start	end	text
580	5300	Hello DEF CON and welcome to my talk here at the Recon Village for DEF CON 28
5300	11400	Safe Mode. Super excited to be here. This is my first time ever as part of the DEF CON
11400	17640	speaker community. I'm super excited. So I hope you're excited also while we start talking about
17640	25880	Ambly, the smart darknet spider. So who am I that's talking to you about this really cool project?
25880	32080	I am known by a few names online. This may or may not be all of them, but it certainly is the
32080	39400	few that are most common. Some people will know me as Cytissus Eurydice. Others may be CyberSci.
39580	44200	Most people in this community are going to know me as Levitanin or Levi.
44240	48480	This is what I am online where I'm actually interacting with people most often.
49180	54400	By day I am a cybersecurity incident response professional and by night I'm a darknet
54400	59940	researcher by choice and trade. I am a self-proclaimed master of spiders also, which
59940	66540	may or may not be both on the computer and off of the computer. Just keep in mind that spiders in
66540	71700	real life out in the wild, they're doing a lot of good stuff for us. But those online, they're
71700	77180	equally hiding in plain sight doing a lot of cool things that we need them to do every day.
77340	83300	And I'm here hoping to create tools that are based off of these spiders and build upon them
83300	87660	in order to help us in fields like open source intelligence, threat gathering,
87660	92360	and other research areas. But before we get ahead of ourselves, let's talk a little bit
92360	98860	about TOR because we're going to be talking TOR a lot today. Keep in mind though that TOR is not
98860	104680	the only darknet access point, so we're going to be mentioning a few others as well. Before we get
104680	109900	too too far ahead of ourselves, because I could talk TOR, darknet, and spiders all day long,
109900	114580	let's talk a little bit about the different layers of this presentation. We're going to
114580	119960	be going over open source intelligence, or OSINT. We're going to talk about cyber threat intelligence,
120320	125840	which you'll often see abbreviated as CTI. We'll talk about the different layers of the internet,
125840	130840	which I've already slightly touched on. We'll also talk about the difficulties of finding cyber
130840	136020	threat intelligence on the darknet specifically. And finally, this is going to lead us into talking
136020	141960	about Ambly, a smart darknet spider specifically designed for cyber threat intelligence.
142160	148220	So let's get started. What's open source intelligence? Most people in this village
148220	153700	specifically probably have some sort of idea about what open source intelligence is, but we're going
153700	159440	to break it down a little bit anyway. Open source intelligence is anything that is accessible from
159440	165760	original sources, broken down as accessible original information or data. You can also
166340	172040	explain this further by saying something that is posted, viewed, or interacted with by a user,
172040	178760	which is accessible publicly online or offline. It doesn't have to be specifically on the internet.
179180	184360	This includes, but it's not limited to, the internet at the clear, deep, and dark levels,
184360	191780	which we'll get into later. Mass media, television, radio, books, journals, print of all kinds,
191780	198400	video games, specialized journals, conference materials, and think tank studies. These are out
198400	202320	there. People are talking about them all the time. We're going to be posting about DEF CON for months
202320	208040	after this, right? Then there's photos and videos, not just on YouTube or Snapchat, but in general
208040	215000	that are posted publicly online. Finally, another area is geospatial information, such as
215000	222080	where they actually are located, their GPS, where on a map they may be, or even their IP addresses.
223860	230880	So, what is OSINT good for? Absolutely everything. And if you thought about that with a tune in your
230880	236620	head, you thought right, because I was talking about that song that's now stuck in your head.
236620	242860	You're welcome for the earworm. So, OSINT can be utilized in an array of situations, including,
242860	249180	but again, never limited to, designing internal training for a company, understanding your threat
249180	256160	profile, beating Keith and Joe at an open source CTF that may or may not be hosted by, you know,
256160	261870	Trace Labs today, later on after this presentation. Maybe, maybe not. I don't know. Volunteering,
262520	266380	finding out the title of your favorite book from when you were nine, but you forgot existed for
266380	272160	about 10 years and you desperately wanted to read again sometime later. Yeah, all of these are
272160	280500	actual areas that I have used OSINT for on the clear net and down into the dark net. And that
280500	285540	book, for anyone who was interested, was called Goddess of Yesterday, which I highly recommend.
285760	293320	It's a good book. But, now you may be asking, if you're not used to this field just yet,
293320	301620	is open source intelligent gathering legal? Short answer is yes. Long answer is depends,
301620	309260	which is a longer word than yes. The longest answer is, if you're in a country outside the
309260	313000	United States, I don't know. It's going to depend. You're going to have to look into your own local
313000	318860	laws. Even in the United States, you're going to have to look into your laws per capita, per state.
