Insights For Success

Strategy, Innovation, Leadership and Security

TOR Project

Tochka DarkNet Marketplace

GeneralEdward KiledjianComment
Tochka.png

It's been a while since I posted a Darknet website. I would like to introduce you to the Tochka Marketplace ( http://pointgg3pgee4gic.onion/ )

Tochka was launched in 2015 by Russian speaking devs. It offers the ability to conduct transaction without the buyers and sellers having to talk. Dead-drop transactions are available for more sensitive transactions. They also offer a "Buy It Now" option called "Instant Trade".

This is a smaller marketplace and is less known that it's more popular (aka news-worthy) counterparts. It has poorer design and a questionable choice of colors.

Enter the marketplace

Tochka1.png

If you click on the vendor tab, you can choose your seller of choice.

You can buy anything from Marijuana to Marijuana oil, Research chemicals , with prescription medications, credit cards and everything in between.

Tochka2.png

Shipping Expertise

What you will find most interesting is how they have developed expertise to ship items carefully wrapped in an attempt to bypass customs inspection. Hopefully writing about it here may create interest by some police departments and shut down some of these more questionable and dangerous sellers.

Popular TOR site list

GeneralEdward KiledjianComment
TOR-Links1.png
TOR-Links2.png

Candle is a basic search engine. It contains a small but interesting subset of TOR sites.

TOR-Links3.png

Grams is a dark market search engine for labour, digital & physical goods that can be purchased with various currencies including Bitcoin. It searches the most popular darknet markets including Hansa, AlphaBay, Agora, Nucleus Market, Majestic Garden, Oxygen, Outlaw Market, Oasis, Tochka and Arsenal.

TOR-Links4.png

Haystack is another TOR (darknet) search engine and claims to have indexed 1.5 billion pages (which makes it one of the most comprehensive TOR search engines). In my experience, this site is a hit type of thing. Every couple of searches fail for me.

Security sites

TOR-Links5.png

GnuPG (open source version of PGP) allows users to cryptographically sign and encrypt email communications.

TOR-Links6.png


OnionShare is a free and opensource tool that allows users to securely and anonymous share large files over the TOR network.

Anonymous Pasting sites

There may be times when you want to post (public or private) a snippet of text with the world. The common feature shared by most of these TOR based services is that pastes delete automatically after a certain amount of time. These are TOR alternatives to pastebin.com

TOR-Links7.png

DeepPaste is a very simple and basic pasting service.

TOR-Links8.png

RiseUp pasted are automatically deleted within a week. Additionally you can share files up to 50MB.

TOR-Links9.png

Pasta is an open source paste service that supports standard pastes, editable pastes, self-burning pastes and URL shortener.

Email

TOR-Links10.png

Confidant Mail is a free and open srouce non-SMTP encrypted email system that leverages GNU Privacy Guard (PGP).

TOR-Links11.png

Daniel email service is a free anonymous email and XMPP service (limit of 25MB storage space). Encryption is not built into the service.

TOR-Links12.png

Elude is an email service with encrypted storage with a TOR only web client. Their accounts are completely anonymous, they allow you to purge your data completely if required and provide encryption.

TOR-Links13.png

I wrote a review about ProtonMail here and their well designed email service is also accessible via the TOR network. This is a very good option because unlike the other email services here, ProtonMail is a real company offering a professional service.

Social sites

TOR-Links14.png

Cyph Messenger is an open source video chat and file transfer app that uses a modified Signal messenger protocol enhanced with Quantum Resistant encryption (their claim).

TOR-Links15.png

Dread is a TOR Reddit clone that is used primarily as a drug market discussion and reviews forum.

TOR-Links16.png

Here is the Facebook TOR site.

Is TOR Private and Anonymous?

GeneralEdward KiledjianComment
japan-956073.jpg

One of the most frequently asked questions I receive from readers (from this blog, Twitter and LinkedIn) is "Should I consider TOR private and anonymous?" 

This question is interesting with fervent activists on each side [of the issue]. On one side are TOR proponents extolling the virtues of the platform and explaining how it will save humanity from the scourge of privacy-invading networks. On the other side of the discussion are conspiracy theorists that claim TOR is nothing more than an NSA honeypot (a data collection tool). 

Like most important topics, the truth is never as clean as we would like it. The truth is that TOR is a little bit of this and a little bit of that. Let's dive straight in. 

Who started TOR?

Conspiracy theorists love highlighting the fact that the United States Navy developed TOR. So the first question we need to tackle is regarding this origin statement.

The core privacy functionality of the TOR network, the onion routing, was developed by United State Naval research laboratory employees named Paul Syverson, Michael G Reed and Favid Goldschlag. The purpose of the technology was to protect US intelligence communication. 

The TOR Project was launched in September 2002 by Paul Syverson,  Roger Dingldine and Nick Mathewson. In 2004, the Naval Research Laboratory released the TOR code under a free license, and the EFF (Electronic Frontier Foundation) began funding the initiative. The Tor project we know and love today was started in December 2006 as a 501(c)(3) non-profit organization with support from the US International Broadcast Bureau, Internews, Human Rights Watch, the University of Cambridge, Google and  Stichting NLnet.

It is true that the majority of the funding for the free and open source project came from the US government. 

Does the government control TOR entry and exit nodes?

