DarkCyber for February 20, 2018, Now Available
February 20, 2018
The February 20, 2018, DarkCyber walks through the method for de-anonymizing Bitcoin transactions. The paper, written by researchers at Qatar University, highlights information leakage in the Bitcoin blockchain implementation. The video news program is available at www.arnoldit.com/wordpress and on Vimeo at https://vimeo.com/256283081 .
A Dark Web customer used multiple identities to purchase Class A controlled substances via the Dark Web. Investigators were able to trace one of the bad actor’s false identities to specific personal details and arrest the individual. Aliases combined with use of the Tor browser are vulnerable to the investigative methods used by British cybercrime investigators.
LmnTrix, an Australian cyber security firm, discovered a new ransomware service called GAndCrab. What makes the service unique is that the developers impose a terms of service agreement upon individuals wishing to extort money. One example of the deal is that clients of the ransomware software developer must agree to use the software outside of Russia and other members of the Commonwealth of Independent States or have their license for the ransomware revoked. MBA thinking now informs black hat hackers.
You can view the video at this link.
Kenny Toth, February 20, 2018
DarkCyber for February 13, 2018, Now Available
February 13, 2018
The February 13,2018, DarkCyber reports on Ecuador’s country-wide surveillance system. A new story about a Dark Web criminal case sparks a surge of interest in the Dark Web. The publicity is similar to the attention directed at Random Darknet Shopper’s exhibition of contraband purchased by a software robot from hidden Internet contraband markets. Bitcoin’s anonymization is becoming less and less anonymous. The latest innovation is the use of ad tracking technology similar to that used by Google DoubleClick to unmask users of digital currency for Dark Web purchases. Ecuador has implemented a country-wide surveillance system developed jointly by Chinese and Ecuadorian engineers. The program is also available on Vimeo at https://vimeo.com/255241891.
Kenny Toth, February 13, 2018
DarkCyber for February 6, 2018, Now Available
February 6, 2018
The Beyond Search DarkCyber video program for January 6, 2018, is now available. You can view the program on YouTube or on Vimeo. This week’s program reveals that the go-to system for purchasing military-grade weapons is Telegram, the messaging app. Lebanon’s surveillance program has been exposed. After years of covert operation, human error allowed researchers to characterize the operation. White hat and black hat techniques were used by the Middle Eastern country. Haven, a software app attributed to Edward Snowden, promises protection from third-party access to a mobile phone. Dark Cyber tested the app and found that it could transmit data back to the app’s creator. The program also reviews some of the investigative techniques used to locate the operator of a Dark Web pornography site. In addition to analysis of Dark Web traffic, investigators matched behavioral to Surface Web sources and examined linguistic behaviors to track down users. You can view the video from the Beyond Search main page at this link.
Kenny Toth, February 6, 2018
DarkCyber for January 30, 2018, Now Available
January 30, 2018
DarkCyber for January 30, 2018, is now available at www.arnoldit.com/wordpress and on Vimeo at www.vimeo.com at https://vimeo.com/253109084.
This week’s program looks at the 4iq discovery of more than one billion user names and passwords. The collection ups the ante for stolen data. The Dark Web database contains a search system and a “how to” manual for bad actors. 4iq, a cyber intelligence specialist, used its next-generation system to locate and analyze the database.
Stephen E Arnold said:
“The technology powering 4iq combines sophisticated data acquisition with intelligent analytics. What makes 4iq’s approach interesting is that the company integrates trained intelligence analysts in its next-generation approach. The discovery of the user credentials underscores the importance of 4iq’s method and the rapidly rising stakes in online access.”
DarkCyber discusses “reputation scores” for Dark Web contraband sites. The systems emulate the functionality of Amazon and eBay-style vendor report cards.
Researchers in Germany have demonstrated one way to compromise WhatsApp secure group chat sessions. With chat and alternative communication channels becoming more useful to bad actors than Dark Web forums and Web sites, law enforcement and intelligence professionals seek ways to gather evidence.
DarkCyber points to a series of Dark Web reviews. The sites can be difficult to locate using Dark Web search systems and postings on pastesites. One of the identified Dark Web sites makes use of a hosting service in Ukraine.
About DarkCyber
DarkCyber is one of the few video news programs which presents information about the Dark Web and lesser known Internet services. The information in the program comes from research conducted for the second edition of “Dark Web Notebook” and from the information published in Beyond Search, a free Web log focused on search and online services. The blog is now in its 10th year of publication, and the backfile consists of more than 15,000 stories.
Kenny Toth, January 30, 2018
DarkCyber for January 23, 2018, Now Available
January 23, 2018
The January 23, 2018, DarkCyber program about the Dark Web and related online issues is now available. The program can be viewed at www.arnoldit.com/wordpress and on Vimeo at this link: https://vimeo.com/251980239.
The program address four important news stories related to law enforcement and intelligence work.