319420	324980	This may be different in some areas. In Europe, I'm expecting that there's probably a lot stricter
324980	329500	regulations on what is or is not open source intelligence than there may be here in the
329500	336280	United States. That being said, in the U.S., there's a public law that open source intelligence
336280	342720	is produced from publicly available information, collected, analyzed, and disseminated in a timely
342720	349280	manner to an appropriate audience, and addresses a specific intelligence requirement. This is what's
349280	354660	publicly posted on the CIA's website regarding open source intelligence. Now, there are a few
354660	362340	other sources that you can look into, including the public law number 108-458, posted in December
362980	374160	2004. We also have the FOIA B3 exceptions from the 50 U.S.C. 403-1, which is on intelligence sources
374160	382860	and methods. And finally, ATP 2-22.9, which is the Establishment of Open Source Intelligence for the
382860	388380	Army. These are all laws that are out there that you can read up on, and they will help you
388380	394680	understand what is and is not legal in the United States. Again, certain states may vary.
396060	401120	All right, we're going on to the next section now. We're going to start diving into cyber threat
401120	406420	intelligence. But first, let's take a step back, let's relax a second, and let's think through a
406420	413680	scenario that's going to come up again and again to this presentation. One, let's go. During a
413680	419380	pandemic, you're working from home. Everyone's working from home, we hope. Stay safe, right?
419600	424440	Your company, which is global, just announced it's working on processing pandemic data to help
424440	431660	drive towards a cure. Great, that's awesome work. But does that open you up to some threat that may
431660	438780	be out there, some cyber threat actors? As part of the cybersecurity team, your job and your goal
438780	444260	is to identify if there are any actors out there that you need to be aware of, and anyone who may
444260	450100	be actively targeting not only your company, but companies in your industry. So what do you do?
450100	454240	How do you find that out? Keep this in mind, we're going to come back to this.
455860	460720	All right, what's cyber threat intelligence? I just kind of threw a scenario at you, but what
460720	465900	are we even talking about? Well, cyber threat intelligence is the collection and analysis of
465900	471160	threat actors' motives, targets, and attack behaviors in the realm of cybersecurity.
471820	477340	Often automatic machine learning and techniques implemented for data collection and processing.
477480	483280	This is how we are gathering this information. However, you can do it manually. This is helping
483280	490120	to shed some light on preemptive actions, or for preemptive actions, and reveals adversarial
490120	494960	motives and tactics, techniques, and procedures, or TTPs, which we'll be talking about a lot.
495900	503220	The reason we do this is to help in three areas within a company or possibly even the government.
503280	507920	And what these areas are tactical, which is where you're performing a malware analysis and
507920	513120	enrichment, you're collecting threat indicators, and you're trying to help out with defensive
513120	520620	cyber teams. The goal here is to be able to talk to a semi or more technical audience.
520760	525760	Then you have the operational team. You have a team that's trying to understand adversarial
525760	532800	capabilities, infrastructure, TTPs. You want to leverage this information to conduct targeted
532800	539620	prioritization operations. This team is probably more technical with the details and they want to
539620	545120	know about attacks and campaigns from the past, the present, and possibly, if you can anticipate it,
545120	552380	the future. Finally, we're talking to the strategic team. This is the team that needs to know all of
552380	557000	this information at high level. They want to know about adversarial motives. They want to know who's
557000	562100	targeting your industry. They want to be able to leverage this information to engage in strategic
562100	567880	security. This is for a non-technical audience in most cases, but it's really important that
567880	572480	we make sure that they understand what's going on and why it's important to focus in on this
572480	578600	information. Now, are there companies out there that are focused on this? Absolutely. A few of the
578600	586620	top ones are Recorded Future, CrowdStrike, FireEye, Mandiant, and SANS. And this is an area that more
586620	591820	and more people are getting involved in, especially right now and in this scenario. When there's a
591820	596840	pandemic or there's a work-from-home situation, you have to be aware of your cybersecurity.
596840	601040	So, the more people who are looking at this, the more we need to know about it and know how we can
601040	608180	dig into it. So, what are some tools that we can use right now if we wanted to get into open-source
608180	615720	intelligence and cyber threat intelligence? Well, we've got Maltego, Spiderfoot, MalShare,
615720	621640	the Open Source Framework, which everyone should start at at some point. It's right there and it
621640	627880	will lead you through the tree path to whatever you may need. We have the Check Usernames or
627880	633700	Been Verified, which is a great tool to see if a username is used across platforms. You can use it
633700	639600	to track people's movements if you need to find a target or if you're working on something like a
639600	645240	CTF or Trace Labs. Or you can even use it for yourself to see if the username you want that
645240	650560	you want to kind of trademark as your official account or handle is used anywhere that you may
650560	656540	need to grab. Have I Been Pwned? Excellent resource. See if you or anyone else has been
656540	662060	pwned, if their email addresses have shown up in any leaks. We've got Census, Shodan, which is one
662060	669080	of my favorite sites, built with Google Dorks. If you know how to Google Dork, you probably are a
669080	675480	leg ahead of a lot of people. Google Dorking, or which is Google Hacking, or just knowing the syntax
675480	682360	of how to do a proper search with Google, is an amazing, amazing ability. And it's magic. I don't
682360	689420	really know any way else to say it. It's magic. We have Recon NG, The Harvester, Nmap, Creepy, which
689420	694560	is a little creepy, but you know, it knows it's branded well. There's so many tools out there.
