What's up, everyone? So today we're talking about
Phantasma Market, which was a liability and a failure
pretty much from the get-go.
Failure! You're still a failure!
Failure! I can smell the failure!
Like the minute had launched and
basically I'm talking about their
name as well as their branding ability because it's a really stupid name.
It sounds like it was invented by a 12-year-old who thought that that would be a cool name for a market.
Now, on a kind of more serious note, these
morons decided to launch a market with a clear-net IP address and a
$99 re-skinned silk road template, which makes total sense. It's kind of worse than lazy.
It's just an operation that is going to get people arrested.
That's how it works when you make these dumb markets.
And like if you're watching this and you've never like set up a dark-net market before like everyone else or done that working or
dealt with any kind of infrastructure whatsoever and know nothing about the back-end or the middle-tier or the front-end
in regards to like development or about infosec or
opsec and like just went out and set up a like dark-net market.
Something like this would probably be the result of that.
But you would also have to add in that factor of just not caring and just a pinch of reckless disregard like with it.
So yeah, yeah, it's really bad. The most damning mistake
was pretty immediate. Hubbunter discovered Phantasmas clear-net IP within minutes of actually visiting the site.
This wasn't actually the result of like phishing or shodan or something like advanced
recon or oscent on this part. It was just there. Visible to the public, kind of like an apple at the bottom branch like
aka low hanging fruit. Now, this is the same fruit that law enforcement absolutely loves.
It appears that the dark-net market admin by default was in some part actually
kind of trying to like give his market away to law enforcement.
The server was serving the hidden service directly from a clear-net IP address.
Yeah, if that makes sense without any attempt to route it like solely through tour.
That's the equivalent of a dark-net market basically
doxing itself before they even start like on day one.
Hubbunter described it as a quote, an extremely poor and basic server set up.
And obviously this is a incredible understatement.
I have absolutely no doubt that he could have been much more brutal
in his actual critical assertion of this market.
Like one thing I'll give him is that he's definitely a fairly classy guy.
Tends not to completely unleash in certain cases like this when he probably could.
I, however, am not so I will if I was to give a comparison for this,
it would be that when your clear net IP is visible,
your location is visible, right?
Your infrastructure is visible.
Your users are visible,
especially if you're connecting without advanced protections at all.
They're also vulnerable to things like traffic
correlation, timing attacks, passive monitoring and potential subpoenas
to hosting providers because of that.
So you're not just risking like your own freedom as an admin.
You're also dragging every buyer and vendor down with you.
And this is why people who set up markets and don't actually know
what they're really doing are by far some of the most ignorant
and really dangerous people that are in the sphere of the dark-net markets.
And this like wasn't even like their only mistake.
The entire back end was built on recycled,
unmodified $99 marketplace script,
a known template which was filled with vulnerabilities,
backdoors and logical flaws.
It was actually confirmed to be one of the old ECMAR scripts
which have been floating around the clear net forums for years.
And you see scam circles use these as well.
But the scripts are infamous for being easy to deploy
and even easier to compromise.
Essentially, you could basically just run this
and more or less you have a market set up.
Don't do it. It's a horrible thing to do, massive risk.
But I know some of you have thought that this is a good idea
because I've talked to some of you through email about this.
And I would say this is by far one of the worst things that you can do.
Again, not only does this expose you to the potential targeting
by law enforcement, for which if you're caught,
you could possibly get a life sentence, right?
If they charge you with continuing criminal enterprise.
But at the least you'd be looking at like 10 years in federal prison.
And that's if everything goes really good for you.
But on top of that, you're also jeopardizing a ton of other people.
It's cool not to care about yourself
and have a kind of a laissez-faire attitude about that kind of stuff.
I mean, you have that prerogative as an individual
who isn't actually owned by anyone else.
However, my real main issue and main contention kind of comes
when you start to jeopardize everyone else's safety and security
because of laziness or incompetence or just lack of understanding.
Now, the admin didn't even try to secure anything on the site.
They openly admitted they were using the Silk Road theme as a tribute to Ross.
I'm claiming it was meant to reflect his values.
But instead of actually honoring Ross, they insulted his legacy
by launching something that was so insecure, unstable
and really unserious at the end of the day.
The script was the same ECMAR base that's been around for years,
known by everyone in the scene to be riddled with backdoors
and lazy coding, basically.
Duck Egg even commented saying, old Silk Road script.
Why not just design a new one from scratch?
The design is awful.
Hubbunter emphasized the issue wasn't using the pre-built script,
but instead failing to actually customize, harden and actually audit it.
And that's exactly what happened here.
They just launched it raw and exposed.
So when it was banned from Dread for the IP leak, the admin pulled a
kind of a textbook move.
They created a new Dread account and basically reposted the exact same market
like nothing had happened.
Now, the new account was like 56 minutes old.
And the attend was obvious here.
It was called reputation laundering.
And that's when you basically reset your public image.
You bury the past and try to attract new users who.
Aren't as aware of the disaster, right?
Wikipedia holds the term as something that occurs when a person
or an organization conceals unethical, corrupt
or criminal behavior or other forms of controversy
by performing highly visible positive actions with the intent
to improve their reputation and obscure their history.
