![\"\"](\"https:\/\/i0.wp.com\/ramonaleone.com\/wordpress\/wp-content\/uploads\/2021\/04\/DUW-300x100.jpg?resize=300%2C100\")
<\/p>\nBy nachash (nachash@observers.net)<\/p>\n
<\/p>\n
[The advice in this article can be adapted to suit the needs of other
\nhidden services, including ones which are legal in your jurisdiction.
\nThe threat model in mind is that of a drug market. The tone is that of a
\ngrandfather who is always annoyingly right, who can’t help but give a
\nstream-of-consciousness schooling to some whippersnapper about the way
\nthe world works. If this article inspires you to go on a crime spree and
\nyou get caught, don’t come crying to me about it.]<\/p>\n
You’ve decided that you’re bored with your cookie-cutter life of working
\nat a no-name startup, getting paid in stock options and empty promises.
\nYou want a taste of the good life. Good for you, kid. I used to run a
\nfairly popular hidden service (DOXBIN) that was seized by the FBI after
\n3 1\/2 years of spreading continuous butthurt, then subsequently
\nrepossessed from the feds. Because I managed to not get raided, I’m one
\nof the few qualified to instruct others on hidden services and security,
\nsimply because I have more real-world experience operating hidden
\nservices than the average tor user. In other words, very little of this
\nadvice is of the armchair variety, as you’ll often find in abundance the
\nInternet. But enough about me. Let’s talk about your future as an
\ninternet drug lord.<\/p>\n
First things first, you need to cover the legal, historical and
\npolitical angles. Read up on various drug kingpins and cartels from the
\n20th century. Learn everything you can about how they rose and fell (
\nyou can safety ignore all the parts about intelligence agencies backing
\none drug cartel over another, because that’s not going to happen to
\nyou). Once you’ve got a good command of that, read everything you can
\nabout busted drug market operators and branch out into cybercrime
\ninvestigations as well. It wouldn’t hurt to make yourself familiar with
\nlaw enforcement and intelligence agency tactics either. You’ll find that
\nvirtually all drug kingpins either get murdered or go to prison. Let
\nthose lessons sink in, then find a good drug lawyer and make plans for
\nbeing able to pay them when The Man seizes everything you own. While
\nyou’re dreaming big about making fat stacks of fake internet money, do
\nsome research on Mutual Legal Assistance Treaties and extradition treaties.<\/p>\n
Mutual Legal Assistance Treaties (MLATs) are self-explanatory. Country A
\nwill help Country B do whatever it takes to aid a cybercrime
\ninvestigation should some aspect of the crime bleed over into Country A.
\nFigure out which countries don’t provide legal assistance to your
\ncountry in these cases, then find hosting services that are based there.
\nYou’ll shorten this list by determining which hosts allow tor, or at
\nleast don’t explicitly forbid it in their Terms of Service (you don’t
\ncare about exit bandwidth. You just want relays. Remember this for later
\nin the article). Last but not least, sort out which hosts accept payment
\noptions that don’t make you sweat bullets over the fact that the NSA has
\nbeen monitoring global financial transactions since at least the 1970s.
\nYou will want to avoid any host that advertises itself as bulletproof —
\nthey’ll probably kit your box and siphon everything of value, in
\naddition to overcharging you for the privilege of running on older
\nhardware — and any host which sells a cheap VPS and promises to
\nguarantee your privacy.<\/p>\n
Extradition treaties mean that if you’re in Country A and do something
\nthat makes Country B want to prosecute you, Country A is most likely
\ngoing to give you a one way ticket to Country B. If or when your box
\ngets seized and you know the heat is on, you’re going to want to beat it
\nto a place that won’t send you back, where you will presumably live out
\nthe rest of your days. Just make sure you’ve made enough money to grease
\nall the right palms in your new life, or the road ahead may be extremely
\nbumpy. If you’re smart, you’ll permanently move to this country well
\nbefore you have any trouble with law enforcement.<\/p>\n
One last thing before moving on: Don’t be so stupid as to attempt to
\nhire a hitman to kill anyone. Murder-related charges have no statute of
\nlimitations, which means you won’t get to write a tell-all book about
\nwhat a sly bastard you are when this wild ride is a distant memory. If
\nyou’ve reached a point in your new career where murdering people makes
\nsense, it’s time to walk away. Don’t get corrupted like Dread Pirate
\nRoberts.<\/p>\n
This section tries to be as operating system independent as possible.
