start	end	text
3850	10030	Hello everyone, my name is Apoorva Singh Gautam. I would like to thank Defcon Retain Village
10030	16610	for having me here. I will talk about automating threat hunting on the dark web and the things that
16610	24410	surrounds it. I presented this talk, I presented a short version of this talk at Grimcon and this is
24410	31150	the extended version of it. So let's get started. I will switch off my webcam so that you guys can
31150	40620	focus on the presentation here. Okay, so a little about me. My name is Apoorva Singh Gautam. I go
40620	46220	by the handle ASGScorpion. I am a security researcher. I started into threat intel or
46220	53900	hunting two years back and I've been loving it since then. I'm currently pursuing my master's
53900	60140	in cyber security at Georgia Tech. Recently, during the summer, I was a research intern at
60140	69380	UC Berkeley doing research in threat intelligence. Some of my hobbies are gaming. I pretty much
69380	76840	love Rainbow Six Siege. I sometimes stream it also. I love hiking. I recently started
76840	83300	into lockpicking and I've been enjoying it. I contribute to the security community.
83300	88740	It's my passion contributing to the security community. I'm a senior teaching
88740	94600	assistant at Siberia. I contribute at Station X also and at the local security meetups.
95040	100380	And there are my socials if you want to contact me or hit me up.
102100	108600	So what's today's agenda? So we will talk about introduction to dark web, what dark web is,
108600	114700	how to access dark web, what Tor is, what is the difference between dark web, deep web,
114700	118720	why you should perform hunting on the dark web. Before that, we will discuss
118720	123620	what is threat hunting and why it is crucial to hunt on the dark web. We will discuss
124320	130520	different methods to hunt on the dark web. Can the dark web hunting be automated?
130600	135840	What's the pipeline or the architecture of hunting, automating the dark web hunting?
136420	142000	Then we will discuss a little about threat intelligence lifecycle. That's how
142000	149180	threat hunting on the dark web is analogous to threat intelligence lifecycle. What steps are
149180	154740	there that corresponds to this? We will discuss a little about operational security, that's OPSEC,
154740	161600	and why is it important to secure yourself when hunting on the dark web. And yeah, that's it.
163320	169420	So introduction to dark web. I'm sure you must have seen this image a lot of times on the internet
169420	175560	that shows difference between surface web, deep web, and dark web. So the surface web is the
176220	181100	sites that are indexed by different search engines, that's Google, Bing, Yahoo, etc.
181620	188760	And the majority of the portion of the internet is deep web. Now deep web is any site, any website
188760	195700	that is not indexed by the search engine. So this can include your databases, your server instances,
195700	202180	or any other different websites that you cannot search from the search engines.
202860	209480	The third one is the dark web that we will talk mostly about today. And this is the part of the
209480	215860	internet where you need some kind of software, special software to access the dark web. So this
215860	223300	can include anything related to like drugs or weapons that's being sold on the dark web, or
223300	232860	some kind of research, or books that's sold there. So dark web includes several forums and
232860	238280	marketplaces where people sell different kind of things. So these type of things are sold there.
240140	246280	So majority portion of the internet is deep web, and people confuse it between dark web and deep
246280	253100	web. So as you can see, only 6% of the internet is dark web, and 80 to 90% is the deep web.
256090	262170	Moving on, so how do you access the dark web? So there are several companies, several organizations
262170	269730	that offer their own dark web systems, or you can call it, so the famous one is Tor,
269730	277090	that's the onion router. The second is I2P, that's an invisible internet project.
277090	288050	Zeronet is also becoming popular nowadays. So Tor has .onion domain, like the domain name
288050	295590	ends with .onion, and I2P is .i2p. Talking more about Tor, what Tor is and how it works,
295590	307070	is it's like a three-layer proxy system. If you can see on the image here, there are entry nodes,
307710	312470	the entry node is where your traffic goes to, and then it goes through the middle layer,
312470	319450	and the exit layer, and then goes to the destination. This way your identity is hidden,
319450	326370	and also only the entry node is publicly listed, rest of the nodes are not publicly listed.
