7 ms·

Drug Market ‘Agora’ Replaces the Silk Road as King of the Dark Net

61 points by e15ctr0n 12y ago

GrinningFool 12y ago
I noticed that in the weeks and months before Silk Road went down, we had some interesting things happen: 1. several articles like this one 2. statements from the FBI that it was untraceable 3. the implication in tech media that it was 'safe' to use, with usual caveat emptor verbiage. I know we have a sample size of one here, and there's no guarantee that steps 2 and 3 above will follow - but to me, it seems that mainstream coverage of anything like this is a sure signal to bail out.
- nazgulnarsil 12y ago
  Are you implying that the silk road was not safe for people who followed protocols?
  - GrinningFool 12y ago
    Nope - but I suppose I am implying that significant numbers of people using such services know or care little of protocols. Instead they're happy to go with the idea that it's a nicely packaged untraceable means of getting what they're after.
  - MichaelGG 12y ago
    Correct. The sellers made a huge footprint by mailing so much on such a regular basis. This lead to major sellers getting busted. At which point all the buyers that purchased from them may have their order details released.
    - nazgulnarsil 12y ago
      this is incorrect. Sellers drop off packages over a wide area anonymously. They don't just mail stuff.
      - MichaelGG 12y ago
        nod was found because he (or his girlfriend) dropped off packages over a "wide area" by going into post offices and mailing things. The indictment claims the investigator went to the PO and asked if they had noticed a certain car, and the employees there were readily able to provide details on a individual that made frequent mailings. A large seller has too many packages to easily avoid leaving a trace. Automated analysis of video recordings near a post drop, for instance, could reveal these patterns. Apart from that, sellers often mess up on opsec, just because it's so hard to maintain over such a large period of time. That's just how it is.
- gabriel34 12y ago
  If this is a US operation, don't the US law prohibits entrapment? Also, doesn't it seem more likely a surge in public interest is what originated the operation, instead of the other way around?
  - bravura 12y ago
    That's not entrapment. An undercover cop can ask you to commit a crime without entrapping you. It's only entrapment if the police induce you to commit a crime that you wouldn't commit otherwise. Hence, them offering you the opportunity to commit a crime is permitted by law. See this illustrated guide to understand better: http://thecriminallawyer.tumblr.com/post/19810672629/12-i-was-entrapped http://thecriminallawyer.tumblr.com/post/19810672629/12-i-wa...
    - deleted 12y ago
      [deleted]
    - derefr 12y ago
      What I learned from that: the easiest way to detect undercover cops is to ask them to--or really, entrap them into--committing an unrelated crime, e.g. hurting someone. Imagine "rewarding" the new member of your drug ring by giving them a hired escort who has been paid to resist all acts upon them, and then locking the new member and the escort in a room together with some extremely brutal S&M "toys." You'll get lots of false positives--people who don't actually get their jollies from harming others--but it's the false negatives that are important here, so maybe populating your organization with sociopaths is a low price to pay. On the other hand: is the boss committing a crime just by setting up this "reward?" They wouldn't mention anything about having to harm the escort, it'd just be implicit in the setup that if you're that type of person, the situation is easy to take advantage of.
      - bardot 12y ago
        No escort is stupid enough to participate in that. Only men would do that.
      - 12y ago
MichaelGG 12y ago
I thought the Tor project sort of agreed that Hidden Services could be discovered by a not-that-awesome adversary. Doesn't that vastly increase the risk of being found? After all, with The Silk Road, part of the evidence was that they had imaged the VM -- but they didn't say how they found that VM in the first place.
- jamoes 12y ago
  Yeah, Tor as a whole, and Hidden Services specifically are very vulnerable to traffic analysis attacks. I'd love to see a project with a real focus on anonymous publishing of content. Tor's original goal was anonymous retrieval of content, with anonymous publishing just added on as a secondary goal. In order to make anonymous publishing robust against traffic analysis, it may be necessary to sacrifice the "real-time" goal that Tor has.
  - api 12y ago
    IMHO you'd have to distribute the data and the computation so that there is no single point to find.
    - contingencies 12y ago
