 00:20:51,720
Some of them are just lists.

267
00:20:51,720 --> 00:20:54,260
Some of them are kept up to date, and some aren't.

268
00:20:54,260 --> 00:20:59,460
This one is the general normal access point, but there are others, and there are some that are better.

269
00:21:00,280 --> 00:21:05,000
They also have here hidden answers, which is another good one, and generally anonymous.

270
00:21:06,520 --> 00:21:08,880
But one big thing I want to note here.

271
00:21:09,620 --> 00:21:16,800
If you look at these two, and I've got my mouse over here just to show you these two URLs.

272
00:21:16,820 --> 00:21:20,920
First off, we're on tour, so all the URLs are going to end with dot onion.

273
00:21:21,460 --> 00:21:25,560
But you'll also see that this one is very short.

274
00:21:25,560 --> 00:21:26,820
It's a bunch of gobbledygook.

275
00:21:26,820 --> 00:21:32,140
You're not going to be able to understand what it is in most cases, but it's short.

276
00:21:32,140 --> 00:21:35,800
And that's fine and dandy, but that's a v2 URL.

277
00:21:36,220 --> 00:21:45,100
What's going on right now is that we're switching over to v3 URLs, which are these longer strings, usually around, I think, 52 characters.

278
00:21:45,480 --> 00:21:53,380
Sometimes you'll be able to see a tag like this, where it's got an actual human readable English readable word in the beginning.

279
00:21:53,720 --> 00:21:58,220
But generally speaking, we're just looking for these longer URLs.

280
00:21:58,220 --> 00:22:01,240
Those are the ones that are going to be sticking around for a while.

281
00:22:01,600 --> 00:22:05,300
This shorter one is going away in 2021.

282
00:22:05,400 --> 00:22:09,340
So yay, we found this, but what does that mean?

283
00:22:09,980 --> 00:22:11,600
What are we going to do about that?

284
00:22:11,600 --> 00:22:15,340
And how does that, how do we get an updated one if this is a good starting point?

285
00:22:15,340 --> 00:22:17,060
We're going to talk about that too.

286
00:22:18,360 --> 00:22:20,500
So, step four.

287
00:22:20,580 --> 00:22:23,500
We found the URLs, but how do we actually access them?

288
00:22:23,580 --> 00:22:32,420
If you go and plug and play those dot onion links into your Google Chrome or Firefox or any normal standard browser, you're not going to be able to reach it.

289
00:22:32,720 --> 00:22:36,860
You need to be part of the Tor network or the onion routing system.

290
00:22:37,360 --> 00:22:44,300
In order to do that, you need either to set up the proxy or you download the Tor browser.

291
00:22:44,420 --> 00:22:45,600
So this is Tor.

292
00:22:45,700 --> 00:22:48,620
This is the base browser that you have right now.

293
00:22:48,620 --> 00:22:51,440
It's updated to 9.5.3.

294
00:22:51,540 --> 00:22:57,800
It's based off of Mozilla Firefox and it allows the user to connect to the Tor network and onion router system.

295
00:22:57,960 --> 00:23:00,640
Now, you can change a few settings in here.

296
00:23:00,640 --> 00:23:05,680
Generally speaking, it's not recommended to have JavaScript on.

297
00:23:05,680 --> 00:23:11,700
For example, you want to try to be in the safest mode you can be when going through different sites.

298
00:23:12,180 --> 00:23:15,640
And you start off with the search engine DuckDuckGo.

299
00:23:15,640 --> 00:23:18,220
Now, DuckDuckGo is a clear net search engine.

300
00:23:18,440 --> 00:23:24,740
It doesn't necessarily help you with Tor websites, though it can give you some results similar to if you look up on Google.

301
00:23:25,560 --> 00:23:32,740
But now we can quickly and easily pivot into using those URLs that we found earlier.

302
00:23:32,740 --> 00:23:34,380
So let's go to the hidden wiki.

303
00:23:34,900 --> 00:23:39,100
Here's the first thing that popped up when I went on the hidden wiki about two days ago.

304
00:23:39,300 --> 00:23:44,620
Top of the page, hidden wiki, new URL as of 2019-2020.

305
00:23:44,880 --> 00:23:47,480
Add this to the bookmark and spread it.

