News for hackers. Stuff that matters.

A comment on Underground Hansa Market taken over and shut down. Parent comment

Re:Underground Hansa Market taken over and shut down by bripeace on Thursday July 20, 2017 @02:45PM (#14815224)
But where did they get the 3 year old email.

1) They were investigating AlphaBay for nearly 3 years 2) They came upon somehow control of an email address which contained 3 year old mail that contained the password reset email 3) They are capturing and storing large amounts of tor traffic much like the NSA does on clearnet see: xkeyscore

This isn't really explained in the indictment

[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by jdenning on Thursday July 20, 2017 @06:28PM (#14816807)
Apparently, he leaked the email address in an early email sent to site users. It contained his real first name and birth year, and he used the address on several other sites.

When he was busted he was logged in to the site, and had several passwords/keys stored in plaintext on his machine.

Multiple OpSec failures.

Good analysis here: https://medium.com/@thegrugq/dark-net-trap-545ae5dd8476

[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by fiatpandas on Thursday July 20, 2017 @04:57PM (#14816234)
They could have gained knowledge of the email address through classified means, and made up the email header story to hide their method of initially obtaining it.
[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by burger_moon on Thursday July 20, 2017 @04:09PM (#14815838)
This is a really interesting question. Knowing how they got access to such an old email from an external source.
[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by problems on Thursday July 20, 2017 @04:57PM (#14816226)
Honestly it doesn't seem that interesting - browsing /r/DarkNetMarkets, dnstats and just signing up yourself is enough. I've signed up for a few for shits and giggles but never bought anything, browsing is pretty interesting. You just need to find one person like me who'd be willing to give them the email... not exactly hard.
[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by CM30 on Thursday July 20, 2017 @06:11PM (#14816722)
Perhaps it's from someone they were investigating for other crimes. I mean, it doesn't seem beyond the realm of possibility that law enforcement were going after say, a drug dealer who was using the site to sell goods, and found the welcome email from the platform he or she was using in their inbox.

That seems like one plausible possibility.

[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by ATsch on Thursday July 20, 2017 @07:25PM (#14817032)
This is my pet theory. A seller was busted and the emails were siezed. Seems like the most likely possibility.
[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by xorcist on Thursday July 20, 2017 @06:45PM (#14816873)
Isn't it likely that a number of recipients did not delete that particular message? Also that a number of them sold drugs by mail order, not uncommonly a short lived profession?
[ Parent | on HN ]
Re:Underground Hansa Market taken over and shut down by math0ne on Thursday July 20, 2017 @08:58PM (#14817374)
I'm sure they sign up for every darknet site constantly.
[ Parent | on HN ]