You can surf the dark web but you can’t always hide. People who want to keep their online activities secret will often use both bitcoin, which is tied to pseudonyms, and the Tor browser, which obscures your real movements. But if you’re not careful, all that hassle could be for naught.
By linking bitcoin wallets with transactions on the dark web, researchers at Qatar University in Doha were able to .
Supposedly secret activity on sites like The Pirate Bay – which hosts torrents of pirated music and films, for example – and the black market Silk Road – a kind of Amazon for illegal products, such as drugs and guns – could then be linked to individuals’ social media accounts on the normal web.
Advertisement
The weak link in the chain between the normal web of sites we use every day and the dark web was bitcoin. Users may have used pseudonyms on dark web sites but their bitcoin addresses – which were shared on public websites – gave them away.
“People don’t know that paying from the same addresses they’ve posted publicly can be linked to accounts on the dark web,” says team member Husam Al-Jawaheri.
Nowhere to hide
The researchers trawled through five billion tweets and one million posts on cryptocurrency message board site . They found more than 45,000 unique bitcoin addresses posted by users. Looking up transactions made on the dark web on the bitcoin blockchain and cross-checking the addresses used with their database scraped from the normal web, the researchers were able to identify certain individuals behind some of the transactions.
“It was overly simple to link identities to hidden services,” says Yazan Boshmaf, another member of the team.
At a technical level Tor is secure, he says. “However, if someone makes a payment through an address that’s been posted somewhere on the public web, all of a sudden the privacy model is broken.”
Despite an association with criminal activity, Tor and bitcoin both have many legitimate uses. Tor proved a valuable way for activists in the Arab Spring to remain anonymous, for example. The researchers contacted the 125 users they had identified to warn them about their security misstep, but did not receive a reply from any of them.
This work reinforces previous findings about how user error can cancel out the privacy we expect from Tor and bitcoin, says independent security researcher . “The Tor network can’t help you if you shout out your name.”
She says that governments and police forces are also analysing bitcoin and the blockchain, scraping transaction data from dark-web sites to identify users. That’s something that worries Al-Jawaheri, too. “Someone with a larger set of resources – an active adversary – can apply this attack in an even more sophisticated manner,” he says.