306
00:23:47,480 --> 00:23:50,100
This is the current URL for the wiki.

307
00:23:50,360 --> 00:23:52,120
Now, can you get there from the small one?

308
00:23:52,120 --> 00:23:54,520
Yes, which you can see right here at the top.

309
00:23:54,520 --> 00:23:58,280
I was accessing the small v2 URL.

310
00:23:58,580 --> 00:24:04,760
This is the v3 URL and it's going to help us stay connected to the wiki as long as it's viable and up.

311
00:24:04,780 --> 00:24:15,760
So when you do come across these v3 URLs, you want to grab them or you may lose access to the site and beyond normal losing of access on darknet.

312
00:24:16,740 --> 00:24:18,920
So we're on the wiki.

313
00:24:18,920 --> 00:24:20,600
We're at step five.

314
00:24:20,600 --> 00:24:22,380
Visit the starter point.

315
00:24:22,380 --> 00:24:25,660
What are we doing on this website?

316
00:24:25,680 --> 00:24:33,960
Well, first we're trying to find information about the threat actors for our cyber threat intelligence scenario.

317
00:24:33,960 --> 00:24:37,660
So what areas of the wiki can help us?

318
00:24:37,660 --> 00:24:43,940
Well, we've got social networks, which, slight side note, this includes Facebook.

319
00:24:43,980 --> 00:24:52,560
And for the life of me, I cannot understand how a dot onion site for Facebook is not going against their own terms and policies.

320
00:24:52,560 --> 00:24:58,280
But also, if anybody could explain that to me, please, by all means, I would love to hear it.

321
00:24:58,280 --> 00:25:09,920
But I also personally wouldn't recommend signing into any of your real life social media accounts, especially at the same time as doing other things on the darknet.

322
00:25:09,920 --> 00:25:14,400
The whole point of this is to stay private, to try to stay anonymous.

323
00:25:14,740 --> 00:25:24,460
And if you're logging into your personal accounts and random accounts, or your personal accounts and your darknet accounts, it's possible that you could link those two.

324
00:25:24,460 --> 00:25:26,080
We want to try to avoid that.

325
00:25:26,080 --> 00:25:35,560
Similarly, if you're doing OSINT online and you're not using the darknet, but you're using maybe a virtual machine, you don't want to log into your own stuff in that instance.

326
00:25:35,940 --> 00:25:37,960
You could run into a conflict .

327
00:25:38,640 --> 00:25:41,240
Anyway, we have social media.

328
00:25:41,240 --> 00:25:47,120
We've got Connect, we've got Galaxy 3, which is rather new, we have Torbook, and we have Facebook somehow.

329
00:25:47,300 --> 00:25:53,400
Facebook I wouldn't necessarily consider a darknet social media, but it's there.

330
00:25:53,600 --> 00:25:57,080
Then we've got Hack, Freak, Anarchy, Warriors, Viruses, and Crack.

331
00:25:57,080 --> 00:25:59,380
We've got all of the stuff you need.

332
00:25:59,380 --> 00:26:02,600
Just try to rent a hacker, why don't you?

333
00:26:02,600 --> 00:26:07,740
Definitely isn't a scam, definitely is not going to backfire on you at all, promise.

334
00:26:10,000 --> 00:26:23,260
Do we think the threat actors that we are looking at for the industry, for our cyber threat intelligence scenario, are really taking any action here on these websites?

335
00:26:23,260 --> 00:26:30,680
Are they maybe selling their abilities or any code that they've made online?

336
00:26:30,820 --> 00:26:31,980
Maybe.

337
00:26:32,340 --> 00:26:38,520
Personally, I wouldn't think they'd be on these sites, but it's possible.

338
00:26:39,900 --> 00:26:44,800
You can definitely look into them, all depends on what you're trying to get into.

339
00:26:44,980 --> 00:26:51,360
Now, there's also another area, which is the introduction points.

340
00:26:51,660 --> 00:26:54,120
Earlier, I mentioned the search engines.

341
00:26:54,120 --> 00:27:02,460
Those are Google, DuckDuckGo, Bing, clear net search engines, awesome resources for clear net, for open source, all that good stuff.

342
00:27:02,780 --> 00:27:11,100
These are considered, in most cases, to be darknet search engines.

