1. Many dark web constructs. The most notorious/popular is Tor/Onion.
Built for anonymity.
The home of criminals, black hat hackers…
Trading Post for illicit software—
Ransomware, hijacking, DDOS, phishing.
Trading in stolen SS#s, credit card numbers, drugs, weapons, and people
Visible web
Deep web
Dark web
9/24/2018

2. Phishing Expeditions Accumulate email addresses of website managers
Send malware with key loggers
Gain control of website – Install malware for ransomware ware
aaomojomolo1979
absolutezero
achardt1966
alexandraboies11976
allen.kong1964
altheapaul1981
andersonah
andilila
andreacohen42005
andreacuyun
andrew
andy.bt1985
annlouiseberg2000
antalon2pbs1962
antoniod
ashley_m_mason1995
bshepard
bucketless
bzindler_
9/24/2018

3. s
9/24/2018

4.
9/24/2018

5. http://www. bluedot. co. za/l5afva/getnum. php
9/24/2018

6.
9/24/2018

7.
9/24/2018

8.
9/24/2018

9. http://www. bluedot. co. za/l5afva/getnum. php
9/24/2018

10. Pay Ransom With Bitcoin
Wallet is a randomized ID holding private key.
Blockchain is history of every transaction segmented by checksum- difficult to calculate, easy to verify.
Two parties construct a transaction.
Transaction could take hours to appear in blockchain.
Your Bitcoin holdings is the sum of your transactions in the blockchain.
9/24/2018

11. How you can be Identified and surveilled
ISP DHCP server assigns you a unique IP number
mfg MAC address is required by ISP
2C7E81CBDA43
MAC used in 802 Wi-Fi protocols
ISP assigns users a DNS server
Authorities can tap the user connection at the switch
9/24/2018

12. Overcoming ID and Surveillance
HTTPS
Origin/destination are exposed
vulnerable to man-in-the-middle attacks
(third party DNS server)
VPN protocol
minimum destination header – origin protected
transport and application layer protected
Proxy server
varying levels of protection
destination usually informed of proxy in progress
Public Internet-Wi-Fi
passwords are simple to break
ID usually limited to physical
signal boosting techniques
Ghosting a MAC address
MAC address as a fingerprint
9/24/2018

13. MS .NET RNGenerator Distribution Test
Standard deviation
100K
150K
200K
250K
300K
350K
400K
450K
500K
3C703E596F F756C C6C20616C6C206F F E E D696C792
9/24/2018

14. Tor/Onion http://nql7pv7k32nnqor2.onion
Most popular of several dark constructs
version of Firefox/Chrome
roots back to Mosaic
Any ability to ID user or activity is stripped out.
Multiple levels of encryption
Proprietary “DNS” service
Google cannot/will not index it.
Not quite HTML/HTTP
Packets are sent through at least 3 relays before the destination.
Surveillance won’t see final destination
9/24/2018

15. Secure eMail Addresses
To register on most onion sites require a secure address
Unlike surface web – these providers promote anonymity
ProtonMail
Torbox
Mail2Tor
9/24/2018