A Guided Tour of the Internet Ghetto

The Business Value of Tor Hidden Services

Brent Huston “Internet Ghetto Tour Guide” & Does Some Threat Stuff Guy… @lbhuston

Caveats!• Not your average ISSA talk

[NSFW]

• Mentions of porn, violence, drugs & illicit activities

• NO - I will NOT be showing actual porn…

• If you are offended by the subject matter - bye!

• No harm, no foul…

• Don’t try this at home, or suffer the consequences…

What is this Tor thing in 90 seconds?

Whats a Tor Hidden Service?• Uses the Tor bouncing hosts as a

“maze” - except everything is in motion…

• Zooko’s conjecture: out of Decentralized, Secure, and Human-Meaningful, you can achieve at most 2…

• XYZ.onion <- Like DNS on Snow Crash…

• http://3g2upl4pq6kufc4m.onion/ = Duck Duck Go Search Engine

• Rendezvous points & PKI make the date

• Client & server meet covertly, without knowledge of each other’s real location…

No, Brent, I need deep technical deets…

http://bit.ly/1nIZZxNhttps://www.torproject.org/docs/hidden-services.html.en

Caution on being anonymous…

Not all anonymity is created equal…

• Data can still leak in a variety of ways

• NOT a replacement for operational security

• Use Tor Browser Bundle and/or specific OS’s - Tails, etc.

• Warning: trojans, exploits, sting ops & a variety of other techniques can slice the onion & leave you crying…

Welcome to the ghetto…** Last warning **!

Mature Content Ahead!

The train station…• Lists, wiki’s and search engines of

hidden nodes

• http://kpvz7ki2v5agwt35.onion/ - Hidden wiki (the sage…)

• http://xmh57jrzrnw6insl.onion/ - Torch

• http://dppmfxaacucguzpc.onion/ - TorDir

• http://e266al32vpuorbyg.onion - Dark Nexus

Walking “The Street”…• Stores - what can you buy?

• drugs, weapons, porn, fraud gear, data, property, cars, people, fake IDs, exploits, malware…etc…

• Clubs - what’s in there?

• conspiracy theories, crypto, hackers, social & idealogical forums, tribal meetings, pastebins, etc.

• Houses - who lives here?

• IRC, wrapped messaging apps, TOR web mail services, personal pages, etc.

Inside the “Black Sun”• Web of trust, very similar to

old days of BBS culture & piracy…

• Reputation & relationship is key to access

• Access brings extended services

• Murder for hire, custom porn, special gear, search services, more code, etc.

Yen & Kongbucks…• 3 ways to pay…

• Trade/barter -> Be VERY Careful… (Not Likely Anon)

• Bitcoin & cryptocurrencies

• Gift cards

• Sheeple: credit cards… Yep… some do… :-o

Business Value• Start with the search engines…

• Company name, project names, product names…

• Watch for operations targeting your vertical…

• Check out traditional web sites (phishing, spears, etc.) with a Tails Live CD/VM - leverage TOR

• Research that you don’t want tied back to your company…

Where’s the exit?• Tor hidden services are growing

& expected to continue

• Blind spot for most organizations & MANY infosec ppl

• In time, the dark side will likely yield to new emerging markets, be prepared for the future…

• At the very least, know how the dark side of the Internet works, ignore it at your own peril…

Be a “Hiro Protagonist”…• Tor site: torproject.org

• Tor Wikipedia: en.wikipedia.org/wiki/Tor_(anonymity_network)

• EFF has a lot of materials

• Twitter #tor is very active

• @lbhuston

Thanks for hanging…