|
Search Irongeek.com:
Affiliates:
Help Irongeek.com pay for bandwidth and research equipment:
|
Intro to Darknets: Tor and I2P Workshop (Hacking Illustrated Series InfoSec Tutorial
Videos)
Intro to Darknets: Tor and I2P Workshop
This class introduces students to the I2P and Tor Darknets. We
cover setting up Tor & I2P, the basics of use, and how to make hidden services.
We also go over case examples like Eldo Kim Harvard & the Harvard Bomb Threat,
Hector Xavier Monsegur (Sabu)/Jeremy Hammond (sup_g) & LulzSec, Freedom Hosting
& Eric Eoin Marques and finally Ross William Ulbricht/“Dread Pirate Roberts” of
the SilkRoad, to explain how people have been caught and how it could have been
avoided.
Download Slides:
http://www.irongeek.com/downloads/into-to-darknets-tor-and-i2p.pptx
Download Video:
https://archive.org/download/IntoToDarknetsTorAndI2P/Into%20to%20Darknets%20Tor%20and%20I2P.avi
Text from Slides:
Tor and I2P Workshop
Adrian Crenshaw
About Adrian
• I run Irongeek.com
• I have an interest in InfoSec education
• I don’t know everything - I’m just a geek with time on my hands
• Sr. Information Security Engineer at a Fortune 1000
• Co-Founder of Derbycon
http://www.derbycon.com
Perspective and General Warnings
• I will be taking two perspectives
¡ People trying to stay anonymous
¡ People trying to de-anonymize users
• I’m not really a privacy guy
• IANAL
• Be careful where you surf, contraband awaits
Part 0:
Basics of how Tor and I2P work
A little background…
Darknets
• There are many definitions, but mine is “anonymizing private networks ”
• Use of encryption and proxies (some times other peers) to obfuscate who is
communicating to whom
• Sometimes referred to as Cipherspace
(love that term)
Tor
The Onion Router
Overview
• Who?
First the US Naval Research Laboratory, then the EFF and now the Tor Project
(501c3 non-profit).
http://www.torproject.org/
• Why?
“Tor is free software and an open network that helps you defend against a
form of network surveillance that threatens personal freedom and privacy,
confidential business activities and relationships, and state security known
as traffic analysis.” ~ As defined by their site
• What?
Access normal Internet sites anonymously, and Tor hidden services.
• How?
Locally run SOCKS proxy that connects to the Tor network.
Tor: The Onion Router
• Layered encryption
• Bi-directional tunnels
• Has directory servers
• Mostly focused on out proxying to the Internet
• More info at https://www.torproject.org
Layers like an Ogre
Layout to connect to Internet
Layout to connect to Internet
Layout to connect to Internet
Layout to connect to Hidden Sevice
Layout to connect to Hidden Sevice
Layout to connect to Hidden Sevice
Layout to connect to Hidden Sevice
Layout to connect to Hidden Sevice
Layout to connect to Hidden Sevice
Node types
• Client
Just a user
• Relays
These relay traffic, and can act as exit points
• Bridges
Relays not advertised in the directory servers, so harder to block
• Guard Nodes
Used to mitigate some traffic analysis attacks
• Introduction Points
Helpers in making connections to hidden services
• Rendezvous Point
Used for relaying/establishing connections to hidden services
What does it look like to the user?
Applications/Sites
• Tails: The Amnesic Incognito Live System
https://tails.boum.org/
• Tor2Web Proxy
http://tor2web.org
• Tor Hidden Wiki:
http://kpvz7ki2v5agwt35.onion
• Scallion (make host names)
https://github.com/lachesis/scallion
• Onion Cat
http://www.cypherpunk.at/onioncat/
• Reddit Onions
http://www.reddit.com/r/onions
Tor Pros and Cons
Pros
• If you can tunnel it through a SOCKS proxy, you can make just about any
protocol work.
• Three levels of proxying, each node not knowing the one before last, makes
things very anonymous.
Cons
• Slow
• Do you trust your exit node?
