[Andrew Lindner] Great, all right, sorry about that.
So what we're going to do here is we are going to use
Google search and study the question ecologically
by looking at the number of people searching
on Google for Tor in a state year, so it's going to be New York
2006, 2007, and so on, and look at what are the conditions in
particular state years. And then what are the, what's the
level of Tor interest in that place. Now you might be
saying well just because people are searching
for Tor does that mean that it bears relation to
actual Tor usage and actually this has been studied
in a number of different studies to track things where we can count the real
life thing so we can compare google search
to some kind of outcome so there there's some
evidence that google search is a good indicator of local interest of
various things now one thing to be really careful of
here as we interpret results is that this morning when Gareth was
giving numbers about users
that are those are actual Tor users. There's a big difference between someone
searching what is Tor and someone being like a hardcore daily
user of Tor. And so this gives us a sense of
interest in Tor in a place but not necessarily
necessarily of hardcore usage or even light usage. So that's
something we want to be careful with all right so some things we should
expect um in this study one of the stories i
said was that people are pushed to Tor
by surveillance if that's the case we would expect that in state years
where there were more searches for Edward Snowden after his revelations of
mass surveillance where people are searching for more on
Edward Snowden they're interested in that topic
we would see more interest in Tor likewise
if it was more the pole effect they're drawn by the lore of the
dark web we would expect that in places where there are more
searches for dark web, deep web, silk road, for there to be
higher levels of Tor. We have several controls in this study
one has to do with politics now politically the the right
the political right has had sentiment and not wanted the government
spying the political left tends to defend civil liberties in this
study we have two measures of political attitudes in a state
one is a citizen ideology measure from left to right
and it measures the electorate's attitudes in that state year how liberal
or conservative they are the other is a political measure of the
state legislators how conservative or liberal they are and
you know it's a little bit hard to tell because
maybe more liberal places would have some reason to be
more opposed to surveillance maybe conservative places would be
overall though because the left has been more outspoken on surveillance issues
I went into this thinking that more liberal places would tend to have
greater interest in Tor we also thought that several different
demographic factors would matter specifically we
thought that you know Tor would be, I was picturing
San Francisco when I started this study like that's where Tor would be big it
would be like kind of populous uh highly educated
disproportionately white areas and so we control for a number of demographic
conditions of the state years
we also tore if you go to a tour project place they tell you that journalists
tech industry people and people in
activists are using tor and so we thought okay maybe labor representation
in those state years would also affect it so we control for
the percent of journalists the percent of tech
workers and because of a multi-collinearity
issue the number of legislators so as an
indicator of the number the size of the political sector in that
state so we expect for tor to be higher in
those places because that's what the torah project says
places with more representation those industries
so to go about doing this we got whoops data from a few sources one source is
google trends there we took the dependent variable tor
as well as measures of how much interest there was in
edward snowden how much interested there was in
dark web deep web silk road from the american community survey which
is a census run survey the best source of community level data we took our
demographic measures we were able to get the political
measures from ippsr and then got the labor measures
from the bureau of labor statistics in doing this analysis we put this all
in a multi-level model and run fixed effects models i'm not going to
show you that instead i'm going to show you try to
visualize this for you in a few ways a few things one during this time period
tor interest goes up um
this is the distribution of variation over time
of interest and tour by state here's virginia and dc
virginia's kind of middle of the pack for tour interest
dc is at the very low end and you can see there are some states with a lot of
variation states with fewer variation less variation by year here's what it
looks like for the country as a whole over time so we can see it growing
all over the country 2014 is the peak year now onto the big
hypotheses surprisingly not correlated with tor
at the state year level were most of the demographics
and any of the measures of labor representation
to give you one uh visualization of what that looks like
here is tor interest by median household income
if i were fitting a line through that it would be a flat line
and so there's just no association whatsoever
and this holds for most of those measures
it's definitely not a red state blue state thing
hunting is popular in the red states as a search
mad men is popular in the blue states as a search
here's what tor looks like it has some red states
some blue states and our model none of the political measures were
statistically significant
what was significant was uh at the point one level uh although
this is a population of state years um was the dark web and what we can see
is that um for all but 2015 there's a significant association between
interest in the dark web and tour volume now you can see the values are pretty
cluster rather lowly uh very tightly in the
early years the first row um that's because there's just low
levels of search for everything we could change that access and it would
wind out but still there is a pretty uh steep slope
a strong relationship between the two so that's the pull
on the push side of things here's the correlation between
searches for snowden and um tour and what we can see is especially
in 2013 the year the news came out there's a pretty strong relationship
this is the predicted value in the regression model so so
key findings like i said interest in torah has grown over time
it tends to be in states with slightly smaller than average
uh populations for every 10 percent increase of the
interest in edward snowden we found a 7.7
increase in tour giving some evidence uh for uh the push
um we also found for every 10 increase in dark web searches
there's a seven percent increase in tour searches
