Pierluigi Paganini August 09, 2012

Yes Guys, when we think to the deep web the media tell us only about its dark side, it’s considered the paradise of cybercrime, the reign of the theft, a place to escape, but is it true?

The governments want you to ay far from the hidden web, because they cannot spy on you, the crime is in the deep web as in the clear web and we have described it in detail in the incoming Book, the “Deep Dark Web”.

Of course, the anonymity granted by deep web could encourage and facilitate criminal activities but at same time it represent an obstacle to the criminal that for example desire to steal sensible information of the users or spy on them.

Meanwhile, on the clear web, we are able to find many reports produced by security firms on cyber criminal activities and related earnings, we know relatively little about the profits related to the Deep Web that we remember to be of size and turnover dramatically greater than the dark web.

I’ve found an interesting research  made by the Carnegie Mellon computer security professor Nicolas Christin on the earning of one of the most famous black market in  the deep web, Silk Road, that seems to be able to realize $22 Million In Annual Sales only related to the drug market.  Total revenue made by the sellers has been estimated at around USD 1.9 million per month, an incredible business also for the Silk Road operators that receive about USD 143,000 per month in commissions.

The experts have examined over 24,400 separate items sold on the popular site demonstrating that Silk Road is mainly used as drugs market, very interesting also the composition of the sellers that for obvious needs leaves within a couple of weeks the site to appear in second time.

The study highlights that the famous market reach $22 million in annual sales and around double the commission respect six months ago.

First of all where is located Silk Road?

Silk Road is an hidden service exposed, be aware hidden service doesn’t mean that it’s difficult to locate but this is the meaning that is used for the service provided in the anonymizing network for the reason that I explained in the past articles on the subject.

We are facing with a complex economy that has also its electronic currency, the Bitcoin, another argument that we have already introduced. We can consider the market armored due the anonymity mechanisms that it trade on, from the Tor Network to the payment methods.

The study has analyzed the evolution of the market in the last months demonstrating the increasing of the business may be obtained also thanks to the aura of mystery that many media give the Deep Web.

The number of sellers of any kind of drugs is passed from 300 in February to around 570 in August as reported in the following graph:

The analysis have been conducted running crawler program against the website and at same time monitoring the activities of the site administrator to understand if the study was intercepted.

The researchers have participated to the forum of the site without noting any signal that demonstrated that their crawler were discovered.

The application used for the analysis were able to collect any kind of information related to the product sold such as pricing information and feedbacks posted by the buyer (surprisingly high level of customer satisfaction, around 97.8%), an useful information to estimate the number of sales.

To avoid detection of measurements the team has used different Tor circuits and have performed analysis randomly during every day.

Which are the most sold products?

The study has grouped the product in categories and has revealed that the “most wanted” items are drugs, following is proposed the list of the Top 20 categories in terms of items available. 

The study has also tried to take a picture of typical seller, of course excluding its identity that is impossible (maybe 😉 ) to track. First, we specify that due to the anonymous nature of the market place, it is impossible to discern whether certain sellers use multiple seller pages, we can only speculate that a seller will use for convenience a single page to prost its product.

Most sellers leave the site fairly quickly, but a core of about 4% of them have been on the site for the entire duration of our study, the majority of sellers are only on the site for less than two months, may be because they leave the site once sold the products or because they move “into stealth mode as soon as they have established a large enough customer base”.

Another interesting data is related to the location of the sellers and buyer, information that has been obtained from the list of acceptable shipping destinations of the items. The following table 2 shows the top 12 locations for both origin and destinations. Most items ship from the United States, with the United Kingdom a distant second and The Netherlands where the government permits narcotics sales.

The study reveals that a majority of items ship worldwide, in spite of the nature of the items,  considering that the odds are paid only once received and that the quantities being sold are generally rather small the researchers believe that sellers use techniques to make package inspection unlikely, for example using vacuum sealing and of course a “professional-looking” envelopes with typed destination addresses.

In this way, it’s hard to trace the senders because they also use private couriers to ship the items.

Giving a look to the economic aspects of the market we must consider first that all transactions are using Bitcoin currency that is a notoriously volatile currency

Analyzing the evolution of the exchange rate of the Bitcoin against the three major currencies that sellers use in their countries, is possible to note that the Bitcoin exchange rate has remained relatively stable between the end of February and early May, oscillating  around 1 BTCUSD 5, and corresponding values in euros and pounds. Since then, the Bitcoin has notably appreciated, reaching close to USD 9 since mid-July 2012, with relatively large fluctuations in value.

The evolution of product prices closely mirrors the evolution of the Bitcoin exchange rates suggesting little inflation for these items over the time interval considered.

Conclusions

The experts and law enforcement are conscious that are facing with an anomalous market where identities are hidden, payments difficult to trace, where no advertising is made and where the access to the “market place” implies anonymizing tool such as a Tor client. Despite all this consideration, the study has revealed a string growth of the business, the market appears in expansion and number of sellers that use it is dramatically increased.

Christin declared

“It’s a stable marketplace, and overall it’s growing steadily.”

But many users on the site have worried for possible infiltration made by law enforcement, another source of concerns is that several of its high-profile sellers have disappeared.

The possibility to infiltrate a similar market is concrete and market place such as Silk Road represents in my opinion a moderate risks for the worldwide community. The most problematic aspects of similar business is that they are controlled by criminal organization but the figure proposed are far from to justify a massive Government intervention,  the problem is how much hidden services like this are in the hidden web?

I believe that government are working on the possibility also to fight this type of cybercrimes but are worried by the most dangerous way to use anonymizing networks.

In the reports are also proposed some solution to stop the market place, some of them really impractical like the block of Tor networks, don’t forget that government primary use this type of networks that they have designed and promoted …

Are market place such as Silk Road an acceptable side effect?

More responses in our incoming book on the topic … The Deep Dark Web

Pierluigi Paganini

(Security Affairs – Tor, Silk Road, cybercrime)

[adrotate banner=”5″]

[adrotate banner=”13″]