OPSEC Guide: How LE Target Darknet Users

The Dark web was created as the number one gateway for users to remain private on every single occasion, without any need for an exception. Unfortunately, as we move into a more technically advanced and tech-focused age… Remaining totally anonymous online is virtually impossible. But getting the right OpSec makes your anonymity possibilities spread wide. 

There’s a saying in the Darknet Community…  “OpSec is a state of mind, not just a checklist.” This article will focus on Law Enforcement social engineering tactics. We’ll look into never-ending efforts to de-anonymize darknet users and how you can work on it. 

Law Enforcement Heightens Focus On Vendors

As the digital age progresses and darknet markets change, law enforcement are still working on how to handle criminals who choose the online package. Until now, their focus has always been to take down darknet markets. Although they’ve captured hundreds of vendors, taking down a darknet market was always a greater victory and almost seen as a more effective way to mitigate the online black markets. 

However, it’s become clear to LE that attacking the users and vendors is a much more effective method for slowing the use of darknet markets. Capturing a major Darknet vendor has a greater impact than taking down an entire marketplace. 

This means that there’s going to be a shift in focus for the FBI. They’ll be finding new methods and using different psychological warfare tactics to sniff darknet vendors out. 

LE Manipulation: Social Engineering

When interrogating and handling a criminal of any sort, the LE agent is often trained in the art of social engineering. This is especially true for those who have covered their asses well enough with some decent OpSec.

Typically, LE will use Social Engineering tactics as an art to manipulate “Suspects” into revealing information they do not have. It’s a version of psychological warfare used to exploit that weak point… our minds. But understanding these tactics means you could counter them and work against them. 

Trojan Horse

One of the most common tactics used by LE is the Trojan horse. I’m sure you know the store. Greeks fought the Trojans, and the Trojans were too strong, so the Greeks created a large wooden horse with a couple of their finest soldiers inside of it. This Trojan Horse gift looked like a genuine offering but became the instrument of their victory.

Once the people of Troy let their guards down, the soldiers within the horse escaped and opened the gates allowing the Greeks easy entry and the possibility to end the war overnight.

Similarly, this act of a gift to break down our walls takes place often both in interrogations and, of course in the cybersecurity world. Calculated steps are carefully orchestrated to manipulate and breach a barrier. Case and point Silk Roads, Ross Ulbricht.

Ross Ulbrichts Trojan Horse

Should you keep to all your typical OpSec, you will remain anonymous while using darknet at all times. But LE used these psychological warfare tactics to de-anonymize darknet market buyers, vendors, and admins.

They’ll use psychological manipulation and deception to get the user to reveal nuggets of identity online. That includes impersonation, pretexting, and elicitation to deceive their targets. It’s not so much a “Honey pot” but more of a personal level way to extract valuable information that can lead to identification and apprehension.

Case and point, Ross Ulbricht… the mastermind behind Silkroad and the person many people tout as the reason Bitcoin is so valuable today. As we all know, Ulbricht was apprehended in 2013 by law enforcement after some failed OpSec. However, an undercover agent named Carl Mark Force IV found a key piece of evidence. Mark infiltrated the operations of Silk Road and gained Ulbrichts trust. 

The DEA agent spoke to Ulbricht under the name “Nob” and posed as a high-roller drug vendor looking to join the website. Over time Nob was even given administrative roles on the Silk Road. 

One of the first messages sent to DreadPirateRoberts was the following.

Mr. Silk Road,

I am a great admirer of your work. Brilliant, utterly brilliant! I will keep this short and to the point. I want to buy the site. I’ve been in the business for over 20 years. SILK ROAD is the future of trafficking.

Sincerely,

Nob

DEA Agent “Force” sent this message on his undercover laptop to send this message, and… well DreadPirateRoberts bit the bullet.

The day after Nob’s proposal, DreadPirateRoberts wrote, “I’m open to the idea. What did you have in mind?” This automatically opened doors for the LE to speak directly to the man in charge of the world’s largest and most influential darknet marketplace.

A trojan horse is the main tactic used, but LE has a few tricks up its sleeves. 

• Befriending: LE will do its best to “sympathise” and essentially build a friendship with a target. We’re all wired to want a connection with somebody who understands our situation. Darknet users can’t exactly speak to their friends and family about their anonymous work, but doing so online and making a friend with an LE agent would feel like a better option, wouldn’t it?
  Generally, law enforcement pretends to share their ethos, common interests and life experiences.
• Flattery and ego stroking: Grabbing vendors by their core and complimenting orders and work as a way to create a connection. LE will touch the target’s ego and open the door to sharing information as the vendor could try and further impress his new “friend.”
• Phishing: Typical, but it works well enough. Law enforcement will send some calculated messages with malicious links, attachments, or requests for information. For vendors and users who don’t take their OpSec seriously enough, their curiosity will get the better of them, and enough information should be leaked to start a solid case and apprehend said user.