So reputation laundering can include gestures such as donating
to charities, sponsoring sports teams or joining prominent associations.
Obviously, in this case, they didn't do any of that.
In fact, they didn't.
Do really absolutely anything to benefit anyone besides themselves.
So that didn't really matter, though, because users like UK
Peng and going to go for it immediately noticed calling it out
in the comments.
And another user, Hourglass, who we've talked about on this
channel a couple of times, pointed out that it was a blatant
reputation reset tactic.
So there was that.
The same admin had previously demanded to be made a moderator
of the new market's subreddit.
And Hubbunter incited this in a post referring to the market
admin when he said, quote, one was already banned from new markets
and throwing a tantrum and demanding to be made a mod of it instead.
So it's banned.
And he's like, make me a mod flipping out that he's on a
absolutely no sense.
They had no credibility, no technical skills, no track record whatsoever.
And they thought like somehow they're entitled to dictate how
other markets got listed.
It's just beyond stupidity.
The entitlement alone, though, really should have raised red flags.
And instead of focusing on actually fixing their catastrophic
security and PR issues that they were having, they started
throwing tantrums like a 12 year old would and kind of begging
for influence from everyone else that was there.
Technically, the site was a mess also, right?
It wasn't just physically.
Multiple users actually reported issues, broken security,
forms, slow load times, poor UX and heavy front bloat.
There was no effort to actually streamline and secure anything
from top to bottom.
It just looked like complete boilerplate mess deployed by
someone who didn't even understand how PHP sessions or CSRF
tokens actually work.
Now, keep in mind the risks that are actually posed by
markets like this aren't actually theoretical.
They're very much operational.
When a market leaks its clear net IP and fails to isolate
services or runs unpatched public facing infrastructure,
it gives law enforcement and hostile actors a very easy
path to correlation and compromise.
So just like many law enforcement agencies depend on
informants and because of that have become subpar
at investigation abilities, many of the investigating agencies
that end up taking down dark net markets also rely on
really stupid, upset mistakes that the dark net market
admins make. And this is why when a market is taken down,
it makes international news, right?
Like it's like law enforcement is screaming from the roofs
like a four year old, look what I did, daddy.
And I brought this up before because it's just it's
annoying to see every day.
But basically, earlier, I was saying, was it just theoretical?
I could back that up.
It's exactly what happened with Alpha Bay, where early
server misconfigurations allowed the tour service to
basically be correlated with a clear net IP, ultimately
identifying the operator.
Now, before anyone jumps in and claims it was the email address
I got him caught, read the actual indictment.
The US Department of Justice clearly states that
law enforcement first identified the clear net IP hosting the market.
That IP was registered to a Canadian company,
which was tied to the actual admin.
Now, only after they had that infrastructure did they actually
connect his reused Gmail and LinkedIn accounts as corroborating evidence.
Now, the email didn't expose him.
The exposed server actually did that.
Like, and you can verify this yourself in the 2007 Department
of Justice complaint that actually exists.
The IP comes first and then the email comes second.
Hey, now I'm getting a little track and then distracting myself
from the actual point of this.
But markets like this one basically repeat the same fatal mistake.
And that's hosting their own nodes, but not knowing how to actually do it.
Hosting the application server and often elastic search.
Or whatever the search thing is, all on a single exposed box.
And any part of that stack actually responds to clear net queries.
It creates a pivot point that traffic correlation becomes trivial.
If ingress and egress pass are visible on the same physical host.
So add that back end logic that was actually left in development mode,
which is yet like another brilliant move by the Internet admins
and the verbose error messages.
So you can give extra information away for free.
That detail to every little thing, along with the stripped headers
or exposed debugging endpoints.
The attack surface just multiplies exponentially.
And every user basically assumed anonymity
that the infrastructure couldn't technically deliver.
Now, Huggbunter had actually banned them from Dredd,
stating clearly that he wouldn't allow such a threat
to actually remain active on the platform.
And again, like I said before, it makes sense.
He pretty much made it plain that law enforcement or anyone else
with bad intentions could exploit that kind of negligence
that they displayed in ways that would absolutely hurt the community.
He also called out the admins, kind of a erratic behavior
that they were childlessly freaking out about instead of actually paying
attention and listening to the feedback that was given
or fixing the issues.
And that's the right move, right?
Like this is in 2012.
These aren't rookie mistakes.
We have use cases.
We can look at prior engagements
and figure out what best practices are.
And so these are mistakes that should be happening.
If I had to define this market in summary,
like one term, I guess, I would say it was a factory failure, right?
Like the admin was absolutely reckless.
The infrastructure was negligent.
The script was outdated and insecure.
The entire launch just showed a complete disconnect
from running a dark damn market.
And like any of the actual discipline
that that actually requires or entails.
And this should be a warning to the community overall
to avoid anything that uses recycled scripts
and avoid admins who can't handle criticism,
even though there are some top admins to this day
who are exactly like that.
Avoid platforms that claim to value anonymity and privacy
while leaking their own infrastructure or name dropping.
That happens too.
If you see a market like this one
reappear under a different name,
treat it like a trap because in retrospect,
that's what it actually is.
Thank you for watching and I'll see you in the next video.