343
00:27:11,100 --> 00:27:15,660
Now, DuckDuckGo, we talked about, searches the clear net, but it's kind of working with Tor.

344
00:27:15,700 --> 00:27:20,620
We've got AMIA, which is searching Tor websites, but it's on the clear net.

345
00:27:20,700 --> 00:27:23,760
Then we've got stuff like Torch or NotEvil.

346
00:27:24,420 --> 00:27:32,560
If we wanted to go into these search engines and try to find more information on cyber threat intelligence, how would we start?

347
00:27:32,900 --> 00:27:34,980
Well, that's going to bring us to step six.

348
00:27:34,980 --> 00:27:36,480
Let's begin the hunt.

349
00:27:37,320 --> 00:27:38,780
This is NotEvil.

350
00:27:40,620 --> 00:27:48,880
FYI, this will probably get posted after, but if you try to go NotEvil, it may be down for an upgrade on August 7th.

351
00:27:49,080 --> 00:27:52,660
But otherwise, you can pretty much use this like Google.

352
00:27:52,660 --> 00:27:55,020
Put in some keywords and start searching.

353
00:27:55,280 --> 00:28:07,240
Now, I can tell you, but I will not show you, that when searching NotEvil for anything related to the pandemic, you get, surprise, surprise, a lot of pornography.

354
00:28:07,680 --> 00:28:10,600
Most searches will get you a lot of pornography.

355
00:28:11,780 --> 00:28:15,760
If we're being serious, that's just kind of how it is.

356
00:28:15,760 --> 00:28:30,100
You can tag videos and images and everything with anything, and it kind of works sometimes as a way of hiding actual posts and data, and sometimes it's just because people like to share it to each of their own.

357
00:28:30,100 --> 00:28:39,760
But as Pornhub stats can have shown in the past, when stuff is going on in day-to-day, you tend to see it turned into pornography and get really popular.

358
00:28:39,760 --> 00:28:44,840
So that's fine and dandy, but we're not going to show that here.

359
00:28:44,840 --> 00:28:47,880
Instead, what we're going to show is when I looked for hacker.

360
00:28:47,920 --> 00:28:49,020
Does stuff show up?

361
00:28:49,020 --> 00:28:49,940
Yes.

362
00:28:50,480 --> 00:28:51,780
We have some sites.

363
00:28:51,780 --> 00:28:53,520
We see some messages here.

364
00:28:54,380 --> 00:28:57,220
We see some posts down here.

365
00:28:57,220 --> 00:29:05,000
We have Vincent Canfield, a hacker on Keybase, who specifically says, do not chat messages on Keybase.

366
00:29:05,340 --> 00:29:06,280
Okay.

367
00:29:06,800 --> 00:29:08,720
We have The Social Hacker.

368
00:29:08,720 --> 00:29:11,580
We've got a warning on that site, check before purchasing.

369
00:29:11,580 --> 00:29:12,480
What are they selling?

370
00:29:12,480 --> 00:29:13,460
What's going on here?

371
00:29:13,460 --> 00:29:15,560
That's something we might want to look at.

372
00:29:16,740 --> 00:29:19,440
Now, what do we do if we search for cyber terrorists?

373
00:29:19,440 --> 00:29:23,180
Which is the next little block we have over here.

374
00:29:23,580 --> 00:29:24,820
Well, let's see.

375
00:29:25,060 --> 00:29:27,440
We've got Daniel's Onion List.

376
00:29:27,460 --> 00:29:28,280
That's cool.

377
00:29:28,280 --> 00:29:31,940
We've got some other languages that are popping up here.

378
00:29:31,940 --> 00:29:33,120
That's nice.

379
00:29:33,360 --> 00:29:35,350
Look, we have a mention of the CIA.

380
00:29:35,880 --> 00:29:36,920
Okay.

381
00:29:37,060 --> 00:29:38,760
We've got Rat Wires.

382
00:29:38,760 --> 00:29:39,160
All right.

383
00:29:39,160 --> 00:29:40,320
Interesting.

384
00:29:40,320 --> 00:29:49,160
So we get a few hits, but is a cyber terrorist group going to label themselves a cyber terrorist group?

385
00:29:49,520 --> 00:29:50,600
Maybe.

386
00:29:50,800 --> 00:29:53,220
Cyber terrorism is kind of a perspectives game.

