All right, this afternoon, we're going to learn a little bit about Darknet OPSEC.
Pretty interesting talk.
Please welcome our first-time at DEF CON and first-time speaker, Sam Bent.
Cheers.
Thank you.
It's great to be here.
I never thought I'd be up on this stage.
So my talk is about Darknet OPSEC from the point of view of myself.
Some of the precautions, some of the things that I did as a Darknet vendor to try to keep myself safe
from the federal government and other adversaries that existed out there.
So these are my aliases.
I have a couple of them.
My day job involves me writing documentation, pretty dry stuff, but I enjoy doing it.
While my night job, I'm a prison advocate.
So I do a lot of outreach work and try to help people and guide people through the myriad that is the federal prison system,
whether it's them going into it or their family members going into it.
I have about 54 slides, so I'm going to have to move pretty quick once I start.
So I've worked not only as a Darknet vendor, but also worked on multiple Darknet markets, done PR work for them,
as well as resolved problems.
Disputes for customers, things like that.
My objective with this talk is to give a different perspective than typically what's given at conferences or on the mainstream media
from someone who's actually been there, not just studied it from a distance or speculated on it.
So there are a lot of similarities between the Darknet subculture and the hacking.
So I'm going to start with the hacking subculture.
Both of them typically involve some kind of paranoia, and a lot of times that paranoia is there for a reason.
Both very much value their anonymity, secrecy, intellectual dominance, especially in the hacking realm or in the hacking scene.
But also there's a bit of a learning curve to each.
I would argue that the hacking scene has a much,
much greater learning curve than the Darknet, especially because in order to be a hacker, you don't just start up Tor.
There's a lot that goes into it, depending on what you're doing.
So the paths between being a hacker and a Darknet vendor can differentiate, too.
As a hacker, you start off really with no adversaries whatsoever.
You don't have anyone that's out to get you.
You know, when you hop on IRC for the first time,
you
can
learn almost everything as far as the process goes for a pen test inside of things like the pen test standard.
A lot of what we do is open source at this point. You can watch a DEF CON talk and learn a lot about
what it is that hackers do, or the culture, or just be here in this room, come to DEF CON.
That doesn't exist in the Darknet.
You can't, you know, just hop on and watch a YouTube video and learn about Darknet subculture.
It's something that you have to hop on to Darknet and you have to explore and learn and meet people and hopefully be safe in doing it.
The sources for information are completely different.
For me, my favorite always was, as a Darknet vendor, Darknet news sites.
Darkfail is one that's been around for quite a while and is pretty good.
Dread is a forum.
That's one of the most active on the Darknet from what I've seen.
So there's a book that Kevin Mitnick wrote called Ghosts in the Wires.
And I took his approach when looking at operational security
from that. Specifically the part where he called up law enforcement and social engineered them.
To allow him to use the NCIS system that they have.
I feel that a lot of the information that you could want or would be relevant
is located in manuals.
And if we know how law enforcement operates, we're trying to be criminals,
then we know what they're going to do next.
It's like having a cheat sheet.
So with that,
I ended up going and looking and finding the United States Postal Inspector's manual
to see what he classified as a suspicious package.
I needed to know that if I was going to be shipping narcotics through the United States mail.
So this information is out there.
This is not it, but this is an example of some of the things that you would look at when evaluating things like this.
It'd be an eclectic process where you take what's valuable and what's not.
And leave what's not.
Some of the things that would raise suspicion when you're trying to move drugs through the United States mail system
would be using too much tape.
Handwriting the labels.
If you don't, use the official USPS boxes.
Fake names on recipients or return addresses.
All of these things add up as red flags that ultimately leads to a United States Postal Inspector.
Possibly applying for a search warrant for a box.
So in order to avoid these, you just don't do those things.
It's pretty straight forward.
It's like reverse engineering law enforcement to some degree.
For me, I had a moral dilemma when I wanted to ship drugs.
Which is kind of ironic.
I didn't want to send, say, cocaine from some random person's address.
