1
00:00:00,087 --> 00:00:01,170
- All right this afternoon,

2
00:00:01,170 --> 00:00:03,683
we're gonna learn a little
bit about Darknet OpSec.

3
00:00:05,700 --> 00:00:06,960
Pretty interesting talk,

4
00:00:06,960 --> 00:00:08,980
please welcome our first time at DEF CON

5
00:00:09,901 --> 00:00:12,249
and first time speaker Sam Bent.

6
00:00:12,249 --> 00:00:15,416
(audience applauding)

7
00:00:18,660 --> 00:00:20,310
- Thank you, it's great to be here.

8
00:00:20,310 --> 00:00:22,353
I never thought I'd be up on this stage.

9
00:00:23,292 --> 00:00:27,180
So my talk is about Darknet OpSec

10
00:00:27,180 --> 00:00:29,790
from the point of view of myself.

11
00:00:29,790 --> 00:00:31,649
Some of the precautions,

12
00:00:31,649 --> 00:00:33,270
some of the things that
I did as a darknet vendor

13
00:00:33,270 --> 00:00:36,690
to try to keep myself safe
from the federal government

14
00:00:36,690 --> 00:00:39,423
and other adversaries
that existed out there.

15
00:00:40,860 --> 00:00:43,053
So these are my aliases.

16
00:00:44,400 --> 00:00:45,600
I have a couple of them.

17
00:00:48,664 --> 00:00:51,439
My day job involves me
writing documentation,

18
00:00:51,439 --> 00:00:54,093
pretty dry stuff, but I enjoy doing it.

19
00:00:55,830 --> 00:00:57,030
While my night job,

20
00:00:57,030 --> 00:00:58,863
I'm a prison advocate,

21
00:00:59,856 --> 00:01:02,820
so I do a lot of outreach
work and try to help people

22
00:01:02,820 --> 00:01:06,360
and guide people through the myriad

23
00:01:06,360 --> 00:01:08,490
that is the federal prison system.

24
00:01:08,490 --> 00:01:11,264
Whether it's them going into it

25
00:01:11,264 --> 00:01:12,750
or their family members going into it.

26
00:01:12,750 --> 00:01:14,250
I have about 54 slides,

27
00:01:14,250 --> 00:01:17,133
so I'm gonna have to move
pretty quick once I start.

28
00:01:18,900 --> 00:01:21,360
So I've worked not only
as a darknet vendor,

29
00:01:21,360 --> 00:01:25,230
but also worked on
multiple darknet markets,

30
00:01:25,230 --> 00:01:29,760
done PR work for them as
well as resolved disputes

31
00:01:29,760 --> 00:01:32,373
for customers, things like that.

32
00:01:33,750 --> 00:01:37,050
My objective with this talk is to give

33
00:01:37,050 --> 00:01:40,261
a different perspective
than typically what's given

34
00:01:40,261 --> 00:01:42,663
at conferences or on the mainstream media,

35
00:01:43,650 --> 00:01:45,540
from someone who's actually been there,

36
00:01:45,540 --> 00:01:49,413
not just studied it from a
distance or speculated on it.

37
00:01:53,460 --> 00:01:56,138
So there are a lot of similarities

38
00:01:56,138 --> 00:02:00,654
between the darknet subculture
and the hacking subculture.

39
00:02:00,654 --> 00:02:04,950
Both of them typically
involve some kind of paranoia

40
00:02:04,950 --> 00:02:08,613
and a lot of times that
paranoia is there for a reason.

41
00:02:09,960 --> 00:02:14,960
Both very much value
their anonymity, secrecy,

42
00:02:15,390 --> 00:02:16,770
intellectual dominance,

43
00:02:16,770 --> 00:02:20,013
especially in the hacking
realm or in the hacking scene,

44
00:02:21,240 --> 00:02:26,100
but also there's a bit of
a learning curve to each.

45
00:02:26,100 --> 00:02:28,574
I would argue that the hacking scene

46
00:02:28,574 --> 00:02:32,637
has a much greater learning
curve than the darknet,

47
00:02:32,637 --> 00:02:34,915
especially because in
order to be a hacker,

48
00:02:34,915 --> 00:02:36,480
you don't just start up tour.

49
00:02:36,480 --> 00:02:38,537
There's a lot that goes into it,

50
00:02:38,537 --> 00:02:39,563
depending on what you're doing.

51
00:02:41,010 --> 00:02:44,853
So the paths between being
a hacker on a darknet vendor

52
00:02:44,853 --> 00:02:46,293
can differentiate too.

53
00:02:47,370 --> 00:02:49,475
As a hacker, you start off really

54
00:02:49,475 --> 00:02:50,820
with no adversaries whatsoever.

55
00:02:50,820 --> 00:02:52,650
You don't have anyone
that's out to get you.

56
00:02:52,650 --> 00:02:55,833
You know, when you hop on
IRC for the first time,

57
00:02:57,480 --> 00:03:00,360
you can learn almost everything.

58
00:03:00,360 --> 00:03:03,180
As far as the process goes for a pen test

59
00:03:03,180 --> 00:03:05,910
inside of things like
the pen test standard.

60
00:03:05,910 --> 00:03:08,790
A lot of what we do is
open source at this point.

61
00:03:08,790 --> 00:03:11,939
You can watch a DEF CON
talk and learn a lot about

62
00:03:11,939 --> 00:03:15,660
what it is that hackers do or the culture,

63
00:03:15,660 --> 00:03:17,640
or just be here in this room,

64
00:03:17,640 --> 00:03:18,633
come to DEF CON.

65
00:03:19,740 --> 00:03:22,680
That doesn't exist in the darknet.

66
00:03:22,680 --> 00:03:25,599
You can't, you know, just hop on

67
00:03:25,599 --> 00:03:27,700
and watch a YouTube video and learn

68
00:03:27,700 --> 00:03:28,860
about darknet subculture.

69
00:03:28,860 --> 00:03:31,360
It's something that you
have to hop on the darknet

70
00:03:32,197 --> 00:03:33,739
and you have to explore and learn

71
00:03:33,739 --> 00:03:37,713
and meet people and hopefully
be safe in doing it.

72
00:03:39,720 --> 00:03:43,980
The sources for information are
completely different for me.

73
00:03:43,980 --> 00:03:48,930
My favorite always was
as a darknet vendor,

74
00:03:48,930 --> 00:03:50,250
darknet news sites,

75
00:03:50,250 --> 00:03:54,404
dark.fail is one that's been
around for quite a while

76
00:03:54,404 --> 00:03:56,340
and is pretty good.

77
00:03:56,340 --> 00:04:00,630
Dread is a forum that's
one of the most active

78
00:04:00,630 --> 00:04:02,380
on the darknet from what I've seen.

79
00:04:10,200 --> 00:04:13,080
So there's a book that Kevin Mitnick wrote

80
00:04:13,080 --> 00:04:14,613
called "Ghost in the Wires"

81
00:04:15,539 --> 00:04:20,010
and I took his approach when looking

82
00:04:20,010 --> 00:04:23,370
at operational security from that,

83
00:04:23,370 --> 00:04:26,190
specifically the part where he called up

84
00:04:26,190 --> 00:04:29,100
law enforcement and social engineered them

85
00:04:29,100 --> 00:04:32,823
to allow him to use the
NCIS system that they have.

86
00:04:34,050 --> 00:04:36,210
I feel that a lot of the information

87
00:04:36,210 --> 00:04:38,770
that you could want or would be relevant

88
00:04:39,930 --> 00:04:42,153
is located in manuals.

89
00:04:44,940 --> 00:04:49,050
And if we know how law
enforcement operates,

90
00:04:49,050 --> 00:04:50,880
we're trying to be criminals,

91
00:04:50,880 --> 00:04:53,030
then we know what
they're going to do next.

92
00:04:54,630 --> 00:04:56,180
It's like having a cheat sheet.

93
00:04:57,690 --> 00:04:59,043
So with that,

94
00:04:59,940 --> 00:05:02,730
I ended up going and looking and finding

95
00:05:02,730 --> 00:05:05,100
United States Postal Inspector's manual

96
00:05:05,100 --> 00:05:08,280
to see what he classified
as a suspicious package.

97
00:05:08,280 --> 00:05:10,380
I needed to know that if
I was going to be shipping

98
00:05:10,380 --> 00:05:12,723
narcotics through the United States mail.

99
00:05:14,280 --> 00:05:16,380
So this information's out there,

100
00:05:16,380 --> 00:05:19,920
this is not it, but this is an example

101
00:05:19,920 --> 00:05:22,680
of some of the things
that you would look at

102
00:05:22,680 --> 00:05:25,110
when evaluating things like this.

103
00:05:25,110 --> 00:05:27,630
It'd be an eclectic process where you take

104
00:05:27,630 --> 00:05:29,703
what's valuable and leave what's not.

105
00:05:31,590 --> 00:05:34,830
Some of the things that
would raise suspicion

106
00:05:34,830 --> 00:05:38,121
when you're trying to move drugs

107
00:05:38,121 --> 00:05:39,870
through the United States mail system

108
00:05:39,870 --> 00:05:42,120
would be using too much tape,

109
00:05:42,120 --> 00:05:43,920
handwriting the labels,

110
00:05:43,920 --> 00:05:47,520
if you don't use the official USPS boxes,

111
00:05:47,520 --> 00:05:50,430
fake names on recipients
or return addresses,

112
00:05:50,430 --> 00:05:53,730
all of these things add up as red flags

113
00:05:53,730 --> 00:05:58,110
that ultimately leads to the
United States postal inspector

114
00:05:58,110 --> 00:06:00,963
possibly applying for a
search warrant for a box.

115
00:06:04,740 --> 00:06:08,460
So in order to avoid these,
you just don't do those things.

116
00:06:08,460 --> 00:06:10,303
It's pretty straightforward.

117
00:06:10,303 --> 00:06:11,940
It's like reverse
engineering law enforcement

118
00:06:11,940 --> 00:06:13,650
to some degree.

119
00:06:13,650 --> 00:06:17,490
For me, I had a moral dilemma
when I wanted to ship drugs,

120
00:06:17,490 --> 00:06:18,630
which is kind of ironic.

121
00:06:18,630 --> 00:06:21,030
I didn't want to send,

122
00:06:21,030 --> 00:06:26,030
say cocaine from some
random person's address.

123
00:06:26,700 --> 00:06:30,075
You know, there's a lot of
hardworking people in the world.

124
00:06:30,075 --> 00:06:33,060
And to me sending out four ounces of blow

125
00:06:33,060 --> 00:06:35,020
to some guy who's a construction worker

126
00:06:35,855 --> 00:06:36,688
and just trying to make ends meet

127
00:06:36,688 --> 00:06:39,690
and have DHS break through his door

128
00:06:39,690 --> 00:06:41,940
really wasn't the best way to go about it.