giving some evidence for the story of the poll
uh finally tour much to my surprise does not appear to be associated with
either labor conditions or uh demographics
of the area now what this might suggest is that inequalities in tour use those
demographics that were non-significant that the differences are more within
states than between states so we can't observe it here
but tor is not a culture wars issue like saying merry christmas or happy holidays
uh it's not a left right sort of a thing
um it's also not particularly associated with industries as to
the tour project uh suggests um of the two the push and the pull
we find that the snowden revelations is a better predictor of tor
overall than deep web interest but both of them are fairly strongly
associated thanks very much for listening i'd be
happy to answer any questions okay thank you we have a few minutes for
questions i see one right there very quick yeah how you doing sir so
this seems to be sort of a introspective like u.s
uh perspective only did you have to do some research uh globally with like so
for example like the arab spring you know so our spring kicking off do we
see any sort of influx of dark web usage for the tour right so i actually think
uh eric could answer that better than i
could because his study uh was uh cross national mine was
just within the u.s um so yeah and the unfortunate thing is mine
started right after that so i don't have the data that would
be needed in order to say here's the effect of the arab spring
it you know in general um we did see you do see substitution when there's
major political events towards these sorts of technologies in terms of
user data but it tends to it tends to spike in the decline uh a
fair bit so not necessarily the best sort of
cross-national answer because i don't think we've been able to
look at that yet
hi um so when looking at the snowden as a predictor for dark web interest
it's interesting one of those i feel like
people who are interested in edward snowden are
likely to be interested in the dark web and are likely to be interested in tour
in general right there's i feel like there's a high correlation
between those groups of people so you're it's fair to say
like are you saying that there's just a
relationship between the two are you saying that one causes the other
right so this is a great point because what i show you is
uh deep web by tor and snowden by tor but i'm not showing you deep web by
snowden and you're correct in your intuition that
uh yes in fact places that are interested
in the dark web or deep web are also unusually interested in edward snowden
um you can't see it with these scatter plots but
in the larger model we run it tries to control
so what it attempts to do is say taking two places where
uh where interest in the deep web is high does the one with more interest
in edward snowden then have more interest in tor while
simultaneously doing the other one by doing that kind of controlling we tr
attempt to disentangle it but ultimately it is true that
places that are interested in one also tend to be places interest in the other
so on the slide where you had the uh the chart showing all of the different
states ranked um at a quick glance it looked to me
like the ones at the top of the chart were
states that are much more rural than others were you able to take the
data down to more of a smaller uh location level right so that you
could see does that hold true even in states that have big cities
great question so uh two answers to that the first answer
is that we do control for population and population density
so we control for basically how rural or how urbanized the state is
and if it was the case that it was principally
rural states where the interest was high we would expect to
observe a statistically significant population density variable we don't so
net of other things it's probably not more rural areas now
it might be that that variation is hidden in states
that average out to modest population density but have both rural
and urban places and the actions all happening in the
rural places one way i'm getting at that is in the
next study that i'm not presented here today but we're working on
we're doing the same exact thing but for metro areas
so that we're comparing apples to apples there
with only urban places um and um there
you know uh what you do see it does tend to be slightly more liberal places
uh but again how urbanized the places doesn't appear to have much of an effect
isn't this the sort of study that's really suitable for mturk you know the
problem with mturk is a selection effect but there you can really isolate these
types of users and dive in deeper there uh so to go on mturk and uh
say answer these questions if you're yeah that would be interesting and you
could probably get some sample of people i'd be worried
about the representativeness of that and i'd also
be worried about like maybe people in mturk would be
comfortable saying yeah i'm buying drugs but would they
admit child abuse their i mean you still have big social
desirability barriers even if um it's completely confidential
yeah yeah so the conclusion that you laid out about sort of the relative
unimportance of political factors sort of saying this is not a
left right issue um i think it makes a certain amount of sense and certainly
the results seem to bear that out have you looked for the possibility that
it's a far-left far-right issue in the sense that you
know if i live in the cabin in the woods in montana i might care a lot about
torah in the dark web if i'm super far left and i think the
government's out to get me i might again care about this and that
it may be sort of a curvilinear type of relationship rather than a linear one
yeah so in some versions of the model i did put in a squared coefficient
on the citizen ideology and that it was not significant
so that suggests that in terms of like the overall average of the state
it's not curvilinear what could be and jim and i were talking about this
yesterday you can have a very small number of people in a state
who profoundly affect the overall political environment
and so one thing i'm thinking about that i haven't done yet would be
to look at searches for uh nationalist movements or sovereign
movements that represent some kinds of the far
extremes that are like so small you won't capture
it in a statewide measure but that could capture it with the google search volume
and those people also wouldn't participate in surveys that would
measure the right i mean they're not going to
participate in any survey there's a long simmering feud between
nationalists and sociologists and absolutely you can't get them to
answer so you're not gonna you're not gonna get them to participate
okay well any uh last questions okay well thank you
okay next we have Jim Hawdon from Virginia Tech
online extremism in the united states
i am