\nYou’ll want to consult the documentation of your OS for specifics. The
\ntechnical side of running a hidden service and not getting owned by cops
\nis a lot harder than just installing stuff and crossing your fingers.
\nThe recommendations in this section WILL NOT protect you from 0days in
\nthe wild, but should help somewhat with damage control. Remember, if
\nthey want to own your hidden service, it will probably happen eventually.<\/p>\n
Before you even think about installing bitwasp and tor, you need to
\nreally understand how tor works. Go to freehaven.net and read the white
\npapers until your eyes glaze over, then continue reading until you’re
\nout of papers to read. Pay particular attention to the hidden service
\npapers. If you feel like you didn’t understand something, come back to
\nthat paper again when you have more knowledge. A lot of the papers
\nexplain some of the same concepts with slight differences in the intros.
\nDon’t skim over them, because you might read someone’s rewording that
\nwill clarify an idea for you. Check back with freehaven regularly. Once
\nyou’re up to speed, a good next step is to keep up with the tor
\nproject’s mailing lists. [1]<\/p>\n
While you’re doing all of this reading, it’s (mostly) safe to go ahead
\nand install tor on a box on your local network, purely for
\nexperimentation. Keep in mind that the NSA will start scooping up all of
\nyour packets simply because you visited torproject.org. That means don’t
\npost code questions related your drug market on Stack Exchange, if you
\nwant to avoid giving The Man morsels he can use for parallel
\nconstruction. Once you’ve gotten hidden services working for http and
\nssh, you’re going to take the first baby step towards evading casual
\ndiscovery: Bind your hidden services to localhost and restart them.<\/p>\n
The next step in your journey towards changing the drug business forever
\nis to grab the transparent proxying firewall rules for your operating
\nsystem to make sure they work. [2] They will guard against attacks that
\ncause your box to send packets to a box the attacker controls, which is
\nuseful in thwarting attempts to get the box IP. You may wish to have a
\nsetup similar to an anonymous middle box, preferably without public IPs
\nwhere possible, so if your application gets rooted tor isn’t affected.<\/p>\n
Speaking of applications, do everything you can to ensure that the
\napplication code you use to power your hidden service isn’t made of
\nSwiss cheese and used bandaids. To protect against other types of
\nattacks, you will want to identify any pre-compiled software that your
\nusers will touch and compile it yourself with hardening-wrapper or it’s
\nequivalent, plus any custom flags you want to use. If you keep
\nvulnerabilities from the application and server to a minimum, your
\nbiggest worries will be tor-related.<\/p>\n
You will only connect to your production box via a hidden service. It’s
\na good idea to get into that habit early. The only time deviating from
\nthis pattern is acceptable is when you have to upgrade tor, at which
\ntime you’ll want to have a script ready that drops your firewall rules
\nand unbinds ssh from localhost just long enough for you to login, do the
\nupgrade, re-apply the firewall rules and bind ssh to localhost again. If
\nyou’re not ready to deal with the latency, you’re not ready to do any of
\nthis. Don’t forget to transparently proxy the machine you use too, so
\nyou don’t slip up by mistake.<\/p>\n
On the subject of the machine, you need to automate the process of both
\nsetting up your hidden service and of destroying it. Proactively change
\nservers every few months, in order to frustrate law enforcement attempts
\nto locate and seize your site. Your creation script should install
\neverything your site needs as well as all configuration files. Your
\nclean-up script needs to destroy all evidence, preferably with a tool
\nlike srm.<\/p>\n
Regarding time-related issues: Always select either UTC or a time zone
\nthat doesn’t match the box’s location. You will also do this to the box
\nyou use to interact with your hidden service every day. If you read the
\nwhitepapers, you will probably note a recurring theme of clock
\nskew-related attacks, mostly directed at clients, in some of the older
\npapers. Tor won’t even start if the clock skew is off by too much.<\/p>\n
If you want to have some fun at the expense of business in the short
\nterm, intentionally take your service offline periodically in order to
\nmess up attempts to match your downtime with public information. If
\nyou’re the kind of person with access to botnets, you could DDoS
\n(Distributed Denial of Service) some provider at the same time on the
\noff chance that someone might connect the dots. This counter-measure
\nwill only work on researchers looking at public info, not nation state
\nactors with an ax to grind.<\/p>\n
I’ve saved some of the hardest stuff for the last part of this section.
