[Applause]
well I'm gonna cut that Otto and I can
up hello first of all like to thank for
cantata Canyon I mean they come you like
to thank you for inviting me this year
my colleague responsible for you see
their development area so what are we
going to see today
well we're gonna look at cyber crime
detection in the daytime and nighttime
this is the Internet we know the two
sides of the same coin on the one hand
we have the surface web what we all use
work pleasure whatever and then we also
have the other side which known as
archaea and darkness and what we call
deep web and on both sides we see cyber
crimes and this is what we're going to
tell you of today precisely those
activities those recreational activities
that happen in these two sides of the
coin and how in in Seba we investigate
this crime and how we devote tools in
order to fight these criminal activities
very often we confuse our Terms
ourselves as web deep web and dark web
and this is what I'd like to clarify
with these asteroids surface where my
father's
what an internet that are accessible and
that indexed with the main searches that
are engines that we use being Yahoo etc
and then the Deep Web that's accessible
but it's not indexed by these angels for
instance the content of your email
accounts or the information stored in
your corporate networks and finally in
dark web
what is restricted and non-indexed not
indexed because can access the content
of the neck itself so we need to use a
specific and specific web Freenet our
clients or other so if we look at the
year 2017 we may highlight some events
such as everything that happened are
related to runs and when somewhere or
information leaks or issues related to
botnets and this is what my colleague is
going to start talking to you about
thank you very much I'm gonna tell you
about security issues that we've seen in
2017 and how they're related to the
subject we're treating them as to
whether they happen in daylight on the
surface web or the dark web let's begin
with a ransom aware I'm sure that you've
all heard about one a cry
petia etc and then other things that
last known but have also that have also
affected our companies and bank
institutions Eva those true that in
general they've affected Eastern
European countries mostly Russia what do
these run some away all this ransomware
a share
well the people that are managing these
this cybercrime trying to hide behind
anonymous networks network like toy here
we have examples of the typical panels
in order to rescue the files that have
been encrypted in computers and what
they share they're trying to have their
activities behind the internet this is
something that's happened in daylight in
clarity and they are hiding behind a
tool in order to hide next to the
anonymous e offered by these networks
and there's also the information leaks
every year more and more information is
being released from different sources we
have statistics a clear how since 2013
of 9 billion files have been leaked or
released from information systems or
they've been compromised and the true
problem here has to do with these
statistics we see underneath and that is
that only 4% of that information was
encrypted this means that the rest of
the information that was stolen was are
publicly accessible here we see the
evolution in 2005 2006 where we started
seeing lots of
left we see that these are balls will
start growing the amount of information
that criminals are taking from companies
is increasing 2120 or 12 until we reach
an explosion in the last three years
where there's such an amount of
registers that they don't even fit in
net so much crime that we see but
they've also got a component of a deep
with a lot of information information
from my bank account and credit cards of
this information stored in the Deep Web
were through the network such as thought
that I'm sure you all know of and
something that we've seen this year is
the botnets you may say well this
there's no new malicious activity
because we've known about many years
things are shape things like Maury
Reaper
so they try to explain and exploit the
IOT Internet of Things right now we see
an exponential increase of Internet of
devices connected to the Internet and at
the end they are being compromised by
these botnets and as we know in the case
of my ray last year for instance
you know many companies Google etc were
affected and they can be used for any
attachment from spam campaigns malware
distribution attack how many different
organizations the DDoS attacks well see
them in the surface web but these cyber
crimes for in the Deep Web if we want a
DDoS attack all we need to do is to go
into one of those well-known thought
services and with a small price you can
buy these things were sort of cybercrime
appear in daylight so to speak surface
and that let me tell you about an
investigation that happened in the
summer 2017 because this is something
that I compared the light and this
affected dot s domains that is Spanish
domains the idea was we reach out to the
maximum number of users and I'm gonna
tell you about this investigation and
what it was about the origin well first
of all it tells you about a fraudulent
dot es domain that was impersonating a
famous Spanish brand this was in the
internet in the same platform and what
it does is to set up a virtual store and
the crime itself
theft of credit cards we we were doing
