An exploration of the cybercrime ecosystem around Shodan

Bada, Maria; Pete, Ildiko

doi:10.1109/iotsms52051.2020.9340224

Cited by 15 publications

(10 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to find the hidden relationship of darknet users, several studies have been proposed to identify key players of the underground forum [19,20]; while some other works analyzed roles, influence levels, and social relationships of key actors [21]. Sun et al [22] proposed a method that utilizes uploaded text data from forums to reveal private interactions among users, and Bada et al [23] explored the prominent use cases of the specific search engine Shodan to highlight hackers' targets and motivations.…”

Section: Darknet User Data Analysismentioning

confidence: 99%

“…In order to further increase anonymity and avoid tracing of activities of darknet users, the darknet markets frequently transform their IP addresses or domain names [2,6,7], and allow only cryptocurrencies like Bitcoin [4] or Ethereum [5] for the anonymous transactions [8][9][10][11][12][13][14][15][16]. In addition, most of the useful information for user identification is hidden by the darknet market operators or the other additional anonymous technologies [17][18][19][20][21][22][23]. Especially, many darknet market vendors create multiple accounts, called Sybil accounts, within the same market or across different darknet marketplaces.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Detect Your Fingerprint in Your Photographs: Photography-based Multi-Feature Sybil Detection

Kim¹,

Kim²,

Chung³

et al. 2023

PoPETs

View full text Add to dashboard Cite

A darknet market is an online marketplace typically implemented over Tor, where vendors sell illegal products or criminal services. Due to dramatic growth in the popularity of such markets, there is a recognized need for automatic investigation of the market’s ecosystem and identification of anonymous vendors. However, as they often create multiple accounts (or Sybil accounts) within or across different marketplaces, detecting Sybil accounts becomes the key to understanding the ecosystem of darknet markets and identifying the actual relationship between the vendors. This study presents a novel Sybil detection method that extracts multiple features of vendors from photographs in a fine-grained level (e.g., image similarity, main category, subcategory, and text data), and reveals the multiple Sybil accounts of them simultaneously. Each feature is extracted from multiple rich sources using an image hash algorithm, Deep Neural Network (DNN) classifier, image restoration, and text recognition tool; and merged using a weighted feature embedding model. The matching score of each vendor is then calculated to identify not only the exact Sybil accounts, but multiple potential accounts suspected of being associated to a single operator. We evaluate the efficacy of our method using real-world datasets from four large darknet markets (i.e., SilkRoad2, Agora, Evolution, Alphabay) from 2014 to 2015. Because of the anonymity of darknet market, we construct the ground-truth of Sybil accounts by randomly splitting the dataset of vendors into two even parts. We used the first set to train the model, and linked the second set to the original vendor in the first set to evaluate performance. Our experimental results demonstrated that the proposed method outperforms the existing photography-based system with an accuracy of 98%, identifying up to 700% more candidate Sybil accounts than prior work. Additionally, our method detects multiple Sybil accounts for 90% of evaluated test cases, presenting a very different picture of darknet marketplace dynamics than methods that can only detect a single Sybil account for each target vendor. Due to its fine-grained multiple feature extraction from photographs, our method can be more generically applied to various darknet markets for Sybil detection regardless of their languages or categories of items.

show abstract

Section: Darknet User Data Analysismentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Detect Your Fingerprint in Your Photographs: Photography-based Multi-Feature Sybil Detection

Kim¹,

Kim²,

Chung³

et al. 2023

PoPETs

View full text Add to dashboard Cite

show abstract

“…1 At the time of writing, CrimeBB contains more than 100 million posts, some dating back more than 20 years. The dataset has been extensively used for cybercrime research (e.g., [14], [16], [24], [26], [27], [28], [29]).…”

Section: B Underground Forums and Crimebbmentioning

confidence: 99%

Autism Disclosures and Cybercrime Discourse on a Large Underground Forum

Man,

Siu,

Hutchings

2023

2023 APWG Symposium on Electronic Crime Research (eCrime)

View full text Add to dashboard Cite

Prior research on the relationship between autism and cybercrime has been inconclusive. While some research suggests those who had an autism diagnosis are more likely to engage in cybercrime than those without, other evidence indicates a diagnosis of autism is associated with a lower risk of cybercrime offending. Prior research has primarily relied on self-report survey data. To the best of our knowledge, data gathered from cybercrime-related conversations on underground forums has not previously been used to study the relationship between autism and cybercrime offending. This research applies natural language processing (NLP) techniques to a large underground cybercrime forum data. We developed two NLP classifiers to automatically categorise the context and content of forum posts. We find that terms related to autism were mostly used in a negative context, primarily to insult other users. We find that actors who selfdeclare as autistic, post more frequently on the forum than those who do not disclose to be autistic. Despite the increased frequency of their activity, we find those who disclose they are autistic are less likely to discuss cybercrime-related matters, compared to a matched sample of users with similar posting activity.• We build two classifiers that automate the labelling of underground forum posts according to their context and content related to autism. The autism-context classifier identifies the different autism-related context the conversations were in (e.g. self-claimed autistic or using the term to reference other actors or things) and the autism-

show abstract

“…Nawrocki et al reported that unprotected ICS communications were detected by monitoring traffic at an Internet exchange [25]. As for device discovery using Shodan, Bada and Pete [26] surveyed the cybercrime ecosystem, and they clarified that Shodan was used for finding attack targets.…”

Section: A Device Discoverymentioning

confidence: 99%

Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote Management Devices

Sasaki

Fujita

Gañán

et al. 2022

2022 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Geographically distributed infrastructures, such as buildings, dams, and solar power plants, are commonly maintained via Internet-connected remote management devices. Previous studies on detecting and securing industrial control systems (ICS) have overlooked these remote management devices, as they do not expose ICS-specific services like Modbus and BACnet and thus do not show up in Internet-wide scans for such services. In this paper, we implement and validate a discovery method for these devices via their Web User Interface (WebUI) and detect 890 devices in Japan alone. We also show that many of these devices are highly insecure. Many allow access to the status or even the control over industrial systems without proper authentication. Taking a closer look at three prevalent remote management devices, we discovered 13 0-day vulnerabilities, several of which were rated as medium or high severity. They have been responsibly disclosed to the manufacturers. By using honeypots that imitate these systems, we show that over time, only a small number of attackers enter these systems, but some do change critical parameters. Attackers appear to interact more with the system when more facility information is displayed on the WebUI. Finally, we notified operators of 317 vulnerable remote management devices by email and telephone. We reached 212 persons in charge of the devices and received confirmation that our method had correctly identified the device. 50% of the persons in charge of the devices stated that they mitigated or will mitigate the problem. We confirmed their actions via a followup scan for vulnerable devices and found that measures were taken for 58% of the devices when we could reach the persons in charge of the device.

show abstract

An exploration of the cybercrime ecosystem around Shodan

Cited by 15 publications

References 13 publications

Detect Your Fingerprint in Your Photographs: Photography-based Multi-Feature Sybil Detection

Detect Your Fingerprint in Your Photographs: Photography-based Multi-Feature Sybil Detection

Autism Disclosures and Cybercrime Discourse on a Large Underground Forum

Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote Management Devices

Contact Info

Product

Resources

About