Following our previous report regarding the mutual DDOS attacks of the darknet markets, the situation has just escalated to a full marketplace Cyberwar as Dread Pirate Roberts posted a proof showing that he has the database of the competing market TOR marketplace (link to the original thread on SR2 Forums: http://silkroad5v7dywlc.onion/index.php?topic=8598.0):
To start, I would like to make this clear to everyone involved that Silk Road does not have malicious intentions or an anti-competition attitude, we actually require competition to keep us motivated and for the diversity of the network but in order to fulfill that function the competition must be a safe one which does not put people in harms way or subject to possible exploit. This post I hope will demonstrate to you why claims a market makes does not correlate to the true story and we would like to demonstrate this with Tormarket.
At this moment in time, I also want to clarify in light of recent events the full disclosure everyone deserves to know. This investigation started under the suspicion that Tormarket was behind the ongoing DDOS against Silk Road but has since taken another turn when we looked below the surface a little more. I have no conclusive proof Tormarket did or did not order the DDOS currently hitting us and personally I don’t believe I ever will so I won’t go on about this much more as it is actually not something that matters any more since we are definitely en route to fixing it if you have watched our recent developments, but over Tor such attacks are not trivial to correct. All of this is done in the name of safety and I hope the owners of Tormarket can take this seriously, go away and rethink their strategies because as I will discuss later we didn’t even put much effort in to extracting this data.
What is it I am attempting to prove?
To take it from the home page of Tormarket, I wish to publicly overturn the rumors and falsehoods of some of the below:Quote from: TorMarket
Darknet Market done right
Secure codebase, competent operators, and common sense.
Common sense I will allow that to pass as a subjective matter and how they wish to operate their market is none of my business. Competent operators – again it would depend on your individual definition of that. Secure codebase – let us put that to the test.
Let’s start with the basics
One of the most valuable pieces of any website is the database. It controls so many parts of the site and without it there could be no effective market, so we started trying to extract the information from that. Surprise surprise, it didn’t take long to grab the structure:Now we’ve had a sneak peak at their table structure, it was decided to have a trawl through the messages that vendors had sent to customers. We will list a little segment below, some vendors here might recognize their own messages with of course sensitive information removed from below.</p>
123456789101112131415161718192021 orders table- id- price- status- qt- address- notes- crypto_currency_id- buyer_id- buyer_username- vendor_username- vendor_idvendor table- id- username- banned- currency- location- messages_id- messages_bodyThen an order note which was from a buyer to a vendor, we’ll keep this very select for obvious reasons:</p>
123456789101112131415161718192021222324 Paulwalker : thank you.S0wl : has been sent. if?17538 : here's a screenshotStrings999 : hello,i was sent an invite whileOGCorleone : hello, thanks for your order :)Puntitot1 : has been sent. if?Berndman : hello, your order is ready to ship. you have to finalize now.Crepuscular : hello, did you order here or on heep? what am i missing?Jackpot1875 : hello, your order is ready to ship. you have to finalize now.Spartanec731 : hello to you as well . indeed it is the original haizenberg , and offence non taken , :)Dogtanian : hello my friend good to hear from you,Levlvov70 : hehe i was joking, but you seem cool man. i ll send you a sample of one each...Az12er34ty56 : hello! i requiered a seller account here i am matrixx on bmr with more than 180 positives feedback!Strom : hello, your order is ready to ship. you have to finalize now.MickeyMantle : hi there, when your product has arrived please mark as arrived and set a positive feedback on your experienceQwertyqazwsx : haha, won't do so brother... your order will ship asap.Toefia : abgemacht. dann sind 7 tage rum und dann kann ich dir reship anbieten.Spaniard : always verify identity using pgp keyGtiv : allso mit unserem shop werden wir im lauf der nexten woche online gehen. wenn du willst kanst du auch dar ber verkauf n. wegen den geb ren bist du mit 1 einverstanden? einfach f r hosting arbeit usw. ich werde noch ein paar andere verkaufer fragen abJTLeary : always verify identity using pgp keyMrTrump : ah yes i just saw it! i think with out 1700 orders and 100 feedback on sheep it will be going strong! -)Slappfisk : barePiccolabesti : azi fbMushinmusa : bajs fr n katter?...Worried? So were we.</p>
1234 From: JackCubrickTo: GodfatherNLPurchase: *** 1 gram pure uncut cocaine ***Message: hey there. please ship asap as i would like to place a large order before christmas once i have confirmed weigh in and quality
Up to this point we weren’t looking for any kind of mass data extraction, but in the interest of ensuring the users of Tormarket are safe, we had to do it anyway. The summary of some of the data we went through was to see who the top buyers were, something of equal interest to law enforcement as vendors except it is more likely a buyer will have leaked personal information on the site than a vendor. So who are the top buyers:So user icq has the highest amount of products purchased. We investigated a little further to see precisely what he bought (and we could do this for every buyer I would like to point out):</p>
123456789101112131415161718 Top 15 Buyers by number of products purchasedBuyer ID Buyer Name16759 icq13621 jackcubrick12226 shedrik11994 dreamsage13100 purpleextreme12274 [redacted]18634 [redacted]10625 sebb66g13572 choicethespi16611 felsad14731 marvel11001 madcunt3313127 sleep1218308 roxas5013132 rstevensSomebody tell him you don’t need to pay these days. Let’s try another (jackcubrick):</p>
1234567891011 ID Buyer Vendor Product16759 icq moneysell Brazzers.com - [LIFETIME PORN PREMIUM ACCOUNT]16759 icq rainbowbear INTERNATIONAL 100 grams bulk methylone M1 moonrock 99.9% purity16759 icq moneysell Teenpornopass.com - [LIFETIME PORN PREMIUM ACCOUNT]16759 icq moneysell PornPros.com - [LIFETIME PORN PREMIUM ACCOUNT]16759 icq moneysell Asiansexdiary.com - [LIFETIME PORN PREMIUM ACCOUNT]16759 icq moneysell Babes.com - [LIFETIME PORN PREMIUM ACCOUNT]16759 icq dipsycards An Idiot's Guide to Fleeing to Mexico16759 icq positive Xbox One Console!16759 icq moneysell 3dxstar.com - [LIFETIME PORN PREMIUM ACCOUNT]16759 icq moneysell Sexart.com - [LIFETIME PORN PREMIUM ACCOUNT]So can this extraction be scaled up to getting entire lists of users? Well we found out:</p>
12345678910111213 Purchases made by jackcubrickVendor: ProductPureHeaven : 3 Grams of Tested 90% Cocaine...Verified Vendor!ozconnection L 1 gram Peru Cocaine Australiasunwu : 250mg Pure Alprazolam Powder (Xanax) - USAtomorrowman : 3 grams tan mdma crystals 85%+ puritydemoniak : 2GR PINK Speed (dry)sunwu : 250mg Pure Alprazolam Powder (Xanax) - UKwilfred : 3.5g Hydroponic BUDS - HIGH THC - New Vendor Special !!justincase : 10 regular seeds - Hindu&#39;s Shivauperspeedbros : 2g of Speed -- Amphetamine sulfategodfathernl : *** 1 gram pure uncut cocaine ***