Being Aware Is Your Solution

The only way to defend against these various social engineering tricks LE use is to by being vigilant and follow basic OpSec. LE will happily take months building relationships with their targets, waiting for the slip-ups. This goes for buyers and vendors.

If you think that law enforcement is not interested in buyers, you are sadly mistaken. Sometimes if they establish that a buyer has been purchasing from a vendor that they are after, then busting the buyer can help them get to the vendor. They may take over the user’s online identity and start ordering things from vendors since he already has established trust with these particular vendors. If the vendor slips up because of the trust built up with the buyer, the vendor is in trouble.

Follow simple rules like never sharing your personal information, even if you think you know the person you’re talking to. 

Six Basic Rules to Maintain OpSec.

Rule 1: Share no personal information

It’s not difficult to understand that your usernames, passwords, etc should have no tie to your actual identity. Yet this is how hundreds of darknet users are captured. Take a look at Operation SpecTor, over 280 vendors were captured for poor usage of their information

Don’t use the same pseudonym on multiple websites, make sure your pseudonym doesn’t correlate to your nickname/ real name/ or initials in any way. Keep your passwords unique, rather lose an account than tie multiple to your identity. 

During forums talks etc, don’t give out anything about yourself. No dates of picking up something, don’t mention where you live. Don’t even share what movie you watched on Netflix last night. Any bit of data on you could play a critical piece in a puzzle and case against your identity. 

Rule 2: Use encryption for all communications:

We have a very useful PGP tool, you can load the page, and disconnect your internet before you start encrypting if you like. We also have a guide to PGP encryption so you can make sure you’re doing it the right way. 

Make sure everything you say or do on the darknet when it comes to communication is full encrypted. This way no message is intercepted, read, or manipulated by external adversaries of any sort… including law enforcement. The same is true for any other channels of communication you may use, such as jabber, and you should always use encryption protocols. 

Rule 3: Never click unverified, random links/attachments

Pretty simple but you should always cross-verify all links to make sure you’re on the correct websites. Honeypots are real and effective enough for Law Enforcement and others to continue creating. 

Basic OpSec is understanding how phishing attacks work, but if you aren’t putting enough thought into every button your press you can open up a trojan, or dubious file that will infiltrate and knock down all lines of defence. 

You may have heard certain popular darknet websites being called honey pots, or that there’s been an LE takeover (which is what happened to Monopoly.) It could happen to any website no matter the size. LE are happy to use this to their advantage and compromise additional data to gather intel on certain targets. 

I should go without saying but, before clicking on any links or downloading any attachments, always use caution and confirm legitimacy. 

Rule 4: Dedicated Device

Darknet vendors have been saved simply because they were safe in their operation and used TailsOS. TailsOS is simple to use, and could keep you from many headaches. 

If you sticking to all other forms of OpSec and only a specific device, or specific OS to access the darknet and run your operation, you’re not going to open doors to compromising your information in other ways. 

Additionally Tails will prevent your ISP from knowing which websites you’re using, but they can see that you’re connecting to a TailsOS server. Tor will do the additional work in hiding your IP. 

Essentially you’re Separating your darknet activities from your identity in real life. This approach increases your overall security by making it harder for attackers to connect your online devices to your real identity.

Rule 5: Use Mixers/Monero

Monero is the ultimate privacy for good reason, and it has it’s own mixing service build directly into it’s code. The team have done amazing jobs to ensure it’s the most secure and privacy-based token system out there, hence the reason it’s outgrowing Bitcoin as the go-to option on the Darknet. If you can operate only through Monero, then that’s best option to take. 

However, some people may prefer to deal directly with Bitcoin, and there are some solid alternative coins from Monero to choose from. It’s possible to use open-ledger platforms and still work out to be safe, you just need to take additional steps. 

Always wash your tokens using Bitcoin Mixers (see our sidebar) or even exchanging the token into Monero, and back to Bitcoin. 

Rule 6: Paranoia is Good

You bet your ass that it’s better to be safe than sorry. Adopting a mindset of healthy paranoia is necessary when operating on the darknet. There are countless opportunities that could turn your private life into a legal system battle. Double-check every source, even this website and be wary of everybody who tried to gain your trust.