When talking about TOR privacy and confidentiality, there are 2 distinct question most astute users ask:

  1. Can someone "see into" my traffic?
  2. Can someone tie TOR traffic back to me? 

The first theory I read about consistently was that world governments (particularly the 14 Eyes Countries) control the majority of the TOR Exit nodes thus can "see into the traffic." Looking strictly at the Exit node piece, governments have no deterministic way of knowing where a suspects traffic will exit from the network. As long as they don't control all of the TOR Exit nodes (which we believe they do not), they can't be sure the suspect traffic will flow through their nodes. Additionally, if the site you are visiting is using cheap and easy to implement security (like TLS) then even if the government controls the exit node, they won't be able to "see inside the traffic." Traffic that joins the TOR network to access a TOR hidden service never exits the network so it wouldn't even pass through an Exit node.

What if a government controls both the Entry node and Exit node you use? Assuming you are using TOR to browse the "normal" internet then you will hit an exit node. If the government(s) control enough of the entry and exit nodes, they can use statistical correlation tie traffic back to you. 

If you are browsing a site with well-designed security, they still would not be able to see "inside your traffic" but would know that you originated the traffic flow (aka collect metadata). 

It is important to remember that the TOR Project isn't just idly sitting on the sidelines watching the government violate its technology. They are actively working to harden the platform and work tirelessly to make it more secure every day. Some of the techniques used by the TOR platform include:

  • Switching TOR circuits regularly and unpredictably. Thus making long-term data mining more difficult. 
  • Ensuring that the TOR nodes used are as randomized as possible. Thus making predictability of route near impossible.
  • and more 

Has the TOR browser been hacked?

The answer is yes but hold on before you install the TOR browser from your computer. I would submit that almost every commercial or free software has exploitable bugs that would compromise a users privacy and confidentiality. The question isn't whether a product has these types of exploitable bugs but rather what the software "vendor" does about them. The TOR project has been an incredibly honourable steward of the TOR platform. They quickly patch any discovered vulnerability. 

The other "trick" for the extra paranoid is to switch the security level in the TOR Browser to high. This will break some sites, but you want strong security don't you? 

torb1.PNG

Can I be tracked using the TOR Browser?

I wrote an article in 2016 talking about browser fingerprinting techniques and referred readers to the EFF's Panopticlick site to test this on their own devices. Browser Fingerprinting is a technique that leverages information your browser gladly provides to sites to uniquely identify you and then track you as you browse the web. 

To illustrate the power or browser fingerprinting, I ran the Ponopticlick site on my "normal use" machine using different browsers. 

  • My reference browser will be Google Chrome (same results with or without UBlock Origin): Your browser fingerprint appears to be unique among the 1,747,285 tested in the past 45 days. Currently, we estimate that your browser has a fingerprint that conveys at least 20.74 bits of identifying information.
  • The Brave "privacy" browser (default configuration): Your browser fingerprint appears to be unique among the 1,747,235 tested in the past 45 days. Currently, we estimate that your browser has a fingerprint that conveys at least 20.74 bits of identifying information.
  • Microsoft Edge (Win 10 latest update): Within our dataset of several million visitors tested in the past 45 days, only one in 218410.63 browsers have the same fingerprint as yours.
    Currently, we estimate that your browser has a fingerprint that conveys 17.74 bits of identifying information.
  • Microsoft Internet Explorer (Win 10 latest update): Your browser fingerprint appears to be unique among the 1,747,285 tested in the past 45 days. Currently, we estimate that your browser has a fingerprint that conveys at least 20.74 bits of identifying information.
  • Tor Browser with safest security option: Within our dataset of several million visitors tested in the past 45 days, one in 92.3 browsers have the same fingerprint as yours. Currently, we estimate that your browser has a fingerprint that conveys 6.53 bits of identifying information.

So in safest mode, the TOR browser does dramatically reduce information leaking about your browser but the fact you are using a low popularity browser is in fact itself a tracking tool. The short answer to this question is that tracking is still possible.

Should I trust the TOR Browser?

I've addressed some of the most common questions I receive, but the only reason you read this article is for this one question alone. You want to know if the TOR browser is safe enough for you. 

Unfortunately for you, I'm a security professional, and I believe security is never black or white. The question of whether the TOR Browser is safe enough for you is the real question and that depends. 

It depends on the types of activities you are performing. 

On the low end of the spectrum is a general user that wants to use TOR to browse questionable websites from work without leaving traces in the company proxy logs or without being stopped by a URL filtering tool. For this type of user, the privacy and anonymity afforded by TOR are probably sufficient. It is unlikely that a nation state will target you for deanonymization and tracking. 

On the other end of the spectrum is a hardened criminal trying to sell nuclear secrets to the highest bidder. You would probably be classified as a high-value target by the global intelligence community, and thus they would use the full arsenal of tools to identify and track you. If you are a criminal mastermind hellbent on world domination, you probably need better tools than TOR. 

A tweet by Edward Snowden explains it best:

Security is a complex system of risk management and mitigating controls. There is no magic bullet where everyone is safe and anonymous all of the time. True security is a complex architecture of different technologies implemented in very particular ways, to achieve the protection level you desire or need. 

If you are browsing adult content from home and want some level of anonymity, TOR is perfect. 

If you want to browse it while at work, know that most companies have agents installed on your workstation to track your browsing regardless of the browser used. 

Therein lies the real risk. Whether you are using TOR or the end-to-end encrypted Signal messenger, the tools themselves are often secure.  However, if someone compromises either of the endpoints, you can still be de-anonymized. This is why true security must be done in layers.

Maybe you need to run a secure Operating System, like Qubes OS that routes its traffic through TOR (booted from read-only media and hash checked to ensure it has not been tampered with). Additionally, even if you have a safe and secure computer, operating system and connection, you must still be careful not to involuntary divulge clues about yourself when online, so security hygiene is also very critical. 

Security is though. Perfect security doesn't exist.