DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
Transcript of DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
1/52
!"#$%%&'()*++,-.(/
12'34) 5'+)6!47
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
2/52
!"#$%%&'()*++,-.(/
! & '8) &'()*++,-.(/
! & !49+ 4) 3):+'+6: 3) &);(: ,)(7 +9+'?:!3)* @ &>/ A86: 4
*++, 73:! =/+ () /? !4)26
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
3/52
!"#$%%&'()*++,-.(/
!
& 73BB F+ :4,3)* :7( #+'6#+.=9+6
" G+(#B+ :'?3)* :( 6:4? 4)()?/(86
" G+(#B+ :'?3)* :( 2+@4)()?/3H+ 86+'6
! &>/ )(: '+4BB? 4 #'394.? *8?
!
&1I1J
! K+ .4'+;8B 7!+'+ ?(8 68';L .():'4F4)2 4743:6
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
4/52
!"#$%%&'()*++,-.(/
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
5/52
!"#$%%&'()*++,-.(/
E4',)+:6
! C!+'+ 4'+ /4)? 2+M)3=()6L F8: /3)+ 36
N4)()?/3H3)* #'394:+ )+:7(', O
! P6+ (; +).'?#=() 4)2 #'(Q3+6 R6(/+ =/+6 (:!+'
#++'6S :( (F;86.4:+ 7!( 36 .(//8)3.4=)* :(
7!(/
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
6/52
!"#$%%&'()*++,-.(/
C!+ T)3() U(8:+'
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
7/52!"#$%%&'()*++,-.(/
! !"#$D3'6: :!+ P< I494B U+6+4'.! J4F('4:('?L :!+) :!+ VDD 4)2 )(7 :!+ C(' G'(A+.:
RWXY.Z )()@#'(M:S-
!"#$%%777-:('#'(A+.:-('*%
!
!"%$NC(' 36 ;'++ 6([74'+ 4)2 4) (#+) )+:7(', :!4: !+B#6 ?(8 2+;+)2 4*43)6: 4 ;('/(; )+:7(', 68'9+3BB4).+ :!4: :!'+4:+)6 #+'6()4B ;'++2(/ 4)2 #'394.?L
.()M2+)=4B F863)+66 4.=93=+6 4)2 '+B4=()6!3#6L 4)2 6:4:+ 6+.8'3:? ,)(7) 46
:'4\. 4)4B?636-O ] 16 2+M)+2 F? :!+3' 63:+
! !"&'$1..+66 )('/4B &):+')+: 63:+6 4)()?/(86B?L 4)2 C(' !322+) 6+'93.+6-
! (#)$J(.4BB? '8)
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
8/52!"#$%%&'()*++,-.(/
! J4?+'+2 +).'?#=()
! K3@23'+.=()4B :8))+B6
! _46 23'+.:('? 6+'9+'6
! `(6:B? ;(.86+2 () (8: #'(Q?3)* :( :!+ &):+')+:
! `('+ 3);( 4: !"#6$%%777-:('#'(A+.:-('*
Internet Server
Directory Server
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
9/52!"#$%%&'()*++,-.(/
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
10/52!"#$%%&'()*++,-.(/Image from http://www.torproject.org/hidden-services.html.en
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
11/52!"#$%%&'()*++,-.(/Image from http://www.torproject.org/hidden-services.html.en
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
12/52!"#$%%&'()*++,-.(/Image from http://www.torproject.org/hidden-services.html.en
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
13/52!"#$%%&'()*++,-.(/Image from http://www.torproject.org/hidden-services.html.en
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
14/52!"#$%%&'()*++,-.(/Image from http://www.torproject.org/hidden-services.html.en
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
15/52!"#$%%&'()*++,-.(/
Image from http://www.torproject.org/hidden-services.html.en
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
16/52!"#$%%&'()*++,-.(/
! 5B3+):
a86: 4 86+'
! U+B4?6
C!+6+ '+B4? :'4\.L 4)2 .4) 4.: 46 +Q3: #(3):6
!
