Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim

2017年12月10日 - Birds of a Feather ( 簡稱BoF ),語意上是指鳥類會與相同類型的鳥群一起飛翔,之後衍伸為讓志同道合的人們聚集在一起或舉辦非正式聚會。

https://hitcon-girls.blogspot.tw/2017/12/Birds-of-a-Feather.html

  • Be the first to comment

  • Be the first to like this

Birds of a Feather 2017: 邀請分享 Light Up The Korean DarkWeb - Dasom Kim

  1. 1. Light Up The Korean Dark Web HOGUWARTS X
  2. 2. HITCON 2017 Dec - TAIWAN Table of Contents ● What is the Dark Web ● Introduction to the Korean Dark Web & Surface Web ● How to use the Data from Korean Dark Web ● Case study of Korean Dark Web ● Link analysis with the Dark Web & Surface Web
  3. 3. HITCON 2017 Dec - TAIWAN What is the Dark Web? ● The “Dark Web” is a part of the world wide web that requires special software to access. ● Once inside, web sites and other services can be accessed through a web browser in much the same way as the normal web. Source URL: https://simplyluculent.com/accessing-the-hidden-deep-Dark Web/
  4. 4. HITCON 2017 Dec - TAIWAN ● Some Dark Web sites require joining the website with the PGP public key in their personal profile. ● Most of the Dark Web membership forums will have to do grade-up. ● There are several prerequisites for grade up, one of which is to add own PGP public key in profile. Communication using PGP key
  5. 5. HITCON 2017 Dec - TAIWAN Communication using PGP key ● Eg. ○ High Korea
  6. 6. BROWSING TIPS
  7. 7. HITCON 2017 Dec - TAIWAN How to protect my identity when browsing ● Note that links *.onion.link, *.onion.to don’t use tor service. ● In particular, if you click image file links on PHP-BB posts such as High Korea, a security flaw in Tor where an actual IP address can be sent to the server when clicking on an address beginning with file: //. ● Do not sign up for the id of the portal site used on the surface web. ● Do not use scripts or plug-ins in browser.
  8. 8. HITCON 2017 Dec - TAIWAN Importance of archiving ● It's important to get a page at a certain point in time because the server is quickly disappearing or moving. ● Data is lost by the administrator. (eg. Such as promoting a specific link in a forum)
  9. 9. DARK WEB FORUM / MARKET
  10. 10. HITCON 2017 Dec - TAIWAN Introduce to Korean Dark Web & Surface Web “Korean Dark Web” ● Communication & Sharing Information of Dark Web Agora ( 아고라 ) The Hidden Wiki Korea ( 히든위키코리아 ) ● Dark Web Drug Marketplace High-korea ( 하이코리아 ) Unknown-crew ( 언노운크루 ) Eastern-front ( 동부전선 ) “It sells more diverse products including drugs” + add
  11. 11. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Korean Dark Web” ● Communication & Sharing Information of Dark Web Agora ( 아고라 ) Total 4,000+ posts ● Information of Drug ● Issue of Today ● Leakage of personal information
  12. 12. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Dark Web of Korea” ● Communication & Sharing Information of Dark Web Agora ( 아고라 )
  13. 13. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Dark Web of Korea” ● Communication & Sharing Information of Dark Web Agora ( 아고라 ) Fake ID, passport sales Hey, If I bought passport and fake id, can I pass security check in airport? If I have a fake passport, can I become british citizen? It depends on fortune.
  14. 14. HITCON 2017 Dec - TAIWAN Marihuana sales It is possible to trade all over the country 15 per 1g, 10 per 1g for purchases over 2g Torch Chat : 7bb34cjp********* telegram, wickr : withwee****** Several kinds of drugs are sold.
  15. 15. HITCON 2017 Dec - TAIWAN
  16. 16. HITCON 2017 Dec - TAIWAN I sold it for three times, promoting it for a week in here. If you can buy marihuana, contact me.
  17. 17. HITCON 2017 Dec - TAIWAN Spilled out the information of ex-girlfriend. Her birthday is the card password. Her birthday is on passport. I need a password to make a payment. you can be paid by CVC number at Foreign market. Jeon Seung-jun=his name(ex-girlfriend) KimXX, who lives in Songpa-gu.
  18. 18. HITCON 2017 Dec - TAIWAN Passport credit card ID card credit card credit card
  19. 19. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Korean Dark Web” ● Communication & Sharing Information of Dark Web The Hidden Wiki Korea Total 4,000+ posts ● Guide of Using Dark Web ● Issue of Today ● List of Korea Dark Web
  20. 20. HITCON 2017 Dec - TAIWAN Korean hidden wiki
  21. 21. HITCON 2017 Dec - TAIWAN
  22. 22. HITCON 2017 Dec - TAIWAN
