Aidan Murphy: Hello, and welcome to another episode of the Dark Dive. The podcast that delves into the depths of the dark web. My name is Aidan Murphy and I'm your host as each episode we look at different aspects of the dark web. In the podcast feed, you can already find the entire limited series. In other episodes, we look at how the dark web works and areas of the dark web like marketplaces, hacking forums and ransomware leak sites. But in this episode, we're going to look at what I call dark web service providers by which I mean the wider ecosystem of services like crypto mixers dark web search engines that support many of the marketplaces and forums we've discussed over the past four episodes. Here today to help me coin the term, 'Dark Web service providers,' are two cyber security experts. Rob Fitzsimons, Lead Threat Intelligence Engineer at Searchlight Cyber. Hello, Rob.

Rob Fitzsimons: Hi, Aidan, thanks for having us.

Aidan Murphy: And Carlito Perschky, Senior Threat Intelligence Analyst at Searchlight Cyber. Hello, Carlito.

Carlito Perschky: Hello, hello.

Aidan Murphy: So just to bring you guys up to speed, on our very first episode our CTO, Dr Gareth Owenson, laid out his view that the dark web really took a turn when cryptocurrency became more mainstream and suddenly, a quite niche area of the internet was compounded with a way to pay for illicit services. Did you agree with that assessment? Has cryptocurrency spurred on the cyber criminal community?

Carlito Perschky: Yes, absolutely. Traditionally, committing crimes and transferring funds would either be done through cash in hand, or through banking systems. The KYC for banking systems today is incredibly good. Cryptocurrency circumvents the majority of that. The ability to send funds to someone in another country within ten to fifteen minutes which is not anonymous but pseudo-anonymous really helped shape the future of how online crime is conducted.

Rob Fitzsimons: The majority of the criminals leveraging the dark web utilize it for its anonymity. Bringing cryptocurrency into that provides an additional element of anonymity around people's payments, it helps to further secure their transactions, and always gives the facade of added impunity against their actions.

Aidan Murphy: Is there a cryptocurrency of choice for criminal deeds?

Carlito Perschky: It depends on the type of criminal. Bitcoin is the most prevalent just due to how widespread it is in society. But there are individuals who are a bit more privy to understanding how blockchain tracing works and will use more privacy focused coins like Monero, Litecoin, or e-Cash.

Aidan Murphy: My understanding is cryptocurrency works on the blockchain and the blockchain is a ledger. In theory, it should be pretty transparent. Why is cryptocurrency more anonymous than fiat payments?

Carlito Perschky: While everything is on the ledger, it's available to see that X address has paid Y address. But unless you have a starting point you're not really able to identify where these addresses are tagged as. It's just like saying 'Bob Jenkins has sent two pounds to Susie Smith' - it doesn't mean anything to anyone without any context. The ability to drag individuals who try to hide behind pseudo-anonymity out into the light and tie them to real world identities is the base of what we do.

Aidan Murphy: How do criminals cash out cryptocurrency they've amassed maliciously?

Carlito Perschky: The main way is to try and obfuscate the source of funds. They'll either swap chains, transfer to a different type of coin, or they'll use the services of mixers.

Aidan Murphy: How do crypto mixers work?

Carlito Perschky: Essentially it's a very large pool of funds. You'll transfer X amount of Bitcoins. You'll tell them where you want the funds deposited out. Within this large pool, with hundreds or thousands of people putting in one Bitcoin at a time, and thousands of people on the other side also gaining a Bitcoin, how are you supposed to say that A and B are connected?

Rob Fitzsimons: It's money laundering, which has been happening forever. The technological advancement of cryptocurrency has just shifted that focus from physical currency to digital currency, giving criminals additional capability to continue to conduct their malicious activities on the dark web and have that ease of money laundering.

Aidan Murphy: Are there examples of crypto mixers being taken down by law enforcement?

Rob Fitzsimons: Yes - Blender and Chipmixer are examples of mixers that have been taken down. The cyber security industry tackles this by leveraging tools like Chainanalysis or Elliptic who offer capabilities to start enabling investigations into the blockchain, to monitor and follow those transactions through the digital ledgers.

Aidan Murphy: Are crypto mixers strictly illegal?

Carlito Perschky: As long as you're using it for the correct purposes, it's a tool like any other. You can make anonymous donations to charities, or if you're a journalist wanting to protect sources. Anonymous transactions aren't inherently bad. It's when they are abused that it's the issue.

Aidan Murphy: Just before we move on, you mentioned dark web search engines. Our CTO said sites are not indexed on search engines - but there are search engines on the dark web. What's going on there?

Rob Fitzsimons: They're trying to make certain markets and forums more visible, easier to find for people who are fairly new to the dark web. They can't find you if you're not making yourself visible. If you're not visible, you're going to have a load of product that you can't shift. Think of Google search engine but in one of its earlier, more clunky iterations. It's not infallible - a site that might be up today might be down tomorrow.

Carlito Perschky: It always comes with the disclaimer that the dangers are really real. Anything that you wouldn't want to see on the clear web can crop up on there. So it's always important to be incredibly careful about protecting yourself from malware but also ensuring that you're not seeing content that is upsetting or offensive.

Aidan Murphy: And link sites - what are those?

Carlito Perschky: There are a lot of these sites which are often just HTML pages with links attached to them. One example is called Tor.Taxi which does exactly what I previously described.

Rob Fitzsimons: These link sites are almost like a more easy to use version of the search engine. You'd have categories of forums, user-maintained lists of the top forums currently, all of them hyperlinked through to their onions. That could be markets, forums, crypto mixers, how to set up crypto addresses, Wikis. There are all sorts of areas that can generally be quite useful from a security research and threat intelligence perspective.

Aidan Murphy: What are some of the weirder areas of the dark web that our listeners may not have heard of?

Carlito Perschky: A personal one that really stood out to me was a website titled Pee-Pick Of The Day. It was just a webpage with an image of an individual in a public stall. Nothing inherently problematic but very niche.

Rob Fitzsimons: I have a particular favourite - a site called GetGnomed. Essentially it was a service supposedly being provided from the dark web where you could request to have an individual, be it a friend or an enemy, gnomed in some way shape or form. The lower tiers started at about 500 bucks - their front lawn would be filled with gnomes. There was a tier called Gnome Haunting where you'd start off with a single gnome. If you removed that, the next day there would be two, then four, then eight, multiplying day after day. It does seem like a hoax, but it went viral on TikTok and is a really light-hearted insight into the dark web.

Aidan Murphy: Why is it important that people know about these areas of the dark web?

Rob Fitzsimons: There is a growing criminal activity within the dark web ecosystem. It's all of those pieces combined, depending on your specific use case, that you can start deriving value from. Investigating an individual, monitoring a ransomware group, understanding what's happening so that we can ultimately have informed decisions about what we may need to do from a cyber security perspective. From a law enforcement perspective, identify individuals, track activities and understand what is happening.

Aidan Murphy: Brilliant. A big thank you to Rob and Carlito for joining me. Remember to follow us for free on Apple podcasts, Spotify and whatever podcast app you have on your device. Until next time, stay safe.