A new Dark Web search systems called Candle wants to provide easy, quick access to Dark Web content. The DarkCyber’s research team found that the system was easy to use. However, specific searches often return no results. This week’s program suggests an work around.
Mobile phones can be fingerprinted. Take a picture with a mobile phone, and researchers have discovered that manufacturing defects in sensors make it possible to tie a specific mobile phone to a particular digital image. Although in the research and development stage, the data suggest a new tool for law enforcement when gathering evidence in human trafficking and pornography cases.
The need for anonymous communication is fueling an open source project called Soprani.ca. The idea is that an alternative network will allow untraceable messaging and calling. The challenge of these leapfrog innovations is that established lawful intercept companies may have to develop new systems and methods. The giant Shoghi Communications reveals that its system can struggle when trying to make sense of encrypted communications, including https packets.
Bitcoin is running into regulatory headwinds. The news about China’s actions has overshadowed an equally important development in Australia. DarkCyber explains why Australia’s actions are important.
You can view the program at www.arnoldit.com/wordpress.
Kenny Toth, January 23, 2018
DarkCyber, January 16, 2018, Now Available
January 16, 2018
This week’s DarkCyber examines the Experian Dark Web alerting service. Based on an examination of the Digital Shadows’ Web site, that company is working with Experian to provide the Experian consumer service. Digital Shadows appears to be moving from its law enforcement and intelligence focus into a broader business to business and consumer market.
The video is available on Vimeo at https://vimeo.com/250765019 The video can be accessed via Beyond Search at www.arnoldit.com/wordpress.
The program also takes a different approach to the changes in net neutrality. DarkCyber reports that law enforcement and intelligence agencies may have wider scope for action for certain data collection methods. Companies like FinFisher allow non US customers a way to gather information using higher levels of network access.
Stephen E Arnold, publisher of the Beyond Search blog and producer of HonkinNews DarkCyber, said:
“Outside of the US certain governments are able to use the capabilities of Tier 1 and Tier 2 network providers, aided by specialized software from companies like FinFisher. With a higher level of network access, placing special software on suspected bad actors computing devices is less complicated. Changes in net neutrality in the United States may facilitate a similar capability. In order to deal with the increasingly rapid changes in technology available to bad actors, access to higher level network access can pay significant dividends for law enforcement and intelligence authorities.”
Dark Web eCommerce vendors, Stephen E Arnold reports, are now showing more interest in digital currencies with more robust obfuscation. Monero and Zcash are two currencies gaining momentum in the Dark Web. Investigators’ ability to figure out who is conducting certain digital currency transactions continues to improve.
The final story takes a look at the alleged kidnapping of a British supermodel. The alleged wrongdoer is awaiting trial in Italy, but the publicity about the alleged auctioning of the supermodel as a Dark Web sex slave remains controversial.
Check out the video at this link.
Kenny Toth, January 16, 2018
Encryption and Decryption: A Difficult Global Problem
January 10, 2018
I read “FBI’s Wray Calls for Significant Innovation’ in Accessing Encrypted Data.” The story echoed a statement which appeared in one of the technical product sheets from a company few people reading generalized online content have heard about.
The firm is Shoghi, and it is based in India. The main business of the firm is designing and licensing hardware and software for military and law enforcement use. The company can acquire data from a range of sources, including undersea cables. In the company’s description of its https intercept service, I noted this statement:
“Interception of this secure HTTPS traffic is possible at various point but it is normally not possible to achieve the decryption of the HTTPS traffic due to the secrecy algorithms used for encryption of the data.”
HTTPS poses a challenge. Encrypted hardware poses a problem. The volume of data continues to increase.
When a major lawful intercept company is quite explicit about the difference between intercept (capture) and being able to “read” the information, the problem is not confined to the US. Shoghi has as customers more than 65 countries and, it appears, each has the same problem.
Jumping back to the Fox story and Mr. Wray’s call for innovation, I want to point out that:
- The problem is not just the FBI’s; it is a problem for many authorities
- The “weakening” of the Internet is a powerful argument; however, as the fabric of security continues to fray from insider and outsider activities continues to capture headlines, the Internet has not become weak. The Internet is what it was designed to be: Robust in delivering packets and weak in terms of inherent security.
- The technical innovation referenced in the write up is what Shoghi wants its licensees to do: Figure out how to make sense of the captured data.
- The solution may reside with specialist firms which have developed technologies which perform date and time stamp analysis, clustering, digital fingerprinting of handles (user names), link analyses, and other text processing methods.
To sum up, Mr. Wray has identified a problem. Keep in mind that it is one that exists for countries other than the US. From my point of view, identifying specialists with non-intuitive ways of approaching the encryption problem warrant additional funding in the efforts to crack this “problem.”
My Dark Web Notebook team has compiled a list of companies with orthogonal approaches. We do make this information available on a fee basis. If you are interested, write benkent2020 at yahoo dot com for more information. Also, the January 23, 2018 “Dark Cyber” video includes a segment about the encryption problem for lawful intercept and surveillance vendors.