so i'm just gonna use an updated yeah because now you can
but um really want to be sure there's no
power
ah there you go
thank you
well everyone uh thank you for coming um i'm going to be talking about
something kind of different than what we've been
talking about most of the day first of all most of the activity that
i'm going to be talking about is on the clear net not on the dark web but
i hope to tie that back into it uh secondly um we talked a lot about
selling commodities on the dark web
could you put on the microphone
um the other thing i'm talking about is oh here
we go sorry
it's on it is on very good
okay so one thing is i'll be talking more about the clear net than the dark
web secondly i'll be talking about the
selling of ideas rather than the selling of commodities
and specifically the ideas i'm talking about are
those of online extremism and so this is based off work that i started
in 2013 with some colleagues from finland and germany and
we looked at extremism in the us germany finland the
uk then extended this with funding from the
national institute of justice and really what we've been looking at is
exposure to extremism um the consequences of that exposure and
what like the rhetoric of that exposure and then
what who at least to some extent admits to being involved
in extremism and by extremism we use the european union's definition and so it's
a tax on people because of their
membership in a group so it's it's the tax
on uh or degrading of people because of their their race their ethnicity
their nationality their gender their sexual
orientation um political review views
religious views basically the difference between
and cyber bullying cyber bullying is i can hate you for you
i could say you know i hate you because you're stupid because you're
ugly you know whatever that's bullying but if i hate you because of your innate
status because you're a man because you are
liberal because you are a christian then that's
extremism and so what we've done is we tried to track
exposure to extremism and what we see is that over time there has been a
relatively precipitous increase uh in 2013 well there was about
53 percent of respondents said that they had seen
attacks of of groups uh within
the last three months um by 2018 you see it's almost three or seventy
four percent almost three-fourths of people
um see a little spike in 2016 based on some open-ended questions this
was undoubtedly related to the election uh but it went down in 2017
but now up again so if we look since 2013 there's been
over a 30 percent increase in exposure and indeed
this has become more vile while the use of stereotypes is
maybe unpleasant um we see that more serious types of
of exposure is is happening um now 24 of the people who said that they've seen
this say that what they saw advocated violence against
the group this is up by almost 13
we see that they're blaming the group for their personal
problems up by almost 30 percent blaming the group for the country's
problem up by over 30 percent advocating hatred for the group up by 19
percent and calls for discriminating against the group
up by about 23 percent now if you if you look at all of these
aspects of what what the extremism is calling for
these are all behaviors that precipitate pretty ugly events in
history when we start out you know
blaming groups for the country's problems stereotyping about the group
this is all aspects of othering that have preceded a number of
unpleasant events and now we've always had extremism that's to be
sure but i would argue that the internet has
radically changed the nature of what is required
for any social movement to succeed and especially the social movements of
extremism if we think traditionally with so it's mobilization theory and
it's socialism social movement theories
point to that are required for a social movement to be successful
you need money you need a good organization
you need to frame your strategies you need to me you know market your message
you need good leadership and you need some true believers some
some willing participants i would argue that the internet has
radically changed all this the internet's virtually free you don't
need much money to be on the internet
you really don't need an organization you really don't need a leader
and if you don't have a leader you really need one person to follow you
really what it's all about is the message it's about framing the idea
and how to market this and so what we we look at
the way that these groups market their ideas
they do so on the clear net differently than they do on the dark web
when we look on the clear net it's about educating
you all you know really we don't hate anybody you just don't
understand the real problem when you look on the dark web they'll
tell you what the real problem is and that's
that you should hate these people um but what we so what we see and then
you know i'm sure this isn't news to anybody in the room but
um these hate groups and extremists operate on the dark web
you know they operate they use things like tor
and indeed in our analysis people who have
used tor independent of other factors are 38 percent more likely to have seen
this material and they're about 85 percent more likely to have produced
this material so they're they're on that's where a lot of this is happening
and these discussions are happening but then of course what happens is that they
send the out their ideas into the clear net and
looking at recent research actually saw this as a job talk at virginia tech
the gentleman was tracing information coming from the dark web
and how it spread on twitter and what he found was that
alternative news or some would call fake news spreads much more quickly on
twitter than dues real news stories news stories
from reliable sources mainstream sources
of course we all know none of them are reliable um
we also see that those stories that are alternate from alternative
sense sources it compares about five percent
of tweets and when you think about the volume of
tweets that's fair a number of them are coming
from the dart web now of course once they get
out into the clear net they go through all kinds of all kind of
networks and shared by millions of people
and as this happens this exposure goes up
what we know is that exposure is one of the first steps on the pathways to
radicalization and eventually you're going to
run into a network that's sharing this idea if it's framed properly
that is going to attract a recruit back into
the group and into the dark web
and indeed we see once you're exposed your probability of taking that second
step on the path of radicalization that is
starting to produce these messages start to increase
and as we see over time not only has exposure
increased but so has the number of people who
admit to producing materials that they say others would likely define
as hate materials this is up by over 150
percent since 2013.
