Darknet & Bitcoin: The Perfect Storm for Cybercriminals

The developers of the Tor anonymity network and the mysterious Satoshi Nakamoto who created bitcoin probably didn't imagine that their products would be fuelling the burgeoning criminal underworld when law enforcement agencies are fighting a losing battle against ever more sophisticated and innovative cybercriminal.

That however is the reality in 2014, where the darknet is a world where you can buy whatever you want from such as drugs and guns - all paid for anonymously with bitcoin or one of hundreds of other cryptocurrencies.

"There's lot of money to be made" Tim Keanini, CTO of security company Lancope, told IBTimes UK at the InfoSecurity conference taking place in London this week.

Perfect Storm

Keanini, who says he has forgotten how many blog posts he has written about how good a time it is to be a cybercriminal at the moment, says now is a "perfect storm" for cybercriminals.

The anonymity offered through Tor networks is one of the key enablers for cybercriminals allowing them to advertise their wares with impunity to a group of like-minded buyers who also covet the anonymity the darknet offers.

"Tor networks, cryptocurrency and the dark markets have completely changed the way in which cybercriminals are doing business and frankly they are just out innovating us," Keanini says.

The "us" Keanini speaks of are those charged with defending our networks, information and identities online. These include security companies like Lancope, but also the numerous law enforcement agencies around the world such as the European Cybercrime Centre (EC3) at Europol, the NSA and UK's GCHQ.

Cat and mouse

Mike Potts, CEO of Lancope, puts the situation even more bluntly:

"We are in catch-up mode. This is a cat and mouse security game and right now the mouse is getting bigger, fatter and arguably smarter and more nimble than the cat protecting the network. He's kicking the cat's tail is what's happening."

These are criminals who are "good at their craft and now using the internet" Keanini says.

While the Tor network may have been established with lofty ideals of protecting privacy it has been annexed by criminals who use its cloak of anonymity to openly trade on the so-called dark markets in illegal goods, to buyers equally happy to hide behind the mask of anonymity.

Closing down one of these dark markets - with Silk Road being the most high-profile - has little or no impact.

"It's a whack-a-mole situation. As soon as they pop Silk Road down, another pops up. They shut that down, another pops up."

Unbreakable

The reason why they are so many criminals operating on the underground internet is simple: supply and demand. There is a huge demand for these type of markets which sell everything from Class A drugs to malware kits, stolen credit card numbers and Uzi sub-machine guns.

The worrying thing is, there appears to be no way for the law enforcement agencies to stop the tide of criminal business taking place on the web.

The integrity of the Tor network, which hides a user's identity by bouncing their IP address through numerous nodes, has so far proven robust enough to prevent anyone from compromising it - even the NSA.

Are we likely to see Tor infiltrated in the near future? No, says Keanini but rather than trying to break a piece of technology which is also used for good, the way he believes security companies and police can change the situation is by changing the economics of cybercrime.

Change the economics

"We have to find a way to strike an equilibrium. You can't get rid of crime, [we have to] find a balance to crime." He says that when cybercriminals get too greedy, that is when they are caught, as the pressure for law enforcement to take action becomes too big, and they need to be seen to be doing something.

However, while big wins like the Silk Road bust are good, there remain hundreds of other criminals operating below the radar who are not making waves, stealing small amounts of money from lots of people.

Because there are so many of these criminals and because the likes of the FBI just don't have the resources to go after all of them, they act without fear of capture.

Stay in the game

Keanini says that for businesses, cyber security is "finally becoming a business issue" and it becomes about "staying in the game" rather than trying to bulletproof your entire business at a huge cost.

"It's not about winning or losing, you just want to stay in the game and if you are profitable every quarter and are handling [attacks] reasonably well, that is where businesses need to be."

While Potts envisions a security utopia where threat-sharing between security companies and law enforcement raises the security bar across all businesses, the reality is that in 2014, cybercrime is a great business to be in.

"It is our time"

Lack of proper regulation; failing cross-border cooperation for prosecutions; continuing anonymity provided by the darknet and bitcoin; as well the sheer scale of innovation by cybercriminals, means the security industry is certainly fighting a losing battle.

But Keanini is not downbeat, he is an optimist and believes we need to look at cybercriminals and copy their innovation and techniques if we are to capture them.

He says the security industry is "ripe for innovation. It is our turn."