694780	700340	TraceLab has a VM full of them. OSINT Combine is another course where you can learn stuff about
700340	705200	OSINT, and they have a lot of tools they talk about. Tools are popping up over and over and
705200	710500	over again, all over the place, and most of them are open source. Some of them may have paid features
710500	716340	that you can or cannot get if you want, but you can do a lot of this stuff without paying a dime,
716340	722880	and they're very useful. So I highly recommend digging into these tools. And if we want to talk
722880	727240	about these at all, please let me know. I'd be happy to chat with anyone about any of these.
727540	733680	But for right now, we're going to move on. We're getting to one of my favorite parts. I could talk
733680	740460	about this way too long, so I'm going to limit myself to three slides. Four slides, I lied. Four
740460	746180	slides. We're going to talk about the layers of the internet. Number one, out of the box. Please,
746180	753600	please, do not believe everything you see in infographs. Because honestly, I don't know how
753600	761380	many times I see this whole igloo... is that the word? Ice cube? Iceberg that we want, that we see
761380	768060	for the internet, for these three layers, or in some cases up to 12 layers I've seen. But I don't
768060	773520	necessarily agree with this one based on my interaction with the layers of the internet,
773520	780340	my understanding of it. But even more so than that, just like you can kind of do with stats,
780340	786000	you can do almost anything with an infograph and be convincing. You can really get people's
786000	791400	attention. So just keep that in mind. I'll get off my horse about that for right now and just
791400	795980	let you know that we're going to be talking about the clear net, the deep web, and the dark net.
798060	802760	Clear net. Everybody's favorite layer of the internet, even if you don't know it.
803480	809520	The clear net is... oh, that might not be true. We'll see. The clear net is where you can access
809520	815520	things like Google and Bing and DuckDuckGo. And if you look for something on Google and you can
815520	823020	find the page, you're on the clear net. Otherwise, if you can find the front page but you can't find
823020	829080	specific data, let's say you joined a forum and you're trying to figure out what's going on with
829080	834480	one of the users, you might be able to search that user and see that that forum has a post,
834480	839960	but probably not going to be able to see that post. Not without getting through an access point.
840020	845860	And that brings you into the deep web. The deep web is anywhere where you're talking to people
845860	850660	online. You're on Discord, you're at DEF CON, you're probably on Discord. By the way, DEF CON,
850660	858320	you've gone to the DEF CON forums? Deep web. Like to play video games? Twitch or Steam? Deep web.
858320	865960	How about ever log into a university or school portal? Ever. Deep web. You have a bank account
865960	874400	anywhere? Deep web. All of these areas also have a front-facing website that is accessible via the
874400	882320	Google, Bing, DuckDuckGo, whatever your preferred search engine. But because you have to have an
882320	888540	access point, you have to go into this, you're running into this area where it actually is the
888540	896120	deep web. It's not as accessible, it's not as indexable for those spiders and crawlers behind
896120	901020	Google and other search engines. Which is what makes it the deep web. Which if you go back to
901020	909480	that infograph, this should be the largest section of the iceberg. Which leaves us with
909480	915560	the darknet. My favorite, personally. There's a few different ways of getting onto the darknet,
915560	921340	but the top three access points are those we see here. We've got the Tor Project, which is the
921340	928060	Onion Router Network, or just Tor, like we said, we're going to talk Tor today. And the focus is
928060	933780	going to be on Tor from here on out for right now. But keep in mind that we also have the Freenet.
933780	941080	We have I2P and the Bulletin Board System. All of these require specialized access and or knowledge
941080	947820	in order to get onto and interact with users. For Tor, you need to get the Tor Browser to access
947820	955580	the Onion Routing System. For Freenet, you need another specialized software. You can also get
955580	962180	specialized software for I2P, which will run your traffic through different tunnels via peer systems.
962180	969360	And BBSs require telnet client software. All of these require extra software and extra knowledge
969360	976880	to even find these websites in most cases, or chat rooms, or what have you. And that's what makes this
976880	987060	the Darknet. It's not easy to explore, to travel. If you're trying to get from one site to the other,
987060	993920	you need to know someone or something to get there. So, what does that mean for us? What is cyber
993920	999540	threat intelligence on the Darknet? Like I mentioned, we're going to focus on Tor. But first, let's go
999540	1005580	back and look at this. How long does it take to find a website for us to use? If you're on the
1005580	1013740	ClearNet, a website that's newly posted takes about four weeks if you get the SOEs okay. If you get the
1013740	1018840	SOEs set up really well for that website, it can take about four days. And then you'll start seeing
1018840	1026080	it populated on Google or other search engines, depending on how it's set up. So, if I actually go
1026080	1032640	and I log in and I try to find a website on Google, and it's not a hurricane, like it may or may not be
1032640	1038720	outside, then what are we dealing with? A few seconds, maybe a minute. It's kind of based on
1038720	1044180	your internet speed at that point, right? All right, what about the DeepWeb? Well, let's say the DeepWeb
1044180	1053140	website has a ClearNet facing access point, right? Maybe you're trying to find a certain forum post.