• Semi-fixed Infrastructure:
Sept 25th 2009, Great Firewall of China blocks 80% of Tor relays listed in
the Directory, but all hail bridges!!!
https://blog.torproject.org/blog/tor-partially-blocked-china
http://yro.slashdot.org/story/09/10/15/1910229/China-Strangles-Tor-Ahead-of-National-Day
• Fairly easy to tell someone is using it from the server side
http://www.irongeek.com/i.php?page=security/detect-tor-exit-node-in-php
What does the traffic look like?
(Keep in mind, this is just the defaults)
• Local
9050/tcp Tor SOCKS proxy
9051/tcp Tor control port
(9150 and 9151 on Tor Browser Bundle)
• Remote
443/tcp and 80/tcp mostly
Servers may also listen on port 9001/tcp, and directory information on 9030.
• More details
http://www.irongeek.com/i.php?page=security/detect-tor-exit-node-in-php
http://www.room362.com/tor-the-yin-or-the-yang
I2P
Invisible Internet Project
(in a nutshell)
Especially as compared to Tor
Overview
• Who?
I2P developers, started by Jrandom.
http://www.i2p2.de/
• Why?
To act as an anonymizing layer on top of the Internet
• What?
Mostly other web sites on I2P (eepSites), but the protocol allows for P2P (iMule,
i2psnark), anonymous email and public Internet via out proxies.
• How?
Locally ran proxies that you can connect to and control via a web browser.
These connect other I2P routers via tunnels. Network information is
distributed via a DHT know as NetDB.
Layout
I2P: Ins and Outs
• Unidirectional connections: In tunnels and out tunnels
• Information about network distributed via distributed hash table (netDB)
• Layered encryption
• Mostly focused on anonymous services
• More info at http://www.i2p2.de/
Silly Garlic Routing
Animation
Encryption Layers
• EIGamal/SessionTag+AES from A to H
• Private Key AES from A to D and E to H
• Diffie–Hellman/Station-To-Station protocol + AES
What does it look like to the user?
Naming and Addresses
• Details
http://www.i2p2.de/naming.html
• 516 Character Address
-KR6qyfPWXoN~F3UzzYSMIsaRy4udcRkHu2Dx9syXSzUQXQdi2Af1TV2UMH3PpPuNu-GwrqihwmLSkPFg4fv4y
QQY3E10VeQVuI67dn5vlan3NGMsjqxoXTSHHt7C3nX3szXK90JSoO~tRMDl1xyqtKm94-RpIyNcLXofd0H6b02
683CQIjb-7JiCpDD0zharm6SU54rhdisIUVXpi1xYgg2pKVpssL~KCp7RAGzpt2rSgz~RHFsecqGBeFwJdiko-
6CYW~tcBcigM8ea57LK7JjCFVhOoYTqgk95AG04-hfehnmBtuAFHWklFyFh88x6mS9sbVPvi-am4La0G0jvUJw
9a3wQ67jMr6KWQ~w~bFe~FDqoZqVXl8t88qHPIvXelvWw2Y8EMSF5PJhWw~AZfoWOA5VQVYvcmGzZIEKtFGE7b
gQf3rFtJ2FAtig9XXBsoLisHbJgeVb29Ew5E7bkwxvEe9NYkIqvrKvUAt1i55we0Nkt6xlEdhBqg6xXOyIAAAA
• SusiDNS Names
something.i2p
• Hosts.txt and Jump Services
• Base32 Address
{52 chars}.b32.i2p
rjxwbsw4zjhv4zsplma6jmf5nr24e4ymvvbycd3swgiinbvg7oga.b32.i2p
I2P Pros and Cons
Pros
• Lots of supported applications
• Can create just about any hidden service if you use SOCKS5 as the client
tunnel
• Eepsites somewhat faster compared to Tor Hidden Services (Subjective, I
know)
• No central point of failure
(Example: What happened to Tor when China blocked access to the core
directory servers on September 25th 2009)
Cons
• Limited out proxies
• Sybil attacks a little more likely
How People Got Caught Interlude 0:
Harvard Bomb Threat
• Suspect Eldo Kim wanted to get out of a final, so is alleged
to have made a bomb threat on Dec. 16th 2013
• Used https://www.guerrillamail.com/ to send email after
connecting over Tor
• Guerrilla Mail puts an X-Originating-IP header on that
marked who sent the message, in this case a Tor exit point
• All Tor nodes are publicly know (except bridges):
http://torstatus.blutmagie.de/
• Easy to correlate who was attached to Harvard network and using Tor at the
same time the email was sent (unless you use a bridge).