129
00:06:41,940 --> 00:06:45,570
And I was sure that
somewhere there existed

130
00:06:45,570 --> 00:06:49,720
a database of people that
I considered personally

131
00:06:50,580 --> 00:06:52,953
to be people okay to screw over.

132
00:06:54,159 --> 00:06:57,375
(audience laughs)

133
00:06:57,375 --> 00:06:59,760
So I searched for it and
I tried to figure out

134
00:06:59,760 --> 00:07:01,500
what that database would be,

135
00:07:01,500 --> 00:07:05,130
how it would look and how I
would be able to access it.

136
00:07:05,130 --> 00:07:09,090
And the only solution that I
could come up with was this.

137
00:07:10,249 --> 00:07:14,499
(audience laughing and applauding)

138
00:07:19,350 --> 00:07:22,920
So remember I said, you need
to have a valid return address.

139
00:07:22,920 --> 00:07:25,230
It needs to be the correct name.

140
00:07:25,230 --> 00:07:28,114
It needs to be the correct address,

141
00:07:28,114 --> 00:07:30,150
all of these had that.

142
00:07:30,150 --> 00:07:33,240
So they qualified and they made them real.

143
00:07:33,240 --> 00:07:36,750
And if it got sent back to them

144
00:07:36,750 --> 00:07:38,250
or if they got raided,

145
00:07:38,250 --> 00:07:41,370
I didn't really have any qualms in that.

146
00:07:41,370 --> 00:07:43,489
And it was interesting

147
00:07:43,489 --> 00:07:46,436
because the Department
of Homeland Security's

148
00:07:46,436 --> 00:07:49,110
special agent that was in charge

149
00:07:49,110 --> 00:07:50,970
when they ended up raiding me,

150
00:07:50,970 --> 00:07:54,093
felt the exact same
while this crowd feels,

151
00:07:55,440 --> 00:07:58,212
he laughed about it too, he
thought it was hilarious.

152
00:07:58,212 --> 00:07:59,700
(audience laughs)

153
00:07:59,700 --> 00:08:02,310
So when I ship,

154
00:08:02,310 --> 00:08:04,920
the thing that I came to my conclusion

155
00:08:04,920 --> 00:08:07,680
was you can pick obviously you have a ton

156
00:08:07,680 --> 00:08:09,120
of different services that you can use

157
00:08:09,120 --> 00:08:11,193
to ship anything nowadays.

158
00:08:12,090 --> 00:08:16,613
My favorite by far is the
United States Postal Service.

159
00:08:16,613 --> 00:08:19,593
And there's a few reasons for that,

160
00:08:20,910 --> 00:08:23,970
private services like DHL or UPS,

161
00:08:23,970 --> 00:08:27,090
they can open up your
package whenever they want.

162
00:08:27,090 --> 00:08:28,992
There's no rules in that.

163
00:08:28,992 --> 00:08:29,933
They're a private corporation,

164
00:08:30,840 --> 00:08:35,700
but a warrant is required
for USPS to be able

165
00:08:35,700 --> 00:08:36,693
to open something.

166
00:08:38,070 --> 00:08:41,580
They also have more
locations than anyone else,

167
00:08:41,580 --> 00:08:44,130
and they can get to your
door from tour to door

168
00:08:44,130 --> 00:08:47,460
in three days, which is great,

169
00:08:47,460 --> 00:08:49,290
especially if you're
going for good reviews

170
00:08:49,290 --> 00:08:50,801
on the darknet, you know.

171
00:08:50,801 --> 00:08:52,710
(audience laughs)

172
00:08:52,710 --> 00:08:55,410
So it is run by the federal government,

173
00:08:55,410 --> 00:08:59,430
which is kind of, you know,
it's kind of an ironic thing

174
00:08:59,430 --> 00:09:01,317
that the people that are hunting you,

175
00:09:01,317 --> 00:09:03,660
you know, a branch of their system

176
00:09:03,660 --> 00:09:05,460
is going to be enabling you

177
00:09:05,460 --> 00:09:10,290
to traffic drugs on a national
or an international level.

178
00:09:10,290 --> 00:09:14,590
It's kind of, I guess you say
like a spiteful thing to do

179
00:09:15,930 --> 00:09:18,360
where you're having the feds

180
00:09:18,360 --> 00:09:19,653
send you drugs for you.

181
00:09:22,920 --> 00:09:24,870
So the other thing to take into account

182
00:09:24,870 --> 00:09:29,340
is the amount of packages that exist.

183
00:09:29,340 --> 00:09:33,130
How hard is it to find my one package out

184
00:09:34,051 --> 00:09:35,583
of that 21.5 billion?

185
00:09:36,960 --> 00:09:38,430
You'd probably have a better chance

186
00:09:38,430 --> 00:09:40,500
at winning the powerball,

187
00:09:40,500 --> 00:09:43,260
especially because I'm well aware of

188
00:09:43,260 --> 00:09:45,000
what you're looking for

189
00:09:45,000 --> 00:09:46,650
when it comes to a suspicious package

190
00:09:46,650 --> 00:09:49,300
and none of my packages are
ever gonna look that way.

191
00:09:50,640 --> 00:09:53,220
And we compare 'em to some
of the other shippers,

192
00:09:53,220 --> 00:09:55,710
and you can see the
numbers are pretty drastic

193
00:09:55,710 --> 00:09:57,273
in terms of differences.

194
00:09:58,350 --> 00:10:00,930
Drug sniffing dogs compared
to like a lot of people

195
00:10:00,930 --> 00:10:03,000
think, drug sniffing dogs, they don't work

196
00:10:03,000 --> 00:10:04,320
eight hour shifts.

197
00:10:04,320 --> 00:10:05,253
They're sporadic.

198
00:10:06,390 --> 00:10:10,307
You can't work them like you
could an Amazon employee.

199
00:10:10,307 --> 00:10:13,140
(audience laughs)

200
00:10:14,638 --> 00:10:16,110
So that's one thing,

201
00:10:16,110 --> 00:10:18,615
but then you take into account permeation,

202
00:10:18,615 --> 00:10:20,880
which is where a smell
can go through an object.

203
00:10:20,880 --> 00:10:22,230
All those things come into play.

204
00:10:22,230 --> 00:10:25,080
When I would ship, I would
ship two to three day.

205
00:10:25,080 --> 00:10:26,130
There's not enough time for it

206
00:10:26,130 --> 00:10:28,140
to come through vacuum sealed bags

207
00:10:28,140 --> 00:10:31,083
and a visual barrier
in that amount of time.

208
00:10:32,580 --> 00:10:34,890
So on top of that, like when you get,

209
00:10:34,890 --> 00:10:37,110
if your drugs do get intercepted,

210
00:10:37,110 --> 00:10:39,520
what happens is you get a notice

211
00:10:40,391 --> 00:10:41,550
and we call it a love letter

212
00:10:41,550 --> 00:10:43,800
and it comes from USPS typically,

213
00:10:43,800 --> 00:10:46,083
or customs if it's an overseas order.

214
00:10:47,790 --> 00:10:51,270
And they just say that we've
intercepted your drugs,

215
00:10:51,270 --> 00:10:53,474
they don't say it like that.

216
00:10:53,474 --> 00:10:54,951
They say, we have your package,

217
00:10:54,951 --> 00:10:57,840
please come to the post office
and pick up your package.

218
00:10:57,840 --> 00:11:00,240
Once you show up with that letter,

219
00:11:00,240 --> 00:11:03,810
you're acknowledging
that that's your package.

220
00:11:03,810 --> 00:11:06,330
Because aside from that,
they can't prove it's yours.

221
00:11:06,330 --> 00:11:08,970
They can't, you didn't
order this on Amazon.

222
00:11:08,970 --> 00:11:12,450
So they can't hop on and see, you know,

223
00:11:12,450 --> 00:11:15,150
your credit card transaction,

224
00:11:15,150 --> 00:11:17,170
where you bought these drugs.

225
00:11:17,170 --> 00:11:19,570
You bought it in Bitcoin or your Monero

226
00:11:19,570 --> 00:11:22,920
or any one of the available
options that existed to you.

227
00:11:22,920 --> 00:11:24,570
So they rely on things like that.

228
00:11:25,591 --> 00:11:27,030
So, you know, your
countermeasure for when you get

229
00:11:27,030 --> 00:11:29,070
a love letter is to burn it

230
00:11:29,070 --> 00:11:32,553
or throw it away, it's relevant.

231
00:11:33,510 --> 00:11:36,270
So the other thing that
law enforcement likes to do

232
00:11:36,270 --> 00:11:38,928
on occasion is controlled deliveries

233
00:11:38,928 --> 00:11:41,970
and controlled deliveries,
a little bit more aggressive

234
00:11:41,970 --> 00:11:43,440
obviously than a love letter.

235
00:11:43,440 --> 00:11:46,410
But again, you have
countermeasures for that as well.

236
00:11:46,410 --> 00:11:49,293
You have no obligation to
open your door for anyone.

237
00:11:50,340 --> 00:11:53,004
And if they had, you know,
even if there was the police,

238
00:11:53,004 --> 00:11:55,470
if they had permission
to come into your house,

239
00:11:55,470 --> 00:11:57,300
they wouldn't be knocking, right?

240
00:11:57,300 --> 00:12:00,240
They'd be kicking in the
door and they'd be coming in

241
00:12:00,240 --> 00:12:02,460
and they'd be taking you out.

242
00:12:02,460 --> 00:12:05,070
So it's all voluntary.

243
00:12:05,070 --> 00:12:06,870
You answering that door
and it's the same thing

244
00:12:06,870 --> 00:12:08,020
with delivery services.

245
00:12:08,889 --> 00:12:10,886
You can just not answer that door.

246
00:12:10,886 --> 00:12:12,870
I mean, a lot of the times darknet vendors

247
00:12:12,870 --> 00:12:14,680
are not gonna require signature

248
00:12:15,570 --> 00:12:18,900
because it would be like,
you know, requiring you

249
00:12:18,900 --> 00:12:21,270
to give your real name when you're using

250
00:12:21,270 --> 00:12:23,160
a handle as a hacker.

251
00:12:23,160 --> 00:12:24,480
It's just not something you're gonna do.

252
00:12:24,480 --> 00:12:28,380
If I ask you on an IRC
chat, what's your real name?

253
00:12:28,380 --> 00:12:29,790
And we just met.

254
00:12:29,790 --> 00:12:33,540
How willing are you gonna be
to give that information over?

255
00:12:33,540 --> 00:12:34,833
Probably not likely.

256
00:12:37,537 --> 00:12:41,580
So from that, there are
countermeasures for it.