Stephen E Arnold, January 10, 2018
DarkCyber for January 9, 2018, Now Available
January 9, 2018
The January 9, 2017, DarkCyber video news program is now available at www.arnoldit.com/wordpress. (The video is also available on Vimeo at https://vimeo.com/249649665.)
The Dark Cyber program (produced by Stephen E Arnold, Beyond Search, and HonkinNews) for January 9, 2017, explains how Trovicor’s IPF collects and analyzes a range of information. This low-profile company, based in Germany, provides lawful intercept technology to more than 35 countries. The company’s robust system has the capability of monitoring the data flows resulting from the actions of a single individual to the actions of a a much larger group of suspected bad actors. Trovicor sells and licenses its technologies to governments, not commercial enterprises.
The January 9, 2017, video answers a frequently asked question about the Dark Web: “Can a person buy an automatic weapon on a Dark Web contraband site?” The answer is provided by the US Government Accountability Office. The GAO studied more than 70 Dark Web merchants offering weapons. More than 15 percent were outright scams, but other vendors were set up to do business and sell in exchange for digital currencies. There are barriers; for example, delivery. The Dark Cyber video provides details and a link to the GAO report.
Dark Web drug markets thrive despite increased pressure from government authorities in Western Europe, the UK, and elsewhere. The reason is simple economics. The cat-and-mouse game means that when one drug site is taken down by law enforcement, another drug site opens. Dark Cyber reports that online drug buyers seek sources of contraband despite the risks of legal action.
Dark Cyber also explains how Dark Web drug economics encourages bad actors to open contraband Web sites despite law enforcement crackdowns. This week’s program answers the question, “Can a person buy an automatic weapon on the Dark Web?” The research conducted by the US Government Accountability Office provided the answer. The study reported that 15 percent of weapon offers were scams, a surprisingly low number if the data are accurate.
Kenny Toth, January 9, 2018
Dark Cyber for December 12, 2017, Now Available
December 12, 2017
The HonkinNews Dark Cyber program for December 12, 2017, presents a snapshot of a next-generation investigation analysis system, data about illegal drugs on the Dark Web, and news about a secure chat system which runs within Tor. Most analysts and investigators have access to a range of software and hardware devices designed to make sense of data from a range of computing devices. However, the newer systems offer visual analyses which often surprise with their speed, power, and ability to deliver “at a glance” insights. This week’s Dark Cyber examines Brainspace, now a unit of Cyxtera. Brainspace’s graphics are among the most striking in the intelligence analysis market. The role that Cyxtera plays is perhaps more important. The company is a roll up of existing businesses and focused on cloud delivery of advanced software and services. Dark Cyber also provides facts from a recent European Union report about illegal substances on the Dark Web. What’s interesting about the report is that the data it presents seems to understate the magnitude of the volume of drug sales via the Dark Web. You can download the report without charge from the url included in this week’s program. The final story addresses what is a growing challenge for law enforcement and intelligence authorities: Secure chat within Tor. The Dark Cyber team reports that Anonymous Portugal has made this alleged breakthrough. (The second edition of the Dark Web Notebook will include a new chapter about chat and related services plus ways to compromise these communications.) You can view the program at this link https://youtu.be/E2jNuJXblOI.
Kenny Toth, December 12, 2017
HonkinNews Dark Cyber for December 5, 2017, Now Available
December 5, 2017
The December 5, 2017, Dark Cyber program includes three stories and one feature. If you were wondering if the Dark Web offered high-value content, you will find our report about the New York Times useful. The “nation’s newspaper” or the “Gray Lady” to some has a Dark Web site. Dark Cyber asks two questions about this surprising online move. Uber is a popular, controversial, and litigation magnet. For those who depend on Uber, the fact that valid Uber accounts are available for purchase on the Dark Web may be troubling. Dark Cyber adds to the concern by pointing to Surface Web sites which also sell stolen Uber accounts. Free rides on someone else’s account my sound like a good idea. The reality is that you may be violating one or more laws if your dabble in stolen Uber accounts. The feature this week answers in part the question, “Exactly what type of reports does a high-end intelligence analysis system provide to an authorized user?” Dark Cyber uses reports generated by Tovek, an intelligence software and services firm based in Prague, for the answer. As you review the outputs, please, keep in mind that Dark Cyber has intentionally blurred the images for security. Pay particular attention to the mapping of a person of interest’s travel data. The final story for December 5, 2017, is a quick look at what a consumer newspaper revealed about Google Chrome browser’s “incognito” mode. If you thought your online behaviors were hidden from monitoring, you may want to think about what Google Chrome Incognito does not do for its users. You can view the program at this link https://youtu.be/LwGDBczVj10
Kenny Toth, December 5, 2017
-
- Subscribe to Beyond Search
Feature archive
News archive
-