326830	336050	So it hides your identity, it hides your IP address, and these nodes are volunteer-based
336050	343530	systems. So Tor has about like 6,000 relays, and I don't know the number about I2P,
343530	355470	but it is also becoming more popular nowadays. And the major thing about Tor is each node
356230	364370	only knows the IP address of the next node or the previous node. So if we talk about here,
364370	369150	the entry node doesn't know about the exit node or vice versa. So in this way,
369150	378170	the location of the nodes are also protected. So there are many misconceptions about Tor,
378170	385870	the dark web. The famous one is whenever we talk about Tor, people think about criminal
385870	392110	or criminal things that goes on Tor. Yes, there is criminal side of Tor,
392110	399150	but there is a good side of the Tor also, or the dark web. So it's really famous among
399150	407670	whistleblowers or activists. There are many countries where free speech is limited. So
408470	413550	they can use Tor, like people from those countries use Tor to express their speech
413550	424050	or express what they think. Tor also has access to many old literature or researches,
424050	431070	which is not available on the open web. And it's like safe haven for journalists, obviously.
431790	436410	So there are many popular sites like Facebook and New York Times that has their counterpart
436410	445930	on Tor, like their .NER website counterpart. So it's useful for whistleblowers or activists.
446290	453050	The second thing is Tor is so many people think that it's illegal to access the dark web.
453350	461230	So it's not illegal to access the dark web. It's illegal to indulge in these kinds of activities
461230	466950	like purchasing drugs or purchasing any other illegal things on the dark web that
466950	473730	is being sold there. But it's completely legal to access the dark web. And it's like
475870	481810	the last thing which I would talk about is many people think Tor is like really big.
481810	487150	But if you talk about the uptime or the availability of sites, there are very few
487150	493690	onion domains on the dark web if you compare it with the clear web. So it's like
494110	498670	the dark web is like very little part of the internet.
502040	508300	So we will talk about the dark side of the dark web. I mean, the criminal side of the dark web.
508300	513960	So there are many forums or marketplaces on the dark web. These are some of the relevant
513960	520900	sites that's relevant to security researchers or people who want to access dark web for their
521740	527660	organization's benefit. So this is like some of them are like a credit card market. So where
527660	535800	different credit cards are being dumped or remote access. So these forums include remote access
535800	540600	trojans or some kind of remote access tools or insider threats. So insider threats are
540600	548460	it's like recent coming up a forum where insider like the people who are selling
548460	553520	their company's secrets, they talk amongst themselves. So these are some of the relevant
553520	562420	sites. Now coming to the cost. So how much it costs for some kind of for something to
563210	567980	buy from the dark web. So as you can see, it's really easy to buy these things on the dark web
567980	575820	and it. So like SSN, you can buy any SSN for $1 or fake FB friends, a fake FB with 15 friends,
575820	584440	mobile malware, bank details, so exploit to zero days. So it's like these type of things are
584440	589780	easy to get on the dark web. That's why security researchers and other people are focusing more
589780	595400	on the dark web. You might have heard about recent news, like 500,000 Zoom accounts sold
595400	602140	on the dark web or 267 million FB user profiles sold on the dark web. So there are many
602700	607440	data breaches occurring day by day and they are being sold on the dark web. That's why
607440	615080	researching on the dark web is really important. These are some of the product listings
615860	620540	from the forums of the dark web. This is how the products are being listed.
623420	629540	And you can see these are the average cost of accounts for different online services like bank
629540	634860	services, what's the average cost of it or what's the average cost of service for video games.
635940	641320	This is the average cost of tools that is being sold on the dark web. As you can see again,
641320	649180	bank and financial average cost is $74. So you can buy a brute forcing tool for some bank at $74.