  23. 23. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Korean Dark Web” ● Dark Web Drug Marketplace High-korea ( 하이코리아 ) The total number of posts is countless ● How to buy Drug / Cultivating Drug / Take Drug ● Issue of Today ● Medical Marihuana Legalization Movement
  24. 24. HITCON 2017 Dec - TAIWAN
  25. 25. HITCON 2017 Dec - TAIWAN Mainmenu before login.. Announcement News from surface-web Plan for legalize medical marihuana Information of bitcoin Protect to private in dark-web Chat….
  26. 26. HITCON 2017 Dec - TAIWAN Main menu after login.. Chat for Member Q&A for newbie Discuss on marihuana related product How to cultivating marihuana Sharing experience to abroad Discuss on marihuana trade 1:1 chat with neo ( using PGP )
  27. 27. HITCON 2017 Dec - TAIWAN Main menu after login.. Normal grade / Special market Auction Best grade/ Special market Review of Best class market Apply grade up to Best grade Register a seller Bitcoin loundry Dicuss for special grade Request of confirm Discuss for donate Request opinion to admin Collection of grade up member
  28. 28. HITCON 2017 Dec - TAIWAN Main menu after login.. Seller always indicates price and PGPkey. Sellers records a PGPkey for a sale request from the buyer.
  29. 29. HITCON 2017 Dec - TAIWAN Main menu after login.. Bitcoin laundry service(mixing) Mixing → 비빔밥(Bibimbap; Patter)
  30. 30. HITCON 2017 Dec - TAIWAN An organization’s Facebook page to legalize medical marihuana
  31. 31. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Korean Dark Web” ● Dark Web Drug Marketplace Unknown-crew ( 언노운크루 ) - opened at around October 20th Total 30+ posts ● How to buy Drug / Cultivating Drug / Take Drug ● Issue of Today ● Medical Marihuana Legalization Movement ● Same to the High-korea Format
  32. 32. HITCON 2017 Dec - TAIWAN Sites created along high korea. New site, fewer members yet.
  33. 33. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Korean Dark Web” ● Dark Web Drug Marketplace Eastern-front ( 동부전선 ) “It sells more diverse products including drugs”
  34. 34. HITCON 2017 Dec - TAIWAN
  35. 35. HITCON 2017 Dec - TAIWAN We could not see the inside because the eastern front prevented it from joining. But, the agora provided us with approximate data. (eg. Looking for a broker to cast a couch.)
  36. 36. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Closed Korean Dark Web” ● Dark Web Drug Marketplace 666 - LETOM Black market run by “motel666” ● Dark Web Bitcoin Loundry service LAVADORA
  37. 37. HITCON 2017 Dec - TAIWAN Currently closed... Recent registered member
  38. 38. HITCON 2017 Dec - TAIWAN Currently closed...
  39. 39. HITCON 2017 Dec - TAIWAN site name Sep Oct Nov 1W 2W 3W 4W 1W 2W 3W 4W 1W 2W 3W 4W 하이코리아 (HiGH KOREA) 동부전선(Eastern Front) 666 LETOM 히든갓(HiddenGOD) 라바도라(LAVADORA) Beetgames 아고라(AGORA) Hidden Wiki Korea 표현의자유 (Freedom of speech) 언노운크루 (Unknow Crew) 심부름
  40. 40. HITCON 2017 Dec - TAIWAN site name Sep Oct Nov 1W 2W 3W 4W 1W 2W 3W 4W 1W 2W 3W 4W 하이코리아 (HiGH KOREA) 동부전선(Eastern Front) 666 LETOM 히든갓(HiddenGOD) 라바도라(LAVADORA) Beetgames 아고라(AGORA) Hidden Wiki Korea 표현의자유 (Freedom of speech) 언노운크루 (Unknow Crew) 심부름
  41. 41. HITCON 2017 Dec - TAIWAN Introduce to Korean Dark Web & Surface Web “Why used data of Surface Web ?” ● Korean Dark Web is smaller than international Dark Web “ There are only 5 active sites. ” ● How to solved this problem ? “ We tried to collect more data by linking to the surface web. ” CASE : Linking to Slang-word
  42. 42. SURFACE WEB
  43. 43. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Surface Web of Korea” ● Communication & Sharing Information Korea Community Store of Daily Best ( 일간베스트 저장소 ) DCinside ( 디시인사이드 ) Other Twitter ( 트위터 ) / SNS Uljin21 ( 울진 21) / Korea Online News-paper
  44. 44. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Surface Web of Korea” ● Korea Community Store of Daily Best ( 일간베스트 저장소 ) Total 1,443 posts ● Information of Korean Dark Web ● About International Dark Web ● Found posts related to Dark Web But most of the posts are chat...
  45. 45. HITCON 2017 Dec - TAIWAN
  46. 46. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Surface Web of Korea” ● Korea Community DCinside ( 디시인사이드 ) Total 2,000+ posts ● Information of Korean Dark Web ● About International Dark Web ● Found posts related to Dark Web But most of the posts are chat...
  47. 47. HITCON 2017 Dec - TAIWAN
  48. 48. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Surface Web of Korea” ● Other Twitter ( 트위터 ) / SNS The total number of posts is countless ● Information of Korean Dark Web ● About International Dark Web ● Found posts related to Dark Web Crime-related Data Selling Drug & Requests for Hacking Sharing Information of Drug ...