• Lesson Learned: Don’t be the only person using Tor on a monitored network
at a given time. Use a bridge? IOW: Correlation attacks are a bitch!
Correlation of end point and exit point
Timing Correlation
Part 1:
Installing and getting around in I2P and Tor
Install I2P In Windows
(1A)
1. Make sure you have a JRE 1.5 or higher installed
2. Download I2P Installer for Windows and Linux
http://www.i2p2.de/download
3. Windows: Double click the installer, then Ok, Next, Next, Choose Windows
Service, Next, Next, Ok, Next, Next, Done. Tell the installer that it
installed correctly.
Install I2P in Linux
(Standard Method)
(1B)
1. Make sure you have a JRE 1.5 or higher installed
2. Download I2P Install for Windows and Linux
http://www.i2p2.de/download
3. Linux: Run
sudo –i
wget http://geti2p.net/en/download/0.9.10/i2pinstall_0.9.10.jar
apt-get install default-jre
java -jar i2pinstall_0.9.10.jar
Tack on –console if needed
Install I2P in Linux (APT Method)
(1C)
Install I2P in Linux (APT Method based on
http://www.i2p2.de/debian , this
also seems to work well on Raspbian for the Raspberry Pi)
1. Drop to a terminal and edit /etc/apt/sources.list.d/i2p.list, I use nano:
sudo nano /etc/apt/sources.list.d/i2p.list
Add the lines:
deb http://deb.i2p2.no/ stable main
deb-src http://deb.i2p2.no/ stable main
Get the repo key and add it:
wget http://www.i2p2.de/_static/debian-repo.pub
sudo apt-key add debian-repo.pub
sudo apt-add-repository ppa:i2p-maintainers/i2p
sudo apt-get update
sudo apt-get install i2p i2p-keyring
2. Run:
dpkg-reconfigure -plow i2p
Set it to run on boot
3. Web surf to:
http://127.0.0.1:7657/
See link above for more details, or for changes to the process
Run I2P
• Windows:
Run it from the menu
• Linux:
./i2pbin/i2prouter start
• Linux Daemon:
service i2p start
I2P HTTP Proxy Settings
• HTTP:
4444
• HTTPS:
4445
Tweak:
Note bandwidth and port settings
I2P, connection and Firewall settings
(3A)
1. Click “I2P Internals” (http://127.0.0.1:7657/config) and look around.
2. Scroll down and note UDP Port.
3. By default, TCP port will be the same number.
4. Adjust your firewall accordingly, but this varies.
Proxy Settings for I2P
(1D)
• Set HTTP proxy to 4444 on local host (127.0.0.1)
• SSL to 4445 on local host (127.0.0.1)
Name Service subscripts to add (also show profile path)
(3B)
Go to http://127.0.0.1:7657/dns
and paste in:
http://www.i2p2.i2p/hosts.txt
http://i2host.i2p/cgi-bin/i2hostetag
http://stats.i2p/cgi-bin/newhosts.txt
http://tino.i2p/hosts.txt
http://inr.i2p/export/alive-hosts.txt
Install Tor in Windows
(2A)
1. Grab Tor Browser or Vidalia Bundle
Tor Browser Bundle
https://www.torproject.org/dist/torbrowser/
OR
Tor Vidalia Bundle
https://www.torproject.org/dist/vidalia-bundles/
2. Run and take the defaults, except perhaps the path.
Install Tor in Linux
(2B)
Lots of options
Package manager:
apt-get install vidalia
Then make sure you choose the users that can control Tor, and restart the X
server.
