News for hackers. Stuff that matters.
Re:German police take down 'world's largest darknet marketpl... by cm2187 on Thursday January 14, 2021 @06:10AM (#25774971)
I get how these market places are used for digital goods (malware, credit cards), but I don’t understand how people can trade physical goods on those. If they have to exchange products, they must either meet in person or use the mail, either is trackable by the authorities. I see how the seller can protect himself for local transactions. He could leave the goods hidden somewhere and tell the buyer where to go. But the buyer has to be exposed 100% of the time.
Re:German police take down 'world's largest darknet marketpl... by waste_monk on Thursday January 14, 2021 @06:27AM (#25775098)
From an article [1] I read here a while ago:

"""

Now, goods are hidden in publicly accessible places like parks and the location is given to the customer on purchase. The customer then goes to the location and picks up the goods. This means that delivery becomes asynchronous for the merchant, he can hide a lot of product in different locations for future, not yet known, purchases. For the client the time to delivery is significantly shorter than waiting for a letter or parcel shipped by traditional means - he has the product in his hands in a matter of hours instead of days. Furthermore this method does not require for the customer to give any personally identifiable information to the merchant, which in turn doesn’t have to safeguard it anymore. Less data means less risk for everyone.

The use of dead drops also significantly reduces the risk of the merchant to be discovered by tracking within the postal system. He does not have to visit any easily to surveil post office or letter box, instead the whole public space becomes his hiding territory.

...

To prevent theft by the distribution layer, the sales layer randomly tests dead drops by tasking different members of the distribution layer with picking up product from a dead drop and hiding it somewhere else, after verification of the contents. Usually each unit of product is tagged with a piece of paper containing a unique secret word which is used to prove to the sales layer that a dead drop was found.

"""

It's worth reading the entire article for more detail, the business model is quite clever.

[1] https://opaque.link/post/dropgang/

Re:German police take down 'world's largest darknet marketpl... by cowboysauce on Thursday January 14, 2021 @12:31PM (#25779274)
I’m skeptical that dead drops of items purchased on the dark net is common. It seems like too many competing factors that would make it impractical.

Your customers are limited to your immediate geographic area and those who are willing to search for their purchases. The use of cryptocurrency to make purchases is a pretty big barrier for most people and reducing your customer base even further seems like it would make the whole operation uneconomical.

Paradoxically, the purchases should be inconspicuous yet easy to find. The mention of using Bluetooth and WiFi to help guide your customers would help, but at some point you have people out in public (presumably they’re in public because private locations provide even more obstacles) looking for hidden objects. That in itself is pretty conspicuous, even with the greater public knowledge of things like geocaching and Pokémon go (your customers also risk being engaged by those people). Additionally, placing and maintaining your drop locations is conspicuous. All it takes is one person seeing you leaving an object for the bomb squad to get called in.

The idea that a seller could place multiple orders ahead of time and then activate them as required seems odd as well. Your customers are going to have to be okay with buying drugs that could be degraded from being exposed to environmental conditions if the drops are outside (placing them inside of buildings exposes both you and your customers to more scrutiny). Likewise, leaving them for extended periods of time makes it more likely for them to be discovered. You’re also limited by what you’ve previously placed. If a customer wants multiple items, they’ll have to go to multiple drop locations.

There’s also the time and expense of setting up all these drop locations. You don’t want them concentrated because that makes it more likely that your customers will be noticed, but spreading them out will reduce your profit.

Shipping through the mail obviously poses it’s own problems, but it also has a lot of advantages. Mail generally can’t be opened without a warrant, sending and receiving mail is pretty inconspicuous and it gives the buyer more plausible deniability.

The article reads more of a “maybe this is how it could be done” than a “this is how it’s actually being done”.

Re:German police take down 'world's largest darknet marketpl... by pcthrowaway on Thursday January 14, 2021 @09:40PM (#25786301)
This is brilliant, but also raises a bunch of questions for me. Perhaps you or other readers may have the answers:

- How is collection of the product verified. In other words, a customer can say they went to the drop location and nothing was there. The seller has no way of knowing if the customer was lying or if the product was "intercepted" by chance or federal officials

- How can people making the drop be confident that authorities making controlled buys won't be able to trace them via CCTV (if there is a camera recording in that area, their identity can be determined) I suspect the normalization of face masks has helped make this somewhat easier to evade, but in normal times, the government could go to 100 drop zones used by the same seller, compile a list of all the people who have been seen near those zones in the last 6 months with facial recognition, then dig into people who have been seen in more than one of those zones. I assume these are obscure enough locations that random people won't find the drops, so a person appearing in more than one is enough to flag them as likely to be involved. But in the event these are just really good hiding places in more public locations, someone being near 3 or more of these locations is still enough to suggest involvement.