651520	656880	Now coming to why you should hunt on the dark web. Before that, let's talk about what is threat
656880	665700	hunting. Threat hunting is proactive searching for cyber threats. Proactive means before the attack
665700	671820	happens. That's proactive search. You search for cyber threats from logs or indicators of
671820	678500	compromise. That's IP addresses, emails, domains, etc. or textual data. That's what we are doing
678500	684840	when we are searching the dark web. So it's basically hypothesis based because there's
684840	690540	nothing concrete about the process. You take one use case and work on it and then you take
690540	697600	another use case and work on it. And it goes iteratively in the same way. Many times there's
697600	703160	use of machine learning or natural language processing that's NLP and advanced analytics
704160	710560	process in this because you need to scan through the textual data if you are hunting on the dark
710560	716120	web or if you are hunting on the clear web also but for textual data. So machine learning and
716120	725420	advanced analytics are useful there. So why it's serious? Why threat hunting on the dark web is
725420	733700	really important? What's so big about that? As I told you about again, there are many forums,
733700	741380	marketplaces, dump shops. So what criminals or actors do? They learn new methods and techniques
741380	747400	on the dark web. They monetize their skills. They trade their exploits or tools or even drugs and
747400	755200	weapons and communication. So they communicate with each other and they share their ideas for
755200	763220	new attacks. A security researcher or a person who is researching on the dark web, he can find
763460	770040	a lot on, he can learn a lot while engaging within these communities. You can learn their
770700	777900	techniques or TTPs, that's the attack techniques and procedures, how they think about the attack,
777900	784660	how they plan an attack and it can identify. So if you do it correctly, it can identify attacks
784660	792040	in the earlier stages, that's planning and recon stages and you can reduce the impacts that it
792040	798600	causes. So suppose if your organization data is being sold on the dark web, there are different
798600	803780	kinds of impacts that can cause to your organization. So some of the direct impacts
803780	810300	are like personal information stolen or healthcare records stolen or even your company's trade
810300	816680	secrets. And some of the indirect impacts are repetition of your organization, revenue loss,
816680	821900	and nowadays the legal penalties that your data is lost and you have to cover the cost
821900	831500	of the customers. So this is like, that's why this is really important to like to research
831500	840660	on the dark web, to hunt threats on the dark web. On the same lines, these are the benefits of the
840660	846240	threat hunting. So if you do it correctly, you can keep up with the latest trends of the attacks,
846240	853380	you can get new TTPs, that's tactics, techniques and procedures, you can identify insider threats,
853380	858360	you can discover data breaches. The main thing is you can prepare your SOCs and incident responders
858360	867640	to deal with the attack because they will know before only what are the TTPs attackers are using.
867640	872600	So they can reduce the damage and risk to the organization by acting quickly on that.
875800	881440	So coming to the methods to hunt on the dark web. So we will discuss about some tools that's
881440	885760	used to hunt on the dark web. And then we will discuss about the human element that can be used
885760	892400	to hunt on the dark web. So talking about the first tool that's really, really important for
892400	900700	this is Scrapy. So it's a web crawling framework. It's so famous, it's so important because
900700	906260	it manages multithreading automatically. So you don't have to write, you don't have to spend too
906260	911440	much time on the multithreading part, because it has already capabilities for multithreading
911960	919320	using one or two lines of one or two lines of parameters. The second thing is Tor. Obviously,
919320	926120	if you want to access the dark web, you need Tor. Onion scan is another tool that is used to search
926120	933760	for onion websites. It can tell you if a website is up or not and the correlation between different
933760	943420	websites on the dark web. Coming to Pryvoxy. So Pryvoxy is a web proxy. Before getting more into
943420	951620	this. So when you access the dark web, you need some kind of proxy to access the dark web because
951620	959480	your ISP, as I told you before, the entry nodes are publicly listed. So your ISP can have a
959480	966720	blacklist to block the entry nodes. So you can't access the dark web or even if the ISP doesn't
966720	973240	block it, he can see whether you are accessing the dark web or not. He cannot see what you are
973240	977800	doing on there, but he can see whether you are accessing the dark web or not. So you might not
977800	984060	want that. That's why you need some kind of proxy and a majority of people use SOCKS proxy. So
984060	990900	basic difference between HTTP and SOCKS proxy is SOCKS proxy is a lower level proxy and it
990900	997460	works on the SOCKS protocol. HTTP proxy only works on HTTP or HTTPS websites, but SOCKS proxy can
997460	1007880	work on other protocols also. And there are different tools to use SOCKS proxy like
1007880	1015640	TSOCKS, Polypo and Pryvoxy. I've been using Pryvoxy and it has been so I don't have any
1015640	1023860	problem with Pryvoxy. So and it's good. So another thing is SCP doesn't allow you to use
1025060	1031740	directly SOCKS proxy because it doesn't support SOCKS proxy. So that's why you have to use these
1031740	1039660	tools like Pryvoxy, TSOCKS or Polypo to route your SOCKS through Pryvoxy scripts.