so really what we we see is more of this is happening
and well think about as really kind of policies
what could we do about this if we think about
social control in general there's three ways we can
control behavior three spheres of control there is the
private sphere friends and family there is the
parochial sphere and in the offline world we talk about
the networks of interlocking institutions your churches
your religious institutions social clubs
schools you know these types of things that make up a
community and then there's the public sphere the
bureaucratic agencies of the state well of course the
problem here is
bummer the problem here is that we are talking about ideas
being marketed most of these groups are not
dumb enough at least on the clear net to
start
sorry i'll leave it there most of them are not
dumb enough to openly advocate violence to the point
where they are violating our our hate speech laws
because we have no hate speech laws uh the level of the legal bar in this
country for violating the first amendment is set very high we
put a primacy on free speech so
there's not much the state can do here in terms of
legal action
of course what we can do there is falls on the parochial realm
places like you you will hear people say like well it's a matter of free
speech and indeed in our country the government
can't imprint upon your free speech but twitter is not the government
facebook is not the governor they can put up and
take down whatever they want so it is conceivable that they could
block some of this and indeed there is a move to do this
especially in europe uh germany for example
uh has passed large so they now will find and uh uh you
i guess it's they're going after facebook
um primarily if there's a report of this type of material online they have to
take it down within 24 hours so they will be
face a serious fine um but i would argue that there are other
things we can do this is about ideas and so
what we need to do is if we want to combat this
is to put out counter narratives they of course can flood the networks
with their message we have to flood the networks
with our message if this is going to to work
and i would argue that the other thing that we could think about
doing is some to reinstate in some way the fairness doctrine that required
places to to present two sides of an issue
on any controversial issue that was being presented
we were supposed to give two you know the both sides of it were supposed to
get equal time this course was
there are problems with this and it was uh we got rid of it in 1987
uh formally got rid of it more recently but
um the issues of extremism
come because of polarization and i would say polarization
comes because of lack of dialogue so i think what we need to try to do
is to foster that dialogue and one way of doing that is to
have reasonably reliable sources where you get
both sides of the issue not just one you don't have to flip back and forth
from msnbc to fox to hear both sides of the issue
thank you great thank you questions uh rachel over there
hello okay great so i have um i have two questions for you thank you so much for
your presentation i especially um really interested in slide five
there first question is what percent of the volume increase in extremist
messaging do you think is a result of russian influence operations in the
u.s and secondly do you find evidence of that persis
participation in those dark web circles of trust uh
okay so the answer to the second one's easy
i don't know uh no we have not really i mean i we can't really speak to that
with the data that we have um and i cannot really say for sure
to answer your first question but i do think some of that increase in 2016
was indeed due to the to russian bots um i think that
of course they what they were trying to do is to polarize
and so a lot of the messages that were being sent out
were on the extreme left and right and of course once that message is out
there then extremists would pick it up and
retweet and the number of retweets on those
are just incredibly high right that um a friend of mine always says if you
if you read something you're like really it's probably fake news
right uh it's um but i think that yes i think a lot of them
2016 was that whether or not that's still going on i
don't know
eric thank you jim very very interesting i think uh i have one
i have two questions as well one is that in your data with the increase that
you're seeing in people admitting to producing what
could be classified as sort of extremist content
depending on how much you sort of shaped their
their definition of this is what extremist content means so if you did
your introductory preamble there where it's
like it's about targeting a group talking about a group
i was wondering if your data allows you to sort of disentangle those who are
admitting that they're engaging in the production of what could be classified
as extremist content because they're producing a counter
narrative so i've i'm not on facebook but i am on twitter and i
notice all the time on twitter that one message comes out and then there's a
whole bunch of people who climb on basically actively countering the
narrative right but they're still producing what could be classified
according to the definition as extreme as content
and that would be different than those who are sort of organically originating
extremist content which is a slightly different one certainly more problematic
i think that's my first sort of query and
secondly i the with the in reinstitution of the
fairness principle i i wonder i would interest i'd be
interested in your thoughts for speculating on the viability of such
a thing or who would be doing such an implementation in a sit in an
ecosystem where you have sort of decentralized production of content
that with media elements it was relatively simple you had to
as a centralized source say this is this side of the story and then this is this
side of the story whereas if you have an individual or a
series of individuals producing content i mean i i think facebook's actually
speculated about you know pushing to people's feeds
counter narrative stories but would it all effectively fall on the
content platforms
um okay so your second question first i i think
yes with broadcast news it's relatively easy to
to enforce as as we get into deep more decentralized news sources
although there's a debate about how really how decentralized our news is
but um yes it would largely have to fall on these platforms and
and the ability to enforce that of course would be
