DEF CON 30 - Sam Bent - Tor - Darknet Opsec By a Veteran Darknet Vendor
Vložit
- čas přidán 19. 10. 2022
- The hacking subculture's closest relative is that of the Darknet. Both have knowledgeable people, many of whom are highly proficient with technology and wish to remain somewhat anonymous. They are both composed of a vast amount of introverts and abide by the same first rule: “Don’t get caught." Both tend to love Sun Tzu quotes as well. What happens when the hacker mentality discussed in the Hackers Manifesto is applied to things such as OpSec on the Darknet?
Over the past decade, there have been many DEF CON talks that have discussed Tor and the Darknet. None have ever come from a Darknet vendor. The approach was more academic, as opposed to economical. Having a background in IT, Infosec, and hacking, the goal is to present a unique perspective from a hacker’s point of view, as we look at how the hacker mentality applied functions in various hostile environments such as a Darknet Vendor, staff member of multiple Darknet Markets, and co-found of Dread, who then later would be a federal prisoner. Shortly after, he talks about how he was able to get himself out of federal prison 3 years early.
All of which was possible through the reconnaissance of various systems and methodologies. From the anticipated linguistical analysis that the feds were making of posts on Darknet forums to how to write a motion to a federal judge from a prison cell in order to make him understand what it was like there, we will take a journey through a variety of interesting places and times from a tour guide with unparalleled experience and access.
By focusing less on the basics of Tor and more on how insiders operate within it, we will uncover what it takes to navigate this ever-evolving landscape with clever OpSec. In addition to seeing what happens if you get caught. All through the perspective of the hacker spirit that refuses to submit. - Věda a technologie
When the bald dude with a beard on stage introduces an even balder and more bearded dude to talk you know it's gonna be good.
The grey wizard brought out the white wizard
0:07
Dude looks like a fungus growing on an egg.
Lol I had to rewind because I was like TF? Did he just introduce himself ?
@@LostLeftyLimblol same
I genuinely burst into laughter when he steps aside and an identical looking hackerboi steps up to the mic.
this is the realest shit ive ever heard in a while and brings a lot of street cred back to Defcon.
Thank you for that! I was honored that the let me speak in the first place. :)
Fuck no. This guy is on a stage because he is bad at it. He was fuckin involved with a 10% cashout to a mailing address. 10% cashouts are explicitly illicit. No legit person accepts a 10% fee on cashout. He should have used... Nevermind.
Oh and that BTC->MRC->BTC hop sequence is straight dogshit. Chainalytics broke single MRC hops years ago. BTC->MRC->MRC->MRC->BTC is required. It is called a triple wallet hop. JFC...
@@PresidentofAntifaHuh, triple hop. Much like Tor.
@@MikeTrieu Tor was created by Navy Intelligence; I would never trust it with my safety. 4g sim card router plus a yagi is the only way to fly. They have no cellular card nor GPS. Your base IP must not be your own. Yagis can hit a cell tower in the next state.
The level of anxiety I feel just listening to this talk means I'd never make it as a vendor. Way, way, way too stressful but I admire his determination and commitment. He brought a level of professionalism to his work that's hard to match. Also, surprised the USPI had such a dogged investigator given how much of my mail has gone missing.
What a fascinating insight into a world I couldn't imagine. I hope someone inspires this guy to continue his advocacy, whatever advocacy that might be, because he brings a formidable intellect and understanding.
Hw got help by his cousin.
It was an organization. But he didn't say it.
The human body stores accumulated opsec knowledge in the beard.😊
This was probably the most Relaxed non boisterous talk about Darknet activities and how to keep yourself safe.
It was nice of him to introduce himself
This had me dying! :)
@@DoingFedTime I trust you pulled thru?
@@noahway13 Indeed. :)
Who else rewinded after the introduction to see if it was really another guy coming on?
You know it's a hacker conference when you see a neck beard introduce a neck beard. If you ever want to know how things really work, find the neck beard, and ask them.
It was a beard hand off
Its neckbeards all the way down here. I remember when HOPE was where this kind of thing would happen, DefCon was brimming with 'script kiddies'. Here we are now, OPSEC is hard legal science, social engineering is in it's sophomore phase and gaining traction across society, and we are watching the fallout from some of the happenings since the early 00's.