You know, there's a lot of hard-working people in the world, and to me, sending out four
ounces of blow to some guy who's a construction worker and just trying to make ends meet,
and have DHS break through his door, really wasn't the best way to go about it.
And I was sure that somewhere there existed a database of people that I considered, personally,
to be people okay to screw over.
So I searched for it.
And I tried to figure out what that database would be, how it would look, and how I would
be able to access it.
And the only solution that I could come up with was this.
.
.
So, remember, I said you need to have a valid return address, it needs to be the correct
name, it needs to be the correct address.
All of these had that.
So they qualified.
And they made them real.
And if it got sent back to them, or if they got raided, I didn't really have any qualms
in that.
And it was interesting because the Department of Homeland Security special agent that was
in charge.
When they ended up raiding me, he thought about that, and felt the exact same way this
crowd feels.
He laughed about it, too.
He thought it was hilarious.
So, when I live in a city, the thing that came to my conclusion was you can pick obviously
you have a ton of different services that you can use to ship anything nowadays.
My favorite by far is the United States Postal Service.
. . . . . . . . . . . . . . . . There's a few Abbhart Postal Service coming down and countries.
reasons for that. Private services like DHL or UPS, they can open up your package whenever they
want. There's no rules in that. They're a private corporation. But a warrant is required for USPS
to be able to open something. They also have more locations than anyone else. And they can get to
your door from tour to door in three days, which is great, especially if you're going for good
reviews on the dark net. So it's run by the federal government, which is kind of an ironic
thing that the people that are hunting you, a branch of their system is going to be enabling
you to traffic drugs on a national or an international level. It's kind of, I guess
you'd say, it's kind of a, you know, it's kind of a, you know, it's kind of a, you know,
it's kind of, I guess you'd say, like a spiteful thing to do, where you're having the feds send
your drugs for you. So the other thing to take into account is the amount of packages that
exist. How hard is it to find my one package out of that 21.5 billion? You probably have a
better chance at winning the power model. Especially because I'm well aware of what you're looking
for when it comes to a suspicious package. None of my packages are ever going to look that way.
And we compare them to some of the other shippers, and you can see the numbers are pretty
drastic in terms of differences. Drug sniffing dogs, compared to what a lot of people think,
drug sniffing dogs, they don't work eight hour shifts. They're sporadic. You can't work them
like you could an Amazon employee. So that's one thing. But then you take into account
permeation, which is where a smell can go through an object. All those things come into play.
When I would ship, I would ship two to three day. There's not enough time for it to come
through vacuum sealed bags. And a visual barrier in that amount of time. So on top of that,
like, when you get, when you, if your drugs do get intercepted, what are you going to do?
What happens is you get a notice. And we call it a love letter. And it comes from USPS,
typically, or customs, if it's an overseas order. And they just say that we've intercepted
your drugs. They don't say it like that. They say we have your package. Please come
to the post office and pick up your package. Once you show up with that letter, you're
acknowledging that that's your package. Because aside from that, they can't prove it's yours.
You didn't order this on Amazon. So there's, they can't hop on and see, you know, your
credit, your credit card transaction where you bought these drugs. You bought it in
Bitcoin or your Monero or, you know, any one of the available options that existed
to you. So they rely on things like that. So, you know, your countermeasure for when
you get a love letter is to burn it. Or throw it away. It's relevant. So the other thing
that law enforcement likes to do on occasion.
Is control deliveries. And control deliveries, a little bit more aggressive, obviously,
than a love letter. But again, you have countermeasures for that as well. You have no obligation to
open your door for anyone. And if they had, you know, even if it was the police, if they
had, if they had permission to come into your house, they wouldn't be knocking. Right?
They'd be kicking in the door. And they'd be coming in. And they'd be taking you out.
So it's all voluntary. You answering that door. And it's the same thing with delivery.