marginally effective at best i would think
i think it would be an ideal to to shoot for
and we can you know we can pressure these
platforms as public utilities to behave more in the line of what we
would like them to see them behave in terms of your
first question i think that well first of all we do run
we run a survey experiment where we provide them
with a definition of extremism and then randomly assigned some don't get it and
we have found no difference in any of our the meaningful variables
that we've looked at and but in terms of
um we ask people what they do when they see this type of
material and roughly about a third of them say
that they routinely defend the person being or the group
being attacked and which is what you were talking about
but i can't i don't know how they defend them i
we don't have those data but i would think that a lot of that is
also hate speech right like so you're defending somebody by calling
them a racist right and and now if you're just calling that individual
racist i wouldn't say that's extremism i would but if you're saying
well you're a white middle-aged white guy you're a racist
right that is so i know exactly
so so i do think there is some of that i also
we cannot disaggregate i think there has been a change in
levels of civility um over the last couple of years
and how much of that 151 percent increase is actual increase in the
behavior versus no longer being
afraid to say yeah i i talk smack on groups
um i i we do not know so the young lady in the back and then
andrew so to go back to your recommendation that we institute a
fairness document of some sort so i would love it if
facebook or twitter would be required to give both sides of an issue from a
reputable source that would be great the thing is is that it sounds really
similar to quote unquote fact checking right it's
in the same line of reasoning and we know that fact checking unless
it's from a person from your in-group right
it doesn't really work that well i i would love it if we did it i think we
should we should do everything we can to stop this but
it doesn't work as well what about requiring for people to be
educated about these news sources which i think is an even
harder thing to ask for but in general like you can't stop people from seeing
fake news once they see it or like extreme news but you can teach them to
identify it yes and and
i think
i i think i mean you're absolutely right in terms of
if if i believe you and you say it's fake news
i'm gonna believe it's fake news if i don't believe you
i'm gonna say well no you're fake news right and absolutely
but the the trick is to get people before they are in their tribe
right and i think the way to do that is to
have a to have brought these broader these nuanced more nuanced understanding
of issues in the larger discussion i think that
we have we have increasingly pushed it to
where you're just talking to your right the the whatever you want to call it the
filter bubble or the echo chamber or whatever you want to call it that
happens in online communities if if these were
if these conversations were in the broader community i think we might get
fewer people going to the extreme we would still
get the extremes and once that happens i'm going to believe what i want to
believe yeah absolutely right teaching people
how to like think well right well just
teaching people how to critically evaluate information
it is critical right but good luck with that
that's actually that's the next panel isn't it but
um it's rhetorically palatable to talk about extremism being on both
sides but in fact we know that there's extreme
asymmetry you know bernie bros might be bullies
but they're not gearing up with aks and uh walking around with torches
right not um right and so i wonder if you could say a word about the asymmetry
and in particular how that asymmetry poses problems for platforms like
facebook in terms of implementing solutions yeah
okay so the asymmetry right now the web and really since
about 2008 uh extremism domestic extremism is completely dominated by the
right but we shouldn't forget the fact that
in the 70s it was completely dominated by the left and in fact
acts of terrorism down tremendously since the 70s
the the right-wing the right-wing terrorist groups
the extremists that are active today cannot compete with what
was happening in the late 60s and 70s in terms of
number of incidents number of killed right but but you're
absolutely right now right now i guess it's always asymmetry
asymmetrical which group is dominating right now is
the right and i think in terms of what this means
for facebook and and how to combat it um it's
it's it's difficult in terms of combating the
precisely because like what we were talking about with your paper
if you're if you're a a sovereign nation type of group and what grace was just
saying of course i'm not going to believe this
if it's coming from the state if it's coming from any kind of
authority it's all fake news right that and just just quickly dismiss
it so again i think what we have to try to do is to target the middle
to target the middle that to what we have seen
just politically just as on a general political scale
we have moved to the center so far to the right in our country that
extreme right doesn't necessarily seem that extreme anymore right um
when you compare where we were politically
50 years ago the center has moved i think what we need to do is to
complicate that center what what it does it mean to be
moderate in 21st century u.s and the last question to
about the aaron algorithmic basis for extremism and you can test
this out right now if you go to youtube and you
type in a moderate right right when uh video
your next video displayed will be a slightly more right
right so how do we get beyond the profit-seeking incentive of
platforms foster content lock-in so that they keep your
attention span longer and longer than their platform so
they can make money right so that you know you can shift people
subconsciously away from that they're beginning to filter in the other
direction you have to do it very slowly but it's
much easier to the way they want to go right
how do we get around that's that's your job
now i think um
i mean that could be one way to pressure these
uh providers such as facebook in terms of some kind of fair if you're
going to do this algorithmic push then it can't be
political you know if it's going to be political
content that you're pushing that you have to kind of randomly select
from news sources right that the which one's going to be sent out next