387
00:29:53,220 --> 00:29:55,920
Most things are a perspective game, really, right?

388
00:29:55,980 --> 00:30:04,020
If I'm looking for information about someone that I think has done something bad, I think they've done something bad.

389
00:30:04,020 --> 00:30:06,420
They might think they're doing something good.

390
00:30:06,480 --> 00:30:07,800
Are they a hacktivist?

391
00:30:07,800 --> 00:30:09,720
How do we decide that?

392
00:30:09,800 --> 00:30:14,640
That's another thing we'll need to use some cyber threat intelligence skills and techniques to deal with.

393
00:30:15,260 --> 00:30:19,180
But let's get back to the next step.

394
00:30:19,180 --> 00:30:20,060
Part 7.

395
00:30:20,060 --> 00:30:21,440
Part of the talk.

396
00:30:21,680 --> 00:30:26,440
Websites on TOR can and are volatile.

397
00:30:26,820 --> 00:30:29,060
TORM may be up one day and down the next.

398
00:30:29,060 --> 00:30:35,680
Now, TORM is a great website for getting into the cyber security community on TORM.

399
00:30:35,680 --> 00:30:37,680
It's a very interesting forum.

400
00:30:37,680 --> 00:30:45,940
They got that traditional sweet, sweet terminal green on black going on, so it may or may not hurt your eyes.

401
00:30:46,720 --> 00:30:54,040
I would love to show you a picture of it, but when I went to get all the pictures, as per the slide mentioning, TORM was down.

402
00:30:54,160 --> 00:30:56,360
And that doesn't mean TORM is gone forever.

403
00:30:56,360 --> 00:31:01,800
Most likely it means it was down for maintenance or maybe they had a weather issue or some other issue wherever it's being hosted.

404
00:31:02,300 --> 00:31:03,540
It is what it is.

405
00:31:03,540 --> 00:31:05,520
But this can make communication difficult.

406
00:31:05,520 --> 00:31:10,880
And if you aren't embedded, you can easily lose track of things, if not be left behind completely.

407
00:31:11,340 --> 00:31:19,960
So there is a point at which we may want to talk about how do you safely integrate into the communities to get more information.

408
00:31:20,360 --> 00:31:23,120
You're already having a hard time searching the darknet.

409
00:31:23,660 --> 00:31:28,220
Is there a point at which you want to embed yourself in communities to start learning more?

410
00:31:28,220 --> 00:31:29,440
Is it safe to do?

411
00:31:29,440 --> 00:31:30,800
How do you do it safely?

412
00:31:30,800 --> 00:31:37,060
These are all really great questions that we don't really have time to get into today, but keep an eye out.

413
00:31:37,060 --> 00:31:41,640
This is definitely something I want to talk about with everyone more going forward.

414
00:31:42,980 --> 00:31:45,160
So summary slide, right?

415
00:31:45,160 --> 00:31:47,100
Cyberthreat intelligence on the darknet.

416
00:31:47,100 --> 00:31:52,840
All right, so on the clear net, in parts of the deep web, we can go through profiles, web pages, pretty quickly.

417
00:31:53,340 --> 00:31:54,000
What do we say?

418
00:31:54,000 --> 00:31:57,820
Like a minute to find a page on Google, give or take.

419
00:31:57,900 --> 00:32:02,240
About five, up to five minutes for the deep web if you're just doing a shallow dive.

420
00:32:02,240 --> 00:32:03,420
Not too bad.

421
00:32:03,800 --> 00:32:05,520
Darknet's different though, huh?

422
00:32:05,660 --> 00:32:14,040
Although there are some tools in place, such as darknet search engines, like not evil, we don't have the same boosters here as we do everywhere else.

423
00:32:14,040 --> 00:32:15,360
It's not quite as easy.

424
00:32:15,360 --> 00:32:17,160
It's not quite as indexed.

425
00:32:17,520 --> 00:32:21,160
And this is something we take advantage of in our day-to-day lives.

426
00:32:21,160 --> 00:32:29,540
A lot of us may even forget a time or not have been alive during a time before Google, before these things were indexed and easy to find.

427
00:32:30,960 --> 00:32:34,560
So if we're trying to do darknet research, there's a huge bottleneck here.