You can just not answer that door. And a lot of the times Darknet vendors are not going
to require signature. Because it would be like, you know, requiring you to give your
real name when you're using a handle as a hacker. It's just not something you're going
to do. If I ask you on an IRC chat, what's your real name, and we just met, how willing
are you going to be to give that information over? Probably not likely.
But from that, there are countermeasures for it. So sometimes they'll put devices in the
box and we'll just let the box sit for 24 hours or 48 hours or three days until the
batteries in that device, if it's small, die. Or if they're using something local like
a radio frequency, we travel. Open the box up 10 miles away. Any transmitter they have
in there would be well out of distance.
So if you do it well.
Well, this is what they should know about you. It should be nothing.
It should be, oh, yeah, he's the computer guy.
So in making an image for yourself on the Darknet, one of the best ways I found to
do that was to be helpful. And, you know, just like on a social engineering campaign,
if you're disingenuine, people pick that up very quickly. It's like flattery.
You know, a lot of times flattery has the opposite effect that you intended to have.
So being disingenuous in the Darknet is something that can be picked up by some people, and
a lot of people find it repulsive, just like you do in real life when someone compliments
you for the fifth time on your shoes.
So my move was to contribute 5,000 posts and I did that on HANSA in a month. And by
doing that, basically. everyone in there, they're like, wow, I'm like, whoa. I'm going,
that community now associates my name with good things with helping out with
OPSEC with you know enjoying helping other people and that's the the kind of
the irony is everyone seems to think about the dark net is this horrible
place where you know there's there are really bad things on there it's not up
for debate but at the same time not everyone on there is a psychopath you
know a lot of times it's just people so with that I was able to establish rapid
rapport in that community people knew me and when someone came in there just like
any other community if you come into any community and you start you know
threatening someone or like you know if someone came in here and started saying
a well-known speaker didn't know what he was talking about the community would
probably revolt against that they wouldn't like that very much you have
the same thing in the dark now but instead of having
you know you know you know you know you know you know you know you know you know
that trust you have that verification through things like PGP signatures and
sign messages and all you know stuff like that and when we look at the
history and the present and the future of reconnaissance and information
gathering when it comes to law enforcement there are a few different
countermeasures a darknet vendor can take if he's informed if he knows enough
about it my thing was to hop on Pacer like you
might see the Department of Justice announced
a darknet bust but they don't really give you details Pacer will Pacer is the
place where you can find federal cases you can find the United States attorneys
wording and how they caught that person what that person did where they screwed
up again if we can look and we can map out how they screwed up we can make it
so that we never screw up we never make those same mistakes that our
predecessors did and we're playing in this game you're playing for keeps you
know messing up here it doesn't mean that we're not going to be able to get
away with it it doesn't mean that you know this this particular assignment you
have to go find another penetration testing engagement it means that you're
going to federal prison so it's not something you want to screw up so tend
to tread a lot more carefully even when it comes to things like cashing out
crypto or you know making it so that the chain that law enforcement uses to trace
you or trace your transactions is a lot harder to uncover
so from what I've seen on the dark net the majority of the time that dark net
sites actually get taken down is not from law enforcement being highly
talented it's from just a administrator making a stupid OPSEC mistake we're not
updating or getting complacent right because we have that kind of sliding
scale where we have complacency on one side and security on the other and time
seems to be a variable that's going to have to be changed over time and that's
that wears that down to the other side where they become complacent so reddit
ended up banning darknet markets and our response was to create red hug bunter is
famously known as the one who created it he created it and he ended up making it
and making it public as a replacement for darknet markets which is a massive sub reddit and their
ban of it came out of nowhere and what it did was it made it so that people on the clear net
or people that weren't using tor it made him a lot harder to get their questions answered on
how to navigate the darknet and that removal of information was a tactic used by law enforcement
to try to stop people from using the dark and that was our answer was dread
which i was a administrator on