and um but i don't know
right and and i think it's one thing to feed
in your consumer preference for brown shoes right over
black shoes it's another thing to feed in your political preference
for
whatever political reference you're talking about um
but yeah i mean without without i mean one thing we could do i
mean this would be quite radical but we could declare things like
facebook a public utility
and if they're using the the internet it's a public utility it's like a water
company we're going to regulate it for i don't think that will ever go over but
you know okay thank you and our next president will be eric
muniz
our next president will be eric nunez from arizona state university
presented on malware markets and the dark web
activity
a little bit more this is your flicker
there's yours
so can everyone hear me
yeah is this fine okay so we had uh quite good interesting
talks like since this morning talking about tor
services and the dark web in general we had talks regarding cryptocurrencies
and drug marketplaces and how
cryptocurrencies are used and what kind of even like ponzi schemes
that are run using these cryptocurrencies
so uh what i do uh with uh in the group that i work at arizona state is
we actually look at these markets as well as forums
and we basically focus on the malicious aspect of it in terms of security
and hacking perspectives so we try to look at markets and see like what kind
of exploits or any services that are being
offered which will actually target systems target organizations
target critical infrastructure as well as look at discussions in these
forums that might indicate what are the current cyber events that are going on
what possible current future events could occur and what are the systems
or infrastructure that are of more interest to threat actors
and maybe maybe look at them and see like if there is an actual threat
so the first stage is always like we want to collect like as much data as
possible from these dark web forums and marketplaces so we had an
infrastructure in place uh which is actually the way it works is
just to give you a quick overview is we have a security analyst
who can actually speak multiple languages and they actually go in
to these uh tor websites and they used some tools like scanning tools as well
as some search engines to actually look through and find based
on keywords some of the forums and marketplaces
at first they actually go in themselves look manually at some of the content
and based on the content they actually decide whether this is of interest
in respect to malicious hacking or not once they decide it is
then it actually goes in a queue where a crawler actually goes in and basically
crawls everything it can basically grab from
that website and one of the key things that even
nicholas brought up was like there are always like security
measures from administrators themselves like they have captchas and they have
sometimes it's very difficult some forums are only invite only so like
you have to show some kind of skill level in order to get into these forums
or contribute something in order to get into these forums
so we have security analysts who actually try
to overcome all these barriers and actually get credentials like usernames
and passwords and then the crawler takes it from there
basically grabs everything one thing that initially we observed was
uh initially we just ran the crawler it went in it tried to grab as many pages
as possible and couple of minutes was kicked out so
that happened over and over again in a lot of these forums and markets so
what we thought was maybe the crawlers should not just go in
and kind of behave like a computer but try
to behave as someone who is trying to browse this website
maybe go from topic to topic rather than going
radically towards all the topics and trying to grab everything so we
actually implemented a topic modeling model which actually goes in and whether
if it's looking for something very specific
it tries to only first grab those pages which belong to that particular topic
and then shift it from there so it looks like
more like a person who is trying to look at a particular topic
and we also introduce a different variations
and how much time it takes to grab each page
include some of the randomness in there to make it as probabilistic as possible
so the crawler goes in grabs everything and then the parser actually extracts
all the information in the forums it extracts the topic the
users posting in that topic what kind of interaction is going on
what is the content of these interactions if there are any software
tags or any kind of organizations systems that
are mentioned in these discussions and so on
and from the markets is basically a tries to grab from descriptions what are
what is being sold if there is any rating what kind of
feedback so basically all that information it can find and it
stores in a database from this database we can actually do a
lot of things we can look at different price variations for different products
from the forums we can actually bring social networks of which users interact
more with which users which users have a higher what you call
there is a rating system so some of the users are more trusted
than the others their answers actually get a lot of upvotes and most
of the users are actually waiting for them to answer in some of those services
so we find a lot of these cool things and the one thing that
we try to do is we try to look at it from different perspectives
we like try to look at it from the uh system perspective where we are trying
to find vulnerabilities disclosures look at exploits available if those
experts are publicly available or if they are not
if those systems are already patched or they are not and try to see like what
kind of measures we can take we also try to look
at what kind of users are actually posting these
discussions what is the history of those users
uh way back when the forum started what have we been posting
whom they have been interacting and so on and one more thing that we do is we
try to match users across different platforms across different
forums and marketplaces one thing that we have observed is
because trust is a very important factor in these forums a
lot of these people kind of uh end up using the same usernames
across forums because some forums are invite only so
if you have a good reputation in one of the forums it gets carried on to
different forums and so they actually maintain the same
username so it becomes easy to track down what are the