1053140	1059520	So, the forum you can find on Google. So, there's the few seconds to a minute. Then you have to
1059520	1064420	either make an account or log in. So, that's the next time. Let's say that takes two minutes. So,
1064420	1069000	that's three minutes now. Then you have to log in. So, once you're logged in, you then have to find
1069000	1074460	the post you want. Now, a lot of these sites have internal indexing, which means you can search
1074460	1080420	stuff internally. And that may take another minute or so. So, that's four minutes, five minutes.
1080680	1084340	That's not terrible, so long as you know what you're looking for. If you don't know what you're
1084340	1089540	looking for, it may take longer. If you're specifically trying to find information on a user
1089540	1094880	or a subject, you may have to do a lot of digging before you come across what you really want.
1095000	1101720	And in those cases, it could be extended for a very long amount of time. That's fine. What about
1101720	1107280	the DarkNet? How are you going to find a DarkNet website? Some of them are posted on Reddit.
1107740	1112580	If you look up DarkNet websites, you're usually going to get Tor, and they're usually on Google.
1114140	1121640	Pastebin, GitHub, some of them are on GitHub, yeah. Well, even if you find it, what do you do
1121640	1126720	with that? It can take some time to find websites. Are they really what you want? What are you
1126720	1133720	looking for? And what about how do you access them? And how long does it take to access them
1133720	1140280	as compared to the ClearNet? Well, let's take a look at our scenario from earlier, and we can
1140280	1147520	try to figure this out. So, some extra details. You've uncovered information about a group
1147520	1152860	targeting your company, or in companies like yours. The information you have indicates that
1152860	1158420	this group is active on Tor, but not where they're active. How do we go about finding this group's
1158420	1165240	activity? Let's walk through it. Manual investigation. Step one. Let's figure out
1165240	1170400	what's going on by using Google as an ally. And I'm going to start with Google, because most of us
1170400	1177240	do. Personally, it's not my preferred search engine, but it is one of the better ones. Oops.
1178580	1187240	So, what do we have? I just searched here for Tor websites. I got a few of them. Here's
1187340	1193160	a quick snippet of them. We've got nine best onion sites to visit. Awesome. List of some sites
1193160	1200400	from Wikipedia. Cool. Very nice. We have best onion sites and how to access them safely.
1200460	1208120	Awesome. How to find active .onions darknet sites and why... And finally, we have the best
1208120	1216220	darknet websites you won't find on Google. Hmm. I don't know about you, but that one seems a little
1216220	1222960	weird, considering we found the link on Google. Personally, I think it's funny. So, I'm going to
1222960	1229460	pick that one. So, that leads us to step two. Pick a rabbit hole to dive down, which is what
1229460	1234920	we're going to do with the best darknet websites you won't find on Google, as found on Google.
1235620	1242600	From there, we're going to go into what does this article or this area have. So, the first one they
1242600	1249860	listed was the hidden wiki. Surprise, surprise. There are a lot of hidden wikis. Some of them
1249860	1254260	are mirrors. Some of them are just lists. Some of them are kept up to date, and some aren't.
1254260	1258840	This one is the general normal access point, but there are others, and there are some that are
1258840	1265000	better. They also have here hidden answers, which is another good one, and generally anonymous.
1266520	1274900	But one big thing I want to note here. If you look at these two, and I've got my mouse over here just
1274900	1280120	to show you these two URLs. First off, we're on tour, so all the URLs are going to end with dot
1280120	1287100	onion. But you'll also see that this one is very short. It's a bunch of gobbledygook. You're not
1287100	1293780	going to be able to understand what it is in most cases, but it's short. And that's fine and dandy,
1293780	1300120	but that's a v2 URL. What's going on right now is that we're switching over to v3 URLs, which are
1300120	1307700	these longer strings, usually around, I think, 52 characters. Sometimes you'll be able to see a tag
1307700	1314100	like this, where it's got an actual human readable English readable word in the beginning. But
1314100	1319380	generally speaking, we're just looking for these longer URLs. Those are the ones that are going to
1319380	1327620	be sticking around for a while. This shorter one is going away in 2021. So yay, we found this,
1327620	1333240	but what does that mean? What are we going to do about that? And how does that, how do we get an
1333240	1340740	updated one if this is a good starting point? We're going to talk about that too. So, step four. We
1340740	1346020	found the URLs, but how do we actually access them? If you go and plug and play those dot onion links
1346020	1351520	into your Google Chrome or Firefox or any normal standard browser, you're not going to be able to
1351520	1358600	reach it. You need to be part of the Tor network or the onion routing system. In order to do that,
1358600	1366180	you need either to set up the proxy or you download the Tor browser. So this is Tor. This
1366180	1372980	is the base browser that you have right now. It's updated to 9.5.3. It's based off of Mozilla
1372980	1378860	Firefox and it allows the user to connect to the Tor network and onion router system. Now, you can
1378860	1385720	change a few settings in here. Generally speaking, it's not recommended to have JavaScript on. For
1385720	1391700	example, you want to try to be in the safest mode you can be when going through different sites.