My beard was way better. :) hahahha
holy fuck I didnt even notice there were two different people until I saw this
"show the trajectory the mindset would take you if adapted for the wrong reasons" is the greatest thing ever
Sam is such a down to Earth man. This talk was amazing, really brings back the realness in DEFCON
Damn dude, he almost beat the case at the Franks trial and got prisoner's dilemma'd. That's rough
The Prisoner's Dilemma. It involves two individuals who have been arrested and are being interrogated separately.
In the Prisoner's Dilemma, each prisoner has two options: cooperate with the other prisoner by remaining silent, or betray the other prisoner by confessing.
The dilemma arises because the outcome for each prisoner depends on the choices made by both prisoners.
If both prisoners remain silent (cooperate), they both receive a moderate sentence. If one prisoner confesses (betrays) and the other remains silent, the betrayer goes free while the other prisoner receives a harsh sentence. If both prisoners confess, they both receive a somewhat harsh sentence.
The dilemma is that each prisoner must decide whether to trust the other to remain silent or to betray them. The rational choice for each prisoner is to betray, as it ensures the best outcome regardless of the other's decision. However, if both prisoners act rationally and betray each other, they both end up with a worse outcome than if they had both cooperated.
The Prisoner's Dilemma illustrates the tension between individual self-interest and the collective interest.
When he said he wanted to find a database of people that he wouldn't mind screwing over, I immediately thought of the sex offender registry. Pretty obvious really. Now if only there were a registry of people that ran spam call centers trying to sell extended warranties for you car.
Scam call centers are mostly not in the USA though
@@x87-64sadly the call centers in the US are just as shady and prey on old people as well
That ring around 370hz was driving me crazy the entire talk
We all hear that. Every single human on earth right now has tinnitus from the atmosphere is kinda wild
@@nicholasgrossman3194 Wat
@@TheTylrBllmn the upper atmosphere has been electrically overcharged for the past 5 years and has caused ringing in people's ears. It's like a static constant ring. It's just electricity all around.
@@nicholasgrossman3194 Yeah, as an audio professional working with my ears most days of the week, I can't say I experience that. Sounds like nonsense to me.
Real OG. Amazing talk, thank you!
Thank you, I was definitely not expecting there to be so many people (and hoping that there were not! :) ).
Impeccable approaches to problem solving and research. Except the whole federal crime part.
No, it's all impeccable, it's just not all moral.
@@kraagnjilwulf1413Wouldn’t it only be impeccable if he hadn’t gotten caught in the first place?
@@thefamilydog3278 to a certain extent, yes, but I was pretty sure he mentions that he got caught because some of the people he had worked with snitched on him, so there isn't much he could've done, if anything.
You mean the part of destroying lives by selling drugs...
Fantastic talk. Been in jail as a kid. Turned cop. Now a hacker. Thank you for protecting our privacy and encouraging safe darknet surfing 🏄♂️
As someone who worked as a mid to high lvl drug trafficker complacency is the number one enemy more so than leo
This is such a fascinating talk to watch! It's a privilege to have someone with this kind of experience share their story, and especially as well put together as you had it.
I was surprised to see someone working in drug trafficking put so much thought into their business and it's a reminder that just because something is secretive and illegal does not mean those participating are strictly nefarious, antisocial, or unproductive. Thank you for shedding light on a topic that many would shy away from.
It is also an indictment of the US's war on drugs as a driver of many of the harmful and disruptive aspects of drug use and economy. The worst things you had to do (using other's addresses, laundering, etc.) are strictly a result of the criminalization of drugs.
Anyways, great talk and looking forward to checking out more of your content!
Hansa. Haven’t heard that in a while. I remember I was 15 on Silk Road in 2012 should’ve saved my btc
Dude I remember being 17, working my first job, saving up those little checks….and one day i was online, saw something about bitcoin and was like yeah whatever….
Man if i woulda invested 250 back then 😅 life would be different
One of my favorite sec ops presentations of all time
A sincere ThankYou for sharing, We can see how difficult it is for you, keep fighting that good fight you are both an inspiration and a winner.
Sam Bent; great talk all around. Breaking down the thought process that you took was real interesting and this put me in that problem solving mindset that seems almost useful for any problem where you can look at things as complete motivators-> going to jail
amazing talk, really good guy, can tell this dudes been a lot to get here and be on the platform. respect my man glad you are free man keep rockin!
This is the best DEFCON talk ive seen in fucking years!
Thank you for that lotekchapra!
@@DoingFedTime no seriously. The world is scary and terrifying. People wind up in jail for alot. And opsec is huge. To speak so candidly, this is giving people not only a basis, but I feel it normalized in a way these things.
