defcon 22 adrian crenshaw dropping docs on darknets how people got caught updated

7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED

1/52

!"#$%%&'()*++,-.(/

12'34) 5'+)6!47


2/52

!"#$%%&'()*++,-.(/

! & '8) &'()*++,-.(/

! & !49+ 4) 3):+'+6: 3) &);(: ,)(7 +9+'?:!3)* @ &>/ A86: 4

*++, 73:! =/+ () /? !4)26

!


3/52

!"#$%%&'()*++,-.(/

!

& 73BB F+ :4,3)* :7( #+'6#+.=9+6

" G+(#B+ :'?3)* :( 6:4? 4)()?/(86

" G+(#B+ :'?3)* :( 2+@4)()?/3H+ 86+'6

! &>/ )(: '+4BB? 4 #'394.? *8?

!

&1I1J

! K+ .4'+;8B 7!+'+ ?(8 68';L .():'4F4)2 4743:6


4/52

!"#$%%&'()*++,-.(/


5/52

!"#$%%&'()*++,-.(/

E4',)+:6

! C!+'+ 4'+ /4)? 2+M)3=()6L F8: /3)+ 36

N4)()?/3H3)* #'394:+ )+:7(', O

! P6+ (; +).'?#=() 4)2 #'(Q3+6 R6(/+ =/+6 (:!+'

#++'6S :( (F;86.4:+ 7!( 36 .(//8)3.4=)* :(

7!(/

!


6/52

!"#$%%&'()*++,-.(/

C!+ T)3() U(8:+'


7/52!"#$%%&'()*++,-.(/

! !"#$D3'6: :!+ P< I494B U+6+4'.! J4F('4:('?L :!+) :!+ VDD 4)2 )(7 :!+ C(' G'(A+.:

RWXY.Z )()@#'(M:S-

!"#$%%777-:('#'(A+.:-('*%

!

!"%$NC(' 36 ;'++ 6([74'+ 4)2 4) (#+) )+:7(', :!4: !+B#6 ?(8 2+;+)2 4*43)6: 4 ;('/(; )+:7(', 68'9+3BB4).+ :!4: :!'+4:+)6 #+'6()4B ;'++2(/ 4)2 #'394.?L

.()M2+)=4B F863)+66 4.=93=+6 4)2 '+B4=()6!3#6L 4)2 6:4:+ 6+.8'3:? ,)(7) 46

:'4\. 4)4B?636-O ] 16 2+M)+2 F? :!+3' 63:+

! !"&'$1..+66 )('/4B &):+')+: 63:+6 4)()?/(86B?L 4)2 C(' !322+) 6+'93.+6-

! (#)$J(.4BB? '8)


8/52!"#$%%&'()*++,-.(/

! J4?+'+2 +).'?#=()

! K3@23'+.=()4B :8))+B6

! _46 23'+.:('? 6+'9+'6

! `(6:B? ;(.86+2 () (8: #'(Q?3)* :( :!+ &):+')+:

! `('+ 3);( 4: !"#6$%%777-:('#'(A+.:-('*

Internet Server

Directory Server


9/52!"#$%%&'()*++,-.(/


10/52!"#$%%&'()*++,-.(/Image from http://www.torproject.org/hidden-services.html.en


15/52!"#$%%&'()*++,-.(/

Image from http://www.torproject.org/hidden-services.html.en


16/52!"#$%%&'()*++,-.(/

! 5B3+):

a86: 4 86+'

! U+B4?6

C!+6+ '+B4? :'4\.L 4)2 .4) 4.: 46 +Q3: #(3):6

!

K'32*+6U+B4?6 )(: 429+'=6+2 3) :!+ 23'+.:('? 6+'9+'6L 6( !4'2+' :( FB(.,

! b84'2 I(2+6

P6+2 :( /3=*4:+ 6(/+ :'4\. 4)4B?636 4"4.,6

! &):'(28.=() G(3):6

_+B#+'6 3) /4,3)* .())+.=()6 :( !322+) 6+'93.+6!