K'32*+6U+B4?6 )(: 429+'=6+2 3) :!+ 23'+.:('? 6+'9+'6L 6( !4'2+' :( FB(.,
! b84'2 I(2+6
P6+2 :( /3=*4:+ 6(/+ :'4\. 4)4B?636 4"4.,6
! &):'(28.=() G(3):6
_+B#+'6 3) /4,3)* .())+.=()6 :( !322+) 6+'93.+6!
U+)2+H9(86 G(3):
P6+2 ;(' '+B4?3)*%+6:4FB36!3)* .())+.=()6 :( !322+) 6+'93.+6
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
17/52!"#$%%&'()*++,-.(/
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
18/52!"#$%%&'()*++,-.(/
!
C43B6$ C!+ 1/)+63. &).(*)3:( J39+
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
19/52!"#$%%&'()*++,-.(/
*+#,
! &; ?(8 .4) :8))+B 3: :!'(8*! 4
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
20/52
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
21/52
!"#$%%&'()*++,-.(/
!"#$%%*+=c#-)+:
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
22/52
!"#$%%&'()*++,-.(/
!
5'?#:( 58''+).?
! G'((; (; 7(',
! K3:.(3) 122'+66+6 n G'394:+ ^+?6
!
KB(., 5!43) RB+2*+'S
! C8/FB+'6 RB48)2+'3)*S
! d4? /('+ 3);( F? K(F d+366
!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k932+(6%F632+62+cXYZ%c@m@!4.,3)*@F+)A4/3)6@F(F@7+366@#7.'4.,@3):(@:(@F3:.(3)
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
23/52
!"#$%%&'()*++,-.(/
! T) E+.- Ym:! cXYZ 4 F(/F :!'+4: 746 /42+ :( _4'94'2>6 6:82+): )+76
#4#+' 4)2 6(/+ (\.34B6-!
C!+ #+'6() 86+2 !"#6$%%777-*8+''3BB4/43B-.(/ :( 6+)2
+/43B 4[+' .())+.=)* (9+' C('
!
b8+''3BB4 `43B #8:6 4) o@T'3*3)4=)*@&G !+42+' () :!4:/4',+2 7!( 6+): :!+ /+664*+L 3) :!36 .46+ 4 C(' +Q3: #(3):C($ p3'()*++,q3'()*++,-.(/p r3'()*++,q3'()*++,-.(/s
D'(/$ r+gA)t'Hu((lAZ7q*8+''3BB4/43B-.(/s
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
24/52
!"#$%%&'()*++,-.(/
! 1BB C(' )(2+6 4'+ #8FB3.B? ,)(7) R+Q.+#: F'32*+6S$
!"#$%%:('6:4:86-FB8:/4*3+-2+
! V46? :( .(''+B4:+ 7!( 746 4"4.!+2 :( _4'94'2 )+:7(',
4)2 863)* C(' 4: :!+ 64/+ =/+ :!+ +/43B 746 6+): R8)B+66
?(8 86+ 4 F'32*+S-
! VB2( ^3/ 746 .())+.:+2 :( :!+ C(' )+:7(', 4'(8)2 :!4:
=/+-
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
25/52
!"#$%%&'()*++,-.(/
J+66()6 J+4')+2$
! E()>: F+ :!+ ()B? #+'6() 863)* C(' () 4
/()3:('+2 )+:7(', 4: 4 *39+) =/+!
P6+ 4 F'32*+f
! E()>: 42/3: 4)?:!3)*
! 5(''+B4=() 4"4.,6 4'+ 4 F3:.!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
26/52
!"#$%%&'()*++,-.(/
5MB
8MB
Client
Client
Client
Client
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
27/52
!"#$%%&'()*++,-.(/
Client
Client
Client DoSAttack& .(8B2 A86:
74:.! :!+=/3)*6-
G8B6+ :!+
24:4 {(76
/?6+B;-
T' +9+) A86:
.!4)*+ :!+ B(42() :!+ #4:!-
E(< (8:632+
!(6: :( 4|+.:
:'4\.-
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
28/52
!"#$%%&'()*++,-.(/
DNSQuery
Monitored DNS Server
&; & 2()>: 86+ :!+#'(Q? ;(' EI
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
29/52
!"#$%%&'()*++,-.(/
! _+.:(' o493+' `()6+*8' R
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
30/52
!"#$%%&'()*++,-.(/
! _4//()2 86+2 C('L 4)2 7!3B+ :!+ .'?#:(
746 )+9+' F86:+2L DK& .(''+B4:+2 =/+6
68#}* 746 :4B,3)* :(
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
31/52
!"#$%%&'()*++,-.(/
J+66()6 J+4')+2$
! P6+ C(' .()636:+):B?
