The Beginner’s Guide to The Internet Underground 2nd Ed. Jeremy Martin Sr. Security Researcher This doc covers the basics of anonymity, hactivism, & hidden parts of the Internet underground, along with some of the things you may find there. Disclaimer: Do NOT break the law. This was written to explain what the Darknet / Tor hidden service is and what kind Information Warfare Center, LLC of things you may find. It is not an invitation to break the law without recourse. Just like any network, this one has both good www.informationwarfarecenter.com and bad guys. If you break the law, you will get caught. If you break the law, you have to be lucky EVERY time. Law ( 7 1 9 ) 3 5 9 - 8 2 4 8 enforcement only has to be lucky once. www.Youtube.com/IWCCyberSec Images within this document were taken directly off the Internet or from screenshots at the time of research. The 5 / 3 1 / 2 0 1 4 content of these pages are subject to update, discussion and dispute, and comments are welcome. “If you know both yourself and your enemy, you can win a hundred battles without a single loss” – rough translation; Sun Tzu’s Art of War. "Trust but verify" - Ronald Reagan or the Russian proverb "Доверяй, но проверяй" 1 Page The Story 4 Can there be true anonymity on the Internet? 5 The Internet Underground: Tor Hidden Services 10 - Tips 13 Creating your own Darknet home 14 Other Internet hidden networks: I2P: Anonymizing network 15 Hacker Groups 17 - The Hactavist 17 - The Cyber Criminal 18 - Cyber Espionage / Warfare 21 - The Cyber Jihadists 22 The Activist Group “Anonymous” 23 - Messages from Anonymous: 23 Information sharing 29 - Security Research 29 - Internet Piracy 30 Digital Forensics and investigation 33 - Disk forensics 34 - Network forensics 35 - Misc forensics 36 - Anti-forensics example 37 Real World 38 Mobile Darknet Project 39 Resources 40 About the Author 41 For more information, go to youtube.com/IWCCyberSec And watch Cyber Secrets for updated content related to forensics, hacking, intelligence, and news on the Darknets. 2 3 It's half past midnight. The glow of computer screens flicker off empty energy bottles strewn across the room. Moving images of Japanese anime irradiates from a monitor while the beat of progressive house music leaks out of speakers throughout the room. Pictures on the television show news bulletins filled with thoughts of terrorism, espionage, and a cyber-apocalypse. This fear mongering preceded an Executive Order to allow both companies and government agencies to monitor everything from emails to telephones without a search warrant. This has inflamed the hacker community along with a small portion of the population who consider themselves freedom fighters and patriots. One of the laptops sitting on a nearby desk (a customized Linux) starts to flash, catching a hacker's attention. A script designed to crawl government and military websites, found and defaced the 17th website tonight with cyber-―patriot‖ propaganda. Another laptop views a pastebin information leak where thousands of email accounts and millions of emails from those in the law enforcement, government, and intelligence agencies are listed with a note saying ―If you want to watch us, let the public watch you.‖ The sites publishing the information are getting shut down quickly at first, but soon the data spreads like wildfire. Within a couple hours, the television across the room showcases the major networks as they are commenting on misdeeds of a few corrupt officials due to leaked cables. An IRC chat window starts to become active. Several hackers, known only by their handle, start to laugh (lolz). At first they were hacking for the lolz, but now it is different. They all feel invincible and are doing it for ideology. The chat turns more organized, and plans for future attacks start to solidify. … It is now three in the morning and the sound of rain drowns out the scream of police sirens racing down the street. Tires screech as over a dozen vehicles swarm the suspect‘s house. Within a minute, there are over twenty fully armed S.W.A.T. and federal agents moving towards the red door in the front of the house. 1, 2, 3 one of the officers motions… ―This is the police!‖ another yells as two cops swinging a ―door knocker‖, busts the weak wooden door off of the hinges. Black clothed bodies flood the portal. The Special Agent (SA) in charge of the operation walks through the shattered home immediately after being cleared by the shock troops. Once he gets to the back bedroom where the suspects are located, he finds an elderly couple terrified lying in their bed. Surrounded by weapons drawn, the SA simply asks if the couple had any knowledge of the cyber-attacks plaguing the country. In tear soaked speech, the wife mutters, ―No.", as the SA shakes his head in frustration. A couple of miles away from the flashing of police lights, the actual criminal gazes through his window laughing at how untouchable he thinks he is. The hacker perpetrated the attack by purchasing a high power wireless card with a directional antenna during his travels. Using cash, the transaction was practically untraceable. He used a Linux distribution called ―Reaver Pro‖ to crack the elderly couple‘s wireless WPS key. This only took a few hours and gave the hacker the WPA password, which happened to be their son‘s name. Now, even if they change the WPA key, the broken WPS key will instantly give him their new password unless they change the WPS key as well. He then proceeded to change or spoof his MAC address (hardware fingerprint) to that of the couple‘s personal computer and then piggybacked off their service. 