257
00:12:41,580 --> 00:12:44,400
So sometimes they'll
put devices in the box

258
00:12:44,400 --> 00:12:47,490
and we'll just let the
box sit for 24 hours

259
00:12:47,490 --> 00:12:50,760
or 48 hours or three
days until the batteries

260
00:12:50,760 --> 00:12:53,250
in that device if it's small die,

261
00:12:53,250 --> 00:12:55,080
or if they're using something local,

262
00:12:55,080 --> 00:12:56,313
like a radio frequency,

263
00:12:57,508 --> 00:12:59,949
we travel open the box up 10 miles away,

264
00:12:59,949 --> 00:13:01,890
any transmitter they have in there

265
00:13:01,890 --> 00:13:03,363
would be well at a distance.

266
00:13:05,190 --> 00:13:07,320
So if you do it well,

267
00:13:07,320 --> 00:13:09,543
this is what they should know about you.

268
00:13:11,048 --> 00:13:12,660
It should be nothing.

269
00:13:12,660 --> 00:13:15,273
It should be, oh yeah,
he's the computer guy.

270
00:13:19,170 --> 00:13:22,910
So in making an image for
yourself on the darknet,

271
00:13:22,910 --> 00:13:26,580
one of the best ways I found
to do that was to be helpful.

272
00:13:26,580 --> 00:13:29,820
And, you know, just like on a
social engineering campaign,

273
00:13:29,820 --> 00:13:33,753
if you're disingenuine people
pick that up very quickly.

274
00:13:34,920 --> 00:13:36,720
It's like flattery, you
know a lot of times,

275
00:13:36,720 --> 00:13:40,710
flattery has the opposite effect
that you intended to have.

276
00:13:40,710 --> 00:13:43,780
So being disingenuous
in darknet is something

277
00:13:45,008 --> 00:13:48,690
that can be picked up by some people.

278
00:13:48,690 --> 00:13:50,910
And a lot of people find it repulsive,

279
00:13:50,910 --> 00:13:52,902
just like you do in real life.

280
00:13:52,902 --> 00:13:54,570
When someone compliments
you for the fifth time

281
00:13:54,570 --> 00:13:55,473
on your shoes.

282
00:13:57,150 --> 00:14:00,660
So my move was to contribute 5,000 posts

283
00:14:00,660 --> 00:14:03,180
and I did that on Hansa in a month.

284
00:14:03,180 --> 00:14:06,750
And by doing that, basically
everyone in that community

285
00:14:06,750 --> 00:14:10,260
now associates my name with good things,

286
00:14:10,260 --> 00:14:11,850
with helping out with OpSec,

287
00:14:11,850 --> 00:14:15,203
with, you know, enjoying
helping other people.

288
00:14:15,203 --> 00:14:18,964
And that's the kind of the
irony is everyone seems

289
00:14:18,964 --> 00:14:21,000
to think about the darknet
as this horrible place

290
00:14:21,000 --> 00:14:25,080
where, you know, there are
really bad things on there.

291
00:14:25,080 --> 00:14:28,350
It's not up for debate,
but at the same time,

292
00:14:28,350 --> 00:14:31,230
not everyone on there is a psychopath.

293
00:14:31,230 --> 00:14:33,633
You know, a lot of times it's just people.

294
00:14:34,680 --> 00:14:35,850
So with that,

295
00:14:35,850 --> 00:14:38,640
I was able to establish rapid
rapport in that community.

296
00:14:38,640 --> 00:14:39,473
People knew me

297
00:14:40,599 --> 00:14:41,520
and when someone came in there

298
00:14:41,520 --> 00:14:43,050
just like any other community,

299
00:14:43,050 --> 00:14:45,450
if you come into any
community and you start,

300
00:14:45,450 --> 00:14:47,761
you know, threatening someone,

301
00:14:47,761 --> 00:14:49,110
or like, you know, if someone came in here

302
00:14:49,110 --> 00:14:51,480
and started saying a well-known speaker

303
00:14:51,480 --> 00:14:53,878
didn't know what he was talking about,

304
00:14:53,878 --> 00:14:56,003
the community would probably
revolt against that.

305
00:14:56,003 --> 00:14:57,060
They wouldn't like that very much.

306
00:14:57,060 --> 00:14:59,220
You have the same thing in the darknet,

307
00:14:59,220 --> 00:15:02,130
but instead of having that trust,

308
00:15:02,130 --> 00:15:03,720
you have that verification through things

309
00:15:03,720 --> 00:15:06,450
like PGP signatures and sign messages

310
00:15:06,450 --> 00:15:08,700
and all, you know, stuff like that.

311
00:15:08,700 --> 00:15:12,300
When we look at the
history and the present

312
00:15:12,300 --> 00:15:17,300
and the future of reconnaissance
and information gathering

313
00:15:17,310 --> 00:15:19,890
when it comes to law enforcement,

314
00:15:19,890 --> 00:15:21,570
there are a few different countermeasures

315
00:15:21,570 --> 00:15:24,690
a darknet vendor can
take if he's informed,

316
00:15:24,690 --> 00:15:26,460
if he knows enough about it.

317
00:15:26,460 --> 00:15:28,380
My thing was to hop on PACER,

318
00:15:28,380 --> 00:15:30,720
like you might see the
department of justice

319
00:15:30,720 --> 00:15:33,480
announce a darknet bust,
but they don't really

320
00:15:33,480 --> 00:15:35,524
give you details, PACER will.

321
00:15:35,524 --> 00:15:39,420
PACER is the place where
you can find federal cases.

322
00:15:39,420 --> 00:15:41,970
You can find the United
States attorney's wording

323
00:15:41,970 --> 00:15:44,310
and how they caught that person,

324
00:15:44,310 --> 00:15:47,610
what that person did,
where they screwed up.

325
00:15:47,610 --> 00:15:49,530
Again, if we can look and we can map out

326
00:15:49,530 --> 00:15:50,520
how they screwed up,

327
00:15:50,520 --> 00:15:52,530
we can make it so that we never screw up.

328
00:15:52,530 --> 00:15:55,680
We never make those same mistakes
that our predecessors did.

329
00:15:55,680 --> 00:15:57,360
And we're playing in this game

330
00:15:57,360 --> 00:15:59,190
you're playing for keeps,

331
00:15:59,190 --> 00:16:00,990
you know, messing up here doesn't mean

332
00:16:00,990 --> 00:16:04,920
that this particular assignment,

333
00:16:04,920 --> 00:16:08,370
you have to go find another
penetration testing engagement.

334
00:16:08,370 --> 00:16:10,710
It means that you're
going to federal prison.

335
00:16:10,710 --> 00:16:13,043
So it's not something you wanna screw up.

336
00:16:13,043 --> 00:16:16,724
So tend to tread a lot more carefully,

337
00:16:16,724 --> 00:16:19,860
even when it comes to things
like cashing out crypto

338
00:16:19,860 --> 00:16:22,800
or, you know, making it so that the chain

339
00:16:22,800 --> 00:16:25,770
that law enforcement uses to trace you

340
00:16:25,770 --> 00:16:28,470
or trace your transactions
is a lot harder to uncover.

341
00:16:31,980 --> 00:16:35,580
So from what I've seen on the darknet,

342
00:16:35,580 --> 00:16:38,430
the majority of the time
that darknet sites actually

343
00:16:38,430 --> 00:16:42,210
get taken down is not from law enforcement

344
00:16:42,210 --> 00:16:43,503
being highly talented.

345
00:16:44,580 --> 00:16:47,370
It's from just a administrator,

346
00:16:47,370 --> 00:16:50,820
making a stupid OpSec
mistake or not updating

347
00:16:50,820 --> 00:16:52,980
or getting complacent, right?

348
00:16:52,980 --> 00:16:55,680
Because we have that kind of sliding scale

349
00:16:55,680 --> 00:16:57,420
where we have complacency on one side

350
00:16:57,420 --> 00:16:58,950
and security on the other.

351
00:16:58,950 --> 00:17:02,910
And time seems to be a
variable that wears that down

352
00:17:02,910 --> 00:17:05,260
to the other side where
they become complacent.

353
00:17:09,420 --> 00:17:14,230
So Reddit ended up banning darknet markets

354
00:17:16,918 --> 00:17:20,130
and our response was to create Dread.

355
00:17:20,130 --> 00:17:24,499
Hugbunter is famously known
as the one who created it.

356
00:17:24,499 --> 00:17:29,370
He created it and he ended up making it

357
00:17:29,370 --> 00:17:31,800
and making it public as a replacement

358
00:17:31,800 --> 00:17:33,480
for darknet markets,

359
00:17:33,480 --> 00:17:37,170
which is a massive subreddit
and their ban of it

360
00:17:37,170 --> 00:17:38,897
came out of nowhere.

361
00:17:38,897 --> 00:17:41,400
And what it did was it
made it so that people

362
00:17:41,400 --> 00:17:42,630
on the clearnet or people
that weren't using Tor,

363
00:17:42,630 --> 00:17:45,540
it made 'em a lot harder to
get their questions answered

364
00:17:45,540 --> 00:17:47,320
on how to navigate the darknet.

365
00:17:48,630 --> 00:17:51,750
And that removal of
information was a tactic used

366
00:17:51,750 --> 00:17:54,090
by law enforcement to try to stop people

367
00:17:54,090 --> 00:17:55,510
from using the darknet.

368
00:17:56,880 --> 00:17:59,430
And that was our answer was Dread,

369
00:17:59,430 --> 00:18:01,053
which I was an administrator on.

370
00:18:07,410 --> 00:18:09,690
So when you get started,

371
00:18:09,690 --> 00:18:12,030
you wanna look at a few different things.

372
00:18:12,030 --> 00:18:15,873
Your main goal obviously
is to avoid incarceration,

373
00:18:16,740 --> 00:18:18,093
avoid arrest.

374
00:18:20,057 --> 00:18:23,130
You wanna create a secure persona.

375
00:18:23,130 --> 00:18:26,040
Sometimes it's good to
create multiple personas

376
00:18:26,040 --> 00:18:27,423
and have them all age.

377
00:18:30,360 --> 00:18:33,540
Your ultimate goal is to not get arrested.

378
00:18:33,540 --> 00:18:34,980
And if you do screw something up,

379
00:18:34,980 --> 00:18:36,873
that's what's going to happen.

380
00:18:38,730 --> 00:18:42,540
You are successful as long as
you're not in federal custody.

381
00:18:42,540 --> 00:18:46,713
And once you are as far
too late to go back,

382
00:18:49,230 --> 00:18:51,810
my suggestion is to map
out and have responses

383
00:18:51,810 --> 00:18:53,730
to any type of incident that may occur.