428
00:32:34,560 --> 00:32:38,320
If you're doing manual investigations, that's a slow process.

429
00:32:38,320 --> 00:32:42,640
And getting to websites and finding websites, it's the game of the darknet.

430
00:32:42,640 --> 00:32:44,060
You got to trade stuff, right?

431
00:32:44,060 --> 00:32:47,260
You've got to interact to really dig in and find these.

432
00:32:47,780 --> 00:32:52,600
It's a huge hurdle when trying to hunt for cyber threat intelligence on the darknet.

433
00:32:53,620 --> 00:32:55,580
And this is where Ambly comes in.

434
00:32:55,580 --> 00:33:01,780
And I'm really excited that we've gotten to this part because this is a project that I have been hoping to work on for a long time.

435
00:33:01,860 --> 00:33:06,700
And when I finally got the chance to do it with the SAIL lab, I think I just about lost my mind.

436
00:33:06,700 --> 00:33:07,860
I was so excited.

437
00:33:08,020 --> 00:33:12,340
So taking a step back, let's talk a little bit about Ambly.

438
00:33:12,440 --> 00:33:18,160
Ambly is a smart spider focused on the darknet to gather and identify cyber threat intelligence.

439
00:33:18,460 --> 00:33:33,940
Ambly is going to be using some machine learning and artificial intelligence techniques to actually identify relevant websites and to make sure that they're valid and they're pertaining to cyber threat intelligence.

440
00:33:34,380 --> 00:33:41,600
We're going to be accessing websites hopefully down the line behind capture blocks or user accounts and anti-robot protocols.

441
00:33:41,880 --> 00:33:49,380
The goal here is to use deep learning and natural language processing to identify and rank new URLs based on the potential for CTI.

442
00:33:49,400 --> 00:34:07,420
We're going to hopefully have a report that gives us out webpages and identifies further investigation recommendations so that an analyst, government, researchers, whatever, what have you, can actually use this to get rid of or to reduce that bottleneck that we talked about a moment ago.

443
00:34:08,180 --> 00:34:12,460
Reducing the bottleneck is the key behind Ambly's mission here.

444
00:34:12,460 --> 00:34:17,320
We want to make this easier and better and not just for cyber threat intelligence.

445
00:34:17,320 --> 00:34:23,440
There's other tools that may or may not be in the works here, but this is the goal of Ambly.

446
00:34:23,440 --> 00:34:29,060
Ambly is for cyber threat intelligence to identify and track this information on the dark net.

447
00:34:29,400 --> 00:34:33,220
Right now, specifically Tor, but that does not mean it's limited.

448
00:34:33,680 --> 00:34:35,180
But let's take a step back.

449
00:34:35,560 --> 00:34:38,080
That's what the Ambly we want.

450
00:34:38,180 --> 00:34:41,120
We want to be able to do a lot of stuff with Ambly.

451
00:34:41,120 --> 00:34:43,080
But where are we right now?

452
00:34:43,260 --> 00:34:47,920
Well, Ambly is in a prototype stage and we'll get to that in a minute.

453
00:34:48,420 --> 00:34:51,800
But right now, Ambly is going out and gathering data.

454
00:34:51,800 --> 00:35:01,080
Ambly is actually creating a database on viable dark net websites, specifically on Tor, so they're all .onion sites.

455
00:35:01,260 --> 00:35:03,480
So how does Ambly do that?

456
00:35:03,660 --> 00:35:06,160
Imagine, if you will, another scenario.

457
00:35:06,480 --> 00:35:08,400
You dropped in a random city.

458
00:35:08,640 --> 00:35:10,400
You don't know where you are.

459
00:35:10,760 --> 00:35:14,860
You don't know what country, state, city, anything.

460
00:35:14,860 --> 00:35:20,500
You don't have a phone, you don't have a computer, and you don't know the language of the people around you.

461
00:35:21,080 --> 00:35:22,580
What do you do?

462
00:35:22,820 --> 00:35:24,520
How do you find safety?

463
00:35:24,520 --> 00:35:25,940
How do you get home?

464
00:35:26,440 --> 00:35:41,080
Well, personally, I would start walking, searching for any sign of a police station, of some trusted resource that I can go to for help.

465
00:35:42,160 --> 00:35:48,580
Now, maybe there's this universal sign that we'll see, or some sign that'll help me indicate that path.