1040380	1046800	And there are other tools also like their search engines like Kilos or Recon where you can find
1046800	1055540	different end-to-end domains. Apart from using SOCKS proxy, you can also use VPN with Tor for
1055540	1067790	extra layer of protection and like encrypting your data. So getting more into SCP part,
1067790	1075050	this image might seem a little confusing, but I will get into it like step by step.
1075050	1083250	So this is like why SCP is really important and why SCP is so useful in hunting on the dark web.
1083250	1091590	So if you can see there, so for explaining this, I will explain it in terms of Python code. So
1091590	1097550	suppose everything you see here is a different Python program. So spider is a Python program,
1097550	1105030	downloader is a Python program, middleware is a Python program and so on. So what spider does
1105030	1112550	in spider? So in spider Python program, you give your onion domain on which you want to
1112550	1120270	crawl the data or which you want to get the data. So it gives it to the engine. Suppose engine is
1120270	1129110	just the program that manages every other Python programs. So it gives the onion domain to the
1129110	1134370	engine. The engine gives it to the scheduler. So what scheduler does is here the multi-threading
1134370	1139990	concept comes into the picture. Scheduler gets different domains and schedules it accordingly
1139990	1146450	into multiple threads. So the onion domain goes into the scheduler, the scheduler gives it back
1146450	1152730	to the engine and engine gives it to the middleware. So middleware program includes your
1152730	1160390	proxy program and or login program. So what proxy program is that in proxy function. So if we are
1160390	1165410	talking about middleware, that's a Python program, there's a proxy function into it.
1165410	1172870	So proxy function is where you will note, you will put down your privoxy IP or Tor IP,
1172870	1178290	so that the request response goes and comes through that proxy so that you can access the
1178290	1186670	dark web. The login program, the login function is where you will put your user agents or cookies or
1188650	1197050	so for accessing the dark web forums, you have to, so there nowadays, for all the forums,
1197050	1201690	you have to have an account to access the dark web or to access that particular forum.
1201690	1208310	So to access the forum, you need some kind of cookies or also there are many forums,
1208310	1213690	many high level forums that implement captures. And as Google doesn't work on the dark web,
1213690	1219210	these captures are like image-based capture or text-based capture that is easy to bypass.
1219290	1226590	So you can use any machine learning capture bypassing service or any capture bypassing
1226590	1231870	websites like death by capture or anti-capture to bypass the capture. So these are all codes
1231870	1239870	you will write in this login function in middleware program. Now your request or your
1239870	1245150	traffic goes through this middleware program to the downloader. What downloader does is it's a
1245150	1251230	simple program to extract the HTML and save and give it back to the engine. So downloader extract
1251230	1258430	the HTML and gives it back to the engine. Now engine gives it back to the spider. Now there's
1258430	1266050	another function in spider that extracts the HTML entities that you want from the forums HTML,
1266050	1275330	suppose forum name or document ID or the text-based data or author name who posted a
1275330	1282850	particular content. So you get that and it is called items in Scrapy. So you get these items
1282850	1289390	and it sends it to the item pipeline. Item pipeline is where your database is configured.
1289390	1295810	So I use Elasticsearch, you can use any database whether SQL or NoSQL and it directly saves the
1295810	1305470	items to the SQL. And so the important thing to note here is that Scrapy, so as I told you before
1305470	1312190	multi-threading is automatically handled by Scrapy. The another thing is you don't have to give
1312190	1318850	multiple onion domains to spider. So when the downloader gets the data, when the downloader
1318850	1327930	gets the HTML page from the particular forum, you don't have to configure the code,
1327930	1333030	there is a code to get all the onion domains on that particular HTML page. So the scheduler
1333030	1338590	automatically schedules the other onion domains to go through the same process again and again.