384
00:18:53,730 --> 00:18:57,150
Just like a major company
has security policies,

385
00:18:57,150 --> 00:18:59,859
you know, they set up
and countermeasure set up

386
00:18:59,859 --> 00:19:03,360
to be able to handle
anything that goes wrong.

387
00:19:03,360 --> 00:19:05,820
It's the responsibility of that person

388
00:19:05,820 --> 00:19:09,840
who's going to be, you know,
dealing in transactions

389
00:19:09,840 --> 00:19:11,590
to make sure that they do the same.

390
00:19:15,420 --> 00:19:19,049
So some of the threats that
exist are physical threats

391
00:19:19,049 --> 00:19:21,360
like DNA.

392
00:19:21,360 --> 00:19:23,220
If that darknet vendor
doesn't know anything

393
00:19:23,220 --> 00:19:26,760
about physical security
or operational security

394
00:19:26,760 --> 00:19:28,326
or anything like that,

395
00:19:28,326 --> 00:19:31,044
he might assume that, you
know, they're not gonna

396
00:19:31,044 --> 00:19:33,900
go through the effort of
looking for skin cells

397
00:19:33,900 --> 00:19:37,140
or analyzing a package heavily.

398
00:19:37,140 --> 00:19:40,590
And the fact of the matter is
if you don't know it for sure,

399
00:19:40,590 --> 00:19:43,283
then you're always better
airing on the side of caution.

400
00:19:44,730 --> 00:19:47,404
Noisy neighbors, these kind of, you know,

401
00:19:47,404 --> 00:19:49,980
if you have issues with your neighbors,

402
00:19:49,980 --> 00:19:52,113
they don't like you that's an adversary.

403
00:19:54,510 --> 00:19:56,360
You know, they can call up,

404
00:19:56,360 --> 00:19:58,086
even though wellness check,

405
00:19:58,086 --> 00:20:02,430
anyone can write an email to the FBI.

406
00:20:02,430 --> 00:20:05,490
You know, I see 'em come
in with 20 packages a day.

407
00:20:05,490 --> 00:20:07,653
It's abnormal, it's a red flag.

408
00:20:09,390 --> 00:20:12,030
Bluetooth, wifi attacks, all those things

409
00:20:12,030 --> 00:20:14,443
that we know very well,

410
00:20:14,443 --> 00:20:17,313
you know, people in this
con understand very well.

411
00:20:18,600 --> 00:20:20,550
Trash is another one.

412
00:20:20,550 --> 00:20:23,910
It's always better to shred
it or burn it if possible.

413
00:20:23,910 --> 00:20:26,430
It's a lot of these same security measures

414
00:20:26,430 --> 00:20:28,020
that we take in this field,

415
00:20:28,020 --> 00:20:31,050
safeguarding corporations are the things

416
00:20:31,050 --> 00:20:33,870
that you will see a responsible
darknet vendor take.

417
00:20:33,870 --> 00:20:36,810
The only difference is
instead of having teams do it

418
00:20:36,810 --> 00:20:39,120
and millions of dollars to do it,

419
00:20:39,120 --> 00:20:40,590
they're stuck trying to figure it out

420
00:20:40,590 --> 00:20:42,183
and do it all themselves.

421
00:20:43,950 --> 00:20:47,220
Which is why, one of
the things that creates

422
00:20:47,220 --> 00:20:49,830
that low hanging fruit
for law enforcement,

423
00:20:49,830 --> 00:20:51,780
those people who don't
understand encryption

424
00:20:51,780 --> 00:20:54,330
or don't know fully about OpSec,

425
00:20:54,330 --> 00:20:56,580
and maybe they're just drug traffickers.

426
00:20:56,580 --> 00:20:58,530
They don't have a background in that.

427
00:20:58,530 --> 00:21:01,830
Another thing is linguistical analytics

428
00:21:01,830 --> 00:21:04,530
is something I always
try to keep mindful of.

429
00:21:04,530 --> 00:21:07,297
If I'm writing on the darknet on a forum,

430
00:21:07,297 --> 00:21:08,970
I'm from New England.

431
00:21:08,970 --> 00:21:11,220
So we tend to say the word like wicked

432
00:21:11,220 --> 00:21:13,800
to describe something as very,

433
00:21:13,800 --> 00:21:16,050
you know, so if I say this
is a wicked good talk,

434
00:21:16,050 --> 00:21:18,319
it means it's a very good talk.

435
00:21:18,319 --> 00:21:20,730
And with that said,

436
00:21:20,730 --> 00:21:24,310
if I use that terminology in a forum

437
00:21:25,320 --> 00:21:26,910
and law enforcement picks that up,

438
00:21:26,910 --> 00:21:30,030
now they know, okay, this
guy's from New England

439
00:21:30,030 --> 00:21:31,950
or this guy's from Massachusetts.

440
00:21:31,950 --> 00:21:35,640
You know, tey can get detailed information

441
00:21:35,640 --> 00:21:39,000
on where I am based on
that and that's a threat.

442
00:21:39,000 --> 00:21:42,030
That's a problem and something that,

443
00:21:42,030 --> 00:21:44,220
again, a lot of people,
they don't think about

444
00:21:44,220 --> 00:21:45,739
when they go into it

445
00:21:45,739 --> 00:21:47,220
and there's no manual for this.

446
00:21:47,220 --> 00:21:48,720
You know, unlike the hacking culture,

447
00:21:48,720 --> 00:21:50,700
we've been around a long time,

448
00:21:50,700 --> 00:21:52,350
you know, it's a big culture

449
00:21:52,350 --> 00:21:55,290
and darknet culture isn't so much,

450
00:21:55,290 --> 00:21:56,820
it's a lot more secretive.

451
00:21:56,820 --> 00:21:59,130
What's interesting is everything
I'm telling you today,

452
00:21:59,130 --> 00:22:01,320
all of this is freely available.

453
00:22:01,320 --> 00:22:02,997
You know, so if you're

454
00:22:02,997 --> 00:22:03,830
from the Department of Homeland Security

455
00:22:03,830 --> 00:22:06,030
and you're here hoping to learn
some elite, you know, thing,

456
00:22:06,030 --> 00:22:07,979
it's just not gonna happen.

457
00:22:07,979 --> 00:22:09,060
It's all publicly available to anyone

458
00:22:09,060 --> 00:22:10,410
who seeks this information.

459
00:22:12,360 --> 00:22:14,820
My internet service when
I was a darknet vendor,

460
00:22:14,820 --> 00:22:16,500
it didn't exist.

461
00:22:16,500 --> 00:22:19,800
Again, I drew a lot of my
inspiration from Kevin Mitnick.

462
00:22:19,800 --> 00:22:21,810
I liked a lot of the stuff that he did.

463
00:22:21,810 --> 00:22:24,060
I thought a lot of his
things were ingenious.

464
00:22:24,060 --> 00:22:27,120
And along with those was
something I borrowed,

465
00:22:27,120 --> 00:22:29,100
which was a little bit more
localized than what he did

466
00:22:29,100 --> 00:22:32,340
with cell towers was grabbing a Yagi

467
00:22:32,340 --> 00:22:35,160
and connecting to a neighbor's internet,

468
00:22:35,160 --> 00:22:37,290
who I had no visual barriers to,

469
00:22:37,290 --> 00:22:39,510
meaning I could see his house,

470
00:22:39,510 --> 00:22:42,363
but it was far enough away
for me to feel secure.

471
00:22:43,301 --> 00:22:46,933
So if I saw, you know, a bunch
of black SUVs rolling up,

472
00:22:46,933 --> 00:22:50,400
I could assume it was safe
to burn everything I had

473
00:22:50,400 --> 00:22:52,239
and get rid of everything, clean house

474
00:22:52,239 --> 00:22:54,993
because my neighbor was getting raided.

475
00:23:00,990 --> 00:23:02,670
So one thing I would always check,

476
00:23:02,670 --> 00:23:05,730
I would do perimeter
checks on a regular basis.

477
00:23:05,730 --> 00:23:08,399
I was a homebody, I didn't like to leave.

478
00:23:08,399 --> 00:23:11,237
I'm definitely not big
on social interactions,

479
00:23:11,237 --> 00:23:15,090
personally, the guy of a
little bit of a agoraphobia.

480
00:23:15,090 --> 00:23:18,238
So this talk is extremely
challenging for me.

481
00:23:18,238 --> 00:23:22,170
However, it was something that
I felt I would love to share.

482
00:23:22,170 --> 00:23:24,210
And I'm glad that DEF CON
gave me the opportunity

483
00:23:24,210 --> 00:23:26,277
to share with you guys.

484
00:23:26,277 --> 00:23:29,910
But one of the things
that needs to be stayed

485
00:23:29,910 --> 00:23:32,190
on top of is security checks.

486
00:23:32,190 --> 00:23:34,110
Just like in a corporation,

487
00:23:34,110 --> 00:23:36,540
you constantly have to make
sure that everyone's staying

488
00:23:36,540 --> 00:23:40,083
on point, cuz again, complacency
is the enemy of security.

489
00:23:41,520 --> 00:23:43,530
So that was one of the
big things that I had.

490
00:23:43,530 --> 00:23:46,920
I had weekly, daily and monthly checklists

491
00:23:46,920 --> 00:23:49,223
of things that I would
make sure that I was doing.

492
00:23:50,880 --> 00:23:52,953
At the end of the day, we all feel safe,

493
00:23:53,941 --> 00:23:54,960
when we're at home, we all feel safe,

494
00:23:54,960 --> 00:23:56,370
we all feel secure.

495
00:23:56,370 --> 00:23:59,237
And then one day we lose our keys

496
00:23:59,237 --> 00:24:02,580
and then all of a sudden
we're all penetration testers.

497
00:24:02,580 --> 00:24:05,280
We can look at our house and we can say,

498
00:24:05,280 --> 00:24:06,810
oh, I can card the door,

499
00:24:06,810 --> 00:24:08,460
oh, I left that window open.

500
00:24:08,460 --> 00:24:10,950
Now all of a sudden you can find three,

501
00:24:10,950 --> 00:24:14,214
four different
vulnerabilities in your home

502
00:24:14,214 --> 00:24:19,214
and you stop feeling so safe
until you get those secured.

503
00:24:20,790 --> 00:24:24,630
And I think that's something
that as a darknet vendor,

504
00:24:24,630 --> 00:24:27,180
it's very easy to get comfortable,

505
00:24:27,180 --> 00:24:29,313
just like it is for our average people.

506
00:24:32,400 --> 00:24:34,800
Checking out your
weaknesses and making sure

507
00:24:34,800 --> 00:24:37,980
that they're fixed, evaluating your OpSec

508
00:24:37,980 --> 00:24:41,370
on a regular basis to me is mandatory,

509
00:24:41,370 --> 00:24:44,220
especially because the
repercussions are on a data breach.