4 None of the exploits used or information leaked to the public was ever traced back to the original sources. The hacker and his associates continued the attacks believing they are invincible while fighting for a ―just‖ cause. The fight on both sides escalated over the next year until the freedom fighters hacked a water treatment facility running SCADA or Industrial Control Systems (ICS). Now, they come across a device that looks ―interesting‖. They simply listened to the network traffic for a couple of days. After they record the data between the control center and what ends up being a chemical injector, one of the hackers realizes which one is which. As a political statement, the hacker changes the amount of fluoride flowing into the drinking water. He plans to do this for only a few minutes. Almost immediately, lightning strikes a phone pedestal a mile down the road. The DSL line the hacker is using ―goes dark‖. Panic finds its way across the hacker‘s face as he realizes he just murdered over a thousand people with fluoride poisoning. Artwork by Jeremy Martin The interesting thing is most of it can easily be true. Poor choices by management and improper implementation by staff is rampant. How many malware writers actually get caught let alone convicted? How many hackers actually get caught let alone convicted? Even the hactavists that do get arrested for attacks such as Denial of Service use the defense of activism, free speech, or a ―cyber sit-in. Most of the ones caught aren‘t even the masterminds behind the attacks. The mentalities of hackers vary from a bored teen doing it because they can to actual state-sponsored espionage to an ideological electronic warfare. Anyone can be a hacker. Anyone can be an activist. Anyone can be a criminal… How many cyber laws, just here in the U.S.A., have been passed in the last ten years in the name of ―anti- terrorism‖? The recently failed and reintroduced CISPA was such a law that violates the 4th amendment and every revision of the wiretap laws ever passed. It is understandable why a government would want to do this. It is also understandable why the people would want to stand up against the illegal activities of its government. Warrantless wiretap… Think of this; most cell phones and telephones cross over networks at some point. The voice becomes digital and therefore data, and falls under the monitoring statutes for ―Provider Protection‖. Why would this be considered absolutely inconceivable pre-911 and perfectly acceptable post-911? Questions need to be asked before trying to understand the why. Why would people want to be anonymous or exercise their right to privacy and free speech? Why would others want to monitor everyone‘s communications in the name of security? Why would some be considered cyber-terrorists? Can one actually protect themselves from prying eyes? . 5 To some extent, the answer to the title is yes. However, there are many variables to consider. Just in the United States, there are many laws on the books (especially post-911) that have enabled ―Big Brother‖ to potentially violate several of the rights granted to Americans by the Bill of Rights. Listed are just a few of the regulations or budget contracts that reference loosening the term ―reasonable search and seizure‖ covered in the fourth Amendment and why there is such an internet outcry to Internet privacy. Currently, there are several Internet Service providers that may be illegally wiretapping all your traffic. Whether it is foreign or state sponsored activity or the ISP is watching what you are doing so they can censor, filter, or shape your bandwidth, your secrets may not be that secret. Just in the USA, there are several interesting federal laws Computer Fraud and Abuse Act (CFAA) USA Patriot Act, Title II (Enhanced Surveillance Procedures) ECPA (Electronic Communication Privacy Act) Title 18, U.S.C §1030 (Computer Fraud and Abuse Act) Title 18, U.S.C §2703 (Disclosure of customer communications) CISPA (Cyber Intelligence Sharing and Protection Act) – shot down 2012& resurrected in 2013 NDAA 2011 (The National Defense Authorization Act) Digital Millennium Copyright Act (DMCA) Etc… Constitution of the United States Amendment I Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.