466
00:35:48,580 --> 00:35:50,820
Maybe there's not, and maybe I just have to walk.

467
00:35:50,940 --> 00:35:56,740
And I go down a path, and I keep following that in any way it leads, and if it doesn't work, I go back.

468
00:35:56,880 --> 00:36:02,760
And we keep doing that almost recursive spin around until we find an area that we need to be in.

469
00:36:03,240 --> 00:36:08,580
This is kind of what Ambly is doing, to create that initial data set on Darknet websites.

470
00:36:08,580 --> 00:36:10,620
It's just going.

471
00:36:11,140 --> 00:36:12,300
It's free to move.

472
00:36:12,300 --> 00:36:14,140
It's collecting websites.

473
00:36:14,140 --> 00:36:26,960
It's identifying and collecting a whole database on Darknet websites, when they were viable, verifying that we could actually go to the site, not only that the link was out there.

474
00:36:27,500 --> 00:36:33,660
And from there, we're going to use that data to start doing really cool things with machine learning.

475
00:36:34,520 --> 00:36:37,240
But let's talk about Ambly of today.

476
00:36:37,740 --> 00:36:41,520
All right, so we're in a prototype stage, like I mentioned.

477
00:36:41,620 --> 00:36:45,940
We're beginning to be on active and frequently updated Tor wikis.

478
00:36:45,940 --> 00:36:48,500
Not the one I showed you earlier, but a different one.

479
00:36:48,500 --> 00:36:52,040
One that's really up to date and monitored frequently.

480
00:36:52,300 --> 00:36:54,480
We've got two access points that Ambly has.

481
00:36:54,480 --> 00:36:56,680
One, instantly on the Darknet.

482
00:36:56,680 --> 00:37:01,420
Anything that goes through any search, any website, we're going to the Darknet connection point.

483
00:37:01,420 --> 00:37:07,560
This makes sure that we are always connected to one of the nodes and it keeps us in the network.

484
00:37:07,560 --> 00:37:17,200
So even if, by chance, and early on we ran into this, where maybe we found a Clearnet website, going to that site still used the Darknet IP addresses.

485
00:37:17,440 --> 00:37:25,340
We've now since removed the ability to go to Clearnet sites, as the focus here is on Darknet only or .onion sites.

486
00:37:26,500 --> 00:37:34,640
The second connection is to the Clearnet for the actual database storage, which currently is a MongoDB Atlas format.

487
00:37:35,140 --> 00:37:36,700
We'll talk about that in a minute.

488
00:37:37,180 --> 00:37:41,780
Now the crawls gather HTML, which includes URLs and text.

489
00:37:41,780 --> 00:37:44,300
The URLs are parsed out and stored separately.

490
00:37:44,540 --> 00:37:47,220
The text is parsed out and stored separately as well.

491
00:37:47,220 --> 00:37:51,700
And then the HTML is stored as is, but in a binary format.

492
00:37:52,080 --> 00:37:57,240
At no point, and this is very important, at no point are images specifically pulled.

493
00:37:57,940 --> 00:38:12,600
Illicit materials are avoided and are not meant to be interacted with, including and especially CSAM, which is a term that's used frequently for people who are working on anti-human trafficking and child pornography rings.

494
00:38:12,600 --> 00:38:21,100
This is specifically about sensitive materials regarding children that we do not want out there.

495
00:38:21,780 --> 00:38:24,260
We are not collecting that with Ambly.

496
00:38:24,320 --> 00:38:29,040
You may see on the HTML that an image was there, but the image itself is not pulled.

497
00:38:29,620 --> 00:38:33,000
Now the database, like I mentioned, is a MongoDB Atlas.

498
00:38:33,240 --> 00:38:38,420
It is file sizes identified at the pull and marked so that we don't go over the limit.

499
00:38:38,420 --> 00:38:39,460
We did go over that.

500
00:38:39,460 --> 00:38:41,320
We'll see that in the next slide.

501
00:38:41,460 --> 00:38:46,040
The format of the data is important for avoiding those document limits.

502
00:38:46,040 --> 00:38:47,820
Again, we'll talk about that.

503
00:38:48,100 --> 00:38:51,440
And Ambly runs in a digital ocean droplet.