so when you get started you want to look at a few different things
your main goal obviously is to avoid incarceration avoid arrest
you want to create a secure persona sometimes it's good to create multiple personas
and have them all age
your ultimate goal is to not get arrested
and if you do screw something up that's what's going to happen
you are successful as long as you're not in federal custody
and once you are it's far too late to go back
my suggestion is to map out and have responses to any type of incident that may occur
just like a major company has security policies set up and countermeasures to the motion to take action
as you're set up to be able to handle anything that goes wrong it's the
responsibility of that person who's going to be you know dealing in
transactions to make sure that they do the same so some of the threats that
exist are physical threats like DNA if that darknet vendor doesn't know
anything about physical security or operational security or anything like
that he might assume that you know they're not gonna go through the effort
of you know looking for skin cells or analyzing a package heavily and the fact
of the matter is if you don't know it for sure then you're always better
erring on the side of caution noisy neighbors these kind of you know if you
have ish if you have issues with your neighbors they don't like you that's an
adversary you know they can call up we're not even even though
well
wellness check. Anyone can write an email to the FBI. I see them come in with 20 packages
a day. It's abnormal. It's a red flag. Bluetooth, Wi-Fi attacks, all those things that we know
very well, people in this con understand very well. Trash is another one. It's always better
to shred it or burn it if possible. It's a lot of these same security measures that we
take in this field. Safeguarding corporations are the things that you will see a responsible
dark net vendor take. The only difference is instead of having teams do it and millions
of dollars to do it, they're stuck trying to figure it out and do it all themselves.
Which is one of the things that creates that low hanging fruit for law enforcement. Those
people who don't understand encryption or don't know fully about OPSEC and maybe they're
just drug traffickers.
They don't have a background in that. Another thing is linguistical analytics. It's something
I always try to keep mindful of. If I'm writing on the dark net on a forum, I'm from New England,
so we tend to say the word wicked to describe something as very. If I say this is a wicked
good talk, it means it's a very good talk. With that said, if I use that terminology
in a forum, and long term, I'm going to lose a lot of money. I'm going to lose a lot of
money.
The law enforcement picks that up. Now they know, okay, this guy's from New England. This
guy's from Massachusetts. They can get detailed information on where I am based on that. That's
a threat. That's a problem. It's something that, again, a lot of people, they don't think
about when they go into it. There's no manual for this. Unlike the hacking culture, we've
been around a long time. It's a big culture. The dark net culture isn't so much. It's a
lot more secretive. What's interesting is everything I'm telling you today, all of
this is freely available. So if you're from the Department of Homeland Security and you're
here hoping to learn some elite thing, it's just not going to happen. It's all publicly
available to anyone who seeks this information.
My internet service, when I was a dark net vendor, it didn't exist. Again, I drew a
lot of my inspiration from Kevin Mitnick. I liked a lot of the stuff that he did. I
thought a lot of his things were ingenious.
Kevin Mitnick.
wers Was something I borrowed, which is more localized than what he did with cell towers.
Was grabbing a Yogi and connecting to a neighbor. It was so secure. So if I saw, a bunch of
black SUVs rolling up, I could assume it was safe to burn everything I had. Get rid
of everything. Clean house. Because my neighbor was getting raided.
So, one thing I would always check, I would do perimeter checks on a regular basis.
I was a homebody.
I didn't like to leave.
I'm definitely not big on social interactions, personally, I have a little bit of agoraphobia,
so this talk is extremely challenging for me, however, it was something that I felt
I would love to share, and I'm glad that DEF CON gave me the opportunity to share it with
you guys.
But one of the things that needs to be stayed on top of is security checks.
Just like in a corporation, you constantly have to make sure that everyone's staying
on point, because again, complacency is the enemy of security.
So that was one of the big things that I had.
I had weekly, daily, and monthly checklists of things that I would make sure that I was
doing.
At the end of the day, we all feel safe.
When we're at home, we all feel safe.
We all feel secure.
And then, one day, we lose our keys.
And then, all of a sudden, we're all penetration testers.
We can look at our house, and we can say, oh, I can card the door, oh, I left that
window open.
Now, all of a sudden, you can find three, four different vulnerabilities in your home,
and you stop feeling so safe until you get those secured.