1392180	1397380	And you start off with the search engine DuckDuckGo. Now, DuckDuckGo is a clear net search
1397380	1402740	engine. It doesn't necessarily help you with Tor websites, though it can give you some results
1402740	1409440	similar to if you look up on Google. But now we can quickly and easily pivot into using
1410660	1414380	those URLs that we found earlier. So let's go to the hidden wiki.
1414900	1419100	Here's the first thing that popped up when I went on the hidden wiki about two days ago.
1419300	1427480	Top of the page, hidden wiki, new URL as of 2019-2020. Add this to the bookmark and spread it.
1427480	1432540	This is the current URL for the wiki. Now, can you get there from the small one? Yes,
1432540	1440100	which you can see right here at the top. I was accessing the small v2 URL. This is the v3 URL
1440100	1445360	and it's going to help us stay connected to the wiki as long as it's viable and up. So when you
1445360	1452720	do come across these v3 URLs, you want to grab them or you may lose access to the site and beyond
1452720	1461380	normal losing of access on darknet. So we're on the wiki. We're at step five. Visit the starter
1461380	1470260	point. What are we doing on this website? Well, first we're trying to find information about the
1470260	1477660	threat actors for our cyber threat intelligence scenario. So what areas of the wiki can help us?
1477660	1484320	Well, we've got social networks, which, slight side note, this includes Facebook. And for the
1484320	1490600	life of me, I cannot understand how a dot onion site for Facebook is not going against their own
1491100	1496740	terms and policies. But also, if anybody could explain that to me, please, by all means,
1496740	1502340	I would love to hear it. But I also personally wouldn't recommend signing into any of your real
1502340	1509920	life social media accounts, especially at the same time as doing other things on the darknet.
1509920	1515760	The whole point of this is to stay private, to try to stay anonymous. And if you're logging into
1515760	1521540	your personal accounts and random accounts, or your personal accounts and your darknet accounts,
1521920	1526700	it's possible that you could link those two. We want to try to avoid that. Similarly,
1526700	1530580	if you're doing OSINT online and you're not using the darknet, but you're using maybe a
1530580	1537480	virtual machine, you don't want to log into your own stuff in that instance. You could run into a
1537480	1544480	conflict. Anyway, we have social media. We've got Connect, we've got Galaxy 3, which is rather new,
1544480	1550300	we have Torbook, and we have Facebook somehow. Facebook I wouldn't necessarily
1550620	1555740	consider a darknet social media, but it's there. Then we've got Hack, Freak, Anarchy,
1555740	1562600	Warriors, Viruses, and Crack. We've got all of the stuff you need. Just try to rent a hacker, why don't you?
1562600	1567740	Definitely isn't a scam, definitely is not going to backfire on you at all, promise.
1570000	1576560	Do we think the threat actors that we are looking at for the industry, for our cyber
1576560	1583680	threat intelligence scenario, are really taking any action here on these websites? Are they
1583680	1593040	maybe selling their abilities or any code that they've made online? Maybe. Personally,
1593040	1602420	I wouldn't think they'd be on these sites, but it's possible. You can definitely look into them,
1602420	1609700	all depends on what you're trying to get into. Now, there's also another area, which is the
1609700	1615800	introduction points. Earlier, I mentioned the search engines. Those are Google, DuckDuckGo,
1615800	1621540	Bing, clear net search engines, awesome resources for clear net, for open source, all that good
1621540	1631780	stuff. These are considered, in most cases, to be darknet search engines. Now, DuckDuckGo,
1631780	1636820	we talked about, searches the clear net, but it's kind of working with Tor. We've got AMIA,
1636820	1642680	which is searching Tor websites, but it's on the clear net. Then we've got stuff like Torch or
1642680	1650200	NotEvil. If we wanted to go into these search engines and try to find more information on
1650200	1655240	cyber threat intelligence, how would we start? Well, that's going to bring us to step six. Let's
1655240	1665060	begin the hunt. This is NotEvil. FYI, this will probably get posted after, but if you try to go
1665060	1672040	NotEvil, it may be down for an upgrade on August 7th. But otherwise, you can pretty much use this
1672040	1678500	like Google. Put in some keywords and start searching. Now, I can tell you, but I will not
1678500	1684740	show you, that when searching NotEvil for anything related to the pandemic, you get, surprise,
1684740	1693600	surprise, a lot of pornography. Most searches will get you a lot of pornography. If we're being
1693600	1700160	serious, that's just kind of how it is. You can tag videos and images and everything with anything,
1700160	1706540	and it kind of works sometimes as a way of hiding actual posts and data, and sometimes it's just
1706540	1713680	because people like to share it to each of their own. But as Pornhub stats can have shown in the
1713680	1718840	past, when stuff is going on in day-to-day, you tend to see it turned into pornography and get
1718840	1725420	really popular. So that's fine and dandy, but we're not going to show that here. Instead, what we're
1725420	1732340	going to show is when I looked for hacker. Does stuff show up? Yes. We have some sites. We see some
1732340	1741440	messages here. We see some posts down here. We have Vincent Canfield, a hacker on Keybase, who
1741440	1749600	specifically says, do not chat messages on Keybase. Okay. We have The Social Hacker. We've got a warning
1749600	1754040	on that site, check before purchasing. What are they selling? What's going on here? That's something
1754040	1760740	we might want to look at. Now, what do we do if we search for cyber terrorists? Which is the next
1760740	1768640	little block we have over here. Well, let's see. We've got Daniel's Onion List. That's cool. We've got
1768640	1775350	some other languages that are popping up here. That's nice. Look, we have a mention of the CIA.