1339170	1346470	In this way, you don't have to give extra onion domains to the engine. And this is why Scrapy is
1347070	1356130	really useful in crawling data from the dark web. So you can specify which domain to crawl
1356130	1362390	and which domain to block. In this way, you can be safe from getting illegal data or getting
1362390	1372850	illegal images. Moving on, now comes the human part. So we discussed about the tools, what tools
1372850	1379210	can you use to hunt on the dark web. There is a human element also that's called human intelligence
1379210	1386250	or HUMINT. So it's like it's a process of gathering intelligence through interpersonal contact,
1386250	1393010	interpersonal contact rather by some kind of tools or technical process. That's why it's the most,
1393010	1399770	it's most dangerous and difficult form because you are directly talking to the actor on the dark web,
1399770	1408470	which is not safe. And it's not safe because you don't want your identity to be revealed
1408470	1415650	to the actor or you don't want your organization's identity to be revealed to the actor. And it's
1415650	1424770	important also because you can identify and respond to attacks much quickly. You can do
1424770	1431210	post-attack investigation. So suppose your organization, like there's a data breach on
1431210	1437010	your organization. If you want to confirm, so someone is selling this data on the dark web.
1437010	1442330	And if you want to confirm whether they are selling the correct, whether they are lying
1442330	1448430	about it or whether it is the truth. So you can activate your human intelligence or activate your
1449090	1456530	the guy that is researching on the dark web to go and ask to the actors whether the data is
1456530	1461870	correct or not. So that's post-attack investigation. You can also use it for new attacker
1461870	1468610	vector, new attack vector discovery. So that's discovering new TTPs that the attackers are using
1468610	1475830	or the attackers are discussing about. You can assume is as a high-tech equivalent of
1475830	1483870	what an FBI agent does when he spends months or years working to infiltrate a criminal organization.
1483870	1491590	That's why it's really hard to do it because you have to spend so much time on it. And that's why
1491590	1500170	it's risky. And for this, you have to think like an actor, how they communicate within these
1500170	1505790	communities, how they act within these communities. And the other thing is like
1505790	1512050	it's the source from this is really valuable to your organization's safety.
1514530	1520250	Now moving on, so we talked about tools, we talked about human intelligence, but now
1520250	1526350	comes the pipeline or the architecture of how you can automate these threat hunting.
1526350	1536090	So before that, I would suggest to set up a different system. You don't want your personal
1536090	1542430	data to be on the system where you are doing threat hunting. So you can set up any lab or VM,
1542430	1547690	whether physical or whether on cloud, just isolate the network and install relevant tools like
1547690	1556450	KB, Privoxy, Tor. If you are using Elasticsearch or Kibana, then Elk and different Python libraries
1556450	1563630	that would be necessary for your task. So this is the automated architecture
1564170	1572190	that I have been using it. I will go it one by one. And I have this automate icon
1572190	1579550	for the task that can be automated and for the task that I don't have, that's the only one I
1579550	1585910	think is creepy setup and the design train NLP model. So it's hard to automate that part. So
1585910	1593170	I will discuss it through. So first of all, you need to get the forums, forum links or the
1593170	1599970	market links. So you can write a simple script to gather data from different search engines like
1599970	1607370	I told you Recon and other search engines where you can get all the forum links.
1607730	1613270	So that can be automated. So another thing is using SOCKS proxy. Like I told you,
1613270	1618850	you have to use some kind of SOCKS proxy for this. So you can get SOCKS proxies IP. Again,
1618850	1624030	you can write a simple script and get the SOCKS proxies that can be automated.