U+)2+H9(86 G(3):

P6+2 ;(' '+B4?3)*%+6:4FB36!3)* .())+.=()6 :( !322+) 6+'93.+6


17/52!"#$%%&'()*++,-.(/


18/52!"#$%%&'()*++,-.(/

!

C43B6$ C!+ 1/)+63. &).(*)3:( J39+


19/52!"#$%%&'()*++,-.(/

*+#,

! &; ?(8 .4) :8))+B 3: :!'(8*! 4


20/52


21/52

!"#$%%&'()*++,-.(/

!"#$%%*+=c#-)+:


22/52

!"#$%%&'()*++,-.(/

!

5'?#:( 58''+).?

! G'((; (; 7(',

! K3:.(3) 122'+66+6 n G'394:+ ^+?6

!

KB(., 5!43) RB+2*+'S

! C8/FB+'6 RB48)2+'3)*S

! d4? /('+ 3);( F? K(F d+366

!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k932+(6%F632+62+cXYZ%c@m@!4.,3)*@F+)A4/3)6@F(F@7+366@#7.'4.,@3):(@:(@F3:.(3)


23/52

!"#$%%&'()*++,-.(/

! T) E+.- Ym:! cXYZ 4 F(/F :!'+4: 746 /42+ :( _4'94'2>6 6:82+): )+76

#4#+' 4)2 6(/+ (\.34B6-!

C!+ #+'6() 86+2 !"#6$%%777-*8+''3BB4/43B-.(/ :( 6+)2

+/43B 4[+' .())+.=)* (9+' C('

!

b8+''3BB4 `43B #8:6 4) o@T'3*3)4=)*@&G !+42+' () :!4:/4',+2 7!( 6+): :!+ /+664*+L 3) :!36 .46+ 4 C(' +Q3: #(3):C($ p3'()*++,q3'()*++,-.(/p r3'()*++,q3'()*++,-.(/s

D'(/$ r+gA)t'Hu((lAZ7q*8+''3BB4/43B-.(/s


24/52

!"#$%%&'()*++,-.(/

! 1BB C(' )(2+6 4'+ #8FB3.B? ,)(7) R+Q.+#: F'32*+6S$

!"#$%%:('6:4:86-FB8:/4*3+-2+

! V46? :( .(''+B4:+ 7!( 746 4"4.!+2 :( _4'94'2 )+:7(',

4)2 863)* C(' 4: :!+ 64/+ =/+ :!+ +/43B 746 6+): R8)B+66

?(8 86+ 4 F'32*+S-

! VB2( ^3/ 746 .())+.:+2 :( :!+ C(' )+:7(', 4'(8)2 :!4:

=/+-

!


25/52

!"#$%%&'()*++,-.(/

J+66()6 J+4')+2$

! E()>: F+ :!+ ()B? #+'6() 863)* C(' () 4

/()3:('+2 )+:7(', 4: 4 *39+) =/+!

P6+ 4 F'32*+f

! E()>: 42/3: 4)?:!3)*

! 5(''+B4=() 4"4.,6 4'+ 4 F3:.!


26/52

!"#$%%&'()*++,-.(/

5MB

8MB

Client

Client

Client

Client


27/52

!"#$%%&'()*++,-.(/

Client

Client

Client DoSAttack& .(8B2 A86:

74:.! :!+=/3)*6-

G8B6+ :!+

24:4 {(76

/?6+B;-

T' +9+) A86:

.!4)*+ :!+ B(42() :!+ #4:!-

E(< (8:632+

!(6: :( 4|+.:

:'4\.-


28/52

!"#$%%&'()*++,-.(/

DNSQuery

Monitored DNS Server

&; & 2()>: 86+ :!+#'(Q? ;(' EI


29/52

!"#$%%&'()*++,-.(/

! _+.:(' o493+' `()6+*8' R


30/52

!"#$%%&'()*++,-.(/

! _4//()2 86+2 C('L 4)2 7!3B+ :!+ .'?#:(

746 )+9+' F86:+2L DK& .(''+B4:+2 =/+6

68#}* 746 :4B,3)* :(


31/52

!"#$%%&'()*++,-.(/

J+66()6 J+4')+2$

! P6+ C(' .()636:+):B?