And I think that's something that, as a darknet vendor, it's really hard to do.
It's very easy to get comfortable, just like it is for our average people.
Checking out your weaknesses and making sure that they're fixed.
Evaluating your OPSEC on a regular basis, to me, is mandatory, especially because the
repercussions aren't a data breach, they're incarceration in a federal facility.
Staying away from emotional decisions.
Things like drinking.
Drinking.
And typing will get you raided, will get you a 10 to 25 year sentence.
So it's suicide, career suicide, on a little bit of a different level than what we're used
to.
I like to always advise to never answer questions.
Even to this day, I don't.
I only answer questions after this talk, but, you know, like in general.
When it comes to law enforcement, or obviously someone you don't know, calling up and asking
you questions.
A really great thing to watch is to go to the SC Village and see people calling people
up and those people just giving out information, obviously we all know, it's not a good idea.
So I'm always leery of that.
And in turn, I always like to answer that question with a question.
So once you actually pull that trigger and you start being a darknet vendor and you start
having to actually deal with customers, you have to write terms and conditions, you know,
when are you going to refund a customer?
How long is it going to go?
How long are you going to wait before, you know, if someone buys something from you today
and tomorrow they say, hey, I want a tracking number, are you going to give it to them?
Should you give it to them?
You know, if you give it to them.
Then.
Then they'll know where you shipped that from, you know, maybe you want a little bit
more time before you're willing to give that away.
So all those little kind of things are things that need to be seriously evaluated when you're
considering building a platform or when you're considering being a darknet vendor.
And again, I have it as number six here, don't drink and type.
It's essential.
So changing your PGP key.
Not a lot of vendors do that.
Not a lot of people do this, but it lets you switch up as you switch up your identity,
which means you, your reputation dies and that's unfortunate, but you can always build
that reputation back up and it will take a massive target off your back.
So your point of you doing this is to make money.
That's how I saw it.
It was to make money, just to get in, just to get out.
And that was my goal.
So having that mapped out with your ingress, your egress and your regress, as far as things
like changing your PGP key or things like that were essential to me before I started.
And with things that I kept in mind during the whole time.
Once you start building a reputation on the darknet, it's in spite or out.
So what I mean by that is like you as professionals right now, if you have, you work for a big,
big company, right?
Or you write a book, you're building a reputation.
You can use that reputation to get a better job.
And you can do the same thing on the darknet, except instead of me offering a former employer
might be a verifiable PGP signed message to a new employer and a new darknet opens
up and I messaged the admin and I say, Hey, listen, I can help you out.
I have these previous accounts.
I can validate them.
You can check them.
And I can prove that I've done this kind of work before.
And it allows you again to spite her out and end up getting multiple different jobs, which
pay sometimes a lot better than if you're just starting out as a vendor.
That reputation is something you can buy and you can sell and you can trade on.
And your, you know, your PGP key, your identity is much more restrictive.
It's restricted to darknet market admins as opposed to all the users.
So me personally, I hate Bitcoin tumblers.
I never use them.
I just didn't like them.
I don't like sending my Bitcoin to someone and I don't know who they are.
It always kind of rubbed me the wrong way.
So what I used to do.
I used to convert it from Bitcoin to Monero and then back to Bitcoin.
And I was happy with that because I knew that the link between the two different types of
Bitcoin that I had was completely broken.
It's kind of like robbing a bank, buying a bunch of weed and selling all that weed.
And now the money that you have is completely different.
Whether or not you made money on it is a different fact, um, alternatively, um, also buying drugs.
So if I sold $20,000 worth of narcotics in three days, I could turn around and I could
buy narcotics and I could sell them locally at a much steeper Marco and still have anonymity.
So then you get to retirement.
If you make enough, you know, if you're lucky enough, you get to this point.
Um, and surprisingly, a lot of people I've known a lot of darknet vendors who have gotten
to this point.
They just don't get to retire.
Well, darknet vendors do, and I've known a couple of them.
It's completely possible.
