Social Media Investigations Within the Dark Web About the presenters Joe Church Founder & Owner Digital Shield, Incorporated Ashley Luna Product Manager X1 John Patzakis Executive Chairman X1 Agenda • X1 Overview • Digital Shield Overview • Introduction to the Dark Web • Accessing the Dark Web • Dark Web Collection Demo • Interactive Q&A X1 Social Discovery • Designed for investigative professionals to collect social posts, website content, webmail, and YouTube videos and other social media types all from within a single user interface. • Supports the simultaneous collection of content and metadata • Legally defensible collections that preserve chain of custody. • Build on X1’s patented & proven fast-as-you-type search technology Presenter Background • Joe Church – Digital Shield, Inc. • Prior LE/Federal LE • Private Business • Litigation Support • State/Federal/International Testimony • Case Work • Leading Technology • Course Development • Major Vendors Internet Layers Surface Web • Also called: ▫ World Wide Web ▫ Clearnet ▫ Visible Web • Topmost level of the web, searchable by surface crawlers ▫ Examples: Bing, Google, Yahoo Deep Web • Also called: ▫ Deepnet ▫ Invisible Web ▫ Hidden Web • Second level of the web • Cannot be reached by traditional search engines Dark Web • Also called: ▫ Darknet • Small portion of the Internet that is intentionally hidden ▫ Restricted, encrypted, and not fully indexed ▫ Often associated with criminal activity ▫ Originally developed by US military researches Dark Web • Creates an Overlay Network, a new network that rides on top of the Internet • Relies on the Internet to provide connectivity • But the new network controls how data flows between devices • Uses this new control to keep any two computers from directly connecting, making it hard to trace sender or receiver Hidden Services • A Tor Hidden Service uses a URL that ends in .onion • The name of the site is based on the value of its public key, and is therefore not easy to remember • Example: qmxatp67yinspsuf.onion is the URL for Silk Road 3, which is still online as of Aug 2018 Discovering Onion on Surface Web • Hidden services (.onion sites) are not easy to locate because ▫ No complete search engine for the dark web ▫ URL names are not easy to remember • Finding hidden services by using Surface Web is possible Onion Routing Visitor 2 3 1 Hidden Service Tor 2 Web Services • Tor2web proxies are computers that link to both the surface web and the dark web • They allow content from the dark web to be viewed from the surface web • Some surface web sites maintain directories of hidden services and offer Tor2web proxies to view some or all of the listed sites Onion Search Engines • There are a number of surface web sites that provide lists of hidden services ▫ Darknetmarkets.org ▫ Onion.link ▫ Ahmia.fi ▫ Deepdotweb.com ▫ Thehiddenwiki.org X1 Social Discovery Collection X1 Capture of Dark Web • Web Capture • IE Browser • Tor2Web Protocol ▫ Https:// ▫ .to after .onion site ▫ Slower but effective Contact us Joseph Church | [email protected] Ashley Luna | [email protected] John Patzakis | [email protected] Sign up for our Wednesday Live Product Demo, or a free trial @ www.x1.com/products/x1_social_discovery/ X1 Social Discovery Training is available through Digital Shield www.x1.com [email protected] digitalshield.net [email protected].