504
00:38:52,260 --> 00:38:55,720
All right, Ambly's first 12 hours.

505
00:38:56,140 --> 00:39:04,000
So, first 12 hours that we ran Ambly Prototype Stage 1, we had MongoDB Atlas and local.

506
00:39:04,000 --> 00:39:08,020
We found they both have a limited size of 16 megabytes per document.

507
00:39:08,200 --> 00:39:11,680
And this is what broke our cycle.

508
00:39:11,680 --> 00:39:22,840
The reason for that is originally the text was in an unbounded array format, which just extended too large for certain websites to actually be collected.

509
00:39:22,960 --> 00:39:26,120
So, what you'll see here is the first 12 hours of Ambly.

510
00:39:26,220 --> 00:39:32,180
We collected, in 12 hours, 86,546 websites.

511
00:39:32,540 --> 00:39:40,360
We got 1,819, rather, HTML pulled from those sites.

512
00:39:40,360 --> 00:39:43,740
And the text we got to 1,818.

513
00:39:43,740 --> 00:39:49,080
On the 19th is when we got the limit size was hit.

514
00:39:49,140 --> 00:39:50,900
That has since been rectified.

515
00:39:51,020 --> 00:39:56,200
But just imagine this, the first 12 hours, we got so many URLs.

516
00:39:56,680 --> 00:40:02,260
People talk about all the time that the dark net is small.

517
00:40:02,460 --> 00:40:08,680
And it is compared to the clear net, compared to the deep net, sure, but it is not tiny.

518
00:40:08,800 --> 00:40:11,640
There are so many URLs and websites out there.

519
00:40:11,640 --> 00:40:21,860
And this is specifically specifically designed to make sure that no two websites are pulled with the same URL.

520
00:40:21,860 --> 00:40:28,140
So, even if two sites link to the same website or webpage, only one of them, the first one, is stored.

521
00:40:28,140 --> 00:40:29,620
The other is dropped.

522
00:40:30,080 --> 00:40:38,060
That is 86,546 unique URLs pulled in the first 12 hours.

523
00:40:38,680 --> 00:40:42,320
I don't know about you, but I was ecstatic to see that.

524
00:40:43,020 --> 00:40:44,840
So, let's get into the good stuff.

525
00:40:44,840 --> 00:40:47,440
Let's talk about some initial points of interest.

526
00:40:47,740 --> 00:40:52,800
We've got a few pulls that I went in and I grabbed some interesting sites from.

527
00:40:53,720 --> 00:41:04,700
The fourth website to be pulled after going to the Tor Wiki was the Liberated Books and Papers site, which claims to be a collection of books not easy to come by.

528
00:41:05,180 --> 00:41:17,600
Our sixth website crawled was an error page for WordPress, which actually helped show that WordPress sites are being used on the Darknet under the name of Torpress, which is really interesting.

529
00:41:17,600 --> 00:41:20,180
You can actually see that in the URL.

530
00:41:20,860 --> 00:41:27,440
Thirty-two, we found the TMG Mirror List, also known as the Majestic Garden.

531
00:41:27,440 --> 00:41:32,360
This has a PGP for joining the Majestic Garden group.

532
00:41:32,360 --> 00:41:42,040
And there were multiple, not just these three, there were even more of these URLs that had the exact same thing on them, which brought up a very interesting question.

533
00:41:42,040 --> 00:41:45,220
What do we do about sites that are so similar?

534
00:41:45,320 --> 00:41:52,360
If they all have the same stuff, but they're just a different URL, do we count them as one entity or combine them?

535
00:41:52,680 --> 00:41:53,660
We'll see.

536
00:41:54,040 --> 00:41:54,320
All right.

537
00:41:54,320 --> 00:41:58,820
Sixty-first website crawled, Relate List, new area of intelligence.

538
00:41:58,820 --> 00:42:02,120
Really interesting for looking up information on companies.

539
00:42:03,100 --> 00:42:06,400
I'm going to skip ahead a little bit because I'm seeing we're short on time.

540
00:42:06,400 --> 00:42:07,960
So let's go into this.

541
00:42:07,960 --> 00:42:09,440
Initial points of contact.

542
00:42:09,440 --> 00:42:12,140
This is how we see the URLs.