510
00:24:44,220 --> 00:24:46,520
They're incarceration
in the federal facility.

511
00:24:49,530 --> 00:24:51,972
Staying away from emotional decisions,

512
00:24:51,972 --> 00:24:56,972
things like drinking and
typing will get you raided,

513
00:24:57,480 --> 00:25:02,430
will get you a 10 to 25 year sentence.

514
00:25:02,430 --> 00:25:07,290
So it's suicide, career
suicide on a little bit

515
00:25:07,290 --> 00:25:09,540
of a different level
than what we're used to.

516
00:25:12,930 --> 00:25:15,450
I like to always advise to never,

517
00:25:15,450 --> 00:25:19,290
never answer questions
even to this day I don't.

518
00:25:19,290 --> 00:25:21,570
I only answer questions after this talk,

519
00:25:21,570 --> 00:25:22,947
but, you know, like in general,

520
00:25:22,947 --> 00:25:24,330
(laughs)

521
00:25:24,330 --> 00:25:25,650
when it comes to law enforcement

522
00:25:25,650 --> 00:25:27,870
or obviously someone you don't know

523
00:25:27,870 --> 00:25:30,630
calling up, you know,
and asking you questions,

524
00:25:30,630 --> 00:25:33,660
a really great, you know,
thing to watch is to go

525
00:25:33,660 --> 00:25:37,470
to the SE village and see
people calling people up

526
00:25:37,470 --> 00:25:39,360
and those people just
giving out information,

527
00:25:39,360 --> 00:25:42,270
obviously we all know
it's not a good idea.

528
00:25:42,270 --> 00:25:44,165
So I'm always leery of that.

529
00:25:44,165 --> 00:25:46,650
And in turn, I always like to answer

530
00:25:46,650 --> 00:25:48,250
that question with the question.

531
00:25:56,160 --> 00:25:57,750
So once you actually pull that trigger

532
00:25:57,750 --> 00:26:00,547
and you start being a darknet vendor

533
00:26:00,547 --> 00:26:04,650
and you start having to
actually deal with customers,

534
00:26:04,650 --> 00:26:08,100
you have to write terms and conditions.

535
00:26:08,100 --> 00:26:10,380
You know, when are you
gonna refund a customer?

536
00:26:10,380 --> 00:26:11,670
How long is it gonna go?

537
00:26:11,670 --> 00:26:13,980
How long are you gonna
wait before, you know,

538
00:26:13,980 --> 00:26:16,050
if someone buys something from you today

539
00:26:16,050 --> 00:26:18,150
and tomorrow they say, hey,
I wanna tracking number.

540
00:26:18,150 --> 00:26:19,440
Are you gonna give it to 'em?

541
00:26:19,440 --> 00:26:20,740
Should you give it to 'em?

542
00:26:22,368 --> 00:26:23,925
You know, if you give it to 'em,

543
00:26:23,925 --> 00:26:25,680
then they'll know where
you shipped that from.

544
00:26:25,680 --> 00:26:27,600
Maybe you want a little bit more time

545
00:26:27,600 --> 00:26:30,305
before you're willing to give that away.

546
00:26:30,305 --> 00:26:32,190
So all those little kind of things

547
00:26:32,190 --> 00:26:34,350
are things that need to
be seriously evaluated

548
00:26:34,350 --> 00:26:37,960
when you're considering
building a platform

549
00:26:39,540 --> 00:26:42,303
or when you're considering
being a darknet vendor.

550
00:26:44,010 --> 00:26:46,110
And again, I have it as number six here,

551
00:26:46,110 --> 00:26:48,843
don't drink and type, it's essential.

552
00:26:50,340 --> 00:26:54,180
So changing your PGP key,
not a lot of vendors do this,

553
00:26:54,180 --> 00:26:56,040
but it lets you switch up.

554
00:26:56,040 --> 00:26:57,150
You switch up your identity,

555
00:26:57,150 --> 00:26:59,866
which means your reputation dies

556
00:26:59,866 --> 00:27:02,343
and that's unfortunate,

557
00:27:03,420 --> 00:27:05,790
but you can always build
that reputation back up

558
00:27:05,790 --> 00:27:08,090
and it'll take a massive
target off your back.

559
00:27:14,640 --> 00:27:17,820
So your point of you doing
this is to make money.

560
00:27:17,820 --> 00:27:20,010
That's how I saw it is to make money,

561
00:27:20,010 --> 00:27:21,840
is to get in, is to get out.

562
00:27:21,840 --> 00:27:23,876
And that was my goal,

563
00:27:23,876 --> 00:27:26,130
so having that mapped
out with your ingress,

564
00:27:26,130 --> 00:27:28,110
your egress and your regress,

565
00:27:28,110 --> 00:27:30,240
as far as things like
changing your PGP key

566
00:27:30,240 --> 00:27:33,870
or things like that were
essential to me before I started.

567
00:27:33,870 --> 00:27:35,640
And with things that I kept in mind

568
00:27:35,640 --> 00:27:36,873
during the whole time.

569
00:27:39,870 --> 00:27:43,470
Once you start building a
reputation on the darknet,

570
00:27:43,470 --> 00:27:44,940
it's in spider out.

571
00:27:44,940 --> 00:27:46,650
So what I mean by that is like

572
00:27:46,650 --> 00:27:49,260
you as professionals right now,

573
00:27:49,260 --> 00:27:52,380
if you have, you work
for a big company, right?

574
00:27:52,380 --> 00:27:53,430
Or you write a book,

575
00:27:53,430 --> 00:27:54,660
you're building a reputation,

576
00:27:54,660 --> 00:27:58,860
you can use that reputation
to get a better job

577
00:27:58,860 --> 00:28:01,110
and you can do the same
thing on the darknet.

578
00:28:01,110 --> 00:28:04,410
Except instead of me
offering a former employer

579
00:28:04,410 --> 00:28:06,270
might be a verifiable,

580
00:28:06,270 --> 00:28:09,820
PGP signed message to a new employer

581
00:28:10,740 --> 00:28:14,460
and a new darknet opens up
and I message the admin.

582
00:28:14,460 --> 00:28:16,830
And I say, hey, listen,
I can help you out.

583
00:28:16,830 --> 00:28:19,170
I have these previous accounts,

584
00:28:19,170 --> 00:28:20,160
I can validate them.

585
00:28:20,160 --> 00:28:23,100
You can check them and I can prove

586
00:28:23,100 --> 00:28:25,100
that I've done this kind of work before.

587
00:28:26,400 --> 00:28:29,070
And it allows you, again, to spider out

588
00:28:29,070 --> 00:28:32,850
and end up getting
multiple different jobs,

589
00:28:32,850 --> 00:28:37,830
which pay sometimes a lot
better than if you're just

590
00:28:37,830 --> 00:28:39,273
starting out as a vendor.

591
00:28:40,890 --> 00:28:42,900
And that reputation is
something you can buy

592
00:28:42,900 --> 00:28:44,973
and you can sell and you can trade on.

593
00:28:46,020 --> 00:28:49,260
And, you know, your PGP key, your identity

594
00:28:49,260 --> 00:28:51,120
is much more restrictive.

595
00:28:51,120 --> 00:28:55,830
And it's restricted to
darknet market admins

596
00:28:55,830 --> 00:28:58,863
as opposed to all the users.

597
00:29:08,130 --> 00:29:11,040
So me personally, I hate Bitcoin tumblers.

598
00:29:11,040 --> 00:29:12,093
I never use them.

599
00:29:12,994 --> 00:29:14,670
I just didn't like them,

600
00:29:14,670 --> 00:29:16,800
I don't like sending my Bitcoin to someone

601
00:29:16,800 --> 00:29:18,270
and I don't know who they are.

602
00:29:18,270 --> 00:29:20,890
It always kind of rubbed me the wrong way.

603
00:29:20,890 --> 00:29:22,290
So what I used to do
is I used to convert it

604
00:29:22,290 --> 00:29:26,130
from Bitcoin to Monero
and then back to Bitcoin.

605
00:29:26,130 --> 00:29:28,260
And I was happy with that because I knew

606
00:29:28,260 --> 00:29:31,020
that the link between
the two different types

607
00:29:31,020 --> 00:29:33,870
of Bitcoin that I had
was completely broken.

608
00:29:33,870 --> 00:29:36,090
It's kind of like robbing a bank

609
00:29:36,090 --> 00:29:39,180
and buying a bunch of weed
and selling all that weed.

610
00:29:39,180 --> 00:29:42,420
And now the money that you
have is completely different.

611
00:29:42,420 --> 00:29:45,903
Whether or not you made money
on it is a different fact.

612
00:29:47,190 --> 00:29:50,550
Alternatively, also buying drugs.

613
00:29:50,550 --> 00:29:54,810
So if I sold $20,000 worth
of narcotics in three days,

614
00:29:54,810 --> 00:29:57,960
I could turn around and
I could buy narcotics

615
00:29:57,960 --> 00:29:59,700
and I could sell them locally

616
00:29:59,700 --> 00:30:02,583
at a much steeper markup
and still have anonymity.

617
00:30:08,003 --> 00:30:09,960
So then you get to retirement
if you make enough,

618
00:30:09,960 --> 00:30:12,870
you know, if you're lucky
enough, you get to this point.

619
00:30:12,870 --> 00:30:15,120
And surprisingly, a lot of people,

620
00:30:15,120 --> 00:30:17,280
I've known a lot of darknet vendors

621
00:30:17,280 --> 00:30:18,510
who have gotten to this point.

622
00:30:18,510 --> 00:30:21,360
They say like, drug dealers
don't get to retire.

623
00:30:21,360 --> 00:30:24,300
Well, darknet vendors do when
I've known a couple of them,

624
00:30:24,300 --> 00:30:26,400
it's completely possible.

625
00:30:26,400 --> 00:30:28,110
I'm not encouraging anyone to do it.

626
00:30:28,110 --> 00:30:29,942
If you're at this con,

627
00:30:29,942 --> 00:30:30,775
you're obviously intelligent.

628
00:30:30,775 --> 00:30:32,460
I suggest that you don't do it

629
00:30:32,460 --> 00:30:34,560
cuz it has horrible ROI.

630
00:30:34,560 --> 00:30:37,560
And it's a lot of stress
and, you know, I'm 37

631
00:30:37,560 --> 00:30:39,056
looking with the gray hair I have,

632
00:30:39,056 --> 00:30:40,435
(audience laugh)

633
00:30:40,435 --> 00:30:42,330
you know, it's not an easy job,

634
00:30:42,330 --> 00:30:44,640
so I don't recommend it to anyone.

635
00:30:44,640 --> 00:30:47,290
And that's one thing I
definitely like to make clear.