this research this investigation we
asked ourselves are there more as a dome
is that occurring
the same type of activity and that's
when we started doing parallel carrying
a different a parallel investigation
okay so out of the es domains so far
from out of all of them 11,000 we
started looking for deploy design cars
so we obtained 11,000 domains with a Zen
cart and we started pulling from that
and started comparing this with the
initial domain in the research some of
these domains are detected with names
like for instance lawyer in marbella the
breeder dot yes I was
save and light Car Rental beauty and
health and our me.com dot s and police
online dot s these are just some of them
so the thing was what did they what did
all these domains share what do they all
have in common let's see for instance
our lawyer Mobilia sells some very
wonderful shoes with incredible
incredible discount 75% 80% discount and
if we move to the next one to add reader
that we all relate to a different sort
of thing you can see some very nice
shoes also at very low prices ADSL free
eye DSL what do they do they sell
sunglasses sun shades Christmas time etc
so things are starting to become
suspicious
and for instance save in electricity
women's clothes with good sales car
rental shoes to restaurant El Cortijo El
Cortijo restaurant snow equipment skis
bags etc here they have different types
of material women's bathing suit
t-shirts etc mama dog come yes
sweatshirts and the last 109 police the
es watch are they gonna sell I sell
shoes so they're here it says there's
something that doesn't fit here and we
start and then investigating and the
first thing we say is who can
investigate this in Spain so from
anywhere in the world you can request on
domains as long as there's a links in
Spain for instance legal persons in
Spain or individuals or legal or in
person or individuals related culturally
speaking or socially speaking or
economically with Spain I didn't know
much about this so I wanted to look into
this and I wouldn't do answer the
following questions which are the legal
requirements in order to open up and
open an online store in Spain so here we
came up with a smaller group and
following the first
meet the law what you have to give
information such as name number of the
registry where the business is data
protection is a paranoia professional
ATO you know typical Rosario they don't
ecomo say yes to notify the user of
where these data are going to be stored
and other things like the famous cookies
a policy and secure payment legal things
so first of all we started doing this
manually and then we did it in an
automated way an automatic way to
analyze these domains and see if they
meet these are legal requirements name
of a company registry where it is
cookies policy was missing also privacy
policy was either non-existent or in
English or the wording was strange LLP D
nothing regarding where the information
taken from users or was stored legal
things nothing
and then payments procedure credit cards
and nothing about Sakura payment but
there was more to these sites affect
more brands not only Spanish one but
foreign ones many of which I'm sure you
know many of these domains were
registered by five since who are
authorized that you register companies
in Spain and they all of these companies
said they had been registered by these
are five people ASM Istanbul you see the
open to these Naas ends energy I hosting
and also the ports twenty one twenty
five eighty a hundred and ten 3316 and
we also realized that the domains there
was subscriptions and all the signing
out always in different IP addresses
take into account the cost this entails
some of these sites are presented our SS
services and with this we were
suspecting that there was a fraud many
of these email addresses were related to
fraudulent activities so the question
was who's behind all this who do you
think is behind all this
following question that we'll try and
answer I find this in these certificates
and that take us to this server when
starting to do the analysis we see China
right away start analyzing this and
apart from these are panels these
displays I don't know whether there's
worth 10,000 or 20,000 we also find the
characters that made us start being
suspicious about the country that they
always came from when looking at
administrative contact we see these
different references Connor in 63
dot-com ye Annette Fox Mail calm and
many of them letters to Chinese domains
and many of which were fake addresses so
we started looking at the platform
security is there well since we you've
set up all this let's see if you've
really done a good job at least from the
point of view of security rescuers as
ice wise sql's
vulnerable addresses we start looking at
the mall and see a lot of a
vulnerability the web server and Apache
that Tosa presents a lot of
vulnerability and why should we worry
why worry about security come on
so summarizing what do all these domains
are shared first of all they don't
comply with legal requirements name of
the product not
we're the product as such because they
will speak about shoes clothes just
driving unsubscribing the Ministry of
contact was a fake or the domain pointed
at an age as an Asian thing no digital
certificate in order to do to to do the
purchase and here's the summary we
automate all this part of the 11000
domains we detected we see that 94% were
potentially malicious so we do did the