\nIt’s hard because you have to make choices and it’s unclear which of
\nthose choices are the best. It’s a bit like a Choose Your Own Adventure
\nbook. In that spirit, all I can do is lay out the possibilities in as
\nmuch of a Herodotus-like way as possible.<\/p>\n
One thing you have to consider is whether you want to run your hidden
\nservice as a relay or not. If it’s a relay, you’ll have extra cover
\ntraffic from other innocent tor users. But if your relay goes down at
\nthe same time as your hidden service, it will be far more likely to be
\nnoticed. Federal criminal complaints make a big deal of seized hidden
\nservices not being relays, but three relays were taken down at around
\nthe same time as Operation Onymous, so that’s not a guaranteed defense.
\nThe choice is yours.<\/p>\n
Remember when I said to take note of hosts that don’t ban tor outright?
\nThis is the part where you give back to the community in the form of tor
\nrelays or bridges. [3] The feel-good aspects of this move are along the
\nsame lines as drug barons who build schools and hospitals, but this is
\nmore immediately self-serving. You’re going buy several servers to set
\nup strictly as relays or bridges, then configure your hidden service box
\nto use only those relays or bridges to enter the tor network. Here’s
\nwhere things start to get theoretical.<\/p>\n
If an adversary is running a guard node discovery attack — in which an
\nattacker is able to determine the node you’re using to enter the tor
\nnetwork — against your service and you’re using your own relays as
\nentry nodes, the damage they can do will be limited to DoS (Denial of
\nService) if your relays are not linkable to your identity. However, if
\nyou’re entering the tor network with bridge nodes, an attacker will
\nprobably say “WTF?” at first unless they determine they’ve found a
\nbridge node. Bridge nodes don’t use nearly as much bandwidth as relays
\nbecause there is not a public list of them, so an intelligence agency
\nwould have less traffic to sift through, which makes correlation easier.
\nOn the other hand, using bridge nodes also allows you to run obfsproxy
\n[4] on both the bridges and your hidden service. obfsproxy allows you to
\nmake tor traffic appear to be another type of traffic, which is a good
\ndefense against non-Five Eyes entities. For example, your hosting
\nprovider may decide to monitor for tor traffic for their own reasons.
\nJust make sure your relays\/bridges aren’t linkable to you or to each other.<\/p>\n
One last thing about guard node discovery attacks: The Naval Research
\nLab published a paper in July 2014 about the “Sniper Attack,” [5] which
\nin short works like this: The attacker discovers your guard nodes, then
\nuses an amplified DoS trick to exhaust the memory on all of your nodes.
\nThe attacker keeps doing this until your hidden service uses guard nodes
\nthat they control. Then it’s game over. If your hidden service’s entry
\nnodes are all specified in your torrc file and they get DoSed, your
\nservice will go offline. In this situation, if all of your relays are
\ndown, you essentially have an early warning canary that you’re being
\ntargeted. In other words: This is the best possible time to book your
\none-way ticket to your chosen non-extradition country. For those of you
\nwith a background in writing exploits, this is similar in principle to
\nhow stack smashing protection will render some exploits either unable to
\nfunction or will turn them into a DoS. Personally, I recommend an
\never-changing list of relays or bridges. Add a few new ones at a
\npre-determined interval, and gradually let old ones go unpaid.<\/p>\n
This section is critical, especially when things start to break down. If
\neverything else goes bad, following this section closely or not could be
\nthe difference between freedom and imprisonment.<\/p>\n
This is important enough to re-state: Transparently proxy your tor
\ncomputer. This is a good first line of defense, but it is far from the
\nonly way to protect yourself.<\/p>\n
Do not contaminate your regular identity with your Onion Land identity.
\nYou’re an aspiring drug kingpin. Go out and pay cash for another
\ncomputer. It doesn’t have to be the best or most expensive, but it needs
\nto be able to run Linux. For additional safety, don’t lord over your new
\nonion empire from your mother’s basement, or any location normally
\nassociated with you. Leave your phone behind when you head out to manage
\nyour enterprise so you aren’t tracked by cell towers. Last but not least
\nfor this paragraph, don’t talk about the same subjects across identities
\nand take counter-measures to alter your writing style.<\/p>\n
Don’t log any communications, ever. If you get busted and have logs of
\nconversations, the feds will use them to bust other people. Logs are for
\nundercover cops and informants, and have no legitimate use for someone
\nin your position. Keep it in your head or don’t keep it at all.<\/p>\n
At some point, your enterprise is going to have to take on employees.