636
00:30:49,650 --> 00:30:52,050
So, and I talk about here that, you know,

637
00:30:52,050 --> 00:30:55,020
we do switch up PGP keys,

638
00:30:55,020 --> 00:30:56,940
again, that kills all your business,

639
00:30:56,940 --> 00:30:58,803
but that's a necessary.

640
00:31:00,840 --> 00:31:04,110
So when my Department of
Justice announcement came out

641
00:31:04,110 --> 00:31:07,410
where they announced me
and about 33 other people

642
00:31:07,410 --> 00:31:10,770
that got raided, they said that it

643
00:31:10,770 --> 00:31:13,350
was cuz of Operation Dark Hold.

644
00:31:13,350 --> 00:31:14,520
And I'm from Vermont,

645
00:31:14,520 --> 00:31:17,340
you can see the little
arrow going up north from,

646
00:31:17,340 --> 00:31:18,694
well, maybe you can't.

647
00:31:18,694 --> 00:31:19,527
Yeah, you probably can't on the screen.

648
00:31:19,527 --> 00:31:20,965
I'm sorry about that.

649
00:31:20,965 --> 00:31:23,520
But that's what they planned,

650
00:31:23,520 --> 00:31:25,080
basically Operation Dark Gold

651
00:31:25,080 --> 00:31:29,220
was they caught someone
who was laundering Bitcoin

652
00:31:29,220 --> 00:31:31,470
and they had this guy continue to do it.

653
00:31:31,470 --> 00:31:34,500
And people would cash
out their Bitcoin to him

654
00:31:34,500 --> 00:31:38,168
for 10% and he would send
them cash in the mail.

655
00:31:38,168 --> 00:31:42,570
At this time, KYC the know your
customer policy for Bitcoin,

656
00:31:42,570 --> 00:31:43,950
wasn't really prevalent

657
00:31:43,950 --> 00:31:48,060
and it only applied to banking
institutions at that point.

658
00:31:48,060 --> 00:31:52,360
So personal Bitcoin
transactions are not illegal

659
00:31:54,360 --> 00:31:56,820
and, you know, quoting trying to say that

660
00:31:56,820 --> 00:31:59,460
because someone bought
Bitcoin from someone,

661
00:31:59,460 --> 00:32:00,780
this was how you caught them.

662
00:32:00,780 --> 00:32:03,270
To me, I thought it was asinine

663
00:32:03,270 --> 00:32:06,451
because it made absolutely
no sense whatsoever.

664
00:32:06,451 --> 00:32:11,040
To me, it was just a way
to collect names of people

665
00:32:11,040 --> 00:32:13,667
who were on the darknet.

666
00:32:13,667 --> 00:32:15,731
And that's exactly what they did,

667
00:32:15,731 --> 00:32:19,263
but that was how they said
that they ended up catching me.

668
00:32:20,310 --> 00:32:23,370
The issue that I had with that was that

669
00:32:23,370 --> 00:32:25,800
at the end of the day, you have a hearing

670
00:32:25,800 --> 00:32:27,900
called the Frank's hearing in law.

671
00:32:27,900 --> 00:32:29,490
And Frank's hearing is when you can prove

672
00:32:29,490 --> 00:32:32,640
that law enforcement
violated the law in order

673
00:32:32,640 --> 00:32:36,360
to catch you doing something
or to get a warrant

674
00:32:36,360 --> 00:32:38,040
to search your house.

675
00:32:38,040 --> 00:32:40,950
They themselves broke the law in trying

676
00:32:40,950 --> 00:32:43,054
to ascertain that information.

677
00:32:43,054 --> 00:32:45,330
That was in my case, the
United States postal inspector

678
00:32:45,330 --> 00:32:47,790
opened a package that he
didn't have a warrant for.

679
00:32:47,790 --> 00:32:49,620
Again, one of my favorite reasons

680
00:32:49,620 --> 00:32:52,980
why I used the United
States postal service

681
00:32:52,980 --> 00:32:56,493
was it requires a warrant
for you to open a package.

682
00:32:57,330 --> 00:33:02,330
And this went back to my
OpSec and they broke that,

683
00:33:02,670 --> 00:33:03,840
but in breaking that,

684
00:33:03,840 --> 00:33:07,170
they also gave me a way
to exit out of my 10-count

685
00:33:07,170 --> 00:33:09,750
federal indictment that
they also hit me with

686
00:33:09,750 --> 00:33:11,133
because they broke the law.

687
00:33:12,870 --> 00:33:14,910
We didn't get to that point.

688
00:33:14,910 --> 00:33:18,540
And that was because before
we could bring that up

689
00:33:18,540 --> 00:33:20,850
after our Frank's hearing was granted,

690
00:33:20,850 --> 00:33:22,770
my cousin had already written a statement

691
00:33:22,770 --> 00:33:27,210
which established conspiracy
and the feds can give you

692
00:33:27,210 --> 00:33:30,000
a mandatory minimum for
a conspiracy charge,

693
00:33:30,000 --> 00:33:32,613
can be anywhere from 10 years to 20 years.

694
00:33:33,750 --> 00:33:35,220
So it's not something that you really want

695
00:33:35,220 --> 00:33:36,320
to take a gamble with.

696
00:33:42,390 --> 00:33:46,530
So after I was caught, was convicted,

697
00:33:46,530 --> 00:33:48,600
but only after I pled out,

698
00:33:48,600 --> 00:33:53,280
I agreed to a maximum term of
108 months in federal prison.

699
00:33:53,280 --> 00:33:57,450
And I was actually given 60
months, which is awesome.

700
00:33:57,450 --> 00:33:58,680
I thought it was awesome

701
00:33:58,680 --> 00:34:01,315
cuz then I didn't know anything
about the federal system.

702
00:34:01,315 --> 00:34:03,120
When I first got charged, I
had a 10-count indictment.

703
00:34:03,120 --> 00:34:04,980
When I looked up those charges,

704
00:34:04,980 --> 00:34:07,830
I saw each one came with
a maximum of 20 years.

705
00:34:07,830 --> 00:34:10,590
We do the math that's 200 years.

706
00:34:10,590 --> 00:34:12,857
So that's what I thought I was gonna get.

707
00:34:12,857 --> 00:34:14,250
I thought, well, I'm gonna get 200 years.

708
00:34:14,250 --> 00:34:16,260
I'm never gonna get out of prison,

709
00:34:16,260 --> 00:34:20,070
which it was, its just,
it's not how it works

710
00:34:20,070 --> 00:34:21,170
in the federal system.

711
00:34:22,950 --> 00:34:27,950
So I studied law for 18 months
while I was in federal prison

712
00:34:30,240 --> 00:34:34,110
because I inherently, I
saw a lot of power in it.

713
00:34:34,110 --> 00:34:36,150
Just like a lot of you see a lot of power

714
00:34:36,150 --> 00:34:37,563
in learning how to code.

715
00:34:38,580 --> 00:34:40,590
Those things allow you to do things

716
00:34:40,590 --> 00:34:42,909
that, you know, the
person who doesn't know

717
00:34:42,909 --> 00:34:43,742
how to code, maybe not,

718
00:34:43,742 --> 00:34:45,570
they can't do or they can't automate

719
00:34:45,570 --> 00:34:48,003
or they can't get as much done as you can.

720
00:34:49,977 --> 00:34:54,270
So for me, the code I wanted
to learn was federal law

721
00:34:54,270 --> 00:34:55,570
and that's what I learned.

722
00:34:56,873 --> 00:35:00,123
And by doing that I was able
to get myself out of prison.

723
00:35:04,110 --> 00:35:06,360
They have a thing called
the compassionate release

724
00:35:06,360 --> 00:35:08,760
where, you know, if you can prove

725
00:35:08,760 --> 00:35:12,036
that there's a danger from, you know,

726
00:35:12,036 --> 00:35:14,490
because of your health, then you can apply

727
00:35:14,490 --> 00:35:16,113
for compassionate release.

728
00:35:17,070 --> 00:35:19,690
And I did, I wrote a 200 page motion

729
00:35:19,690 --> 00:35:23,220
and I mailed it in to the federal court.

730
00:35:23,220 --> 00:35:26,430
So that was essentially
my boot force attack

731
00:35:26,430 --> 00:35:31,023
to the federal courts and it
worked and they released me,

732
00:35:32,250 --> 00:35:35,520
but it was after a lot of
studying, a lot of hours,

733
00:35:35,520 --> 00:35:37,620
a lot of 12 hour days reading federal law.

734
00:35:40,323 --> 00:35:45,323
So this year DEF CON's
theme is hacker homecoming

735
00:35:45,630 --> 00:35:48,210
and for me that's especially true.

736
00:35:48,210 --> 00:35:52,290
Technically, my release
date is for the third day

737
00:35:52,290 --> 00:35:54,603
in January of 2023.

738
00:35:55,470 --> 00:35:58,890
So I'm very happy to be
here standing on the stage

739
00:35:58,890 --> 00:36:03,802
talking to all of you as opposed
to being in a prison cell.

740
00:36:03,802 --> 00:36:06,969
(audience applauding)

741
00:36:13,590 --> 00:36:16,710
So I made a stupid mistake
and I got myself in trouble

742
00:36:16,710 --> 00:36:19,187
and I paid the consequence for what I did,

743
00:36:19,187 --> 00:36:20,550
but at the same time,

744
00:36:20,550 --> 00:36:22,560
that hacker mentality of never giving up,

745
00:36:22,560 --> 00:36:24,324
of always wanting to fight

746
00:36:24,324 --> 00:36:29,324
and just continually bashing
your head against that wall.

747
00:36:30,020 --> 00:36:33,420
It ended up paying off in
a totally different way

748
00:36:33,420 --> 00:36:36,720
than a lot of us see on a regular basis.

749
00:36:36,720 --> 00:36:41,130
You know, it wasn't that code
finally ran without crashing.

750
00:36:41,130 --> 00:36:43,860
It was that, you know, I wasn't stuck

751
00:36:43,860 --> 00:36:47,220
in a small cell with a bunch of

752
00:36:47,220 --> 00:36:51,300
sociopaths, you know,
who have life sentences.

753
00:36:51,300 --> 00:36:53,700
So that was a great thing.

754
00:36:53,700 --> 00:36:57,150
But it's one of the
things that really made me

755
00:36:57,150 --> 00:36:59,100
appreciate both communities

756
00:36:59,100 --> 00:37:01,724
because I started out
in the hacking community

757
00:37:01,724 --> 00:37:05,010
and I ended up going into
the darknet community

758
00:37:05,010 --> 00:37:07,680
because it's such an easy transition.

759
00:37:07,680 --> 00:37:09,780
You know, one of the most paramount things

760
00:37:09,780 --> 00:37:11,490
is understanding security

761
00:37:11,490 --> 00:37:14,280
and being in this field
you already do that.