- Most of the risk still seems to be the buyer's burden; if a government official impersonates the seller, they can just wait for the person to show up to collect their package, and they'd be caught "red-handed" so to speak. I suppose the person can claim ignorance, but I don't know how good of a defense this would be.

- Sellers would be taking massive risks with bulk orders being found by the wrong party (I assume bulk orders are most of their profits). Additionally, they wouldn't really have the ability to tailor the amount to the customer for complicated orders

Re:German police take down 'world's largest darknet marketpl... by pcthrowaway on Thursday January 14, 2021 @11:45PM (#25787112)
I wanted to reply to my own questions (let's say 1-4) with some follow-up, because I didn't realize how complex the system was until I read the linked article.

1) The article mentions the drop locations need to be places where another person stumbling upon them will be super unlikely, and which also haven't been used before (not regular, recurring locations as I assumed).

3) There is still likely a fair bit of risk to the buyer, but the writer seems to believe they can plead innocence

4) Addressed in the same as 1, and with drop locations being new every time, making more involved drops may not be as much of an issue

(2) still begs the question, people making lots of drops seem to have a lot of risk; if many controlled buys are taking place, officials can crossreference the lists of people who have been near that location. Once they identify people who make the drops they can then watch the people who are seen in many of the locations, subpoena location information from Google, etc. until they catch them in the act of making a drop or gather enough evidence to indite them. These people could then face very serious charges of conspiracy. It's not unlikely that these people could then be turned informant. Get enough surveillance on, or cooperation of the people making the drops and you can then use the same techniques to suss out the sales layer. Rinse and repeat.

Re:German police take down 'world's largest darknet marketpl... by xamuel on Thursday January 14, 2021 @09:31AM (#25776680)
Great. So because of our glorious War On Drugs, now drugs are being hidden all over the place where curious little kids are liable to find them. Can we please legalize yesterday?
Re:German police take down 'world's largest darknet marketpl... by epanchin on Thursday January 14, 2021 @07:32AM (#25775603)
Mail is not traceable. There is no record of sender, and a parcel being addressed to you is not proof you ordered it.

I suppose this might differ worldwide, but I’m guessing most countries have post boxes?

Wapo did an article on it some time ago: https://www.washingtonpost.com/politics/2018/10/16/postal-se...

Re:German police take down 'world's largest darknet marketpl... by cm2187 on Thursday January 14, 2021 @12:05PM (#25778907)
I am pretty sure all mail is scanned (outer envelope) in the US (and I suspect in most countries) and the record is kept. So the police can tell after the fact what was sent to whom from which post office / collection point. I assume all it takes is a bit of CCTV to fully identify the sender.
Re:German police take down 'world's largest darknet marketpl... by asdff on Thursday January 14, 2021 @12:55PM (#25779604)
There is no CCTV monitering a USPS drop box far from a post office. You could also address the package to your neighbor then take it off their porch after you see the USPS truck make their rounds. Or address it to a derelict property where you know no one will be home. Its trivial to mail things.
Re:German police take down 'world's largest darknet marketpl... by aeyes on Thursday January 14, 2021 @07:31AM (#25775592)
> But the buyer has to be exposed 100% of the time.

In Germany, apartments have mailboxes accessible without entering the building. Mailboxes have last names on them, we don't send mail to apartment numbers.

If you need a secure dropbox you go to a random building with some vacancies, look for an unused mailbox, change the lock (many have them on the outside as well) and put a random name on it.