Um, I'm not encouraging anyone to do it.
If you're at this con, you're obviously intelligent.
I suggest that you don't do it because it has horrible ROI and it's a lot of stress
and you know, I'm 37 and looking at the gray hair I have, you know, um, it's not an easy
job.
Um, so I don't recommend it to anyone.
And that's one thing I definitely like to make clear.
Um.
So, and I talk about here that, you know, we do switch up, switch up PGP keys.
Uh, again, that kills, kills all your business, but that's, it's a necessary, um, so when
my department of justice announcement came out where they announced me and about 33 other
people that got rated, um, they said that it was because of operation dark old and I'm
from Vermont.
You can see the little arrow going up north from that.
Well, maybe you can't.
Yeah.
Sorry about that.
Um, but that's what they, basically operation dark old was, they caught someone who was
laundering Bitcoin, um, and they had this guy continue to do it and people would cash
out their Bitcoin to him for 10% and he would send them cash in the mail.
Um, at this time, KYC, the know your customer policy for Bitcoin wasn't really prevalent.
Um, and it only applied to banking institutions at that point.
So personal.
Yeah.
So Bitcoin transactions are not illegal.
Um, and you know, quoting, trying to say that because someone bought Bitcoin from someone,
this was how you caught them.
To me, I thought it was asinine because it made absolutely no sense whatsoever.
Um, to me it was just a way to collect names of people who were on the dark net.
Um, and that's exactly what they did.
Uh, that was, but that was how they said that they ended up catching me.
Um, and the issue that I had with that was that at the end of the day, you have a hearing
called the Frank's hearing, uh, in law and Frank's hearings, when you can prove that
law enforcement violated the law in order to catch you doing something or to get a warrant
to search your house, um, they themselves broke the law in trying to ascertain that
information.
That was my case.
The United States postal inspector opened a package that he didn't have a warrant for.
Again.
One of my favorite reasons why I use the United States postal service was it requires a warrant
for you to open a package.
And this went back to my OPSEC and they broke that.
But in breaking that, they also gave me a way to exit out of my 10 count federal indictment
that they also hit me with because they broke the law.
We didn't get to that point.
Um, and that was because before we could bring that up.
After our Frank's hearing was granted, my cousin had already written a statement which
established conspiracy and the feds can give you a mandatory minimum for a conspiracy
charge can be anywhere from 10 years to 20 years.
So it's not something that you really want to take a gamble with.
So after I was caught, um, it's convicted.
Um.
But only after I pled out, I agreed to a maximum term of 180 months in federal prison.
And I was actually given 60 months, which is awesome.
I thought it was awesome because then I didn't know anything about the federal system.
When I first got charged, I had a 10 count indictment.
When I looked up those charges, I saw each one came with a maximum of 20 years.
We do the math.
That's 200 years.
So that's what I thought I was going to get.
I thought, well, I'm going to get 200 years.
I'm never going to get out of prison, which it was just, it's not how it works in the
federal system.
So I studied law for 18 months while I was in federal prison because I inherently, I
saw a lot of power in it.
Just like a lot of you see a lot of power in learning how to code.
Those things allow you to do things that, you know, the person who doesn't know how
to code.
Maybe not.
Maybe they can't do or they can't automate or they can't get as much done as you can.
So for me, the code I wanted to learn was federal law and that's what I learned.
And by doing that, I was able to get myself out of prison.
They have a thing called the compassionate release where, you know, if you can prove
that there's a danger from, you know, because of your health.
Then you can apply for compassionate release.
And I did.
I wrote a 200 page motion and I mailed it in to the federal court.
So that was essentially my brute force attack to the federal courts.
And it worked.
And they released me.
But it was after a lot of studying, a lot of hours, a lot of 12 hour days reading federal
law.
So this year.
DEF CONs.
Theme is hacker homecoming.
And for me, that's especially true.
Technically, my release date is for the third day in January of 2023.
So I'm very happy to be here standing on the stage, talking to all of you, as opposed
to being in a prison cell.