! E()>: *39+ #+'6()4B 3);('/4=()

! 5(''+B4=() 4"4.,6 4'+ 6=BB 4 F3:.!j


32/52

!"#$%%&'()*++,-.(/

! D'++2(/ _(6=)* !(6:+2L 4/()*6: (:!+' :!3)*6L

/4)? .!3B2 #(') '+B4:+2 !322+) 6+'93.+ 7+F63:+6-

! D'++2(/ _(6=)* !42 #'+93(86B? .(/+ 8)2+' 4"4.,

F? 1)()?/(86 28'3)* T# E4',)+: F+.486+ (; 3:

!(6=)* 5G-

! &) a8B? (; cXYZL :!+ DK& .(/#'(/36+2 D'++2(/

_(6=)*L 4)2 3)6+':+2 /4B3.3(86 a494


33/52

!"#$%%&'()*++,-.(/

! C!+ #4?B(42 746 N`4*)+:(OL 7!3.! #!()+2 !(/+

:( 6+'9+'6 3) ~3'*3)34 863)* :!+ !(6:>6 #8FB3. &G-

!"#$%%*!(7+)-/+%z3@:('@/4B74'+@4)4B?636

! &: 4B6( '+#(':+2 F4., :!+ .(/#8:+'>6$"

`15 422'+66

"

d3)2(76 !(6: )4/+8)3t8+ 6+'34B )8/F+' :( =+ 4 86+' :( 4 63:+

! `4? F+ 64/+ 46 V*(=6=.4Bb3'4|+-

!


34/52

!"#$%%&'()*++,-.(/

! 1) &'36! /4)L V'3. V(3) `4't8+6L 36 4BB+*+2 :( F+

:!+ (#+'4:(' (; D'++2(/ _(6=)*- C!+ 6+'9+'6

!(6=)* D'++2(/ _(6=)* 7+'+ =+2 :( !3/ F+.486+

(; #4?/+): '+.('26-

! `4't8+6 746 6432 :( !49+ 239+2 ;(' !36 B4#:(# :(

6!8: 3: 2(7) 7!+) #(B3.+ '432+2 !3/-! `('+ E+:43B6$

!"#$%%777-73'+2-.(/%:!'+4:B+9+B%cXYZ%Xg%

;'++2(/@!(6=)*@z3%


35/52

!"#$%%&'()*++,-.(/

J+66()6 J+4')+2$

! E(): !(6: 54#:43) G3.4'2 ('

a8B34) K46!3'!

G4:.!L #4:.!L #4:.!

! D(BB(7 :!+ /()+?

! J+49+ +).'?#:+2 B4#:(#6 3) 4 #(7+'+2

2(7) 6:4:+ 7!+) )(: 3) 86+j


36/52

!"#$%%&'()*++,-.(/

J+:>6 6++ 3; :!+!322+) 6+'9+'

4## 36 98B)+'4FB+

:( 4) +Q#B(3:

RF8|+'

(9+'{(7%7+F4## 6!+BB +Q+.%

+:.S-


37/52

!"#$%%&'()*++,-.(/

!


38/52

!"#$%%&'()*++,-.(/

! C!+ +4'B3+6: :!+? .(8B2 M)2 746 ;'(/ N4B:(32O () :!+

!"#$%%777-6!'((/+'?-('*%;('8/6%6!(7{4:-#!#%I8/F+'%YZhmXggW


39/52

!"#$%%&'()*++,-.(/

!