\nPulling a DPR move and demanding to see ID from high-volume sellers and
\nemployees will just make most people think you’re a fed, which will
\nleave your potential hiring pool full of dumbasses who haven’t even
\ntried to think any of this out. It will also make it easier for the feds
\nto arrest your employees after they get done arresting you. If your
\nenterprise is criminal in nature — whether you’re selling illegal goods
\nand services or you’re in a repressive country that likes to re-educate
\nand\/or kill dissidents — an excellent way of flushing out cops is to
\nforce them to get their hands not just dirty, but filthy, as quickly as
\npossible. Don’t give them time to get authorization to commit a crime
\nspree. If there’s a significant amount of time between when they’re
\ngiven crimes to commit and the commission of those crimes, you need to
\nassume you’ve got an undercover cop on your hands and disengage. If they
\ncommit the crime(s) more or less instantly, you should be fine unless
\nyou’ve got the next Master Splynter on your trail. [6]<\/p>\n
Disinformation is critical to your continued freedom. Give barium meat
\ntests to your contacts liberally. [7] It doesn’t matter if they realize
\nthey’re being tested. Make sure that if you’re caught making small talk,
\nyou inject false details about yourself and your life. You don’t want to
\nbe like Ernest Lehmitz, a German spy during World War II who sent
\notherwise boring letters about himself containing hidden writing about
\nship movements. He got caught because the non-secret portion of his
\nletters gave up various minor personal details the FBI correlated and
\nused to find him after intercepting just 12 letters. Spreading
\ndisinformation about yourself takes time, but after a while the tapestry
\nof deceptions will practically weave itself.<\/p>\n
Ensure that your communications and data are encrypted in transit and at
\nrest whenever applicable. This means PGP for e-mail and OTR for instant
\nmessaging conversations. If you have to give data to someone, encrypt it
\nfirst. For the tor-only box you use for interacting with your hidden
\nservice, full disk encryption is required. Make a password that’s as
\nlong and complex as you can remember (“chippy1337” is not an example of
\na good password). Last but not least, when you’re done using your
\ndedicated tor computer, boot into memtest86+. Memtest86+ is a tool for
\nchecking RAM for errors, but in order to do that it has to write into
\neach address. Doing so essentially erases the contents of the RAM.
\nTurning your computer off isn’t good enough. [8] If you’re planning to
\nuse TAILS, it will scrub the RAM for you automatically when you shut
\ndown. Once your RAM is clean, remove the power cord and any batteries if
\nyou’re feeling extra paranoid. The chips will eventually lose any
\ninformation that is still stored in them, which includes your key. The
\nfeds can do a pre-dawn raid if they want, but if you follow this step
\nand refuse to disclose your password, you’ll make James Comey cry like a
\nsmall child.<\/p>\n
Use fake info when signing up for hosting services. Obfuscate the money
\ntrail as much as possible and supply fake billing info. I prefer
\nregistering as criminals who are on the run, high government officials,
\nor people I dislike. If your box gets seized and your hosting company
\ncoughs up the info, or if a hacking group steals your provider’s
\ncustomer database (It happens more often than you’d think), your hosting
\ninformation needs to lead to a dead end. All signs in Operation Onymous
\npoint to operators being IDed because they used real info to register
\nfor hosting service and then their box got decloaked.<\/p>\n
Speaking of money, you’re going to have to figure out how to launder
\nyour newfound assets, and we’re not talking about using a couple bitcoin
\nlaundering services and calling it a day. You also shouldn’t go out and
\nbuy a Tesla. Living beyond your means is a key red flag that triggers
\nfinancial and fraud investigations. Remember, money is just another
\nattack vector. Washing ill-gotten gains is a time-honored drug business
\ntradition and one that you would be a fool not to engage in. You can
\nonly use your hard-won profits to send shitexpress.com packages to
\npeople you don’t like so many times.<\/p>\n
Take-away: If you rely only on tor to protect yourself, you’re going to
\nget owned and people like me are going to laugh at you. Remember that
\nsomeone out there is always watching, and know when to walk away. Do try
\nto stay safe while breaking the law. In the words of Sam Spade, “Success
\nto crime!”<\/p>\n