So I made a stupid mistake and I got I got myself in trouble and I paid the consequence
for what I did.
But at the same time, that hacker mentality of never giving up, of always wanting to fight
and just continually bashing your head against that wall, it ended up paying off in a totally
different way than a lot of us see on a regular basis.
You know, it wasn't that that code finally ran without crashing.
It was that.
It was that.
You know, I wasn't stuck in a small cell with a bunch of sociopaths who have life sentences.
So that was a great thing.
But it's one of the things that really made me appreciate both communities because I started
out in the hacking community and I ended up going into the darknet community because
it's such an easy transition.
You know, one of the most paramount things is understanding security.
DEF CONs.
DEF CONs.
And being in this field, you already do that.
And that's I think that's the really dangerous thing that exists is because it's so easy
to just move over to that side.
You know, for me, it was anyways.
So in conclusion, moving over from that from from being a hacker to being a darknit vendor,
it was ridiculously easy.
But again, you know, you don't you can have the perfect opsec.
DEF CONs.
DEF CONs.
get fucked over and get fucked up you know you there's no such thing we all
know there's no such thing as an unpickable lock right there's no such
thing as a foolproof plan there's no security application that we can
install that's gonna make us all safe guaranteed it's the same thing no matter
what side of the fence you're on whether it's law enforcement or you know
criminal thank you for letting me speak here
I think they're gonna open it up for Q&A if you guys have any questions
yeah
all right questions
anyone
what's that should you use more than one sock puppet I don't know anyone else if
you have a question come on up here
so that's excellent you're welcome
so how did you originally find out about the darknet market and what all markets
did you operate on so I operated on probably a total of about 15 different
markets I remember the first time I really heard about Bitcoin was from a
friend of mine and he was discussing how there's a site called btc faucet which used to exist back
in the day where like you could hop on once a day and you get anywhere from like 5 to 50 bitcoin um
and we'd we'd done that a bunch of times and then i got to a point where we had like 300 bitcoin
and we were like this is a waste of time just crap you know we just threw away the wallets
big time regret there yes
did you see shiny flakes oh yeah yeah yeah yep yep sold them too
yep hey so you talked a lot about like operational hygiene and stuff like that relating to like oh
okay so like you talked a lot about like operational hygiene so like in um in a week
or in a month you had like these routines and things you would do to try to like
promote like
a good good like sick uh sec ops like hygiene right to make sure i can't make out okay sorry i
can't um uh so for things like you you have like um is is there any strategy you would use
specifically for like trying to determine what your weakest points are for trying to like trying
to establish a a good hey this is what i'm gonna check this week right because you can't check
everything you can't check every fail
your point, every area. What kind of things would you specifically look for as part of
your strategy to protect yourself OPSEC-wise? Initially, I spent six months doing research,
looking at previous cases, where the feds had raided people, why they had raided them,
and that was kind of my starting point for that. Then once you start to grasp that, you
start finding your own little hacks and things that you can do to make it improved. To answer
your question, it was mainly history, because history predicts the future, so I would try
to look at what happened in the past to evaluate what was going to happen or what I would need
to do to evolve and not be the guy in that DOJ announcement.
You have time for about two more questions. Hey, you said you would burn identities with
some regularity to not leave any tracks about who you were. Did you ever get caught on any
of these markets?
By people you interacted with as being somebody on a different market, using a
different identity, and if you did, did that cause any issues?
So I heard the first part of it. What was the second part?
Did you ever get caught using multiple identities on a number of these different websites by
people you interacted with, whether it be other staff, other users, for being, you know, a
vendor under different names? Yeah, so you see, it's interesting, because once you're there for
so long, and like that kind of anonymous environment, you can start to see people's mannerisms.
It's a lot like with 4chan, right? When you started having people who would use the same kind of
terminology or wording, you could tell who's who. Even if their name changes 50 times, you still
know that person, because you spent a lot of time talking to them. You know their ideas, their
ideals, or their politics, or whatever it is that they're discussing. So those things, using your
identity for other things.