543
00:42:12,720 --> 00:42:19,820
We see that the URLs are all stored, we see if it's visited or not, and this is the binary format for the HTML.

544
00:42:20,220 --> 00:42:26,640
We crawled a lot of sites, the Wiki, Bitcoin wallets, marketplaces, resellers, you name it, we saw it.

545
00:42:26,640 --> 00:42:27,820
It was great.

546
00:42:28,120 --> 00:42:30,840
And we still have all of this data to go through.

547
00:42:31,640 --> 00:42:37,400
A few other interesting ones is the black and white cards, which is a mysterious group open to members.

548
00:42:37,500 --> 00:42:40,340
This one was really interesting just to read through.

549
00:42:41,840 --> 00:42:53,440
We also have Rent-A-Hacker, which I don't know if anybody else has noticed this, but there's about five, at minimum, versions of this website under different names and different URLs that say pretty much the exact same thing.

550
00:42:54,300 --> 00:42:55,960
So this is pretty much a mirror.

551
00:42:56,480 --> 00:42:58,440
Very minor, if any, edits.

552
00:42:58,700 --> 00:43:01,740
But if you need a hacker, I wouldn't go to this one.

553
00:43:03,260 --> 00:43:06,200
Again, you're at DEF CON, so really, you need to go to them.

554
00:43:06,320 --> 00:43:08,780
Now, Ambley of tomorrow.

555
00:43:09,440 --> 00:43:13,240
As a prototype, Ambley is on a road of continuous change.

556
00:43:13,660 --> 00:43:17,380
There's a few areas that we want to get down on Ambley's development.

557
00:43:17,480 --> 00:43:35,200
One, integrate a new classifier, PermID, currently working on it, that will help Ambley's crawl to classify webpages during the initial crawl itself, telling us is this relevant to cyber threat intelligence, is it relevant to cybersecurity, drugs, bitcoins,

558
00:43:35,200 --> 00:43:36,220
you tell me.

559
00:43:36,800 --> 00:43:44,460
Now, then we want to be able to identify webpages with CAPTCHA, which we've found a few, test the CAPTCHA breaker component that I'm also working on.

560
00:43:44,460 --> 00:43:50,720
This includes specialized CAPTCHA found on TOR sites, like this gorgeous DREAD CAPTCHA.

561
00:43:50,960 --> 00:44:06,440
DREAD's CAPTCHA methods are both magic beauties, they're beautiful, I can't speak to them, but they're also horrendous to actually deal with as a person.

562
00:44:06,540 --> 00:44:09,180
This one's nicer than the old one.

563
00:44:09,220 --> 00:44:17,000
Finally, we want to implement a deep learning module using natural language processing to identify relevant links to prioritize.

564
00:44:17,700 --> 00:44:19,160
This is really great.

565
00:44:19,160 --> 00:44:24,280
I'm really excited about getting that part up and running, and that's really the big next stage.

566
00:44:24,960 --> 00:44:27,040
But that's all I have time for today.

567
00:44:27,040 --> 00:44:29,980
I'm running out of, I'm pretty much at my limit.

568
00:44:29,980 --> 00:44:38,900
So, unfortunately, I'm sorry I had to run a little fast at the end, but thank you so much, DEF CON, and the recon village, and everyone who's came in today to watch this.

569
00:44:38,900 --> 00:44:41,660
Thank you so much for spending some time with me.

570
00:44:41,660 --> 00:44:50,440
I also want to say I'm thankful for the Sailors of the Secure and Assured Intelligence Learning Lab that I work with, and the KDD team of Kansas State University.

571
00:44:50,740 --> 00:44:57,960
Finally, I volunteer with the Innocent Lives Foundation, and I really wanted to just shout them out here at the last few seconds.

572
00:44:57,960 --> 00:45:00,660
I really hope you give them a look, they're great.

573
00:45:00,940 --> 00:45:08,080
And part of why I'm so passionate about this is because I get to work with them, not specifically on this project, but on others.

574
00:45:08,420 --> 00:45:16,700
I really hope anybody who wants to reach out does, my social media is on this video, and let's chat, let's talk some Tor.

575
00:45:16,960 --> 00:45:18,460
Thanks again, everybody.

576
00:45:18,460 --> 00:45:20,620
Have a great rest of DEF CON.