the job as an investigator or as an
investigator your job is to find details
associated with the suspicious crime so
it's the fact that bitcoin is still the
most widely used crypto currency today
to facilitate cybercrime both on the
dark net and otherwise so we will focus
on Bitcoin and how we will trace a
sample transaction we will look at the
sample case
so as an investigator your job is
actually to find all the entities
related to that particular crime
hostname IP address email address in
order to find out who is behind the scam
or the crime so we also our job isn't
also to document all the findings and
she can help us make the case so we do
not rely on expensive software we should
know how to do this kind of tracing
ourselves as well so we will look at
[Music]
that hole we we will look at how to
validate the address and confirm the
address balance and we will look at
different tools which we can use to find
similarities in the crime
okay so we start by validating the
address we have a suspicious address on
the Bitcoin blockchain so there is a
tool which will allow us to check the
address to find out if that particular
address is valid address or not we don't
know sometimes there is an address which
would not be a valid Bitcoin address so
the first thing we do is to figure out
if it is actually a valid address or not
so then we confirm the address balance
we will put rest balance in and see what
what is actually going on with the
transaction so we see that there are
multiple addresses so there is another
tool as well just called betreff and
this allows us to if you want a user
friendly user-friendly view we can just
put use this tool which will allow us to
see we're still trying to confirm the
transaction so we put in that address
and we can see the date and amount which
is sent and what the balance is so this
is more of a user friendly tool if you
don't understand the more complicated
blockchain X coders you can use this
tool so in this case we see that we have
a few different dates and see that
amount has there's a - Mountain there is
the remaining balance okay so the
Bitcoin address report Bitcoin who is
who is another tool that will show us
more information about particular crime
we see that that is receipt we see the
current balance sure yeah we can see
that that this is the address and this
is the name of the wallet this is in
hexadecimal format now we see their
current balance so and here we see the
number of transactions we see the first
transaction and we see their last
transaction here so we also see that the
website appears nine times so the total
received amount on this address we can
see here and you also see the last
transaction IP it's like one two three
four heipiess that that are involved in
relating this transaction okay
so this is a useful tool yeah yeah by
checking that address we found that
address appears on multiple websites
that have been involved in the scan so
from here we already have a lot more
information about what is going on
[Music]
okay so have six P Doric using that
service we can actually link
transactions together and filter out the
most common senders and the related
receivers so we see the more four most
common senders and four most common
receivers and the two most common
sending siblings and seven most common
receiving siblings so using hash XP we
can find out more about their related
transactions so the address you're
checking is actually here as you can see
okay then you have the famous Bitcoin
blockchain Explorer this is the most
used program actually tool because they
parent the every transaction on the
Bitcoin blockchain will be recorded on
the public option so we can also see the
transaction here the total received
amount and the final balance okay so as
an in as an investigator we need to find
out even more information about related
domains so what is actually passive
leanness passive dns is a database that
saves all the dns lookups if for example
some malware have been using an address
sometimes the attackers change the DNS
which is used only that only on that
specific mother campaign then David
after that they will change back again
to try to obfuscate the domain which
they used for relaying their
or delivering the Muellers there try to
temporarily use a specific DNS name then
they will change back for example here
so but when we have this passive DNS
database we can go back and look at
which malware was actually using that
domain back in time okay
mmm only passive DNS service and that is
a service which provides us with the
database containing the DNS records of
the IP addresses so okay in this
particular case we see that that this
this domain was used in the malware
campaign so we see that last transaction
the date which it was and a record
indicates that when issues websites has
been used for the scan so from that we
find if we found out that Eric or points
to specific the Adina's Atlas which
appears ten times so what is why is this
important it's important because we can
relate we can relate the Bitcoin crime
to a specific host name so we know that
this smaller has been delivered from
this from this could have been delivered
from this domain we don't know for sure
but our job is to try to find out
okay so we checked who is that who is
record in this example we are checking
this address which suffered ten times in
