There’s a mistaken belief that law enforcement is somehow behind the curve when it comes to catching criminals on the dark web. That may have been true once, that they didn’t have the technical chops. It no longer is true. Plus, sometimes, criminals make really dumb rookie mistakes, like reusing passwords. (This was the same mistake Chelsea Manning made. She used the same password to encrypt files that she used for her Macbook.)
Dutch police stealthily took control of Hansa, a dark web marketplace. They didn’t shut down the site until a month later, after they’d had time to plant some bombs and copy evidence. First off, some Hansa vendors stupidily used the same login name and password on Dream, another dark web marketplace, that they used on Hansa. Law enforcement logged on to those Dream accounts and changed the passwords, locking out the vendors.
But wait, there’s more. Police replaced confirmation text files with Excel spreadsheets that had a hidden image. The image was hosted on Hansa. When the user opened it on their computer, it accessed the image on the server, and police logged the IP address. If the user was smart, they would have used a VPN and Tor so no worries. However, I’m guessing some users didn’t.
Law enforcement also got contact info for 10,000 buyers…