Hello world,
The dark web’s largest ever marketplace, alphabay is back. The owner claims he has
returned on a new mission, but some suspect this new site is just a sneaky FBI honeypot.
And a campaigner in the UK was arrested for the high crime of performing a google search.
That’s in today’s episode of the weak web where we break down and dissect cyber
security tech news. The Dark web’s most notorious marketplace
has returned. 4 years after being shut down by the FBI, alphabay - a marketplace 10 times
the size of the infamous silk road has reemerged. Alphabay has a lot of history behind it, the
backstory is intriguing and it’s resurrection is leaving many confused and suspicious that
this is some kind of FBI honeypot.
The original alphabay launched in 2014, it was your typical dark web marketplace, basically
ebay for all things illegal such as drugs, guns, hacking tools, etc… At its peak it
serviced 400,000 users - and in total transacted “at least $1 billion worth of cryptocurrency”.
Needless to say its notoriety made it quite a juicy target for law enforcement as just
3 years after its inception a series of raids took it down in 2017, in what came to be known
as operation bayonet.
This is where it gets interesting, the site was run by 2 individuals, going by the names
alpha02, and DeSnake. Alpha02, was the main man - he was identified as one “Alexandre
Cazes” living in Thailand. An asset seizure document filed in the US details the many
basic mistakes Alex made leading to his arrest. Firstly the email he used in alphabay’s
automated password reset emails was identical to the one on his linkedin profile, also he
had been using his pseudonym ‘Alpha02’ on many other dark web sites since 2008. Upon
his arrest he was logged into alphabay on his laptop, “encryption was wholly absent
on said laptop”. Not only this but the servers hosted in Canada were registered in his name.
With such compelling evidence against him, he was facing the stark reality of going from
living a luxurious lifestyle to facing the rest of his life in a concrete box. Just 1
week after his arrest, Alex was found dead in his Thai prison cell - he had ended himself,
and no wonder. His forerunner ‘Ross Ulbricht’ - owner of the silk road marketplace “was
sentenced to two life imprisonment terms plus 40 years” without the possibility of parole.
Whilst Alpha02’s story may be over, alphabay’s second in command, DeSnake was never charged,
located, or even identified. Free to enjoy the riches he had accumulated, DeSnake disappeared
into the ether. That is until now, you see the new alphabay wasn’t simply named as
such to pay homage to its now defunct predecessor. This new alphabay is run by DeSnake himself.
His identity was confirmed via encryption keys known only to be in his possession, these
are the same ones used by the original alphabay all those years ago.
DeSnake makes his reasoning for alphabay’s resurrection crystal clear. In the new alphabay
‘about’ section, he says “I want to dedicate this to alpha02 first and foremost
we promised each other to go to the bitter end, here I am keeping my end of the deal.
” He claims his friend Alpha02 was “killed by Law Enforcement”, he goes on to assert
“Alpha02 was murdered (Epstein'd, Mcafee'd) by Law Enforcement while they were 'watching'
him.” - though I have seen exactly zero evidence of that and nothing to even suggest
that is the case.
Despite DeSnake’s resolute stance, many people are suspicious that this new alphabay
is simply an FBI honeypot. The argument goes that DeSnake has somehow been compromised,
that some kind of a backroom deal has been done between DeSnake and law enforcement - resulting
in the reemergence of alphabay as merely a trap for dark web sellers. Logically this
argument has some credence, DeSnake is likely already loaded from the original alphabay,
it makes little sense as to why he would get back into the game and risk spending the rest
of his days himself a concrete box, he has little to gain but everything to lose.
Besides, it wouldn’t be the first time in recent history that the FBI have set up a
service with the intent of ensnaring criminals. One such example was anom - in which a dark
web company sold modified google pixels, marketing them as a super secure messaging service for
criminals, this lasted years with thousands of hardened criminals buying the devices.
In reality the whole scheme was just an undercover operation run by the FBI in conjunction with
Australian authorities. Dark web sellers may fear a similar honeypot type situation here
and steer clear of the new alphabay - I would expect this to be the main hurdle to alphabay
reclaiming its title as the foremost dark web marketplace, the gripe could see it fail
to take off simply down to this concern.
The new alphabay is much like the old, but a new set of rules have been laid out in order
to minimise the attention it’ll garner from law enforcement. This includes prohibiting
gun sales, along with covid vaccines, as well as ransomware sales. The site also stipulates
a list of ex soviet countries that aren’t to be targeted, presumably DeSnake is living
in one of them. In an effort to enhance security, the new alphabay will only accept monero.
In his return message, DeSnake lays out a vision for the future. The goal? To create
a “decentralised market network”. Using alphabay’s profits to fund the open source
project, the aim is to “give users and vendors ability to buy, sell and trade in a decentralized
manner.”, “without the need of trusting any market with their cryptocurrency or registering
for each one individually.”. It remains to be seen if this will go anywhere, there’s
already a roadmap page, indicating that this is still very much so in the ideas stage with
not a line of code written. Only time will tell if this project ever sees the light of
day, but if delivered as per DeSnake’s blueprint it could make life very difficult for the
FBI. A campaigner in the UK has been arrested after
performing a simple Google search, our hardened criminal found documents he wasn’t meant
to see, after tweeting the files - the website from which he downloaded them called the cops
on him, resulting in his arrest.
The context behind this story isn’t too groundbreaking, you’re not going to find
any international cyber espionage here. This revolves around a controversial housing development
project in London, which local residents aren’t too happy about. One of the campaigners against
the plans decided to do some detective work, and by detective work I mean a google search.
He was in search of details surrounding a confidential meeting held by the housing company
responsible for the controversy. After finding documents detailing notes taken during the
meeting via a mere google search he posted them on twitter. Unbeknownst to him, the housing
company wasn’t too happy with his OSINT skills, and reported him to law enforcement.
Soon after our Googler received a knock on the door from the Met police, his high crime
of using Google search saw his house raided and him arrested. It would seem the housing
company examined their logs, pulled his IP and reported to police that he had hacked
a password protected area of their website in order to access the files.
It looks like the site in question was so badly designed that whilst download links
may have been held in a password protected area, the files themselves were not. Google
will have simply indexed the actual files, hence why they were visible via a google search.
Not only was he arrested and interrogated by police - but his laptop and phone were
impounded and held for a whole month. After his interrogation he was released under
investigation, eventually the case was dropped, because Googling is not a crime.
The easiest way to level up your security is by using a password manager. I recently
surveyed you guys on instagram - make sure to follow me by the way. I found half of you
guys aren’t even using one! Come on! Reusing passwords is obviously an awful idea, but
even storing passwords in your browser is a massive nono - it’s very common for malware
to simply hoover up autofill credentials.
Now, this video is sponsored by RoboForm, I recently switched to their password manager,
setting up was hassle free, importing passwords from chrome and other browsers was super easy.
Then I just downloaded their browser extension and mobile app, which runs on mac, windows,
linux, ios and android, and I was done. Cross platform automatic password syncing, safe
in the knowledge that malware can’t so easily scoop up your credentials if you’re hacked.
Greatly enhance your security today, for the price of a pizza. If you use the link in the
description you’ll get a whole year’s access for just $16, that’s little more
than a dollar a month. And in the unlikely scenario you aren’t happy with Roboform
for any reason they have a 30 day money back guarantee. Roboform, linked in the description.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go check out my previous video on what exotic malware is and why hackers
are turning to it.
As always sources will be linked in the video description, stay tuned for more hacking videos,
have a good one.