  49. 49. HITCON 2017 Dec - TAIWAN
  50. 50. HITCON 2017 Dec - TAIWAN Introduce to Korea Dark Web & Surface Web “Surface Web of Korea” ● Other Uljin21 ( 울진21 ) / Korea Online News-paper The total number of posts is countless ● Selling Drug & Requests for hacking ● Found posts related to Dark Web Most drug-related articles have posts with NULL title and content. However, there are Drug-related data in the comments, so It’s difficult for administrators to manage posts. Therefore, many Drug-related articles are shared.
  51. 51. HITCON 2017 Dec - TAIWAN
  52. 52. HITCON 2017 Dec - TAIWAN
  53. 53. HITCON 2017 Dec - TAIWAN
  54. 54. HITCON 2017 Dec - TAIWAN How to use Data of Korean Dark Web “Data analysis of Korea Dark Web” ● Communication & Sharing Information of Dark Web We collected Slang word / Seller information of contact / Related to URL Find to Same teller in Dark Web & Surface Web ● Dark Web Drug Marketplace We collected Slang word / Drugs / Seller information of contact / Related to URL Find to Account to promote Drugs in Dark Web & Surface Web
  55. 55. HITCON 2017 Dec - TAIWAN How to use Data of Korean Dark Web “Investigation of Korea Dark Web” ● Currently, the Korean prosecutor has developed a system that searches for new Dark Web in the page and searches for keywords on the Dark Web. ● Through this, they recently arrested the criminals selling and cultivating Marihuana on the Dark Web ● However, the Dark Web monitoring system currently targets only drugs so improvements are needed to monitoring other crimes.
  56. 56. HITCON 2017 Dec - TAIWAN The case study of Korean Dark Web “Abstract of the case” ● In this talk, we will introduce specifics of the Korean cyber underground (including Dark Web). ● Share our approaches for investigations and discuss several case studies.
  57. 57. HITCON 2017 Dec - TAIWAN Link Analysis in Korean Dark Web & Surface Web “How to Link Analysis ?” CASE ) Linking to Slang-word eg. Illegal medicine website
  58. 58. CASE Illegal abortion pill sales
  59. 59. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” h**aXXX ??? h**a223 h**a989 h**a988
  60. 60. HITCON 2017 Dec - TAIWAN +) How to manipulate comments on Korean portal sites ● Used to write articles that are good or support each other in the group (Political writings) ● They should use multiple id ○ Get the credibility by making the same claim through several id. ○ To use other id's when deleted by admin or wrote spam comments ● To identify the same group, we use the ID pattern of ‘English + number’ ○ kevin1234 → *****1234 ○ kevin5678 → *****5678 ○ It seems to be irrelevant. On the dark web, a similar pattern is seen when working in groups. z***a1313 z***a1314
  61. 61. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” h**aXXX h**a111 h**a223 ... h**a988 h**a989 Pattern search of *.hxxa111.* eg. hxxa111.net
  62. 62. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” * Mifegyne? : Abortion pills. Can be aborted for less than 9 weeks of pregnancy. hanaXXX ??? site name h**a988 h**a223 h**a989
  63. 63. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” 경상북도 문경시 산양면 진정리 430-1 → Not a correct address. Telephone and bank accounts are not displayed, So that they can't trace their identity.
  64. 64. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” ● They use a 1: 1 bulletin board to keep in touch while avoiding tracking. ● They use a service called TocPlus. ● Other similar illegal sites are also using TocPlus.
  65. 65. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” Line ID(***444, d***007, ***d118)
  66. 66. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” Keyword Site Result of Tracking IP
  67. 67. HITCON 2017 Dec - TAIWAN The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital” ● 3,4-Methylenedioxymethamphetamine = MDMA = 엑스터시 Keyword Contact ID Result of Tracking Site
  68. 68. HITCON 2017 Dec - TAIWAN ... Report the contents to the Korean police The case study of Korea Dark Web “Case 2 : Abortion pill sales site / H**a Hospital”
  69. 69. Q n A
  70. 70. Thank You

    Be the first to comment

    Login to see the comments

2017年12月10日 - Birds of a Feather ( 簡稱BoF ),語意上是指鳥類會與相同類型的鳥群一起飛翔,之後衍伸為讓志同道合的人們聚集在一起或舉辦非正式聚會。 https://hitcon-girls.blogspot.tw/2017/12/Birds-of-a-Feather.html

Views

Total views

917

On Slideshare

0

From embeds

0

Number of embeds

113

Actions

Downloads

11

Shares

0

Comments

0

Likes

0

×