the Pasadena's report and we saw that
domain is hosted on this IP which also
hosts two other sites so if we want we
can also contact the abuse department so
we know that this domain belongs to this
person who is a developer of Bitcoin
mining software so this is a resistant
number of questions did the malicious
Bitcoin address relations using one of
those servers or was this person
involved in the crime or not we don't
know
okay so we will come back to that BGP
view is another tool which we can use to
find out who is the ISP of that
particular IP address okay so when we
are working with forensics we will try
to find the related domains so what we
do is we take Bitcoin address and use
the onion scan tool the onion scan tool
will it will actually scan scan the
darknet for the darknet address to see
if that bitcoin address is used in in
that in that
- mine are not so so onion scan looks
for more more things like what class to
look for the most common cryptocurrency
clients and it will also extract the
Bitcoin address it will find which email
addresses are there and we will look at
the images on the darknet site and it
will try to find out metadata so many
times scammers on darknet they forget to
remove the active information in the
image the EXIF information in the image
can contain the GPS location which is a
badge is bad for the for the attacker
from there you can actually pinpoint
from where the exact location that
sucker operated that dark net markets or
that scam
so using that tool we can also look for
dark net sites to see if we have a
Bitcoin address if it's been involved in
the dark nets on that side
okay so search engine investigation so
when we we found that domain we had was
the developer behind that well he's a
Bitcoin developer he calls himself
- Jed jay-ar so we tried to find more
information about him on social media so
just go with him and you'll see more
about know about him
so we also check that on Facebook and
LinkedIn we also for more information
about mercy but still we do not have
enough evidence to conclude whether he
was intentionally involved in that crime
or not but our indication points to that
one of his domains was used to
facilitate that cybercrime okay so the
next tool box we also took the dot IP
which we know which we knew that he was
involved in some crime and looked at up
on MX toolbox and that gives us some
information that that particular IP was
already on a blacklist
so yeah here we see the blacklist so
that means that the the scam or was has
been well it can indicate that it has
been delivered using
a mail server which later on blacklist
and someone somebody reported it as a
scanned and it came blacklisted
okay spy talks that is another tool and
we can actually search for persons it's
like a Yellow Pages spy talks will give
us information on possible persons who
has a specific email address so that's
another tool we can use to aid
investigation okay so identifying the
walnut so we can use a tool which is
called wallet Explorer it uses a basic
algorithm to determine the addresses and
it and linked them so if we have an
address we can know if it has been spent
in another transaction or not it will
link possible really link possible
transactions together so that means two
transactions or addresses actually they
will be they could be part of the same
moment
yeah same example here we have the
address we have the date and we have the
amount put the sent and received and you
can check each transaction okay yeah it
is possible that the suspect is using
multiple wallets as well often there are
multiple addresses which are generated
from one single wallet because most
crypto exchanges can generate a new
unique address which will link to the
same wallet so even if the attacker is
using a new unique address it belongs to
the same so politics Pro Explorer who
the guy who made wallet Explorer
actually now works for this company
called chain analysis ok
the oxt not me that is another tool we
can use to look up the Bitcoin address
and the benefit of using this tool is
that it will actually give us a graph
graph which will show us the incoming
and outgoing transactions so yeah
something here is a possible wallet name
the information is basically the same
which we will find in the blockchain
score but
here we can have a visual visualization
of it so it could be useful even if we
want to use that in my report test
report we can visualize the crime so it
also gives us the dates so we can see
when that activity was higher and it was
lower okay and we also have alt coins
which are actually other coins or
cryptocurrencies
one of them is gigabyte did you bite it
is used as an example only so what we do
is we search for the address on
digibytes blockchain Explorer which
gives us that this address belongs to
the Beatrix exchange and the Beatrix
exchange contains this amount of
gigabyte so and we also have the
addresses which correspond to that
moment
yeah so sometimes a larger walnut in
Spanish change and that and from there
we can know that if the attacker is
sending altcoin or some coin to an
exchange we can go directly to the
exchange and get the information about
the user from the exchange because most
exchanges will ask for identification
documents yeah so decentralized
exchanges most so-called decentralized
exchanges are not actually decentralized