Re:German police take down 'world's largest darknet marketpl... by dewey on Thursday January 14, 2021 @07:01AM (#25775378)
Usually the buyers don't really get in trouble, either because the amounts are too small or the priorities are different. They are much more interested in the sellers and operators of the platform.
Re:German police take down 'world's largest darknet marketpl... by zaarn on Thursday January 14, 2021 @06:12AM (#25774976)
In germany, a common method is using dead-mans package stations from DHL using stolen one-time credentials to pick up the package.
Re:German police take down 'world's largest darknet marketpl... by cm2187 on Thursday January 14, 2021 @06:14AM (#25774997)
Though if the seller is the police, the buyer is exposed.
Re:German police take down 'world's largest darknet marketpl... by zaarn on Thursday January 14, 2021 @06:30AM (#25775119)
Not really, the buyer can just claim they didn't know who ordered the package or what was in it. It's not a crime to pick up your mail.
Re:German police take down 'world's largest darknet marketpl... by oji0hub on Thursday January 14, 2021 @07:51AM (#25775745)
You can. And the court can ignore that, which they routinely do, and convict you anyway.
Re:German police take down 'world's largest darknet marketpl... by zaarn on Thursday January 14, 2021 @09:04AM (#25776337)
The court still needs good proof that you intended to receive the package. If they don't have proof, there isn't much for a conviction to stand on and the next instance should slap it back hard.
Re:German police take down 'world's largest darknet marketpl... by oji0hub on Thursday January 14, 2021 @11:28AM (#25778293)
That's how it should be. But plenty of people have been convicted in this way, unfortunately. Plus they have probable cause to search your house which isn't much fun either.
Re:German police take down 'world's largest darknet marketpl... by arez on Thursday January 14, 2021 @06:24AM (#25775068)
honeypots are not allowed in germany afaik. The police is not allowed to sell drugs or ask people for drugs and then take them in
Re:German police take down 'world's largest darknet marketpl... by KraftKacke on Thursday January 14, 2021 @08:28AM (#25776030)
Also, drug laws are saner than in then US (apart from cannabis legalisation) and nobody is out to get you for minor amounts of any drug. Even getting caught selling drugs will get you locked up guaranteed, if you don't pair that with criminal conspiracy.

However, buying or selling weapons is no joke here.

Re:German police take down 'world's largest darknet marketpl... by whatatita on Thursday January 14, 2021 @08:58AM (#25776283)
It's pretty similar over the border in Switzerland too, with the exception of looser gun control laws.

You can buy an amount of weed here (for personal) use that would absolutely get you convicted with "intent to supply" in the UK.

My weed smoking friends were worried they wouldn't be able to pick up when they came to visit. It was not a problem.

Re:German police take down 'world's largest darknet marketpl... by mk89 on Thursday January 14, 2021 @06:22AM (#25775057)
If the method is so common, don't people think that maaaybe... it's the police behind it? :D
Re:German police take down 'world's largest darknet marketpl... by zaarn on Thursday January 14, 2021 @06:29AM (#25775112)
It's common the market, the police can't really do much about the buyer if it's delivered via postal service. You can just claim you didn't know what that package is or who ordered it.
Re:German police take down 'world's largest darknet marketpl... by jamil7 on Thursday January 14, 2021 @12:16PM (#25779078)
The volume of domestic mail in most countries is huge, it's prohibitively expensive to check all packages. International packages from suspect countries (e.g. The Netherlands) might be checked more frequently. As far as I understand, in the case something is caught by customs it's possible to just deny you ever ordered anything and I doubt law enforcement or customs would bother taking it any further unless it was a huge amount, they'll incinerate it and move on.
Re:German police take down 'world's largest darknet marketpl... by spurdoman77 on Thursday January 14, 2021 @06:14AM (#25774992)
Post can be sent relatively anonymously. Receiving is problematic but for small amounts of weed most drug users dont care.
Re:German police take down 'world's largest darknet marketpl... by asdff on Thursday January 14, 2021 @01:00PM (#25779685)
Just address the package to a derelict propery then stop by on delivery day to scoop it off the front door. Receiving isn’t hard. I also routinely get mail from the past dozen or so tenants who had my address, so you could just use a fake addressee as well.

When USPS does randomly seize a package (such as a fake ID caught at customs) the end result is nothing happens to the receiver other than the package not arriving.

Re:German police take down 'world's largest darknet marketpl... by jokethrowaway on Thursday January 14, 2021 @08:52AM (#25776216)
In the UK: Occasionally someone gets fined and makes it to the local newspaper and all his friends laugh at how unlucky he was.

I suspect the cost for local enforcement or for the post office of preventing weed being sent via mail is just too high to be considered.

Re:German police take down 'world's largest darknet marketpl... by whatatita on Thursday January 14, 2021 @08:55AM (#25776253)
The UK's domestic postal service - Royal Mail - is far too broken to even consider screening illegal packages. They make money from posting this stuff and they're too underfunded and stagnant to address it even they wanted to.
Re:German police take down 'world's largest darknet marketpl... by dcolkitt on Thursday January 14, 2021 @10:51AM (#25777787)
USPS domestic mail requires a warrant to open.