Browser Bundle:
https://www.torproject.org/dist/torbrowser/linux
One of many options here:
https://www.torproject.org/download/download-unix
Tor HTTP Proxy Settings
• Tor SOCKS5:
9050
• If using Tor
browser bundle
the port it 9150
Proxy Settings for Tor
(2C)
• Set HTTP and SSL proxy to 9050 on local host (127.0.0.1)
• SOCKS v5 to 9050 on local host (127.0.0.1)
• If you are using Firefox make sure that you go to about:config and set
network.proxy.socks_remote_dns to true
DNS Leaks
Setup FoxyProxy to use Tor and I2P at the same time
(7)
This assumes you are using the Tor Browser Bundle
1. Search for FoxyProxy or
https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/
2. Continue to Download-> Add to Firefox->Allow
3. Restart.
4. Right click FoxyProxy icon, click Options.
5. Edit Default, choose Proxy Details tab, click manually configure, set ip
to 127.0.0.1 and port to 9150.
6. Check "SOCKS Proxy?" and radio button "SOCKS5". Click OK.
7. Add proxy. Under General, set a name like "I2P", and a color.
8. Switch to Proxy Details tab. Set IP to 127.0.0.1 (or a remote proxy) and
port to 4444.
9. Switch to URL Patterns tab. Add a new pattern, call it I2P and enter
*.i2p/* as pattern. OK, OK to get back to proxy list.
10. Add New Proxy. Choose "Direct internet connection".
11. Switch to URL Patterns tab. Make a URL pattern for localhost like
http://127.0.0.1:*. Move it to the top of the list.
12. Right click FoxyProxy icon, click "Use Proxies based on their predefined
patterns and priorities".
How People Got Caught Interlude 1:
LulzSec
• Hector Xavier Monsegur (Sabu) normally used Tor for connecting to IRC but
was caught not using it once and FBI found his home IP. After being caught,
he started to collaborate.
• Hector spoke with Jeremy Hammond (sup_g) on IRC, and Jeremy casually let
slip where he had been arrested before and groups he was involved with. This
narrowed the suspect pool, so the FBI got a court order to monitor his
Internet access.
• Hammond used Tor, and while the crypto was never busted, FBI correlated
times sup_g was talking to Subu on IRC with when Hammond was at home using
his computer.
• Lessons Learned: Use Tor consistently. Don’t give personal information.
Correlation attacks are still a bitch!
Places to go
Data to see
Tor Hidden Service Websites
• Check if you are using Tor
https://check.torproject.org/?lang=en-US&small=1
• Core.onion
http://eqt5g4fuenphqinx.onion
• TorDir
http://dppmfxaacucguzpc.onion
• Hidden Wiki
http://kpvz7ki2v5agwt35.onion
• Onion List
http://jh32yv5zgayyyts3.onion
• TorLinks
http://torlinkbgs6aabns.onion
• The New Yorker Strong Box
http://tnysbtbxsf356hiy.onion
Tor Hidden Service IRC
• FTW
irc://ftwircdwyhghzw4i.onion
• Nissehult
irc://nissehqau52b5kuo.onion
• Renko
irc://renko743grixe7ob.onion
• OFTC
irc://37lnq2veifl4kar7.onion
• Gateway to I2P’s IRC?
irc://lqvh3k6jxck6tw7w.onion
Tor IRC Proxy Settings
Tor IRC
(4A)
1. Set Tools->Preferences-Proxy
Type: SOCKS 5/Host:127.0.0.1/Port 9050
2. Accounts->Manage accounts->add
3. set server without protocol prefix
4. set proxy to use global
Specify an Exit Node in Tor
(4B)
1. View network.
(Vidalia or http://torstatus.blutmagie.de/ )