To me, it wouldn't be something that, I wasn't really there for the socialization aspect.
You know, I was there strictly to make money, and anything that helped further that goal, I would be
there. So when it did come to having to establish an identity, and, you know, just make a ridiculous
amount of posts to the community, that's what I would use it for. But I wouldn't use it anywhere
else. I actually, I remember reading a case about a darknet vendor who had his personal
pgp key on the darknet, and then the idiot decided to use that as his gmail pgp key. You know?
And he didn't last long.
Interesting talk. Thank you. I was wanting to get your thoughts on, like, some markets had exit
scams, and kind of what was involved in that process. Were mods behind it? And also, the
second question is, the DDoS attacks on a lot of markets, is that, you know, a lot of people
really revenue depleting for them, or money losing? Did they pay off the DDoS people to stop that
happen?
So I've seen, really, to answer the second question real quick, I think the primary motive that
you see for DDoSs, when it comes to darknet markets, is mainly federal agencies. It's like,
well, how can you prove that? Well, you can't. But really, it's one of the only ways that you can
really see them.
You can't take down markets with any kind of regularity. But even then, you know, they just
create new URLs, and good luck, they move on. But aside from that, I've known darknet market
admins who have wanted to conduct those campaigns against competing darknet markets.
Hi. Can you explain if and why certain drugs are pharmaceuticals?
I mean, I know that pharmaceuticals aren't as targeted.
I explain why.
As in, like, for example, like, health wellness drugs or something like that, as opposed to,
like, cocaine or heroin. And then also, it kind of ties in with my follow-up question, but
what goes into the ability for someone to order internationally from, like, a drug store
internationally? And why is that legal?
And why is it illegal to import certain drugs when you don't have a prescription?
Do you know anything about that?
So one of the more lucrative trades that I found when I was doing it was just that, was to do retail.
So you have a lot of people who aren't comfortable ordering internationally, because internationally is
when it goes through customs. If I'm sending you any kind of narcotic through the mail here in the U.S.,
it doesn't go through customs. So there's not a whole bunch of scrutiny. So it's fairly easy to do that.
But when it goes through customs, it's a little bit more. So I know that one of the things I started doing
after a while was looking at which countries would produce the best of a certain type of drug.
So, for example, LSD. There's a vendor. And again, this isn't a secret. It's very well known.
Called Gamma Goblin, who makes some of the best LSD that exists. And he lives in the Netherlands.
That's where he's located out of. If you get a package from him, that's where it's going to come from.
Sometimes. But the Netherlands is really known for having good quality LSD and good quality MDMA.
So for me, I would source the countries that had the best quality, and then I would find vendors in that.
Because you can always, you can refine those search parameters in almost any darknet market.
And then with that information, I would go and I would look on sites like Dredd.
And I would cross reference and find their reputation, find out what people said about them.
So I would find the countries that had the best of a certain type of drug.
Then I would find the guy in that country who has the highest reputation in marketing that drug.
And I would order it from him. And like, you know, sometimes the profit margins would be insane.
Like I know with acid from Gamma Goblin, I could grab it for about five cents a hit and sell it for about ten.
Fifteen. Locally, on the darknet, it would usually be around four.
But again, it was still an astronomical return.
I'm on investment. And with something like acid, it's a piece of paper.
There's no smell to it. So it's very easy to do.
Last question.
Hi. What platforms did you use to launder the Bitcoin to Monero?
And then how did you vet those platforms?
So when I did it, the one thing I'd like to remind you is like,
when I was doing all this was years ago.
So originally, it was Changely.
I really liked Changely.
There's another one, Shapeshift IO.
Any service that I would use, I would try to investigate them as much as I could.
And I had learned that Shapeshift was really open to the DOJ.
And I just wasn't for that.
I didn't really see too much about Changely.
So I liked using them.
But again, like any time I would visit their site, it's going to be through Tor anyway.
You know?
Thanks very much.
Thank you.