      Agreed. Some ideas for the resistance of traffic analysis in the provision of Tor hidden services: layered architecture with aggressive caching at edge nodes, non-deterministic latency or update fetch algorithm (eg. random) between nodes, use of push rather than pull (edgier nodes have no knowledge of the location of content-publishing parent, only its key to auth inbound updates as they are supplied from unique addresses periodically) where feasible.
  - EGreg 12y ago
    Freenet and now Maidsafe
    - hackerboos 12y ago
      Freenet is only good for static pages as I recall.
api 12y ago
Who else has wondered whether SIGINT types might allow things like this to run in order to bolster the perception that Tor is not traceable? In WWII they allowed the enemy to sink whole ships to accomplish same.
- Jayschwa 12y ago
  > In WWII they allowed the enemy to sink whole ships to accomplish same. Whoa, that's interesting if true. Do you have any links you can share about this?
  - MichaelGG 12y ago
    In general, you don't want to burn any good intel source. If a bunch of targets mysteriously got out of the way right before an operation, that would let the other side know they had a leak.
  - CamperBob2 12y ago
    Sinking ships may be the least of it. Some say Churchill allowed Coventry to be firebombed to keep from tipping the Germans off to the successful work at Bletchley Park.
  - andrewchambers 12y ago
    Imagine you stole the enemy encryption codes, and are listening and waiting for intel on an upcoming invasion that can save your whole country. Instead you hear chatter about how they are going to bomb a single ship. Do you save the ship and let the enemy know you have access to the encryption codes? Or do you let the ship be destroyed and keep listening for the more important info? This decision is pretty black and white too. Imagine if your mother was on the ship. Or it was half your navy. Some of the decisions world leaders need to make are horrible.
big_youth 12y ago
I dislike Agora. The site is rarely up and when I do manage to login most of my requests time out. What I'm interested in is how much money the major sites are making. The much smaller Cannabis Road was recently hacked and robbed of $130k in bitcoin from various escrow and user wallets. I can only imagine what the major players are making.
olefoo 12y ago
One thing I'm mildly surprised hasn't shown up more in these types of markets is "pirated" or outright stolen clinical pharmaceuticals. Drugs like Humira or Etanercept are expensive and need to be taken for years ( usually for the rest of your life if you really need them ) and are heavily advertised. Selling Humira at $200 USD / dose would be profitable if you were using stock diverted from Abbott Labs, and selling a similar product using a black market supply-chain would still be effective; even if the trust in the product would be less than most sensible people would accept. Of course it would get not just the regular regulators on your tail, but the full panoply of intellectual property and medical enforcement. From a customers point of view it's pretty easy to justify paying a tenth of the "list price" for a drug that keeps you alive and functional; so the demand is there.
- randallsquared 12y ago
  Essentially everyone who needs those gets them through insurance, medicaid, or some such. They are therefore quite price-insensitive (which is it's own problem, of course).
  - olefoo 12y ago
    Empirical evidence says that is not the case; and that most people who need them have to fight their insurance company for them on a semi-regular basis. If only that class of drugs were available at a competitive price so that individual consumers had a way to route around the damage that is our healthcare system.
    - randallsquared 12y ago
      Spending 10-15 hours on the phone two weeks a year to get the insurance company to pay 3K/month of medicine is cheaper for most people than spending 300/month themselves. Even if, as in this example with numbers pulled from nowhere, it's 1/10th the cost in monetary terms, the risk is not worth the savings for a drug that is actually necessary, rather than recreational or mere enhancement. A flatmate of mine has an immune deficiency disease which requires a drug every week which costs more than 3K/month, which is covered by her healthcare. If she doesn't get it, within a few months she'll be in the hospital with serious infections. She has to fight with the healthcare folks two or three times a year to remind them that this is actually a life-or-death matter for her, and then they grumble and continue paying. It in no way makes sense for her to start paying money out of pocket for questionable drugs from a source that might cease to exist in a month or two. If nothing else, assuming she needed to get it through "legitimate" channels again, they would use the time when she officially wasn't getting it as evidence that she doesn't need it. The risk around quality and continuing availability mean that there's no good way to use a shadowy market for anything which is actually required for life, if it's even semi-rare.
deleted 12y ago
[deleted]
jedanbik 12y ago
Am I reading an advertisement?