! E()>: *39+ #+'6()4B 3);('/4=()
! 5(''+B4=() 4"4.,6 4'+ 6=BB 4 F3:.!j
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
32/52
!"#$%%&'()*++,-.(/
! D'++2(/ _(6=)* !(6:+2L 4/()*6: (:!+' :!3)*6L
/4)? .!3B2 #(') '+B4:+2 !322+) 6+'93.+ 7+F63:+6-
! D'++2(/ _(6=)* !42 #'+93(86B? .(/+ 8)2+' 4"4.,
F? 1)()?/(86 28'3)* T# E4',)+: F+.486+ (; 3:
!(6=)* 5G-
! &) a8B? (; cXYZL :!+ DK& .(/#'(/36+2 D'++2(/
_(6=)*L 4)2 3)6+':+2 /4B3.3(86 a494
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
33/52
!"#$%%&'()*++,-.(/
! C!+ #4?B(42 746 N`4*)+:(OL 7!3.! #!()+2 !(/+
:( 6+'9+'6 3) ~3'*3)34 863)* :!+ !(6:>6 #8FB3. &G-
!"#$%%*!(7+)-/+%z3@:('@/4B74'+@4)4B?636
! &: 4B6( '+#(':+2 F4., :!+ .(/#8:+'>6$"
`15 422'+66
"
d3)2(76 !(6: )4/+8)3t8+ 6+'34B )8/F+' :( =+ 4 86+' :( 4 63:+
! `4? F+ 64/+ 46 V*(=6=.4Bb3'4|+-
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
34/52
!"#$%%&'()*++,-.(/
! 1) &'36! /4)L V'3. V(3) `4't8+6L 36 4BB+*+2 :( F+
:!+ (#+'4:(' (; D'++2(/ _(6=)*- C!+ 6+'9+'6
!(6=)* D'++2(/ _(6=)* 7+'+ =+2 :( !3/ F+.486+
(; #4?/+): '+.('26-
! `4't8+6 746 6432 :( !49+ 239+2 ;(' !36 B4#:(# :(
6!8: 3: 2(7) 7!+) #(B3.+ '432+2 !3/-! `('+ E+:43B6$
!"#$%%777-73'+2-.(/%:!'+4:B+9+B%cXYZ%Xg%
;'++2(/@!(6=)*@z3%
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
35/52
!"#$%%&'()*++,-.(/
J+66()6 J+4')+2$
! E(): !(6: 54#:43) G3.4'2 ('
a8B34) K46!3'!
G4:.!L #4:.!L #4:.!
! D(BB(7 :!+ /()+?
! J+49+ +).'?#:+2 B4#:(#6 3) 4 #(7+'+2
2(7) 6:4:+ 7!+) )(: 3) 86+j
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
36/52
!"#$%%&'()*++,-.(/
J+:>6 6++ 3; :!+!322+) 6+'9+'
4## 36 98B)+'4FB+
:( 4) +Q#B(3:
RF8|+'
(9+'{(7%7+F4## 6!+BB +Q+.%
+:.S-
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
37/52
!"#$%%&'()*++,-.(/
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
38/52
!"#$%%&'()*++,-.(/
! C!+ +4'B3+6: :!+? .(8B2 M)2 746 ;'(/ N4B:(32O () :!+
!"#$%%777-6!'((/+'?-('*%;('8/6%6!(7{4:-#!#%I8/F+'%YZhmXggW
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
39/52
!"#$%%&'()*++,-.(/
!