1624790	1634050	Now comes the part of Scrappy setup. So Scrappy setup is is the so here you will write your
1634990	1642290	login functions here. You will get your proxy setups and here you will like
1643410	1648010	manage the settings of the Scrappy. Now, you can't automate this because
1648850	1653250	when you get the onion links or different forum onion links, you have to go to the
1653250	1661410	forums and sign in. Yes, you can automate the you can write scripts for logging in or signing in
1662170	1669290	using different accounts. But I found it difficult to do this. That's why I just I
1669290	1675010	have been using it manual. I've been doing it manually. So like creating different accounts
1675010	1682370	like four to five accounts per forum and then noting down that into the Scrappy like the username,
1682370	1688750	password and cookies into Scrappy. So for this, you have to do this. Also, you need different
1689390	1694010	scrapers for different forums, because the architecture of forums is different for
1694610	1702870	different forums. That's why you need to do this step manually, because you need to analyze,
1702870	1710010	you need to first log into the forum, analyze it, and then write a different function for each
1710010	1716830	forum for the HTML elements that you want to access. Coming to the crawler part. So
1717650	1724470	what crawler is so the crawler parser analyzer, it's and the ELK part, it's all the part of the
1724470	1730970	Scrappy that I discussed before. So these all are part of the Scrappy system. I've just written
1730970	1735930	it differently. So you can understand what each part does. So what crawler does is again,
1735930	1743090	pages from the forums, parser does it's parses the HTML pages, like getting the HTML elements
1743090	1751690	like post, post content, author, etc. And the analyzer. So analyzer part is the part,
1751690	1758430	you can write different function for this in Scrappy. So what analyzer does is so suppose
1758430	1765230	you got the data from the from the dark web forum. Now you need to use some kind of techniques to
1765230	1770770	evaluate the content that is relevant to your organization or relevant to your threat model.
1770770	1776990	So we will discuss what threat modeling is in the later part of the presentation. So for now,
1776990	1783630	just understand this, you can't focus on every other threat that's out there, you have to focus
1783630	1788990	on threat that is relevant to your organization. So you need to do some kind of analysis to
1790390	1795710	like get the data, get the relevant data from the dark web. So here comes the NLP model
1796530	1804650	that I've been using. So you can design a trained NLP model in this way that it can
1805710	1809770	just get you the content that is relevant to your organization.
1810630	1817330	So you don't, suppose if you are a bank, you don't want to focus on tools or you don't want
1817330	1823510	to focus on data breaches that's not relevant to your bank, you most likely would want to focus on
1823510	1830890	the dump shops, that's where credit cards or debit cards are being dumped. So in this way,
1830890	1835150	different organizations have different requirements, and you want to focus on those.
1835150	1841510	Now, designing and training an NLP model can't be automated because you need some kind of content
1841510	1848610	before content relevant to your threat model. And then you need to train your NLP model on that.
1849550	1856110	It's like, so it's the same thing. It's somewhat like either you get the data first or you design
1856110	1861590	your model first. So it's like egg and chicken problem. But nowadays, there are many NLP models
1861590	1872410	like CDED LDA, where you can provide some kind of context before training the NLP model.
1872910	1879970	So it's easy to do that. And then you store the data into ELK. So these all things can be
1879970	1892670	automated. So coming to the part after getting this data, so what's the process after hunting?
1892670	1896450	Now we'll discuss a little about Threat Intelligence Lifecycle.
1896730	1901230	So what Threat Intelligence Lifecycle is, these are different steps that your organization takes
1903390	1912110	to build a threat, like it starts from getting the data till presentation of the data.
1912850	1921750	So how threat hunting on the dark web corresponds to this is, so there are like five phases,
1921750	1925970	as you can see, direction, collection, processing, analysis, and dissemination.
1926690	1931950	What we are doing is, we are doing direction phase from the human sources, like you can see
1931950	1938130	from dark web social media forums. So in the direction phase, we identify dark web forums,
1938130	1944930	we register on those forums, we acquire access on those forums. In the collection phase,
1944930	1952590	you use Scrapy to establish access and collect raw data. Processing phase is also using Scrapy,
1952590	1958890	so you parse raw HTML data, you extract topics and authors. And the analysis phase is where
1958890	1965670	we use NLP and other machine learning models to infer relationship between these data.
1966030	1972030	We get data that is relevant to our organization. We link data sources, we identify trends and
1972030	1977410	hacks and leaks, etc. And dissemination phase is where we visualize the data in dashboards.
1977410	1984610	If you are using Kibana or other kind of dashboards, we give out alerts and reports
1984610	1994150	for our higher managers or the other people to see in our organization. So this is like
1994150	2000290	crux of what threat hunting on the dark web maps to threat intelligence life cycle.
2001730	2005190	Now, threat modeling. As I told you, I was going to talk about this
2005970	2014550	in the coming presentation. So what threat modeling is, it's like getting your organization's
2017310	2022610	critical assets and focusing on your organization's critical asset.