1775880	1784560	Okay. We've got Rat Wires. All right. Interesting. So we get a few hits, but is a cyber terrorist
1784560	1792340	group going to label themselves a cyber terrorist group? Maybe. Cyber terrorism is kind of a
1792340	1798000	perspectives game. Most things are a perspective game, really, right? If I'm looking for
1799000	1804020	information about someone that I think has done something bad, I think they've done something bad.
1804020	1809720	They might think they're doing something good. Are they a hacktivist? How do we decide that?
1809800	1813780	That's another thing we'll need to use some cyber threat intelligence skills and techniques to deal
1813780	1823780	with. But let's get back to the next step. Part 7. Part of the talk. Websites on TOR can and are
1825240	1830720	volatile. TORM may be up one day and down the next. Now, TORM is a great website for
1831460	1837680	getting into the cyber security community on TORM. It's a very interesting forum.
1837680	1845020	They got that traditional sweet, sweet terminal green on black going on, so it may or may not hurt
1845020	1850100	your eyes. I would love to show you a picture of it, but when I went to get all the pictures,
1850100	1856540	as per the slide mentioning, TORM was down. And that doesn't mean TORM is gone forever. Most
1856540	1859940	likely it means it was down for maintenance or maybe they had a weather issue or some other
1859940	1865520	issue wherever it's being hosted. It is what it is. But this can make communication difficult.
1865520	1870880	And if you aren't embedded, you can easily lose track of things, if not be left behind completely.
1871340	1877760	So there is a point at which we may want to talk about how do you safely integrate into
1877760	1883120	the communities to get more information. You're already having a hard time searching the darknet.
1883660	1888220	Is there a point at which you want to embed yourself in communities to start learning more?
1888220	1893800	Is it safe to do? How do you do it safely? These are all really great questions that we don't
1893800	1898340	really have time to get into today, but keep an eye out. This is definitely something I want to
1898340	1906000	talk about with everyone more going forward. So summary slide, right? Cyberthreat intelligence
1906000	1911400	on the darknet. All right, so on the clear net, in parts of the deep web, we can go through profiles,
1911400	1917820	web pages, pretty quickly. What do we say? Like a minute to find a page on Google, give or take.
1917900	1923420	About five, up to five minutes for the deep web if you're just doing a shallow dive. Not too bad.
1923800	1929020	Darknet's different though, huh? Although there are some tools in place, such as darknet search
1929020	1934360	engines, like not evil, we don't have the same boosters here as we do everywhere else. It's not
1934360	1940200	quite as easy. It's not quite as indexed. And this is something we take advantage of in our
1940200	1946220	day-to-day lives. A lot of us may even forget a time or not have been alive during a time before
1946220	1952940	Google, before these things were indexed and easy to find. So if we're trying to do darknet research,
1952940	1958320	there's a huge bottleneck here. If you're doing manual investigations, that's a slow process. And
1958320	1963860	getting to websites and finding websites, it's the game of the darknet. You got to trade stuff,
1963860	1969960	right? You've got to interact to really dig in and find these. It's a huge hurdle when trying
1969960	1975660	to hunt for cyber threat intelligence on the darknet. And this is where Ambly comes in. And
1975660	1980020	I'm really excited that we've gotten to this part because this is a project that I have been hoping
1980020	1984880	to work on for a long time. And when I finally got the chance to do it with the SAIL lab,
1984880	1990960	I think I just about lost my mind. I was so excited. So taking a step back, let's talk a
1990960	1996660	little bit about Ambly. Ambly is a smart spider focused on the darknet to gather and identify
1996660	2003600	cyber threat intelligence. Ambly is going to be using some machine learning and
2003600	2008760	artificial intelligence techniques to actually identify relevant websites and
2009760	2013940	to make sure that they're valid and they're pertaining to cyber threat intelligence.
2014380	2018940	We're going to be accessing websites hopefully down the line behind capture blocks or user
2018940	2024580	accounts and anti-robot protocols. The goal here is to use deep learning and natural language
2024580	2030640	processing to identify and rank new URLs based on the potential for CTI. We're going to hopefully
2030640	2035840	have a report that gives us out webpages and identifies further investigation recommendations
2036400	2042300	so that an analyst, government, researchers, whatever, what have you, can actually use this
2042300	2047420	to get rid of or to reduce that bottleneck that we talked about a moment ago.
