Avoiding Dark Web monitoring detection

Question

At our company, we offer security services to our clients. One of the things that management has pushed down to us is the need for dark web monitoring.

Because I am in the business meetings as well, management has come to this conclusion because many CEO’s, or the ones we work with, eyes light up when “dark web” is mentioned. My management plans to offer the monitoring of 10 key and/or important individuals in a company.

While we are going through this process, this made me wonder how an attacker might avoid detection. Sure, many of the existing tools are proprietary but having researched them, generally, they seem to be just crawling the Dark web through Tor browsers.

My question (purely for academic reasons): How might you, as an attacker, avoid detection on the dark web given that you have confidential information on 10 key individuals of a company and you are trying to receive some sort of monetary value for it?

I imagine an answer with steps, from the day you gain access to the confidential data to the day you sell it on the dark web.

^{* This answer would really help me in defining the scope of the service we are going to offer and to be realistic to clients.}

^{**IMHO, I do not believe in the usefulness of dark web monitoring because it gives a false sense of security.}

Answer 1

Obtaining Access

To begin a dark web is a network (often encrypted) which overlays the Internet but requires specialised software to access it. The Tor client, supplied within the Tor browser bundle, will connect to the Tor network and direct traffic through a triplet of nodes: entryNode --> relayNode --> exitNode. All three nodes will encrypt data transmitted with their public keys in the order:

• (entryNodePublicKey(relayNodePublicKey(exitNodePublicKey(data)))

Unless you have spyware loaded onto the host computers for the "important individuals" you will only see the entryNode IP address and encrypted traffic. Using this IP address you could confirm it belongs to the Tor network, as an induction node or guard node.

Because Tor is implemented for political activists, whistleblowers, oppressed dissidents, etc... it has built-in tools for censorship circumvention, OBFS4 bridges are among a few common methods, but another is using meek bridges. Meek bridges take advantage of AWS and Azure for domain fronting, this will make the Tor entryNode when performing DPI appear as an HTTPS amazon.com or microsoft.com connection; normal traffic. This method is deployed to circumvent the Great Firewall of China.

Equally other methods to conceal the entryNode connection include, but are not limited to:

• OpenVPN using AES encryption: most modern VPNs
• Proxy: HTTP, HTTPS, and SOCKS
• RDP (or any other remote access protocol, preferably encrypted)

The RDP idea will involve connecting to a remote computer and be using that to access the dark web, with or without the protection of VPN(s) or proxy(s).

Mentioning about circumventing censorship has relevance, as Vault 7 disclosures outlined CIA malware would use data centers as botnets and would prefer performing any connections over HTTPS (with modern ciphers) on port 443. This would draw much less attention to connection logs when reviewed by a SysAdmin.

With this information in mind, now we should consider without tremendous detail, the metadata and "noise" the attacker made when obtaining the confidential information. Questions include:

• Did they leave logs and metadata concerning the breach?
• Did they use someone else's access to access the confidential information, or use a zero day exploit?
• Do IP address logs belong to residential IP address(s) or recognised anonymising networks.

We have now built knowledge of when the confidential information was stolen. So, now we can see if the attacker had vulnerabilities within their OpSec that we can use to deanonymise them.

---

Selling the Information

This would be your second (and last) opportunity to identify the attacker. This also may not be possible, as it involves tracing the payment method, which could also employ money laundering.

This confidential information is now an asset to the attack. Presuming their goal is to profit from the attack, we will sell the information onto a buyer. A dark web marketplace would be a good start. Although, they could have been hired by a wealthy group to perform the attack. So, the information will be sold via either method:

1. Dark web marketplace
2. Closed auction (private)

The timing for selling this information would depend on the nature of the breach. Intellectual property with patents would not need a critical sell window, while a database of password hashes should be sold ASAP before the passwords are changed.

Payment would be your opportunity to trace the attacker. Payment could cover several forms:

1. Dead drop bank account(s)
2. PayPal
3. Credit/Debit card(s)
4. Cryptocurrencies

I cannot elaborate much further here, as money laundering is its own topic, and can be very broad. I can state that, the more judiciaries the IP addresses and payment cover, the more cumbersome and less likely you are to identify the attacker.