2. Right click on a node and copy it’s Finger Print.
3. Add this to your torrc and restart Vidalia/Tor
ExitNodes $253DFF1838A2B7782BE7735F74E50090D46CA1BC
Or to do a country
ExitNodes {US}
May have to use
StrictExitNodes 1
To force it to be more than a preference
More options & info at
https://www.torproject.org/docs/faq#ChooseEntryExit
Tor Bridges
• Bridges are unadvertised Tor entry nodes where there is no complete list
• Find them via:
https://bridges.torproject.org
• Tor Button->Open Network Settings->My Internet Service Provider (ISP)
blocks connections to the Tor network
• Enter the bridge string
Obfsproxy: Pluggable Transports
• Even with bridges and Tor looking mostly like SSL web traffic, packet
characteristic's can be keyed on to know it’s Tor using Deep Packet
Inspection (DPI)
• Answer: Make traffic look like HTTP, Skype, or just breaking up the
patterns or normal Tor traffic
• Obfsproxy Tor Browser Bundle
https://www.torproject.org/docs/pluggable-transports.html.en#download
• Uses obfsproxy bridges
I2P Services/Apps
• IRC on 127.0.0.1 port 6668
• Syndie
• SusiMail
http://127.0.0.1:7657/susimail/susimail
• Bittorrent
http://127.0.0.1:7657/i2psnark/
• eMule/iMule
http://echelon.i2p/imule/
• Tahoe-LAFS
• More plugins at http://i2plugins.i2p/
I2P IRC Proxy Settings
• Already listening on port 6668/TCP
I2P eepSites
Project site
http://www.i2p2.i2p/
Forums
http://forum.i2p/
http://zzz.i2p/
Ugha's Wiki
http://ugha.i2p/
Search engines
http://eepsites.i2p/
http://search.rus.i2p/
General Network Stats
http://stats.i2p/
Site Lists &Up/Down Stats
http://inproxy.tino.i2p
http://perv.i2p
http://direct.i2p
http://no.i2p
http://inr.i2p
http://identiguy.i2p
How People Got Caught Interlude 2:
Freedom Hosting
• Freedom Hosting hosted, amongst other things, many child porn related
hidden service websites.
• Freedom Hosting had previously come under attack by Anonymous during Op
Darknet because of it hosting CP.
• In July of 2013, the FBI compromised Freedom Hosting, and inserted
malicious Java Script that used Firefox bug CVE-2013-1690 in version 17 ESR.
The Tor Browser Bundle is based on Firefox, and the newest version was
already patched, but not everyone updates in a timely fashion.
• The payload was “Magneto”, which phoned home to servers in Virginia using
the hosts public IP. It also reported back the computer’s MAC address,
Windows host name, and a unique serial number to tie a user to a site.
• An Irish man, Eric Eoin Marques, is alleged to be the operator of Freedom
Hosting. The servers hosting Freedom Hosting were tied to him because of
payment records.
• Marques was said to have dived for his laptop to shut it down when police
raided him.
• Lessons Learned: Patch, follow the money, leave encrypted laptops in a
powered down state.
Make hidden server contact you over public Internet
Part 2:
Hosting Services
To Make I2P accessible to your network
(3C)
1. Click through to I2PTunnel, then the “Name: I2P HTTP Proxy” settings.
2. In the Access Point->Reachable Dropdown, set it to 0.0.0.0 if you wish,
but only on a private network.
Could also just edit i2ptunnel.config
3. You could also export the web console to the network and enable a
password if you wish:
http://www.i2p2.de/faq.html#remote_webconsole
Make Tor accessible to your network
(4C)
1. Edit your torrc. (/etc/tor/torrc)
2. Add line:
SocksPort 0.0.0.0:9050
3. Restart Tor.
Run I2P as a service in Windows
(3D)
Windows:
Configure it at install time or use
install_i2p_service_winnt.bat
net start i2p
and
uninstall_i2p_service_winnt.bat
from the installed I2P directory.
Run I2P as a service in Ubuntu Linux
(3D)
Linux (Ubuntu):
See https://help.ubuntu.com/community/I2P if you did a normal install.