In the future it would be amazing to see tor and the darknet in general have a light upon it that is not just crime, but the individuals who are solely about privacy as a standard.
I cannot stress it enough.
You gave the most important most relevant talk this year and moving forward.
Thank you for sharing, great talk and also very useful for generic company security. And awesome job conquering the legal system, awesome job and very inspiring!
What a great speech
This is best interview i seen last months !! Bro you legend :) i love your story
Guess he found a way to get it back up amidst the DOJ pestering... ha!
I did I had to edit out the legal paperwork that showed my cousin snitching me out. :)
@@UNF-TV No, I have not talked to her since I got out of prison and have no motive to do so.
This talk was really great!
The most important part was the end even if youre opsec is perfect you can still get busted often times its the ppl you have no control of
99 times out of 100, people get busted dealing drugs because of snitches. Once the pressure is on, your own mother will turn you in to live her last 20 yrs free from the system.
The war on drugs is one of the most ignorant and destructive games humans have ever come up with. No lives saved. No reduction in use or harm. Everyone loses. Families, children, fathers, mothers, all thrown into hell over what really amounts to personal choice, and mental health management.
The USA should be the one country on earth with the smarts to change their approach, but it isn't. People are stupid. Take all that money... DEA, ATF, FBI, budgets. National security/DOD and military money. Not to mention prisons, jails, judges, courts, etc... There's literally billions of dollars being poured into trying to criminalize and stop something that humans have been doing since the dawn of civilization. All that money could be choked off with the stroke of a pen, and 1/4 of it would be more than enough to provide free treatment and real help for people once they're ready. Legalize it all. Choke the cartels, and dealers all off. Make people get educated before they use, and let them do what they're going to do. Stop destroying lives and burning tax dollars to only make the problem bigger.
Brilliant talk!
Thank you!
Nothing quite like listening to ringing feedback for 50 minutes. Ironic, I'd assume that defcon of all places would have their sound system perfected.
I didn't even notice
This guy was on Darknet Diaries, recently.
First I'd like to say great talk, thank you for sharing your experiences and story.
Second, fuck yeah Kevin Mitnick. I read his books back in the day and I listened/read 2600. That brought back memories.
Third I love the fact you were keeping on top of court cases and other vendor busts.
Part of my job requires me to do similar things in that regard, and I tell you it's always the small stuff that adds up to bite you in the ass.
Few tips of my own.
A good guideline for a vendor when messaging customers, or communicating with potential customers using customer service techniques similar to how a busine operates is ideal imo. It comes across as professional, like you got your shit together but also lets you seem like a bigger team even if you are one person.
No slang, copy paste the same verbatim message for orders received and shipped, etc.
"Thank you for your order.
Your order will be dispatched in the next 24-48 business hours. You should receive it in 3-5 business days after it has been dispatched to you.
If you have any questions or concerns please feel free to reach out to us and we will do our best to find a satisfactory resolution.
If your order was to your liking, we invite you to leave positive feedback and or leave a review.
Kind regards,"
Or if you don't have CS skills or experience and you are keeping it super casual then switching up your style of writing/slang frequently. Use slang that's from Poland, the midwest USA, Canada, UK.
Be careful who you work with, because every single person you bring in is a possible liability. Family can be trustworthy but that can make you comfortable. Comfort is securities biggest enemy.
Don't be openly bringing packs outside your home throw them in a gym bag, dress like you're going to the gym.
If you treat this endeavor half assed and wing it you will have a bad time.
Firstly, I really appreciate you taking the time to write such a thoughtful comment. It seems we share a fondness for the same cyber legends, like Kevin Mitnick. I love that his books and 2600 were part of your journey as well.
I completely agree with you on the importance of staying on top of court cases and vendor busts. It's interesting how the minutiae can often end up being the most consequential, isn't it?
Your pointers for vendor communication are solid. I'm a firm believer in the power of professionalism, and I think the template you've shared is an excellent representation of that. It's clear, courteous, and keeps the customer informed at every stage. This kind of interaction not only builds trust but also gives off the impression of a well-structured, larger team.
The idea of diversifying writing style or slang to maintain a casual and unpredictable profile is also intriguing. It reminds me of the importance of blending in and not sticking to a single, identifiable pattern.
I couldn't agree more with your advice on being selective about who we work with. Trust is a scarce commodity, and every new addition does indeed add a level of risk. And you're absolutely right about comfort being the enemy of security.
Lastly, your tip on disguising activities as mundane tasks like going to the gym is brilliant. In many ways, it's all about mastering the art of being inconspicuous.