report in order to submit it to those
who are responsible for this but there's
always what if I pull from these
different ends what if I look into this
if I look into that and here comes the
surprise we start going into other
things and we find a server in the
internet server by these same people and
we see the structure of the directories
we have all the folders and within the
folders there is all these sub
directories with a zinc are about to be
deployed ok
not only this but it was also file dot
zip and what was in it now let's look at
off along one Zen car this is what we
find once against reference to the same
thing ok and what did this file it had
fight like this payment payment dot XML
his you see all the structure of
complete directories files the CSV over
products of the store they changed them
change the names products everything
like I said earlier payment information
information that domains once again
China database Irvin you think a version
they had deployed was also vulnerable so
once we reach this point say all we need
I need a free to give me the passwords
yes so we get to the server they've set
up all the infrastructure for part of it
conclusions
finally we got of 11,000 domains that
commit fraud all the information
obtained was handed to the authorities
in order for them to act so conclusions
that nobody's free of being a victim
cyber criminals also make mistakes this
is something this detection something
that can be automated and this is what
we did and there's not only happens in
the dark areas Verrocchio on the surface
more often than we suspected let's move
on to crime times in done in the dark
now let's move to the hidden Network
where we need a given client in order to
be able to have access once we know the
best door I to be the idea is to get
anonymity and privacy whenever we speak
about tor we always think about negative
things it seems that the whole criminal
activity focuses in a tour but what
happens in telegram or what's up who
uses a telegram who uses what's up okay
so news like this things that have
happened this year 50% gyro discounts in
stores like America Dona etc and the
idea was to
get information from users in order to
sell it or things like child sex abuse
and also ye hardest propaganda and it's
not just telegram because this expense
to the services will know Google+
Facebook Twitter YouTube by mere
assertion criminalized technology we
don't think we should make it illegal
just because of an improper use made of
technology now we move on to tour and
hand the floor over to my colleague who
is now after the knife story that friend
told us about about surface
investigation I'm going to tell you
about stories in the dark web so what we
speaking of according to these
statistics we see that there are around
55 Orion caster services that have been
active and that is the figure that we
work with officially speaking and what
lies behind these active domains well
based on the analysis we carried out
over more than 200,000 tor domains we
reach the conclusion that almost 75% of
those services hide web services just
like the ones that we can find on the
official web
the next we found where as Sh open
services and then residual share of them
which had to do with interests
instantaneous texting messages email
file-sharing services etc so this is
what tor is currently using so within
those 75% of services that are using tor
here we can see several examples of fora
that are pretty famous for example
Elysium was created in 2016 it lasted
less than a year because German agents
managed to close it because its main
subject was unfortunately sexual child
abuse
then there were famous markets such as
Silk Road or silk road abroad that were
closed by several international police
forces the spanish police forces have
collaborated the themes that the
subjects are very varied for example and
this one we have all sorts of drugs but
there are many other illegal activities
in tor
I don't want to demonize the technology
as Frank was saying but the truth is
that until we found all these sorts of
criminal acts sexual child abuse yeah it
is propaganda sale of weapons sale of
drugs and all sorts of people are using
the properties of toy that provides
anonymity in order to do this kind of
things these are some examples there are
many
and many services are only content
indexes since there are no Google style
search engines they have content indexes
so well we've blurred it a little bit
here in order to delete names and
sensitivities but the main subject in
these four are sex child abuse another
common thing in tor is the exchange of
content we have these examples these
Satoshi boxes that meet the supply and
the demand people want to sell for
example child pornography pictures that
may be of interest for some people so
they upload it to this platform they set
a prize in bitcoins and if people are
interested they just download it and pay
in bitcoins and this is what is
currently going on now in relation to
what I was saying in the beginning there
are many ransomware panels this is a
crime that takes place on the surface
and sure we've suffered as ransomware
attack at home or in our company and the
attackers actually meet and the tow web
in some cases even the web site is to
say ransomware is becoming a service it
is now very easy so that you can create
your own ransomware panel you can get
information encrypted it's really simple