61 points by e15ctr0n 12y ago

I noticed that in the weeks and months before Silk Road went down, we had some interesting things happen: 1. several articles like this one 2. statements from the FBI that it was untraceable 3. the implication in tech media that it was 'safe' to use, with usual caveat emptor verbiage. I know we have a sample size of one here, and there's no guarantee that steps 2 and 3 above will follow - but to me, it seems that mainstream coverage of anything like this is a sure signal to bail out.

nazgulnarsil 12y ago
Are you implying that the silk road was not safe for people who followed protocols?
- GrinningFool 12y ago
  Nope - but I suppose I am implying that significant numbers of people using such services know or care little of protocols. Instead they're happy to go with the idea that it's a nicely packaged untraceable means of getting what they're after.
- MichaelGG 12y ago
  Correct. The sellers made a huge footprint by mailing so much on such a regular basis. This lead to major sellers getting busted. At which point all the buyers that purchased from them may have their order details released.
  - nazgulnarsil 12y ago
    this is incorrect. Sellers drop off packages over a wide area anonymously. They don't just mail stuff.
    - MichaelGG 12y ago
      nod was found because he (or his girlfriend) dropped off packages over a "wide area" by going into post offices and mailing things. The indictment claims the investigator went to the PO and asked if they had noticed a certain car, and the employees there were readily able to provide details on a individual that made frequent mailings. A large seller has too many packages to easily avoid leaving a trace. Automated analysis of video recordings near a post drop, for instance, could reveal these patterns. Apart from that, sellers often mess up on opsec, just because it's so hard to maintain over such a large period of time. That's just how it is.
gabriel34 12y ago
If this is a US operation, don't the US law prohibits entrapment? Also, doesn't it seem more likely a surge in public interest is what originated the operation, instead of the other way around?
- bravura 12y ago
  That's not entrapment. An undercover cop can ask you to commit a crime without entrapping you. It's only entrapment if the police induce you to commit a crime that you wouldn't commit otherwise. Hence, them offering you the opportunity to commit a crime is permitted by law. See this illustrated guide to understand better: http://thecriminallawyer.tumblr.com/post/19810672629/12-i-was-entrapped http://thecriminallawyer.tumblr.com/post/19810672629/12-i-wa...
  - deleted 12y ago
    [deleted]
  - derefr 12y ago
    What I learned from that: the easiest way to detect undercover cops is to ask them to--or really, entrap them into--committing an unrelated crime, e.g. hurting someone. Imagine "rewarding" the new member of your drug ring by giving them a hired escort who has been paid to resist all acts upon them, and then locking the new member and the escort in a room together with some extremely brutal S&M "toys." You'll get lots of false positives--people who don't actually get their jollies from harming others--but it's the false negatives that are important here, so maybe populating your organization with sociopaths is a low price to pay. On the other hand: is the boss committing a crime just by setting up this "reward?" They wouldn't mention anything about having to harm the escort, it'd just be implicit in the setup that if you're that type of person, the situation is easy to take advantage of.
    - bardot 12y ago
      No escort is stupid enough to participate in that. Only men would do that.
    - 12y ago

MichaelGG 12y ago

I thought the Tor project sort of agreed that Hidden Services could be discovered by a not-that-awesome adversary. Doesn't that vastly increase the risk of being found? After all, with The Silk Road, part of the evidence was that they had imaged the VM -- but they didn't say how they found that VM in the first place.

jamoes 12y ago
Yeah, Tor as a whole, and Hidden Services specifically are very vulnerable to traffic analysis attacks. I'd love to see a project with a real focus on anonymous publishing of content. Tor's original goal was anonymous retrieval of content, with anonymous publishing just added on as a secondary goal. In order to make anonymous publishing robust against traffic analysis, it may be necessary to sacrifice the "real-time" goal that Tor has.
- api 12y ago
  IMHO you'd have to distribute the data and the computation so that there is no single point to find.
  - contingencies 12y ago
    Agreed. Some ideas for the resistance of traffic analysis in the provision of Tor hidden services: layered architecture with aggressive caching at edge nodes, non-deterministic latency or update fetch algorithm (eg. random) between nodes, use of push rather than pull (edgier nodes have no knowledge of the location of content-publishing parent, only its key to auth inbound updates as they are supplied from unique addresses periodically) where feasible.
- EGreg 12y ago
  Freenet and now Maidsafe
  - hackerboos 12y ago
    Freenet is only good for static pages as I recall.

api 12y ago

Who else has wondered whether SIGINT types might allow things like this to run in order to bolster the perception that Tor is not traceable? In WWII they allowed the enemy to sink whole ships to accomplish same.