762
00:37:14,280 --> 00:37:17,730
And I think that's the
really dangerous thing

763
00:37:17,730 --> 00:37:20,310
that exists is because it's
so easy to just move over

764
00:37:20,310 --> 00:37:23,973
to that side, you know,
for me, I was anyways.

765
00:37:25,530 --> 00:37:30,450
So in conclusion, moving
over from being a hacker

766
00:37:30,450 --> 00:37:32,405
to being a darknet vendor,

767
00:37:32,405 --> 00:37:36,120
it was ridiculously easy,

768
00:37:36,120 --> 00:37:39,510
but again, you know, you
can have the perfect OpSec

769
00:37:39,510 --> 00:37:44,510
and still get fucked
over and get fucked up.

770
00:37:45,090 --> 00:37:46,890
You know, there's no such thing,

771
00:37:46,890 --> 00:37:48,000
we all know there's no such thing

772
00:37:48,000 --> 00:37:51,157
as an unpickable lock, right?

773
00:37:51,157 --> 00:37:52,170
There's no such thing as a foolproof plan.

774
00:37:52,170 --> 00:37:55,110
There's no security
application that we can install

775
00:37:55,110 --> 00:37:58,058
that's gonna make us all safe, guaranteed.

776
00:37:58,058 --> 00:37:59,430
It's the same thing.

777
00:37:59,430 --> 00:38:01,170
No matter what side of
that fence you're on,

778
00:38:01,170 --> 00:38:05,523
whether it's law enforcement
or you know, criminal.

779
00:38:06,960 --> 00:38:08,723
Thank you for letting me speak here.

780
00:38:09,557 --> 00:38:12,724
(audience applauding)

781
00:38:20,159 --> 00:38:22,552
I think they're gonna
open it up for Q and A.

782
00:38:22,552 --> 00:38:24,180
If you guys have any questions.

783
00:38:24,180 --> 00:38:26,069
- [Host] You want mic?

784
00:38:26,069 --> 00:38:27,285
- Yeah, can I use this one or-

785
00:38:27,285 --> 00:38:29,621
- [Host] I can get a
field mic if you want.

786
00:38:29,621 --> 00:38:31,781
- All right, either way
I'm fine with this one.

787
00:38:31,781 --> 00:38:33,479
- [Host] Just have them raise your hand.

788
00:38:33,479 --> 00:38:35,979
- All right, questions anyone?

789
00:38:38,662 --> 00:38:40,832
- [Audience Member] Should I
use more than one sock puppet?

790
00:38:40,832 --> 00:38:42,202
- What's that?

791
00:38:42,202 --> 00:38:44,376
- [Audience Member] Should I
use more than one sock puppet?

792
00:38:44,376 --> 00:38:46,050
- Should you use more than one sock?

793
00:38:46,050 --> 00:38:46,983
I don't know.

794
00:38:47,839 --> 00:38:49,922
(laughs)

795
00:38:51,450 --> 00:38:52,353
Anyone else?

796
00:38:54,990 --> 00:38:56,963
- [Host] If you have a
question, come on up here.

797
00:39:08,850 --> 00:39:10,950
- [Audience Member] So how
did you originally find out

798
00:39:10,950 --> 00:39:14,760
about the darknet markets
and what all markets

799
00:39:14,760 --> 00:39:15,993
did you operate on?

800
00:39:17,670 --> 00:39:20,070
- So I operated on
probably a total of about

801
00:39:20,070 --> 00:39:21,483
15 different markets.

802
00:39:23,370 --> 00:39:25,980
I remember the first
time I really heard about

803
00:39:25,980 --> 00:39:28,740
Bitcoin was from a friend of mine

804
00:39:28,740 --> 00:39:33,690
and he was discussing how
there's a site called btcfaucet,

805
00:39:33,690 --> 00:39:35,040
which used to exist back in the day

806
00:39:35,040 --> 00:39:36,780
where like you could hop on once a day

807
00:39:36,780 --> 00:39:40,890
and you get anywhere from
like 5 to 50 Bitcoin.

808
00:39:40,890 --> 00:39:42,780
And we'd done that a bunch of times.

809
00:39:42,780 --> 00:39:45,240
And then I got to a point
where we had like 300 Bitcoin

810
00:39:45,240 --> 00:39:46,980
and we were like, this is a waste of time.

811
00:39:46,980 --> 00:39:50,079
Just crap, you know, we
just threw away the wallets.

812
00:39:50,079 --> 00:39:50,912
(laughs)

813
00:39:50,912 --> 00:39:52,230
Big time regret there.

814
00:39:52,230 --> 00:39:53,063
Yes.

815
00:39:53,908 --> 00:39:55,770
(audience member faintly speaking)

816
00:39:55,770 --> 00:39:57,183
Oh yeah, yeah, yeah,

817
00:39:58,091 --> 00:39:58,924
yep, yep.

818
00:39:58,924 --> 00:40:00,084
Sold them too.

819
00:40:00,084 --> 00:40:02,167
(laughs)

820
00:40:04,080 --> 00:40:05,640
Yep.

821
00:40:05,640 --> 00:40:06,780
- [Audience Member] Hey,
so you talked a lot about

822
00:40:06,780 --> 00:40:08,550
like operational hygiene and stuff like

823
00:40:08,550 --> 00:40:09,972
that relating to like-

824
00:40:09,972 --> 00:40:10,860
- I'm sorry, I can't hear you.

825
00:40:10,860 --> 00:40:13,612
- [Audience Member] Okay, so
like you talked a lot about

826
00:40:13,612 --> 00:40:14,972
like operational hygiene.

827
00:40:14,972 --> 00:40:17,910
So like in a week or
in a month you had like

828
00:40:17,910 --> 00:40:21,210
these routines and things
you would do to try to like

829
00:40:21,210 --> 00:40:26,210
promote like a good SecOps hygiene, right?

830
00:40:26,220 --> 00:40:27,053
To make sure-

831
00:40:27,053 --> 00:40:27,886
- I can't make out-

832
00:40:27,886 --> 00:40:30,750
- [Audience Member]
Okay, sorry, I can't...

833
00:40:30,750 --> 00:40:34,761
So for things like, you have like,

834
00:40:34,761 --> 00:40:38,910
is there any strategy you would use

835
00:40:38,910 --> 00:40:41,850
specifically for like trying to determine

836
00:40:41,850 --> 00:40:44,161
what your weakest points are for trying to

837
00:40:44,161 --> 00:40:48,420
establish a good, hey,
this is what I'm gonna

838
00:40:48,420 --> 00:40:50,461
check this week, right?

839
00:40:50,461 --> 00:40:52,158
'Cause you can't check everything.

840
00:40:52,158 --> 00:40:54,150
You can't check every
failure point, every area.

841
00:40:54,150 --> 00:40:56,790
What kind of things would
you specifically look for

842
00:40:56,790 --> 00:41:00,580
as part of like your
strategy to protect yourself

843
00:41:01,500 --> 00:41:02,430
OpSec wise?

844
00:41:02,430 --> 00:41:03,263
- Yep.

845
00:41:04,121 --> 00:41:07,440
So initially I spent six
months doing research,

846
00:41:07,440 --> 00:41:10,620
looking at previous cases where
the feds had raided people,

847
00:41:10,620 --> 00:41:12,000
why they had rated them?

848
00:41:12,000 --> 00:41:14,220
And that was kind of my
starting point for that.

849
00:41:14,220 --> 00:41:15,870
And then once you start to grasp that,

850
00:41:15,870 --> 00:41:17,850
you start finding your own little hacks

851
00:41:17,850 --> 00:41:20,070
and things that you can
do to make it improved.

852
00:41:20,070 --> 00:41:22,819
Yep, but to answer your question,

853
00:41:22,819 --> 00:41:24,120
it was mainly history, right?

854
00:41:24,120 --> 00:41:25,770
Cuz history predicts the future.

855
00:41:25,770 --> 00:41:28,710
So I would try to look at
what happened in the past

856
00:41:28,710 --> 00:41:30,810
to evaluate what was going to happen

857
00:41:30,810 --> 00:41:32,850
or what I would need to do to evolve

858
00:41:32,850 --> 00:41:36,238
and not be the guy in
that DOJ announcement.

859
00:41:36,238 --> 00:41:38,913
- [Host] You have time for
about two more questions.

860
00:41:41,490 --> 00:41:43,830
- [Audience Member] Hey,
you said you would burn

861
00:41:43,830 --> 00:41:46,440
identities with some regularity,

862
00:41:46,440 --> 00:41:48,990
to not leave any tracks
about who you were.

863
00:41:48,990 --> 00:41:51,510
Did you ever get caught
on any of these markets

864
00:41:51,510 --> 00:41:54,810
by people you interacted
with as being somebody

865
00:41:54,810 --> 00:41:57,120
on a different market
using a different identity?

866
00:41:57,120 --> 00:41:59,940
And if you did, did that cause any issues?

867
00:41:59,940 --> 00:42:01,680
- So I heard the first part of it.

868
00:42:01,680 --> 00:42:03,480
What was the second part?

869
00:42:03,480 --> 00:42:05,550
- [Audience Member]
Did you ever get caught

870
00:42:06,797 --> 00:42:07,890
using multiple identities on a number

871
00:42:08,739 --> 00:42:10,739
of these different websites
by people you interacted with,

872
00:42:10,739 --> 00:42:11,572
whether it be other staff,

873
00:42:11,572 --> 00:42:14,790
other users for being, you know, a vendor

874
00:42:14,790 --> 00:42:16,500
under different names?

875
00:42:16,500 --> 00:42:19,920
- Yeah, so you see it's interesting

876
00:42:19,920 --> 00:42:21,720
because once you're there for so long

877
00:42:21,720 --> 00:42:23,460
and like that kind of
anonymous environment,

878
00:42:23,460 --> 00:42:25,620
you can start to see people's mannerisms.

879
00:42:25,620 --> 00:42:28,350
It's a lot like with 4chan, right?

880
00:42:28,350 --> 00:42:29,310
When you start having,

881
00:42:29,310 --> 00:42:32,100
you started having people
who would use the same kind

882
00:42:32,100 --> 00:42:33,600
of terminology or wording,

883
00:42:33,600 --> 00:42:35,379
you could tell who's who,

884
00:42:35,379 --> 00:42:37,380
even if their name changes 50 times,

885
00:42:37,380 --> 00:42:38,730
you still know that person,

886
00:42:38,730 --> 00:42:41,040
cuz you spent a lot of
time talking to them,

887
00:42:41,040 --> 00:42:42,996
you know their idea,

888
00:42:42,996 --> 00:42:44,370
their ideals or their
politics or whatever it is

889
00:42:44,370 --> 00:42:45,840
that they're discussing.