2048180	2054740	Reducing the bottleneck is the key behind Ambly's mission here. We want to make this easier and
2054740	2059920	better and not just for cyber threat intelligence. There's other tools that may or may not be in the
2059920	2066100	works here, but this is the goal of Ambly. Ambly is for cyber threat intelligence to identify
2066100	2072400	and track this information on the dark net. Right now, specifically Tor, but that does not mean it's
2072400	2079700	limited. But let's take a step back. That's what the Ambly we want. We want to be able to do a lot
2079700	2086700	of stuff with Ambly. But where are we right now? Well, Ambly is in a prototype stage and we'll get
2086700	2092860	to that in a minute. But right now, Ambly is going out and gathering data. Ambly is actually creating
2093120	2101080	a database on viable dark net websites, specifically on Tor, so they're all .onion sites.
2101260	2108400	So how does Ambly do that? Imagine, if you will, another scenario. You dropped in a random city.
2108640	2115320	You don't know where you are. You don't know what country, state, city, anything. You don't have a
2115320	2120500	phone, you don't have a computer, and you don't know the language of the people around you.
2121080	2133680	What do you do? How do you find safety? How do you get home? Well, personally, I would start walking,
2133680	2141080	searching for any sign of a police station, of some trusted resource that I can go to for help.
2142160	2148180	Now, maybe there's this universal sign that we'll see, or some sign that'll help me indicate that
2148180	2152960	path. Maybe there's not, and maybe I just have to walk. And I go down a path, and I keep following
2152960	2159000	that in any way it leads, and if it doesn't work, I go back. And we keep doing that almost recursive
2159000	2165200	spin around until we find an area that we need to be in. This is kind of what Ambly is doing,
2165200	2172300	to create that initial data set on Darknet websites. It's just going. It's free to move.
2172300	2180720	It's collecting websites. It's identifying and collecting a whole database on Darknet websites,
2180720	2185760	when they were viable, verifying that we could actually go to the site, not only that the link
2185760	2192520	was out there. And from there, we're going to use that data to start doing really cool things with
2192520	2200400	machine learning. But let's talk about Ambly of today. All right, so we're in a prototype stage,
2200400	2206640	like I mentioned. We're beginning to be on active and frequently updated Tor wikis. Not the one I
2206640	2212040	showed you earlier, but a different one. One that's really up to date and monitored frequently.
2212300	2217620	We've got two access points that Ambly has. One, instantly on the Darknet. Anything that goes
2217620	2222300	through any search, any website, we're going to the Darknet connection point. This makes sure
2222300	2228360	that we are always connected to one of the nodes and it keeps us in the network. So even if, by
2228360	2234300	chance, and early on we ran into this, where maybe we found a Clearnet website, going to that site
2234300	2241140	still used the Darknet IP addresses. We've now since removed the ability to go to Clearnet sites,
2241140	2248920	as the focus here is on Darknet only or .onion sites. The second connection is to the
2248920	2254640	Clearnet for the actual database storage, which currently is a MongoDB Atlas format.
2255140	2262000	We'll talk about that in a minute. Now the crawls gather HTML, which includes URLs and text. The
2262000	2267220	URLs are parsed out and stored separately. The text is parsed out and stored separately as well.
2267220	2274320	And then the HTML is stored as is, but in a binary format. At no point, and this is very important,
2274320	2280120	at no point are images specifically pulled. Illicit materials are avoided and are not meant
2280120	2286720	to be interacted with, including and especially CSAM, which is a term that's used frequently
2287260	2292600	for people who are working on anti-human trafficking and child pornography rings.
2292600	2301100	This is specifically about sensitive materials regarding children that we do not want out there.
2301780	2307080	We are not collecting that with Ambly. You may see on the HTML that an image was there,
2307080	2313000	but the image itself is not pulled. Now the database, like I mentioned, is a MongoDB Atlas.
2313240	2318420	It is file sizes identified at the pull and marked so that we don't go over the limit.
2318420	2323540	We did go over that. We'll see that in the next slide. The format of the data is important for
2323540	2330100	avoiding those document limits. Again, we'll talk about that. And Ambly runs in a digital ocean
2330100	2339780	droplet. All right, Ambly's first 12 hours. So, first 12 hours that we ran Ambly Prototype
2339780	2346920	Stage 1, we had MongoDB Atlas and local. We found they both have a limited size of 16 megabytes per
2346920	2355220	document. And this is what broke our cycle. The reason for that is originally the text was in an
2355220	2361760	unbounded array format, which just extended too large for certain websites to actually be
2361760	2368380	collected. So, what you'll see here is the first 12 hours of Ambly. We collected, in 12 hours,
2368380	2383740	86,546 websites. We got 1,819, rather, HTML pulled from those sites. And the text we got to 1,818.