K3:5(3)C4B,-('* G(6:

! N8(:+ ;'(/$ 4B:(32 () a4)84'? cgL cXYYL Xe$ll$WY G`

d!4: 4) 47+6(/+ :!'+42j (8 *8?6 !49+ 4 :() (; *'+4: 32+46- _46 4)?()+

6++)


40/52

!"#$%%&'()*++,-.(/

!

1) 4..(8): )4/+2 N4B:(32O 4B6( /42+ 4 #(6: () K3:.(3):4B,-('* 4F(8: B((,3)*

;(' 4) N&C #'( 3) :!+ F3:.(3) .(//8)3:?O 4)2 46,+2 3):+'+6:+2 #4'=+6 :( .():4.:

N+#,,9=>+?8"' &' @7&?= :#' 8#7O RYX%YY%YYS-

!"#6$%%F3:.(3):4B,-('*%3)2+Q-#!#f:(#3.klehYY-X


41/52

!"#$%%&'()*++,-.(/

!

PBF'3.!:>6 b((*B+u #'(MB+ 6!(7 4) 3):+'+6: 3) :!+ N`36+6 &)6=:8:+O 4 N7('B2

.+):+' (; :!+ 186:'34)


42/52

!"#$%%&'()*++,-.(/

! pU(66 PBF'3.!:-O 4..(8): 4B6( #(6:+2 ()


43/52

!"#$%%&'()*++,-.(/

!


44/52

!"#$%%&'()*++,-.(/

! T) Xe%YX%YZ P< 586:(/6 3):+'.+#:+2 g &E6 73:! 23|+'+): )4/+6L F8: 4BB !493)* 4 #3.:8'+ (;

PBF'3.!:- _(/+B4)2


45/52

!"#$%%&'()*++,-.(/

!


46/52

!"#$%%&'()*++,-.(/

J+66()6 J+4')+2$

! ^++# ()B3)+ 32+)==+6 6+#4'4:+

"

^++# 23|+'+): 86+')4/+6" D'(/ 23|+'+): B(.4=()6

!

_49+ 4 .()636:+): 6:('?

! E()>: :4B, 4F(8: 3):+'+6:6

! E()>: 9(B8):++' 3);('/4=()j


47/52

!"#$%%&'()*++,-.(/

`4?F+f


48/52

!"#$%%&'()*++,-.(/

! C4B, () E4',)+:6 3) *+)+'4B

!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k932+(6%432+@

73):+'@cXYY53#!+'6#4.+%E4',)+:6$}4)()?/3H3)*}#'394:+})+:7(',6

! &cG D1

!"#$%%777-3c#c-2+%;4t-!:/B

! C(' D1

!"#6$%%:'4.-:('#'(A+.:-('*%#'(A+.:6%:('%73,3%2(.%C('D1

! C(' `4)84B

!"#6$%%777-:('#'(A+.:-('*%2(.6%:('@/4)84B-!:/B-+)

!

&cG &)2+Q :( C+.!)3.4B E(.8/+):4=()!"#$%%777-3c#c-2+%!(7


49/52

!"#$%%&'()*++,-.(/

! &):'( :( E4',)+:6$ C(' 4)2 &cG d(',6!(#!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k932+(6%3):'(@:(@:('@3c#@24',)+:6

! `? C('%&cG I(:+6!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k6+.8'3:?%3c#@:('@7(',6!(#@)(:+6

! 53#!+'6#4.+6%E4',)+:6 1) T9+'93+7 T; 1"4.,


50/52

!"#$%%&'()*++,-.(/

!

1.=9+ E+;+)6+ _4'F3)*+' E36:'3F8=() R1E_ES

!"#$%%6(8'.+;('*+-)+:%#'(A+.:6%42!2%

;'(/ KB4., _3BB6 &);('/4=()


51/52

!"#$%%&'()*++,-.(/

E+'F?.()


52/52

defcon 22 adrian crenshaw dropping docs on darknets how people got caught updated

Documents