they are actually hybrid exchanges which
means that they have a coin gateway
which connects to another blockchain so
the coin gateway which means that if
you're sending Bitcoin to this
centralized exchange it is actually not
decentralized it is using a coin gateway
to send that Bitcoin on the Bitcoin
network so the coin gateway will have
some sort of chain analysis software
easily and that will check the
transaction if that address is listed in
some scam if it's a blacklist address or
not so so they're based on the new rules
that will apply to crypto currency
exchanges it's our recommendation for
the g7 countries all exchanges have to
not only carry each users information
when a transaction is moving from one
exchange to another but they also have
to store they also have to store that
section four I don't know the exact
amount of time back but they have to
store it for some time so they can go
back and see who has sent the money yeah
the KYC is now being rolled out to
decentralized exchanges as well okay so
what are p2p exchanges p2p exchanges are
actually peer to peer exchanges they're
not well I can say that they are more
decentralized you can say that they are
truly decentralized because no third
party is involved so for example we have
disk using disk we can send the you can
you can actually buy and sell Bitcoin
directly over the Tor network but even
if you are using bisque it is still
possible to figure out some information
about the transaction so that is
possible because there are certain
patterns you can refer in the traffic if
we were to intercept the tour conduct or
traffic or communication and we can look
for certain pattern patterns and find
out more about that particular
transaction some of them are listed here
yeah
so yes there's an example if you can
write small tools to detect traffic
inside bisque Network but we still will
need to set up a fake tor node or
intercepted traffic in order to be able
to detect that and that Bitcoin
transaction is coming from
abyss cloud yeah
so let's go further yeah okay so there
is a challenge with tracing the Bitcoin
blockchain so the first thing is that
privacy coins for example Manero
they're sending they're sending they are
actually obfuscating the amount which is
sent so we don't know it's very hard to
trace vulnerable transactions but still
malaria is not widely used on the
darknet it's still Bitcoin and conjoin
so co enjoyin is a technique which is
used by Bitcoin what is not part of
Bitcoin but using Oh enjoying our wallet
you can actually muster it the traffic
you can mix the traffic so you are not
able to determine where the which path
the traffic has taken so coin join is
used to bypass software like chain
analysis
so here we have an example of a
transaction which is without conjoin and
here we have an example of a transaction
Bitcoin Juran kwangin basically mixes
the transaction so it breaks the links
it breaks the link in the Bitcoin
blockchain so you cannot know exactly
which part a transaction has taken so
but there is another thing with Cohen
join if it's not implemented properly we
have had some wallets like wasabi wallet
which used the UT EXO the unspent
transaction output then the
implementation of coins oh and is not
that good so we can still detect that
transaction because some of the actually
the mix is not done properly that's the
reason so would a samurai wallet is
actually the one that implements
conjoined in a way that makes tracing
the origin of the transaction very hard
on the Bitcoin network so and there's
another thing with the private fool node
if you run your own Bitcoin private firm
node you also achieve privacy so for
example if you are using disk with your
own profitable node that also helps to
from a privacy perspective to make it
harder to detect the transaction and we
have the Lightning Network which is
coming lightning Network is a second
layer protocol it will maybe add some
privacy futures in Bitcoin but we don't
know when so but most probably it will
be optional privacy features in Bitcoin
that are that is coming in future
so we don't know when so that would also
make it harder for us to I'm trying to
trace the origin of a transaction yeah
so the users who don't around their own
footnote are also exposed to privacy
leak this is from the basic
documentation and that there was
actually a bug there so so our full
spying node will find out easily that
all the addresses created by their
wallet are from one wallet and belongs
to the same owner so we can actually set
up a fake full node on the Tor network
to spy on the bits of traffic so I don't
know if it's done already or not but
there is vulnerability as you can see so
even when using risk or other
decentralized exchanges it still leaves
traces on the blockchain so you can
still find out information okay so by
combining the chain analysis with
passive dns and alternative coin wallet
explorers and darknet we can get a
forensic evidence and relate different
crimes so I've shown an example of a
case earlier where I used this technique
but we need usually we need much more
information than that to actually
determine if someone is actually behind
that crime or not but it will lead us a
long way by combining the information
using open source tools yeah that's what
I had actually
so I found any questions I can yeah open
for them