2383740	2391420	On the 19th is when we got the limit size was hit. That has since been rectified. But just
2391420	2398660	imagine this, the first 12 hours, we got so many URLs. People talk about all the time
2399260	2406660	that the dark net is small. And it is compared to the clear net, compared to the deep net, sure,
2406660	2412740	but it is not tiny. There are so many URLs and websites out there. And this is specifically
2412740	2422780	specifically designed to make sure that no two websites are pulled with the same URL. So, even if
2422780	2428280	two sites link to the same website or webpage, only one of them, the first one, is stored. The
2428280	2439480	other is dropped. That is 86,546 unique URLs pulled in the first 12 hours. I don't know about you,
2439480	2445620	but I was ecstatic to see that. So, let's get into the good stuff. Let's talk about some
2445620	2451680	initial points of interest. We've got a few pulls that I went in and I grabbed some interesting
2451680	2459180	sites from. The fourth website to be pulled after going to the Tor Wiki was the Liberated Books and
2459180	2466200	Papers site, which claims to be a collection of books not easy to come by. Our sixth website
2466200	2472760	crawled was an error page for WordPress, which actually helped show that WordPress sites are
2472760	2477780	being used on the Darknet under the name of Torpress, which is really interesting. You can
2477780	2486400	actually see that in the URL. Thirty-two, we found the TMG Mirror List, also known as the Majestic
2486400	2494460	Garden. This has a PGP for joining the Majestic Garden group. And there were multiple, not just
2494460	2500280	these three, there were even more of these URLs that had the exact same thing on them, which brought
2500280	2506140	up a very interesting question. What do we do about sites that are so similar? If they all have the
2506140	2512360	same stuff, but they're just a different URL, do we count them as one entity or combine them?
2512680	2519160	We'll see. All right. Sixty-first website crawled, Relate List, new area of intelligence. Really
2519160	2524480	interesting for looking up information on companies. I'm going to skip ahead a little
2524480	2529440	bit because I'm seeing we're short on time. So let's go into this. Initial points of contact.
2529440	2536760	This is how we see the URLs. We see that the URLs are all stored, we see if it's visited or not,
2536760	2543040	and this is the binary format for the HTML. We crawled a lot of sites, the Wiki, Bitcoin wallets,
2544020	2549700	marketplaces, resellers, you name it, we saw it. It was great. And we still have all of this data
2549700	2555320	to go through. A few other interesting ones is the black and white cards, which is a mysterious
2555320	2562900	group open to members. This one was really interesting just to read through. We also have
2562900	2566860	Rent-A-Hacker, which I don't know if anybody else has noticed this, but there's about five,
2566860	2571340	at minimum, versions of this website under different names and different URLs that say
2571340	2578440	pretty much the exact same thing. So this is pretty much a mirror. Very minor, if any, edits.
2578700	2584760	But if you need a hacker, I wouldn't go to this one. Again, you're at DEF CON, so really,
2584760	2592080	you need to go to them. Now, Ambley of tomorrow. As a prototype, Ambley is on a road of continuous
2592080	2598140	change. There's a few areas that we want to get down on Ambley's development. One,
2598140	2603200	integrate a new classifier, PermID, currently working on it, that will help Ambley's crawl
2603200	2609040	to classify webpages during the initial crawl itself, telling us is this relevant to
2609720	2616220	cyber threat intelligence, is it relevant to cybersecurity, drugs, bitcoins, you tell me.
2616800	2621360	Now, then we want to be able to identify webpages with CAPTCHA, which we've found a few,
2621360	2626060	test the CAPTCHA breaker component that I'm also working on. This includes specialized CAPTCHA
2626060	2634260	found on TOR sites, like this gorgeous DREAD CAPTCHA. DREAD's CAPTCHA methods are both magic
2635260	2643800	beauties, they're beautiful, I can't speak to them, but they're also horrendous to actually
2643800	2650680	deal with as a person. This one's nicer than the old one. Finally, we want to implement a
2650680	2656000	deep learning module using natural language processing to identify relevant links to
2656000	2661760	prioritize. This is really great. I'm really excited about getting that part up and running,
2661760	2668620	and that's really the big next stage. But that's all I have time for today. I'm running out of,
2668620	2672760	I'm pretty much at my limit. So, unfortunately, I'm sorry I had to run a little fast at the end,
2672760	2677740	but thank you so much, DEF CON, and the recon village, and everyone who's came in today to
2677740	2683240	watch this. Thank you so much for spending some time with me. I also want to say I'm thankful for
2683240	2688680	the Sailors of the Secure and Assured Intelligence Learning Lab that I work with, and the KDD team
2688680	2694900	of Kansas State University. Finally, I volunteer with the Innocent Lives Foundation, and I really
2694900	2699560	wanted to just shout them out here at the last few seconds. I really hope you give them a look,
2699560	2705680	they're great. And part of why I'm so passionate about this is because I get to work with them,
2705680	2711340	not specifically on this project, but on others. I really hope anybody who wants to reach out does,
2711340	2716700	my social media is on this video, and let's chat, let's talk some Tor.
2716960	2720620	Thanks again, everybody. Have a great rest of DEF CON.