Jayschwa 12y ago
> In WWII they allowed the enemy to sink whole ships to accomplish same. Whoa, that's interesting if true. Do you have any links you can share about this?
- MichaelGG 12y ago
  In general, you don't want to burn any good intel source. If a bunch of targets mysteriously got out of the way right before an operation, that would let the other side know they had a leak.
- CamperBob2 12y ago
  Sinking ships may be the least of it. Some say Churchill allowed Coventry to be firebombed to keep from tipping the Germans off to the successful work at Bletchley Park.
- andrewchambers 12y ago
  Imagine you stole the enemy encryption codes, and are listening and waiting for intel on an upcoming invasion that can save your whole country. Instead you hear chatter about how they are going to bomb a single ship. Do you save the ship and let the enemy know you have access to the encryption codes? Or do you let the ship be destroyed and keep listening for the more important info? This decision is pretty black and white too. Imagine if your mother was on the ship. Or it was half your navy. Some of the decisions world leaders need to make are horrible.

big_youth 12y ago

I dislike Agora. The site is rarely up and when I do manage to login most of my requests time out. What I'm interested in is how much money the major sites are making. The much smaller Cannabis Road was recently hacked and robbed of $130k in bitcoin from various escrow and user wallets. I can only imagine what the major players are making.

olefoo 12y ago

One thing I'm mildly surprised hasn't shown up more in these types of markets is "pirated" or outright stolen clinical pharmaceuticals. Drugs like Humira or Etanercept are expensive and need to be taken for years ( usually for the rest of your life if you really need them ) and are heavily advertised. Selling Humira at $200 USD / dose would be profitable if you were using stock diverted from Abbott Labs, and selling a similar product using a black market supply-chain would still be effective; even if the trust in the product would be less than most sensible people would accept. Of course it would get not just the regular regulators on your tail, but the full panoply of intellectual property and medical enforcement. From a customers point of view it's pretty easy to justify paying a tenth of the "list price" for a drug that keeps you alive and functional; so the demand is there.

randallsquared 12y ago
Essentially everyone who needs those gets them through insurance, medicaid, or some such. They are therefore quite price-insensitive (which is it's own problem, of course).
- olefoo 12y ago
  Empirical evidence says that is not the case; and that most people who need them have to fight their insurance company for them on a semi-regular basis. If only that class of drugs were available at a competitive price so that individual consumers had a way to route around the damage that is our healthcare system.
  - randallsquared 12y ago
    Spending 10-15 hours on the phone two weeks a year to get the insurance company to pay 3K/month of medicine is cheaper for most people than spending 300/month themselves. Even if, as in this example with numbers pulled from nowhere, it's 1/10th the cost in monetary terms, the risk is not worth the savings for a drug that is actually necessary, rather than recreational or mere enhancement. A flatmate of mine has an immune deficiency disease which requires a drug every week which costs more than 3K/month, which is covered by her healthcare. If she doesn't get it, within a few months she'll be in the hospital with serious infections. She has to fight with the healthcare folks two or three times a year to remind them that this is actually a life-or-death matter for her, and then they grumble and continue paying. It in no way makes sense for her to start paying money out of pocket for questionable drugs from a source that might cease to exist in a month or two. If nothing else, assuming she needed to get it through "legitimate" channels again, they would use the time when she officially wasn't getting it as evidence that she doesn't need it. The risk around quality and continuing availability mean that there's no good way to use a shadowy market for anything which is actually required for life, if it's even semi-rare.

deleted 12y ago

[deleted]

jedanbik 12y ago

Am I reading an advertisement?