2022610	2030010	So it's like understanding threats and how you can mitigate it when it happens to your
2030010	2037310	organization particularly. So you understand what attacker wants, what different critical
2037310	2044190	assets you have in your organization, what are different types of actors that can
2044190	2049150	target you, whether they would be activists or insiders or some kind of criminal groups
2049150	2057210	and know their capability. So here you choose your target on the dark web.
2060090	2065150	So if you are a bank, you focus on credit card markets. If you are some other organization,
2065150	2069810	if you want, you focus on inside the Fed markets or you focus on general markets.
2070430	2076550	So in this way, you choose your target on the dark web. You prioritize risk as you can use
2076550	2084010	pyramid of pain for that. So you prioritize risk and focus on IOCs that are relevant to your
2084010	2093390	organization. Another thing is you don't just use one source to target, like there are many,
2093390	2099630	many forums on the dark web. You don't just focus on one target, you focus on multiple targets.
2099630	2105290	Apart from dark web, you focus on multiple clear websites also like
2105290	2113350	pastebin or Twitter or nowadays on telegram also many these many actors are communicating.
2113350	2120050	So you focus on the dark web also and the clear web also to get all the things you can
2120050	2128050	for protecting your organization. So again, data collection processing, you collect data from the
2128050	2135210	clear web and the dark web. So some of the sites are pastebin, Twitter, Reddit. On the dark web,
2135210	2140510	it's forums, different forums and different marketplaces. You can do all this using this
2140510	2148150	creepy crawler and parser that we discussed before. The analysis part in the threat intelligence
2148150	2155350	model is you use, like I told you before, you use NLP machine learning or deep learning techniques.
2156090	2163810	Some of them are like LDA, BERT, GPT to gather information related to your organization.
2164010	2172190	You use social network analysis for analysis of different users on the dark web that post
2173010	2179750	data related to your organization. There's clustering of products according to categories
2180530	2186790	for the clustering thing. You classify different. So there's like binary classification,
2186790	2191810	multi-class classification. So that's how you classify different products being sold on the
2191810	2199770	dark web. So these all things come under analysis. I will touch a little on MITRE ATT&CK framework.
2199770	2209730	So what MITRE ATT&CK is, it's a knowledge base of all the TTPs that was built
2210370	2215570	using real world observations. So it contains different tactics, techniques, and procedures
2215570	2223170	that attackers have used all these years. So you use ATT&CK matrix to map the intelligence you
2223170	2230290	obtained to understand the TTPs better and to protect your organization more.
2233500	2242440	So now coming to the operational security stuff. So hunting on the dark web or if you are doing
2242440	2246440	human intelligence stuff on the dark web, you need to follow some set of
2248700	2254720	processes so that you don't reveal your data or reveal your identity or your
2254720	2263320	organizational identity as I talked before. So what is OPSEC? So OPSEC is the practice of
2263320	2272560	hiding yourself online so that you don't reveal your real self or you don't reveal or compromise
2272560	2277740	your own operations. It's derived from the US military, that's operational security.
2278440	2290680	You need to hide your PIA, that's personal identifiable information. So you need to work
2290680	2297180	on the dark web in such a way that you don't disclose your full name or driver's license or
2297180	2304720	bank account or even a simple thing as email. This is what you need to protect and that's why
2304720	2312780	security is really important. And it's also a hard thing to do because at the end of the day,
2312780	2318960	we are all humans and we like to be seen as knowledgeable and we like to impress others.
2319020	2324800	This all leads to gossip, gossiping, bragging and oversharing with others.
2324800	2331060	That's why operational security is really hard. And most of the time people think of it as a
2331060	2336560	process. So people think that, okay, I have to do human intelligence stuff. Now I have to follow
2336560	2344480	operational security. It should not be like that. It should not be seen as a burden to perform or as
2344480	2351960	another of your job tasks to perform. It should be a mindset like you should always think about
2351960	2356880	operational security before doing human intelligence or before engaging with actors.