on the right here you have an example
and it's really scary to see how simple
it is there are other illicit activities
for example year it is propaganda
although this isn't the main means these
people use to disseminate their contents
as they use all the channels for example
telegram whatsapp and all the social
media here we can also find this kind of
information and there are markets as the
ones we saw before markets that sell all
sorts of drugs even referring to very
well-known brands sale of weapons there
are many fora on the subject and after
analyzing all these different subjects
we can't help my one but wonder who is
behind all these hidden services can we
really know who is behind these hidden
services well yes we can how how can we
approach this how can we locate cyber
criminals well we can follow the same
procedure as for these social website we
try to find human errors as people who
are operating these services are human
beings and therefore they can make
configuration mistakes and we can also
look for faults in the information
departments systems there are no hundred
percent secure information systems so we
can try to verify if the information
systems they are using vulnerable or
maybe we can even find exploits and
usually let's take a look at some D and
animation techniques that we've used in
some operations for example the first
one we can try to look for hidden
services that due to human mistakes have
been exposed both in the Tor net and in
these superficial web and if there has
been a connection we can use services
for example Soudan in order to find the
real IP where those services are located
and then we can report this to security
forces
thus in one particular location and we
were able to disclose a hidden service
provider that had more than 2,000 hidden
services and tour will reported this to
the police services and they are cut
them because it isn't technically too
complicated another technique that we
can come across or a technique that we
came across actually was this one in
this case the onion servers its own
private key every onion service has a
private key know the to operate and tour
and they had published it in the service
so once we found it we were able to take
over the service and gain control over
it we can replace the original service
this is something that can be easily
done and easily automate eyes then there
is another technique which is about
finding information in the mail that
data and pictures we can find many
metadata that refer to the owner or and
sometimes a geolocation information so
we decided to do the same in the Tor
network so analyzing all these markets
and the million images that there are
inside of them 126 thousand we found 229
of them that contained information in
their metadata it's a small amount but
it is a first hand in order to help
people operating this kind of services
now going beyond the human error we can
look for faults in the information
systems used for these services here we
realize that they use the same things as
in the surface Drupal Joomla
WordPress PHP bb3 software to set up
shops such as world commerce or thank
God so this is software that is very
well known sometimes free software that
is community audited and there are also
information leaks we can see that
freedom hosting the largest server in
the dark web was attacked by Anonymous
and this way they found out that they
had more than ten thousand domains and
tor
so this hits tour very hard the main
subject of all those ten thousand
domains fifty percent of them more or
less were devoted to child sex abuse so
thanks to that more than eight hundred
databases were published with user next
messages from our public and private for
emails and hashes from user passwords so
we analyzed all the information and what
was relevant was reported to our police
forces a few more operations that took
place throughout this year had to do
with our fab a hence closing this child
pornography forum in Germany so there is
a lot going on in tor so what are the
conclusions that we draw from these
analysis well
the hidden web isn't as dark as it looks
we realize that those behind it are
normal human beings they make mistakes
and we can be attentive trying to
disclose them
they use the same systems as in the
surface and the systems may have
vulnerabilities so our goal is to look
for them in order to disclose them and
then the last conclusion is that the
detection of cybercrime may sometimes be
automated and here is we where we take
apart so now what
after all these cases with all this
investigation how can we have our police
forces to arrest people behind these
services do we increase our resources
well we have great police forces in
Spain but they don't have endless
resources in order to investigate this
kind of thing 100 percent of the time so
what can we do automatize this is
something we are very good at and then
see them all of these techniques that
we've talked about on the deep web and
on the surface are potentially
automatize able since we develop
cybersecurity tools we decided to take
all the knowledge that we get from
police forces and that we get from our
own investigations and we turn them into
tools that make their work easier so
we've developed for example this tool
but you can see on the screen a tool
that crawls all the services and the toe
where in order to obtain relevant
information here there are some tags