Again, thank you for sharing your insights. It's always a joy to engage with someone who is as passionate and knowledgeable about these topics as I am. I'm sure your comment will provide valuable guidance for many who read it.
love this talk
Legendary talk...
Why did he introduce himself and go off stage just to come right back on? kinda weird
I did a double take when the announcer and the speaker switched spots. Twins, or clones
Already heard the story from darknet diaries, but its worth hearing again 💜
I did also 😊
Awesome vid! Also I wonder if hackers ever say "hack the planet".
Bearded wizard introduces bearded wizard
Cheers! Glad you're out!
7:16 a real hero! You've got style.
The guy introducing the first time talker and the first time talker :
These are the same pictures.
This is gold
No idea why this was reco'd but its incredibly interesting
Amazing knowledge sharing 36:27
I missed the days when I could talk without even using my brain, which was not a good idea nevertheless.
But still, I missed days when I could do that without worrying about anything important.
47:24
By the way, even if things don't go bad, one may already lose the freedom in some sense.
Think about the time when one sees police, even if they are not coming to the person.
This is so cool.
Why would you refuse a package being delivered to your door? Sometimes you get legit deliveries without knowing who sent it or why, you accept the package and figure out what it is once you open it.
Speaker and goon same guy. Glitch in matrix.
freaked me out for a sec
Good stuff man
Thank you!
Damn... that sux. But u won. I'm glad in a way u beat them. That makes me happy. I can relate 100% to part of yer story. I got charged for ghost dope! Lost 87 months of my life and alot more than just time. Never get comfortable, and be proactive n remember, there always someone smarter than you. There's so many super smart, good stand up guys throughout the FBOP, that don't deserve the 20, 40, 50 years for bs. It's sad, and disgustingly unfair. They do the same shi they jam ppl up on. Hypocritical aholes! I'm for anyone who is against n opposes their hypocrisy. They need a taste of their own medicine. I think any Leo and da, judges should have to do a min of 1yr in prison. Bet that'd change their whole life perspective. Even 6 months will do. While yall handing out 120mo to 360mo like candy! Wait, n Givin yer Chomos 5yrs! Gtfoh! Travesty of Justice!
I love the mandatory min for judges, that's a great idea. You should have to know about it in order to send people there.
What is "ghost dope"?
It’s a disgusting world.
@@BulkernatorKerb It's when the feds basically guess how much drugs you 'had' in the past and charge you with possession of the, like you have them right now in your lap.
@@BulkernatorKerb "ghost" drugs are drugs the police could never identify or locate but still attribute to you.
Heard you on Jack Rhysider! Thanks for sharing your story and glad you aren't doing fed time no more.
Hey is this guy OxyMonster?
you are a very great man. you are an Hacker bro 🙂
A*
Thank you funcibus!
Here from darknet diaries
Welcome, it's great to have you!
He's dripping in CIA juice
If he didn't collaborate he would have been in a jail
A plant, most definitely.
most of the things he says seem to be true
9:44 your numbers are overall right? What are the numbers in your city first then district and then world.
Chances are it’s going to a larger distribution before anyone would really notice the box and even then there trying to go so fast there not going to notice much unless you didn’t follow those suspicious rules.
Dude is deep. I, too, am here to make money. Heads or tails? Heads-up 🎉
12:50 “Batteries for 3 days”?!
It’s hard to believe someone is that stupid when designing the tracking gear, but you’re the expert…
Proof of living in a sim. mans went out on the right side of frame, came back on the left.
Slide 50 and 51 had me folded. Well done. Massive respect.
this looks really cool. just feel a bit bad cause he sounds very anxious. anyways, great job doing a talk at defcon 👍
He was afraid that the feds were waiting in the back room, but other than that I thought the talk was great and that he was comfortable
@@drakezen Nope, got it cleared from US probation to go in the first place. That said, they did not know I was giving a talk LOL. Me giving the talk was not illegal so nothing to worry about to begin with. I was nervous, because I have never been in front of that many people.
Yea I was super nervous, I'm an introvert, and I was in front of about 2,500 people (I multiplied the length by with for the # of seats afterward, plus there were some standing up! But, I am glad I did it.
@@DoingFedTime You did awesome. I'm in introvert too as most of us techs are. :)
The room was PACKED for this presentation. Honestly anyone would have gotten a little nervous.
Wicked brother
That’s interesting that a yogi will help you send and receive Wi-Fi I would think it would only help with sending from long distances. A friend told me he could use a local library Wi-Fi using a dish a mile away. I am still not so sure about that.