2357820	2364400	So I will discuss some of the things that you can use to maintain
2364400	2370980	opsec in your daily lifestyle. There are many other things. So the main thing you want is
2370980	2378240	hiding your identity. So the first thing you can do or you should do is use a separate system
2378240	2383880	like I talked about before. Also use a separate system where you don't store any personal
2383880	2395160	information. Whether it be a lab or VM or some kind of system. The main thing is to use Tor
2395960	2408280	with a proxy or Tor over VPN. The main thing is maintaining different personas on the dark web.
2408280	2415460	It's like I told, it's an equivalent of an FBI agent going undercover. So he has some kind of
2415460	2420560	persona. He has a backstory. You have to do that. You have to do the same thing. You should have
2420560	2428100	different personas for different identities that you have on different forums. You should never
2428100	2436380	mix it up. That's why you take extensive notes so that you don't mess up the personas.
2438740	2445240	You should always watch what you say and you should always think before posting.
2447240	2455000	Human intelligence is not a 95 job thing. You can't just talk to or you can't just communicate
2455000	2467200	to actors during your job time because they will know that you are doing this as your job.
2467200	2476260	In this way, you can be exposed. They can easily guess that you are a researcher and not a threat
2476260	2488400	actor. It would be a tip off for them. That's why you have to do this work 24 by 7. It's not like
2488400	2494720	you have to do this work on the weekends. You have to do this work after your work hours.
2494720	2503660	That's why it's not a 95 job thing. You have to develop appropriate language skills because
2503660	2510000	people don't talk formally like actors don't talk formally. You have to develop appropriate
2510000	2516560	language skills or slang skills. Also, there are many forums like there are different Russian
2516560	2521380	forums or German forums. You might need to develop that language skills like learning
2521380	2530640	Russian, learning German. Another thing to note is changing time zones. If you are in US and you
2530640	2536740	are accessing or you are engaging in a community on a Russian forum, you might want to change the
2536740	2544280	time zone to Russia because again, it would be a tip off to the actors that you are a security
2544280	2550380	researcher or that you are not a real actor. These are some of the things that should be noted
2550380	2553900	before doing any intelligence stuff on the dark web.
2555760	2562400	Now, that was it. So concluding all this, we discussed a little about the dark web, what dark
2562400	2568640	web is, how to access dark web. We discussed about dark web forums and marketplaces, what
2569400	2573960	different products are being sold there, what is the cost model around that.
2573960	2578340	We discussed about threat hunting on the dark web, how you can hunt on the dark web.
2578340	2585360	We discussed different tools and the main tool was scraping. That's the main framework that we
2585360	2592700	are working on to hunt on the dark web. We discussed about human intelligence, how it can be
2592700	2601980	used or how it should be used to support your tool-based data collection. We discussed about
2601980	2605700	the pipeline or the architecture that can be used to automate the dark web hunting.
2606300	2612320	We talked a little about a threat intelligence life cycle, how threat hunting on the dark web
2612320	2618360	maps to the life cycle steps. And we talked about operational security and why it is so
2618360	2629900	important and why it is so hard to do operational security. Again, some more points to notice,
2629900	2635200	it's obviously threat hunting on the dark web is hard, but it's worth the effort. You don't get
2635200	2641480	intelligence that you get from the dark web. You should always keep operational security in mind.
2642640	2648340	Like I said before, you should look on more than one resource. You should look on forums. You
2648340	2655780	could look on clear web forums also like pastebin and telegram as an example. And you should look
2655780	2661840	on different other forums on the dark web also. It takes a lot of resources and a team effort. You
2661840	2668400	can't do all these things alone. You should have a team for this. And we talked a little about
2668400	2678220	usage of MITRE attack framework and how it can be useful to map your TTPs to that.
2679880	2686320	These are some of the resources that I suggest you to read if you want to know more about the
2686320	2692840	dark web stuff or dark web hunting stuff. The majority, the major ones are like a recorded
2692840	2699920	feature insight, CrowdStrike, digital shadows. They release their blogs or white papers regularly.
2699920	2707140	So read them and you'll understand what all things are there on the dark web.
2710100	2717520	So yeah, that was it. I think, thank you so much. I hope you all liked my presentation and
2717520	2723080	you can contact me on Twitter or LinkedIn if you have any doubt or if you want to discuss
2723080	2730920	about this stuff more. I will hang on in discord to answer all your questions. So yeah, thank you.