OPSEC and Trust in an Underground Cybercriminal Forum
There are perhaps tens of thousands of forums and sites in the visible and dark webs dedicated to criminal activity. Digital Shadows pays special attention to these forums and sites in the hope of learning more about them, their participants and the activities taking place in order to better serve our customers. One such forum which Digital Shadow’s pays particular attention to is the dark web cyber criminal forum known as ‘Hell’. This forum has become particularly interesting given the fact that data from two high profile breaches the Adult Friend Finder and Westnet breaches was hosted and made available for use by cyber criminals.
Digital Shadows first wrote about the ‘Hell’ forum as a result of its connection to the Adult Friend Finder breach data. Since then, the Digital Shadows team has been monitoring the site for other activity and noted that on July 15, 2015 the site had become unavailable. One of the site’s administrators and moderators, PING, had been observed in conversations dating back to June of 2015 with other site administrators and prominent forum members discussing upgrading the forum’s security in order to ward off security researchers and law enforcement. At the time of this writing it is unknown whether that was what lead to the two week period where the site was unavailable however, it is our belief that this could have been a contributing factor. It has come to the attention of the Digital Shadows team that PING is allegedly no longer involved in the administration of the forum and may have in fact been arrested in Canada on charges stemming from credit card fraud.
The site re-emerged on July 31, 2015 along with a note posted by an actor calling himself RonB that described the fact that this was a new forum with new rules and security measures in place. The new version of the forum retained the use of the same logo and tag line and was available on the same .onion site as the old forum. The post by RonB stated that new login credentials were being generated for members and that new members or people seeking membership to the forum would only be able to gain membership through the use of invitation codes generated by existing members though this may require a predetermined degree of status within the forum.
RonB claimed that the forum was now built on the Bootstrap framework in order to allow easier access via mobile devices. Additionally, RonB noted that the topic of leadership was no longer a topic for public discussion and that ROR[RG], a well known member of the previous version of the ‘Hell’ forum known for his work in trying to sell the breached data from the Adult Friend Finder breach, would now be responsible for the highest level of decision making. Furthermore, RonB wrote that that all activity on the forum is now unlogged – a decision made in order to make it more difficult for law enforcement to assemble cases against users. Finally, RonB stated that the site’s administrators would now monitor user activity more closely than ever before. He went on to say that they would remove time stamps in order to make it more difficult for law enforcement to build cases against the forum’s members. Since the forum has come back online, Digital Shadows has observed less activity within the forum. It should be noted that at the time of this writing, August 10, 2015, the forum again appeared to be down.
These updated security measures are consistent with previous assessments that law enforcement operations targeting criminal forums such as Darkode or Hell are likely leading to improved OPSEC on the part of criminal actors. Moreover, perhaps what is most interesting are the implications of these new security measures on the members of the forum itself. Trust is no longer simply granted; it must be earned via demonstrated action or vouching. The impact to the criminal ecosystem will no doubt be apparent in how smoothly the forum continues to run and whether or not participants in the forum remain suspicious of one another.