interests of these actors and basically go out from there so
just to give you a quick overview of the malicious markets so the dynamics of
these markets are basically we try to focus on marketplaces that
sell malware exploits we try to monitor these actors and we
try to examine products from the social structures
for example a lot of these people who are trying to ask for services are
newbies and what a lot of these people who are
providing services and exploits are basically experts
so there is like a pyramid structure inside all these forums and marketplaces
where there are a lot of amateurs at the bottom a lot of people who can basically
run a couple of commands and maybe use tools which are available directly
and then as you go down it becomes much narrow towards who the actual experts
are who can actually write their own
exploits maybe discover zero days and different systems and can provide them
so some of the examples that we have is so we have like places where botnets
scripts are being sold and we also have places where
actual zero-day exploits belonging to uh microsoft office as well
as some of the android zero-day experts
that are being sold one thing that we observe is zero-day
experts definitely have more price than any of those standard experts that
we encounter and these experts remain at a high price
till up so these experts actually so they
start off with at a very high price they remain at a high price even when a
patch is released like if this becomes public disclosure what
the vulnerability is and even a patch is released they still
remain at a high price up to uh two to three months now why two
to three months is because uh there is a research that shows that
even up to two to three months a majority of systems will never patch
uh you take the patch and basically fix
their systems they'll still be exposed but after two to three months this price
actually starts to decrease and after a while
they almost become like they are giving it out for free
for newbies to just try it out because most of the systems are already patched
and they don't they won't actually do anything on those
systems so the actual uh what we can do is we can actually
look at these communities of vendors and see like what kind of
uh things that they are more interested in what kind of systems they actually
prefer targeting there are vendors who only
post about microsoft related things operating systems as well as
applications running on these microsoft systems
so we can actually see like what kind of um
systems are being targeted based on the exploit and zero day
we would know like what kind of certain vulnerability that can be experted in
the wild uh now why i would say that these kind
of vulnerabilities are more important than the ones that
are mentioned in for example so nist actually maintains a database of
all the vulnerabilities out there if you look at nist vulnerabilities only
i think 2.5 to 3 percent of those vulnerabilities are ever exploited
every year so what it says and if you look at it more than fifty percent of
those vulnerabilities have a rating which is more than nine which is out of
ten so which means that it is severe so if an organization is looking at that
kind of rating and basically deciding okay so we have to patch like maybe 50
percent of our vulnerabilities so that actually focuses a lot of
resources that the organization has in order of patching those
but only two percent will ever be exploited
so which ones need to be patched more important but
the dark web is a different thing because what we have observed through
our research is in the dark web if a particular
vulnerability is mentioned or discussed by a threat actor
the chances goes from three to fifteen percent of being exploited in the coming
weeks so that actually helps in prioritizing
what kind of vulnerability management system an organization might be running
so that helps and for forums is much more interesting
because forums you actually have discussions and you have people
interacting with each other so that actually helps like if someone
is looking uh if someone has identified some vulnerability but he's not sure how
to actually exploit them he can provide the details and an expert
can actually comment on what changes need to be made
or how an expert needs to be structured in order to uh
export that vulnerability so the dynamics of the forums are basically
you have existing members administrators and moderators
you have a social network of most active users and you have interactions between
users and and you also have
like different kinds you can also look at these forums and you can also
identify where the people are actually kind of located geographic wise based on
on what time of the day they actually reply to most of the discussions
because we have observed like sometimes in some forums
the questions are basically done like some of the discussions happen only
during daytime when it is in us but the replies are always during night
time when it is in us so it's mostly coming towards from the
side of russia or eastern europe where all the
replies are coming from and we also observe like some of these replies would
be in their own languages as well and so we also observe a lot of language
variety the forums that we actually crawl a
majority of them are in english but we do have a quite a good
distribution of different european languages
that actually have some so a forum is not like
some of these forums are specific for one particular language but some of the
forums have topics in all different languages
so people interact all the time and most of these
topic discussions that we have after filtering the data
is hacking tools trust security privacy political events
censorship surveillance vulnerability disclosures someone found a
vulnerability in a particular application
and he just discloses it and lets everyone know how it can be exploited
so people can work on it if someone comes up with the proof of concept or an
exploit he basically posts the link where everyone can download about
it and we also have discussions regarding potential systems that can be
targeted for example in case of the wannacry
ransomware which actually became public i think on
may 12th or somewhere around the second week of may uh
and but before that three weeks later on a forum it was actually posted by
someone about 50 to 60 000 systems that belong to the
medical domain that are actually vulnerable to this system
have been identified to be vulnerable to this expert that we have