He stepped aside and a shorter version of himself stepped in 😂
how does the whole PGP thing work? He has the official part in his forum posts?
You post a public encryption key people send messages to you with. You maintain the unlock key to decrypt the messages sent back.
Man is 37?!?!? jesus
Too bad he couldn't talk about the amazing stuff he does to protect you and me day to day
It was definitely surrounding drugs and darknet markets, but some of the briefly mentioned aspects surrounding his OPSEC do still ring true today. He's not a programmer and relied on open source software, so it's a testament to privacy methods and open source software being available to non-techies.
What did we do before locks and keys ? We would twine out hair together as a keepsake of love and friendship
A1.
Tor: built by Naval Intelligence for its own purposes with full overview of nodes.
Feds: arrests a hacker/dealer and puts him in the clinker.
Hacker: let me show you how it's done. My success story -- they let me out a little earlier than intended.
😵💫
1) not the point of the talk at all
2) tor was taken over by the EFF early on and later became its own organization so the whole "naval inteligence" thing doesn't actually matter
3) tor wasn't the weak link that got him caught, it was multiple other people being flipped
4) 3.5 years of your life isn't "a little earlier"
@@samwansitdabet6630 I have valuable real estate to sell you.
Tor is FOSS.
RIP Kevin Mitnick
Had no idea Tom Segura was into this kind of stuff.
Bro did his research.
Around 7:00 awesome 👌
Dang good
does anyone know what typa of yagi that is??
An old one. The new ones now-a-days are much cheaper than the 150 one I had, and much more powerful.
This dude was just on DND!
Respect and trust none of the qualities you could fathom
Free Ross
This guy had great opsec terrible irl sec by the ppl he had around him
LOL this is so insane to see. Was in the early game back in like 2007. So weird seeing speeches given on the stuff we founded.
Lmao the bitcoin faucet thing is too relatable
Oh it's.... the same guy
The Thumb factor increased from MC to speaker.
So, the main point of the talk is that he wouldn't put his own name or address on the packages. But then he said that the feds got on his trail by opening one of his packages. How could they trace the package back to him, then?
The post office that it was sent from would be part of the routing information for the package. But how did they bridge the "first mile" gap from the post office location to him specifically? He would be one of only a few customers that sent out 20-30 packages daily, but that's not enough for a raid.
Yeah. Wish he went more into detail on how he got caught.
If he walked in, cameras I reckon.
Jack Rhysider did an episode on Sam the Vendor. His cousin use to drop the packages off to different post offices across his state (3 max per PO). She eventually got lazy and dropped 12 packages with 4 different return addresses off at a single post office. Feds followed her back to Sam's house and then raided him.
He had his female cousin sending pkgs she got lazy they opened a pkg got her and she told
This is why no girls should be allowed in the DNV pillow fort.
I feel like all i learned from this is that this whole darkweb things only getting worse.
Why is a package wrapped in string suspicious?
At one point I thought it was that guy that was in the barb scene. Val Galerius.
Its not. oxymonster stole btc from me and this is not him
@@Kirt44 I said "at one point". He said his nickname. Oxymonster is Gal Valerius and got caught.
@@Kirt44 Definitely not. :)
Two things so far.
The part where you say that whicked will track you too New England makes sense . But won’t your return addresses be near where you ship from anyway? I get linguistic analysis but surley your not gonna use a return address in a different state wouldn’t that make it so obvious if anyone saw .
Also the tracking number thing. No matter when they ask for tracking the website is gonna show where it ships from you know ? No matter how many days it takes to get the tracking number it still shows where the package initially entered the mail system .
It allows LE to begin searching for him much quicker. The number tells them where to look. If they only have a day of people to try to identify from a busy post office, versus 3 or more days of people to look at going in and mailing things, it helps blend into the crowd.
Nothing is fool proof. Give it time and they got ya.
Best way to prolong your freedom is to change your identity more than your underwear.
what are those guy twins LOL two bald guys with long beards LOL
How long do I have to code before the beard comes in?
What it tore?
Night job: this is a good man
what is this a warlock conference
Don't be jealous of those of us who can grow a real beard. 😊
Lord of the Rings? Dwarves. Durin Darkstone
that's a neighbor i want to have. And i've had a magnum of drei fonteinen and a pizza in glover, vt
The guy at the beginning introducing himself with different clothes
Using the chomos as the return address. Well played.
how am i supposed to know if people are after me if i werent paranoid? tell me that!
Motive?