If you did the APT method above:
1. Edit the default I2P files
gedit /etc/default/i2p
2. Set RUN_DAEMON to "true"
RUN_DAEMON="true"
3. Start the I2P service
service i2p start
4. Make sure /etc/rc5.d/ has a I2P symbolic link in it.
Run Tor as service in Windows
(4D)
Windows:
1. Run:
cd "c:\Program Files\Vidalia Bundle\Tor"
2. Then:
tor -install
3. Other commands for stoping, starting and removing later:
tor -service start
tor -service stop
tor -remove
To make Vidalia work again in Window after making Tor a service
(4E)
1. CD into c:\Program Files\Vidalia Bundle\Tor and run:
tor --hash-password somepassword
Note: This output contains is the hash you will use.
2: Add this to the torrc you will locate in C:\
ControlPort 9051
HashedControlPassword
16:B0AB72FC4E3A30D560A3524C79E7F26CF350A8504E73210426CCBE2373
3. If the service is already installed, run:
tor -remove
4. Not run this to set up your config:
tor -install -options -f C:\torrc ControlPort 9051
5. Now when you start, Vidalia will ask for the password to connect.
Run Tor as service in Ubuntu Linux
(4F)
1. Install Vidalia and dependencies.
2. edit /etc/default/tor.vidalia and set:
RUN_DAEMON="yes”
3. Make sure /etc/rc5.d/ has a Tor symbolic link in it.
4. May have to use
sudo /etc/init.d/tor start
to get it going, but it should start on the next reboot also.
To make Vidalia work again in Linux after making Tor a service
(4G)
1. Edit torrc
nano /etc/tor/torrc
and add
ControlPort 9051
HashedControlPassword
16:B0AB72FC4E3A30D560A3524C79E7F26CF350A8504E73210426CCBE2373
2. then restart the daemon:
/etc/init.d/tor restart
Setting up a Tor Hidden Service
(5A)
1. In Vidalia go to Settings->Services
2. Click the plus symbol and configure Virtual Port, Target and Directory
Path. For example:
Virtual Port: 80
Target: 127.0.0.1:80 or just 127.0.0.1
Directory Path: c:\torhs or /home/username/torhs
3. Click ok, then go back into Services to copy out your .onion address.
Setting up a Tor Hidden Service
• From Vidalia go to Settings->Services
Setting up a Tor Hidden Service
• On Linux, edit torrc file:
nano /etc/tor/torrc
• Add lines:
HiddenServiceDir /var/lib/tor/other_hidden_service/
HiddenServicePort 80 192.168.1.1:80
• Find your host name:
cat /var/lib/tor/other_hidden_service/hostname 3nimxh5oor7m72ig.onion
Using the built in web server (Jetty) I2P Tunnel
(6A)
1. Find the eepsite\docroot folder under your I2P profile (location varies
depending on how you installed I2P, see notes at end).
2. Edit the HTML files to your liking.
3. Go into I2P Tunnel (http://127.0.0.1:7657/i2ptunnel/) and start the built
in I2P Webserver.
4. When it is up, click the Preview button to see your site and its Base32
address.
5. You may want to enable the “Auto Start(A):” check box.
Making I2P Tunnels
Making I2P Tunnels
• Simple SOCKS
client
tunnel
Making I2P Tunnels
• SSH Example
Make SSH Server and SOCKS Tunnel
(6B)
1. Make a Standard server tunnel, set target and port.
2. Create client tunnel of type SOCKS 4/4a/5, take defaults other than
setting port (I use 5555).
3. In Putty, under connection, set the proxy to 127.0.0.1 on port 5555 and
set “Do DNS name lookup at proxy” to yes.
Backing Up Tor Hidden Service Keys
• In the relative or absolute path you set
Backing up Tor Hidden Server Key
(5B)
1. In Vidalia go to Settings->Services, and note the location set in
“Directory Path:“.
2. In this path you should find two file to backup, hostname and private_key.
3. To restore on a new Tor install you can just copy these files to a new
path, and create a Hidden Service that points to the directory they are
placed in.