and three weeks later those 50 to 60 000 systems were the first wave of the
attack and then the worm actually propagated throughout
like over 150 000 systems in 50 countries
so we do have people who actually post these kind of discussions
but this is a good one it's like a black swan event
so it happens like such precise details are very rare
but when they occur so if we are able to identify those beforehand
we can actually take a look at it and some of the topic examples if you could
see are a lot of them actually also talk
about carding services where they actually have terms of entire
username passwords as well as credit cards from different companies
and these username passwords are important because some of them might
think like okay for example a particular
organization got hacked a lot of username passwords are out
there if that organization is not mine then i should not worry about but what
happens is a lot of times the usernames that have been used and
one site are often similar to the user names that have been
used on a lot of other sites by the same people
in some cases even the password is the same so
these sites also become vulnerable and even if the password doesn't work
even if you have the email address and details regarding a particular user
it results in phishing attacks like spear phishing attacks
where people then they tried based on the information they have
they try to send like emails to those users and basically try to get out
passwords from there using fake sites and not only
are discussions but there are market forum hybrids as well
where the forum actually acts as if a market itself are
asking for services for hacking and providing tools for hacking
so forums is uh interesting as i said is we can actually look at
uh the forum interactions and build social networks as well as try to look
at like what kind of vulnerability discussions are going on
try to identify these vulnerabilities if they are exploited
if they are not maybe look at what kind of discussions are going on
and give it some kind of rating that says that this might be exploited in the
future because of these the reasons and so it might help the
vulnerability management system in a lot of these things
there are also discussions about structure targeting
power plants and different kinds of systems that are critical to a
particular nation so those kind of things are also there
and what we also gain an understanding is
uh what are the motivations and what are the potential
gains for an average hacker so an hacker might be providing information freely
because he just wants to just disclose everything in public
sometimes he might ask for certain amount of payment for disclosing certain
information that we had interactions where a
particular new product for a company the architecture of that system was
actually the hacker claimed that he knew the exact architecture of that system
and he can actually provide the entire architecture so you can actually
reverse engineer it and do some kind of hacking in that the system itself
but you would only offer it if certain amount was transferred through a bitcoin
uh in terms of bitcoin to him so and it also results in trust issues like do you
actually transfer this bitcoins to him so we actually can look at if he has a
high reputation that actually helps in order to transfer
because you trust him to provide that information
if he doesn't have that high reputation then maybe it's just something
us scam or something so
so these kind of uh things that uh we have had success identifying some of
these factors in the forums as well as marketplaces
but a lot of these things can actually like are still in the works and
we can actually like look at it from a security perspective to actually help
organizations or even nations in order to better defend their systems
uh i think that's it great thank you um questions uh eric
thank you for that eric it was very uh very interesting and very informative i
have a couple of questions about uh whether you've sort
of gone down in the data to sort of look at
sort of co-associations because one of the things that popped up to mind
one to do with language one to do with you're using time of post and for
geography a little bit yeah is there any sort of systematic
variation there about the sort of issues that people are
discussing about the degree of uh maybe even the severity of
the vulnerabilities that they're discussing or anything like this as it
varies across language types or across geographic regions or anything else
so uh so we did observe a lot of these mentions
so a lot of vulnerability mentions do come come up in english forums in
english discussions but if we correlate those to ones that
have been exploited the most success of having a particular
vulnerability being experted and mentioned comes in
the russian language and the chinese language
so even though they mention less number of vulnerabilities
their exploitation rate is much higher than the english
how ones so uh i don't remember the exact
numbers but we do have a paper in which those numbers are mentioned i can
definitely share that with you yeah and for the geographic thing
uh we only uh used that in terms of when we are not able to
decide like what kind of forum it is so if it's completely hosted in a
russian language or a chinese language or if it's a mixture then we try to look
at the times in which we actually get replies
if there is any significance like it's not that people in us cannot reply at
night or post at night so
but if more than like half of your discussions are always in a different
time zone then that actually raises like there are
participants from different parts of the world
thank you right there in the middle hey you talked about the nist cve database
and said that two percent are roughly exploited
and then you said that if you see them posted online they have a significantly
higher rate of exploitation how do you arrive at those numbers so
the two percent was actually based on a research
so we actually gathered the ground truth of exploitation from multiple sources so
symantec actually maintains a signature database where
all its sensors which are around the world they actually record any kind of
attack that has happened on their systems and they also have uh
apart from symantec rapid7 and some other companies also maintain this
database so we actually look at this and see like which cvs they detected
and based on that we go from there
any other questions
okay we're about close to time anyway so this will guess we'll wrap up the
session all right yeah