K3:5(3)C4B,-('* G(6:
! N8(:+ ;'(/$ 4B:(32 () a4)84'? cgL cXYYL Xe$ll$WY G`
d!4: 4) 47+6(/+ :!'+42j (8 *8?6 !49+ 4 :() (; *'+4: 32+46- _46 4)?()+
6++)
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
40/52
!"#$%%&'()*++,-.(/
!
1) 4..(8): )4/+2 N4B:(32O 4B6( /42+ 4 #(6: () K3:.(3):4B,-('* 4F(8: B((,3)*
;(' 4) N&C #'( 3) :!+ F3:.(3) .(//8)3:?O 4)2 46,+2 3):+'+6:+2 #4'=+6 :( .():4.:
N+#,,9=>+?8"' &' @7&?= :#' 8#7O RYX%YY%YYS-
!"#6$%%F3:.(3):4B,-('*%3)2+Q-#!#f:(#3.klehYY-X
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
41/52
!"#$%%&'()*++,-.(/
!
PBF'3.!:>6 b((*B+u #'(MB+ 6!(7 4) 3):+'+6: 3) :!+ N`36+6 &)6=:8:+O 4 N7('B2
.+):+' (; :!+ 186:'34)
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
42/52
!"#$%%&'()*++,-.(/
! pU(66 PBF'3.!:-O 4..(8): 4B6( #(6:+2 ()
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
43/52
!"#$%%&'()*++,-.(/
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
44/52
!"#$%%&'()*++,-.(/
! T) Xe%YX%YZ P< 586:(/6 3):+'.+#:+2 g &E6 73:! 23|+'+): )4/+6L F8: 4BB !493)* 4 #3.:8'+ (;
PBF'3.!:- _(/+B4)2
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
45/52
!"#$%%&'()*++,-.(/
!
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
46/52
!"#$%%&'()*++,-.(/
J+66()6 J+4')+2$
! ^++# ()B3)+ 32+)==+6 6+#4'4:+
"
^++# 23|+'+): 86+')4/+6" D'(/ 23|+'+): B(.4=()6
!
_49+ 4 .()636:+): 6:('?
! E()>: :4B, 4F(8: 3):+'+6:6
! E()>: 9(B8):++' 3);('/4=()j
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
47/52
!"#$%%&'()*++,-.(/
`4?F+f
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
48/52
!"#$%%&'()*++,-.(/
! C4B, () E4',)+:6 3) *+)+'4B
!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k932+(6%432+@
73):+'@cXYY53#!+'6#4.+%E4',)+:6$}4)()?/3H3)*}#'394:+})+:7(',6
! &cG D1
!"#$%%777-3c#c-2+%;4t-!:/B
! C(' D1
!"#6$%%:'4.-:('#'(A+.:-('*%#'(A+.:6%:('%73,3%2(.%C('D1
! C(' `4)84B
!"#6$%%777-:('#'(A+.:-('*%2(.6%:('@/4)84B-!:/B-+)
!
&cG &)2+Q :( C+.!)3.4B E(.8/+):4=()!"#$%%777-3c#c-2+%!(7
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
49/52
!"#$%%&'()*++,-.(/
! &):'( :( E4',)+:6$ C(' 4)2 &cG d(',6!(#!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k932+(6%3):'(@:(@:('@3c#@24',)+:6
! `? C('%&cG I(:+6!"#$%%777-3'()*++,-.(/%3-#!#f#4*+k6+.8'3:?%3c#@:('@7(',6!(#@)(:+6
! 53#!+'6#4.+6%E4',)+:6 1) T9+'93+7 T; 1"4.,
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
50/52
!"#$%%&'()*++,-.(/
!
1.=9+ E+;+)6+ _4'F3)*+' E36:'3F8=() R1E_ES
!"#$%%6(8'.+;('*+-)+:%#'(A+.:6%42!2%
;'(/ KB4., _3BB6 &);('/4=()
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
51/52
!"#$%%&'()*++,-.(/
E+'F?.()
-
7/23/2019 DEFCON 22 Adrian Crenshaw Dropping Docs on Darknets How People Got Caught UPDATED
52/52