Backing Up I2P Tunnel Key
• Notice the file name, relative to I2P’s path
• Look in C:\ProgramData\i2p\i2ptunnel-keyBackup or
/var/lib/i2p/i2p-config/i2ptunnel-keyBackup/
Backing up I2P Tunnel Key
(6C)
1. Under a server tunnels settings, note its “Private key file(k)” setting.
2. This is the path, or path relative to the active I2P profile, to the file
you need to backup.
3. To restore on a new I2P install you can just copy it to the new install’s
profile and make sure the new tunnel’s settings are mapped to it.
How People Got Caught Interlude 3:
SilkRoad
• Big thanks to Nate Anderson for the original article.
• Ross William Ulbricht is alleged to be “Dread Pirate Roberts”, operator of
the SilkRoad, which allows sellers and buyers to exchange less than legal
goods and services.
• With about $1.2 Billion in exchanges on SilkRoad, FBI wanted to know who
was behind it. They started to look for the earliest references to the
SilkRoad on the public Internet.
• The earliest they could find was from “altoid” on the Shroomery.org forums
on 01/27/11.
• An account named “altoid” also made a post on Bitcointalk.org about
looking for an “IT pro in the bitcoin community” and asked interested
parties to contact “rossulbricht at gmail dot com” (10/11/11).
• "Ross Ulbricht.” account also posted on StackOverflow asking for help with
PHP code to connect to a Tor hidden service. The username was quickly
changed to “frosty” (03/16/12).
How People Got Caught Interlude 3:
SilkRoad (continued)
• On 07/10/13 US Customs intercepted 9 IDs with different names, but all
having a picture of Ulbricht. Homeland Security interviewed Ulbricht, but he
denied having ordered them. Allegedly he told them anyone could have ordered
them from the “Silk Road” using Tor.
• FBI starts taking down SilkRoad servers, though I’m are not sure how they
were found. Could have been money trail to aliases, or as Nicholas Weaver
conjectured, they hacked SilkRoad and made it contact an outsides server
without using Tor so it revealed it’s real IP. Once located, FBI was able to
get a copy of one of the servers.
• Server used SSH and a public key that ended in frosty@frosty. Server also
had some of the same code posted on StackOverflow.
• Eventually, on 10/02/2013 the FBI Landed on him in a Library right after
he entered the password for his laptop. More evidence was found on his
laptop.
• Lessons Learned: Keep online identities separate, keep different
usernames. Don’t volunteer information.
More advanced stuff
• Torrify/SocksCap/Tsocks/Torsocks type apps (4H)
¡ SocksCap/Freecap/Widecap for Windows
• OnionCat
http://www.cypherpunk.at/onioncat/
• Garlicat
http://www.cypherpunk.at/onioncat/browser/branches/garlicat/Garlicat-HOWTO
• Svartkast
http://cryptoanarchy.org/wiki/Blackthrow
Many More Links
• Talk on Darknets in general
http://www.irongeek.com/i.php?page=videos/aide-winter-2011#Cipherspace/Darknets:_anonymizing_private_networks
• I2P FAQ
http://www.i2p2.de/faq.html
• Tor FAQ
https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ
• Tor Manual
https://www.torproject.org/docs/tor-manual.html.en
• I2P Index to Technical Documentation
http://www.i2p2.de/how
Sites of Mine
• My Tor/I2P Notes
http://www.irongeek.com/i.php?page=security/i2p-tor-workshop-notes
• Cipherspaces/Darknets An Overview Of Attack Strategies
http://www.irongeek.com/i.php?page=videos/cipherspaces-darknets-an-overview-of-attack-strategies
• Anonymous proxy to the normal web
http://www.irongeek.com/i.php?page=videos/tor-1
• Hidden services
Normally websites, but can be just about any TCP connection
http://www.irongeek.com/i.php?page=videos/tor-hidden-services
Events
Derbycon
Sept 24th-28th, 2014
http://www.derbycon.com
Others
Questions?
42
Twitter: @Irongeek_ADC
 Printable version of this article
15 most recent posts on Irongeek.com:
|