this filter this well the screen was
filtered out with the drug subject so
here we have them ordered and
categorized so that we can
act on these behaviors everything is
automatic all the phases sometimes are
in Syria we know how to build this
software mostly most of us are engineers
but at some point we don't have enough
knowledge in order to do it in this case
we hire specialized research teams that
analyze the texts and tor services the
images can be used in order to obtain
valuable information so these teams help
us categorize and prioritize that's why
the investigation sort of services that
are running insightly dot onion inside
the hidden services and we show it in a
screen on a screen such as the one you
are now watching here we can see whether
it is it what service if it has SSH
ports if there is a file exchange
services of if there is an email service
behind a messaging service behind all
the information that we used to obtain
manually can be easily automate eyes and
prepared in tools for agents to use this
is the labeling part that I was telling
you about before here we have a almost
one category for each time of each type
of cybercrime with the algorithms we got
from the research team managed to
automate eyes them all areas of action
of the police forces can be categorized
as you watch on your labels we have if
we've been able to disclose the service
or not with the techniques that
we've mentioned we can label a service
if we are able to find out the IP or the
person was behind the service if it is
in Spain we also label it we label it
also if it's in Siebel related and if it
is vulnerable also we perform a light
search of the vulnerabilities that these
sites may have so vulnerable the
detection and disclosure all these
techniques have been automatic to be
used in this tool for example obtaining
Internet domain this is what I was
referring to before we try to find
services that have one leg in the
superficial and and all the one in the
Tor web or net since we are crawling the
Tor net we try to obtain any additional
vulnerable information that might be
useful for example we have this piece of
news say in eleven people arrested in
Spain for distributing child pornography
through whatsapp so this happened
because we found a link in tor - what's
up so we followed those links - what's
up it can be what's up or telegram and
here we can detect illegal activities
obtained all sorts of information
telephone numbers account numbers links
to Facebook or Twitter in case we can
relate to profiles with social media
profiles emails and all
the information that may enable us to
disclose the people behind tourist
services and not only the people who
have created them but the people who are
using them because this may be offenders
as well we try to obtain our Bitcoin
wallets github links this is also very
important because sometimes evil tools
which are used in tor being more natural
that you find these tools and the links
to telegram and what's up what is the
goal the goal we are after is this to
manage to take down as many child
pornography services as possible or to
seize firearms or to perform operations
disclosing people behind money
laundering operations and things like
that this would be our goal and how do
we do that we take advantage of the
knowledge of our police forces who are
experts in analyzing this kind of crimes
we provide our capabilities we develop
tools and automate eyes these operations
with the aim of making a safer cyber
space and a safer world so thank you
very much and please if you have
questions do not hesitate to ask them
[Applause]
okay when it occurs which magician must
I guess I thank you so much guys there
is one question I have one doubt once
you know there is a servicing tour and
you've been able to evaluate it what
evidence do you need you know that you
prosecute somebody okay you disclose
that person if if you are able to get is
that enough to prosecute that person is
that enough to put them behind bars what
do you need more information no that's
not enough when we get that kind of
information that information goes to the
police services and its police forces
who launched the investigation and go
after the person is operating we don't
really violate those services inside at
all
what we do is report we report there is
this service and tour we've detected
that we use this software and we've
detected that they may have
vulnerabilities or exploits but we don't
tolerate or violate those services as we
aren't allowed to do it but we do report
police forces so that they take any
measures they consider effective but do
you need what kind of information or as
needed in order to put these people
behind bars I know that this is
something that police forces have to do
not you well imagine we find and neck in
a child abuse forum and we are able to
link it to a Nick on Facebook or Twitter
if there is
strong evidence and a strong
relationship that they can dig in well
they cannot investigate the dark where
but they can go to Facebook or Twitter
no to find out more about that profile
and if they find that this could
potentially be the same person that can
be useful in order to arrest that person
we tried to give them all the valuable
information that we believe may be valid
to launch investigation I don't know if
I answered your questions yes thank you
very much I need further questions
thank you
you