Forums are Forever – Part 2: Shaken, but not Stirred

Cybercriminal forums continue to thrive despite law-enforcement takedowns and the emergence of more efficient and secure alternatives. Digital Shadows (now ReliaQuest) took a deep-dive into the cybercriminal underground to investigate the persistence of forums, uncovering several reasons they remain attractive amid appealing alternatives.

In part 1 of this blog series, we dug into the evidence around forums’ continued popularity. Part 2 looks at cybercriminal forum users’ resistance to moving away from the forum model.

To access the full, in-depth research report from the team, visit our resources center below.

Playing it safe, resisting forum alternatives

Ways to increase security, efficiency, and profit are common topics of discussion on cybercriminal forums. As such, examples abound of forum users expressing doubts about moving away from the forum model or even, sometimes, about introducing measures to improve forums’ functionality and security. Their conservatism stems from trust in the old model, and specific concerns about the newer ones mentioned below.

Messaging applications

In an October 2019 discussion on Torum, one member proposed creating a Telegram or Wickr group for Torum users. Some users supported the idea, but another wrote “This is the most stupid idea ever… I think it is against this forums [sic] rules too?” In a separate Torum thread discussing the merits of Telegram, one user stated, “i like Telegram, but I would never send realy [sic] sensitive stuff with that”. Their sentiment also extended to other platforms: “one of my real life dealers got busted by writing with WhatsApp!” Even for forum users who have turned to new messaging applications, old habits die hard. We’ve seen forum users create Discord channels, only to replicate the forum layout or structure with this newer technology.

Tor domains

In June 2018 Exploit introduced a Tor version of the site. But over a year later (October 2019), the Tor version of the forum was still not functioning as expected, and users were complaining about long loading times, complete inaccessibility of the site, and incomplete functionality. Even so, the number of complaints was surprisingly low, considering how long the Tor site had been operating at this suboptimal level. Comments from members revealed that many users hadn’t switched to the dark web version of the site―they actually preferred the older, less secure, clear web URL.

Figure 1: Exploit Tor domain announcement

Blockchain DNS

Blockchain DNS technology, a decentralized system for top-level domains, brings significant security advantages―think bulletproof-hosted platforms and obscured malicious activity. It’s also much harder for security services to target blockchain DNS sites because they’re not regulated by a central authority in the way conventional DNS sites are. We wrote up an in-depth blog if you’re interested in learning more: How Cybercriminals are using Blockchain DNS: From the Market to the .Bazar.

Even in the face of these benefits, almost no reputable cybercriminal platforms have embraced this new development; the AVCs Joker’s Stash and Mr Swipe are among the only well-known cybercriminal sites that have.

Similarly, most forums have shied away from using blockchain technology to, for instance, store back-end databases and code to support front-end user interfaces. The Russian-language ProMarket and the English-language L33T both introduced multiple blockchain DNS URLs, but these versions of the forums were down more often than they were functional; the clear web URLs were seen as a much more stable alternative. Add to that perception users’ concerns about the public records of blockchain interactions, and you can see why threat actors are reluctant to abandon forums.

Another factor in threat actors’ lukewarm uptake of blockchain technology is the atypical method required to access such sites. Typically, blockchain DNS sites are accessed via Chrome, with a browser extension that enables access to sites with certain URL suffixes. But identifying, downloading, and running the appropriate blockchain DNS extension takes significant skill and knowledge. This much is evident just by scanning the lengthy access instructions provided by Joker’s Stash―and by reading the many forum complaints about not gaining access (see Figures 2 and 3).

Figure 2: Exploit user expressing difficulty accessing Joker’s Stash via browser plugin

Figure 3: Torum user asking how to access Joker’s Stash site

Operational security challenges have also left many threat actors apprehensive when it comes to using blockchain DNS sites. It’s not possible to use the extension with a secure browser (such as Tor), meaning the usual “double lock” (secure browser plus VPN) will be lost. Using anything but the latest version of the extension could also expose a user’s system details. More-accomplished threat actors would have no problem adapting their usual security posture, but entry-level cybercriminals may balk at such conditions. Uncertain of the benefits this technology presents, many stick with their trusty, accessible cybercriminal forum.

Figure 4: Joker’s Stash blockchain DNS instructions

AVCs

Using AVCs to efficiently trade credit-card details has been the norm for a number of years, although recent forum discussions suggest that cybercriminals see a downside. In an October 2019 thread on the Russian-language carding forum Omerta, one user advised, “better use a private vendor… all the rest is trash even [sic] joker”, referring to the Joker’s Stash AVC.

The recent breach of the AVC BriansClub, and ensuing surge in attention from the media (and, possibly, law-enforcement bodies), may have led some AVC affiliates (i.e. the suppliers of the stolen credit-card data) to question the risks involved in selling their data to a third-party AVC. Although AVCs offer an alternative to carding forums, they haven’t replaced this method of selling. For credit-card vendors, advertising on cybercriminal forums can mean a bigger profit and greater control over who can view or buy the data.

Figure 5: Torum post selling credit-card details

So, given the vast range of alternatives out there, why are users still so reliant on the forum model?

The third and final installment of this blog series will investigate several characteristics of forums that make them ideal for supporting cybercriminal communities.