890
00:42:45,840 --> 00:42:50,840
So those things, that using
your identity for other things,

891
00:42:51,598 --> 00:42:54,450
to me, it wouldn't be something that,

892
00:42:54,450 --> 00:42:56,137
I wasn't really there

893
00:42:56,137 --> 00:42:58,620
for the socialization aspect.

894
00:42:58,620 --> 00:43:00,720
You know, I was there
strictly to make money

895
00:43:00,720 --> 00:43:04,140
and anything that helped further that goal

896
00:43:04,140 --> 00:43:05,496
I would be there.

897
00:43:05,496 --> 00:43:08,280
So when it did come to having
to establish an identity

898
00:43:08,280 --> 00:43:11,910
and, you know, just make a
ridiculous amount of posts

899
00:43:11,910 --> 00:43:13,380
to the community,

900
00:43:13,380 --> 00:43:14,640
that's what I would use it for,

901
00:43:14,640 --> 00:43:17,160
but I wouldn't use it anywhere else.

902
00:43:17,160 --> 00:43:18,840
I actually remember reading a case about

903
00:43:18,840 --> 00:43:23,840
a darknet vendor who had
his PGP key on the darknet.

904
00:43:24,000 --> 00:43:26,400
And then the idiot decided to use that

905
00:43:26,400 --> 00:43:28,500
as his Gmail PGP key.

906
00:43:28,500 --> 00:43:31,335
You know, and he didn't last long.

907
00:43:31,335 --> 00:43:33,060
(laughs)

908
00:43:33,060 --> 00:43:34,170
- [Audience Member] All
right, interesting talk,

909
00:43:34,170 --> 00:43:35,003
thank you.

910
00:43:35,999 --> 00:43:37,860
I was wondering to get
your thoughts on like

911
00:43:37,860 --> 00:43:41,310
some markets had exit scams and kind of

912
00:43:41,310 --> 00:43:44,640
what was involved in that
process were mods behind it.

913
00:43:44,640 --> 00:43:48,240
And this, also second
question is the DDoS attacks

914
00:43:48,240 --> 00:43:49,710
on a lot of markets,

915
00:43:49,710 --> 00:43:54,710
is that really revenue depleting
for them or money losing.

916
00:43:56,190 --> 00:43:59,460
Did they pay off the DDos
people to stop that happen?

917
00:43:59,460 --> 00:44:02,370
- So I've seen really, to
answer the second question

918
00:44:02,370 --> 00:44:03,840
real quick.

919
00:44:03,840 --> 00:44:06,690
I think the primary motive
that you see for DDos

920
00:44:06,690 --> 00:44:08,800
is when it comes to darknet markets

921
00:44:09,878 --> 00:44:13,680
is mainly federal agencies.

922
00:44:13,680 --> 00:44:15,840
It's like, well, how can you prove that?

923
00:44:15,840 --> 00:44:17,184
Well you can't, you know,

924
00:44:17,184 --> 00:44:19,710
but really it's one of the only ways

925
00:44:19,710 --> 00:44:23,730
that you can really see
them take down markets

926
00:44:23,730 --> 00:44:26,130
with any kind of regularity,

927
00:44:26,130 --> 00:44:28,701
but even then, you know, they just create

928
00:44:28,701 --> 00:44:30,880
new URLs and good luck they move on.

929
00:44:30,880 --> 00:44:32,670
But aside from that,

930
00:44:32,670 --> 00:44:37,050
I've known darknet market
admins who have wanted

931
00:44:37,050 --> 00:44:38,940
to conduct those campaigns

932
00:44:38,940 --> 00:44:42,303
against competing darknet markets.

933
00:44:45,090 --> 00:44:48,360
- [Audience Member] Hi, can you explain

934
00:44:48,360 --> 00:44:51,510
if and why certain
drugs or pharmaceuticals

935
00:44:51,510 --> 00:44:53,558
aren't as targeted?

936
00:44:53,558 --> 00:44:54,900
- I explained why.

937
00:44:54,900 --> 00:44:58,143
- [Audience Member] As
in, like for example,

938
00:44:59,910 --> 00:45:02,610
like health wellness drugs
or something like that,

939
00:45:02,610 --> 00:45:05,160
as opposed to cocaine or heroin,

940
00:45:05,160 --> 00:45:09,480
and then also it kind of ties
in with my follow up question,

941
00:45:09,480 --> 00:45:14,480
but what goes into the
ability for someone to order

942
00:45:15,180 --> 00:45:19,500
internationally from like a
drugstore internationally?

943
00:45:19,500 --> 00:45:24,060
And why is that legal
to import certain drugs

944
00:45:24,060 --> 00:45:27,063
when you don't have a prescription?

945
00:45:27,978 --> 00:45:30,240
Do you know anything about that?

946
00:45:30,240 --> 00:45:35,100
- So one of the more lucrative trades

947
00:45:35,100 --> 00:45:36,510
that I found when I was doing it

948
00:45:36,510 --> 00:45:38,580
was just that was to do retail.

949
00:45:38,580 --> 00:45:41,460
So you have a lot of people
who aren't comfortable

950
00:45:41,460 --> 00:45:43,298
ordering internationally
because internationally

951
00:45:43,298 --> 00:45:45,720
is when it goes through customs.

952
00:45:45,720 --> 00:45:47,880
If I'm sending you any kind of narcotic

953
00:45:47,880 --> 00:45:50,820
through the mail here in the US,

954
00:45:50,820 --> 00:45:52,353
it doesn't go through customs.

955
00:45:53,190 --> 00:45:55,200
So there's not a whole bunch of scrutiny.

956
00:45:55,200 --> 00:45:57,390
So it's fairly easy to do that.

957
00:45:57,390 --> 00:46:00,363
But when it goes through
customs, it's a little bit more.

958
00:46:00,363 --> 00:46:04,380
So I know that one of the
things I started doing

959
00:46:04,380 --> 00:46:08,443
after a while was looking
at which countries

960
00:46:08,443 --> 00:46:12,690
would produce the best of
a certain type of drug.

961
00:46:12,690 --> 00:46:15,403
So for example, LSD,

962
00:46:15,403 --> 00:46:17,910
there's a vendor and again,

963
00:46:17,910 --> 00:46:19,622
this isn't a secret,

964
00:46:19,622 --> 00:46:21,819
he's very well known called GammaGoblin

965
00:46:21,819 --> 00:46:23,460
who makes some of the
best LSD that exists.

966
00:46:23,460 --> 00:46:25,890
And he lives in the Netherlands.

967
00:46:25,890 --> 00:46:28,139
That's where he's located out of,

968
00:46:28,139 --> 00:46:28,972
if you get a package from him,

969
00:46:28,972 --> 00:46:31,590
that's where it's gonna
come from sometimes.

970
00:46:31,590 --> 00:46:35,220
But the Netherlands is
really known for having

971
00:46:35,220 --> 00:46:38,640
good quality LSD and good quality MDMA.

972
00:46:38,640 --> 00:46:40,560
So for me, I would source the countries

973
00:46:40,560 --> 00:46:42,619
that had the best quality

974
00:46:42,619 --> 00:46:44,040
and then I would find vendors in that

975
00:46:44,040 --> 00:46:47,820
because you can always refine
those search parameters

976
00:46:47,820 --> 00:46:49,800
in almost any darknet market.

977
00:46:49,800 --> 00:46:51,510
And then with that information,

978
00:46:51,510 --> 00:46:53,040
I would go and I would look on sites

979
00:46:53,040 --> 00:46:55,800
like Dread and I would cross-reference

980
00:46:55,800 --> 00:46:56,633
and find their reputation,

981
00:46:56,633 --> 00:46:57,840
find out what people said about them.

982
00:46:57,840 --> 00:47:00,480
So I would find the
countries that had the best

983
00:47:00,480 --> 00:47:01,500
of a certain type of drug.

984
00:47:01,500 --> 00:47:03,450
Then I would find the guy in that country

985
00:47:03,450 --> 00:47:06,420
who has the highest reputation
in marketing that drug

986
00:47:06,420 --> 00:47:07,980
and I would order it through him.

987
00:47:07,980 --> 00:47:10,560
And like, you know,
sometimes the profit margins

988
00:47:10,560 --> 00:47:12,090
would be insane.

989
00:47:12,090 --> 00:47:14,340
Like I know with acid,

990
00:47:14,340 --> 00:47:17,790
from GammaGoblin I could grab
it for about 5 cents a hit

991
00:47:17,790 --> 00:47:22,410
and sell it for about 10 to 15 locally,

992
00:47:22,410 --> 00:47:24,660
on the darknet it would
usually be around four,

993
00:47:24,660 --> 00:47:27,660
but again, it was still
an astronomical return.

994
00:47:27,660 --> 00:47:30,210
I'm on investment and with
something like the acid,

995
00:47:30,210 --> 00:47:31,830
it's a piece of paper.

996
00:47:31,830 --> 00:47:33,752
There's no smell to it.

997
00:47:33,752 --> 00:47:35,574
So it's very easy to do.

998
00:47:35,574 --> 00:47:36,724
- [Host] Last question.

999
00:47:38,907 --> 00:47:40,620
- [Audience Member] Hi,
what platforms did you use

1000
00:47:40,620 --> 00:47:42,690
to launder the Bitcoin to Monero

1001
00:47:42,690 --> 00:47:45,180
and then how did you vet those platforms?

1002
00:47:45,180 --> 00:47:46,350
- So when I did it,

1003
00:47:46,350 --> 00:47:48,210
the one thing I'd like to remind you

1004
00:47:48,210 --> 00:47:50,451
is when I was doing
all this was years ago.

1005
00:47:50,451 --> 00:47:54,000
So, originally, it was Changelly.

1006
00:47:54,000 --> 00:47:55,714
I really liked Changelly.

1007
00:47:55,714 --> 00:47:58,080
There's another one, ShapeShift.io,

1008
00:47:58,080 --> 00:47:59,340
any service that I would use,

1009
00:47:59,340 --> 00:48:01,770
I would try to investigate
them as much as I could.

1010
00:48:01,770 --> 00:48:04,350
And I had learned that
ShapeShift was really open

1011
00:48:04,350 --> 00:48:09,350
to the DOJ and I just wasn't for that.

1012
00:48:09,630 --> 00:48:12,420
I didn't really see too
much about Changelly.

1013
00:48:12,420 --> 00:48:14,190
So I liked using them, but again,

1014
00:48:14,190 --> 00:48:16,792
like anytime I would visit their site,

1015
00:48:16,792 --> 00:48:19,554
it's gonna be through
Tor anyway, you know.

1016
00:48:19,554 --> 00:48:21,730
- [Host] Thank you very much.

1017
00:48:21,730 --> 00:48:23,512
- Yep, thank you.

1018
00:48:23,512 --> 00:48:26,679
(audience applauding)