Darknet Investigations Pieter Hartel

Visit Alphabay Cyber-crime Science 2

Sample listing Cyber-crime Science 3

Darknet markets Social architecture - people »Keeping “honest” people honest (escrow) »Reputation building (reviews) »Dispute resolution (banning) Business architecture - processes »Specialization (80% Drugs) Financial architecture – processes »Pseudonymous payment system (Bitcoins) Technical architecture - technology »Web servers (Market, Forum, Wallet) »Anonymisation network (Tor) Cyber-crime Science 4

Technical architecture Cyber-crime Science 5

acTOR game “Write your phone number and the name of another person on the post-it and put it into the small envelope. Write the name of yet another person on the small envelope and put it into the medium envelope. Write again a different name on the medium envelope and put it into the large envelope. Write yet again a different name on the large envelope and give it to the person whose name is on it. If you receive an envelope, take the contents out and give it to the person whose name is on it. If you receive a post-it, can you find out whose phone number you have got? Cyber-crime Science 6

What do we know? You know who gave you the post-it The person who gave you the post-it knows the phone number too. You know who gave you an envelope and you also know whom you gave it to. And that should be all! (unless you cheated…) Cyber-crime Science 7

Visit site with Tor browser Cyber-crime Science 8 click

Two asymmetric circuits Cyber-crime Science 9 Rendez- vous point Client Hidden Server

Financial architecture Cyber-crime Science 10

Bitcoin Bitcoin is: »A virtual currency »A payment system Technical architecture »Clients send transactions to P2P nodes »Nodes verify transactions and prevent double spending »Block chain records transactions Business architecture »Clever incentives for “miners” »Cost structure transactions different from banks Cyber-crime Science 11

“Anonymous” payment Method:Trust provided by:Coverage: Cashgovernmentlocal Hawalanetwork of hawaladars who have done business for generations regional Bitcoinincentivized people using the same technology global Cyber-crime Science 12

Hawa- ladar Hawa- ladar Babar Hawa- ladar Aisha Hawala Cyber-crime Science 13

ATM Babar ATM Aisha Bitcoin Bitcoin network Cyber-crime Science 14

Bitcoin ATM Cyber-crime Science 15

Bitcoin market Market cap over 5 B$ 200 K transactions per day Exchange rate Jan 2009-Jan 2016 Cyber-crime Science Nov $/BTC

Business architecture Cyber-crime Science 17 [Soska2015] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX Security Symposium, pages 33-48, Washington, D.C., Aug USENIX Association.

A darknet market is an online market – increases choice an illegal goods market – increases demand an anonymous market – reallocates risk part of an ecosystem – increases competition Stealthy connection to the physical worldf Cyber-crime Science 18

Innovation Technologically sophisticated Fuelled by an alternative financial system Transformative, creating a new type of “responsible” dealer What is the effect on public health? Cyber-crime Science 19

Markets [Soska2015] Cyber-crime Science 20

Global drugs trade Street value of drugs seized in EU many billion $ per year Darknet markets turn over a few billion $ per year [Soska2015] Darknet markets trade still insignificant but growing… Cyber-crime Science 21 [EMCDDA2015] EMCDDA. European Drug Report Trends and Developments. European Monitoring Centre for Drugs and Drug Addiction, Topic-Drugs.

Social architecture Cyber-crime Science 22 [VanHout2014] Marie Claire Van Hout and Tim Bingham. Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading. Int. J. of Drug Policy, 25(2): , Mar

Opportunity theory applies 3 out of 5 principles: »Low effort – everything via the Internet »Low risk – anonymisation technology »High rewards – high volume & value Dark markets offer several controls: »Escrow, Referral, Vendor bond, Finalise early, Personal messaging But who controls the admin? Cyber-crime Science 23

Offenders are victims too Vendor scams: »finalize early without delivering »ship low quality products Buyer scams: »deny delivery & reclaim payment »damage vendor reputation Admin scams: »delay payout and exit with the balance Cyber-crime Science 24

Investigative methods Web crawls [Soska2015] Data bases [Spitters2015] Interviews [VanHout2014] Screening shipments [Horne2015] Analysis of criminal cases [Lavorgna2014] Test purchases of drugs [Davies2010] Analysis of server data [McCoy2012] Cyber-crime Science 25

Cases SR I: 2011-Nov 2013, Ross Ulbricht SR II: Dec 2013-Oct 2014, Blake Benthall Evolution: Kimble & Verto – Feb 2015 Cyber-crime Science 26

Conclusions Seizing a market is not effective Some alternatives »Offenders make mistakes and scam each other »Online must meet offline »Trust erosion »Taxing Bitcoins New trends »Single vendor market places Cyber-crime Science 27