Pretty Good Pivot

Pretty Good Pivot

Speakers: Simwindie (Certified Cyber Crime Investigator, Austin doz)

Conference: Recon Village

YouTube: https://www.youtube.com/watch?v=6mykx1zS1yo

Overview

In the realm of open-source intelligence (OSINT), investigators constantly seek overlooked data points that can lead to the unmasking of malicious actors. Simwindie, a Certified Cyber Crime Investigator and Sensei at Austin doz, presented "Pretty Good Pivot" at Recon Village, highlighting the often-neglected yet highly valuable role of Pretty Good Privacy (PGP) keys in tracking and attributing darknet vendors. The talk meticulously details how these cryptographic artifacts, commonly employed for secure communication on darknet markets, inadvertently become a rich source of investigative leads due to prevalent OpSec failures among vendors.

Simwindie's presentation is a deep dive into the practical application of PGP key analysis for OSINT professionals. He demonstrates, through extensive research and compelling case studies, that despite the perceived anonymity of the darknet, vendors frequently make fundamental mistakes during PGP key creation. These errors, ranging from reusing email addresses to neglecting metadata, provide critical pivot points that can link anonymous online personas to real-world identities, significantly aiding law enforcement and private sector investigations into darknet activity.

The significance of this research lies in its systematic approach to an underutilized data source. By quantifying the extent of OpSec failures and providing actionable methodologies for extraction and analysis, Simwindie empowers investigators to leverage PGP keys as a potent tool. The talk underscores that even with sophisticated anonymity tools like Tor and strong encryption, human error remains the weakest link, making darknet vendors just as susceptible to OSINT-driven attribution as any other online target.

Background

▶ Watch: Introduction: PGP keys as OSINT pivot points (0:00)

Pretty Good Privacy (PGP) is a cryptographic program that provides cryptographic privacy and authentication for data communication. PGP is often used for signing, encrypting, and decrypting texts, emails, files, directories, and whole disk partitions to increase the security of communications. At its core, PGP leverages a public-key cryptography system, employing a pair of mathematically linked keys: a public key and a private key. The public key is designed to be shared openly, allowing others to encrypt messages intended for the key owner or to verify digital signatures made by the owner. Conversely, the private key is kept strictly confidential by its owner and is essential for decrypting messages encrypted with the corresponding public key, as well as for creating digital signatures.

Darknet vendors widely adopt PGP to secure their communications with potential buyers. When a vendor establishes a presence on a darknet market, one of their initial steps is typically to generate a PGP key pair and make their public key accessible on their profile. This enables buyers to acquire the public key, encrypt their initial messages, and ensure that all subsequent correspondence remains confidential. The exchange process ensures that no messages are transmitted in cleartext, theoretically safeguarding the identities and communications of both parties.

However, this very mechanism, designed for privacy, presents a significant OSINT opportunity. When a user generates a new PGP key pair, they are given the option to embed additional information, such as a name, username, or an email address, into the public key. Critically, there are no checks to validate the authenticity of this information, meaning users can input anything they desire, or leave fields blank. Yet, as Simwindie emphasizes, the information actually entered, even if seemingly innocuous or fake, can be extracted from the public key by anyone who obtains it. This publicly available metadata has historically been a contributing factor in the arrest of darknet vendors by federal law enforcement, leading to extensive studies and recommendations on improving vendor OpSec.

Common OpSec recommendations for darknet vendors regarding PGP keys include:

• Generating unique PGP key pairs for every profile across different darknet markets to prevent linking profiles based on key reuse.
• Leaving the email address field blank during key creation, as this is the most secure option, offering no pivot point for investigators.
• If an email address must be provided (e.g., for off-market communication if the market goes down), vendors are advised not to use clearnet email addresses (e.g., Gmail, Hotmail, Yahoo) which are easily susceptible to legal process.
• Instead, they should opt for encrypted email providers such as ProtonMail, Riseup, or Tutanota, and ideally still use PGP encryption even with these services.
• Under no circumstances should vendors reuse a personal email address that is inherently tied to their real-world identity, as this constitutes a critical OpSec failure.

Despite these seemingly reasonable and straightforward recommendations, Simwindie's research underscores a pervasive failure among darknet vendors to adhere to these basic security practices, transforming PGP keys into a potent investigative tool.

Key Findings

▶ Watch: Talk agenda: PGP background, case study, examples (2:00)

Simwindie's extensive research, initiated around 2023, involved systematically collecting public PGP keys from vendor profiles across 10 darknet markets. The study specifically targeted vendors dealing in digital items—such as malware, hacking services, and cracked software—under the initial assumption that these tech-savvy criminals might exhibit superior OpSec compared to those selling physical goods. Out of 710 vendor profiles examined, a striking 705 (all but five) made their public PGP keys readily available, confirming PGP keys as an incredibly common and accessible data point on darknet markets.

To process this large dataset efficiently, Simwindie developed an automated methodology:

1. Hashing: The file contents of each public key were hashed to quickly identify identical keys and facilitate link analysis, revealing instances of key reuse across different vendor profiles.
2. User ID Packet Extraction: The gpg --list-packets command was used in conjunction with grep to isolate the User ID packet within each public key. This packet is where optional information like names, usernames, and email addresses are stored.
3. Email Pattern Matching: Regular expressions (regex) were applied to the extracted User ID strings to identify patterns consistent with email addresses.
4. Domain Validation (WHOIS): To filter out fake or malformed email entries, the domain of each identified email address was subjected to WHOIS queries. This step confirmed whether the domain was legitimately registered, effectively distinguishing real email addresses from arbitrary strings.
5. Data Breach Cross-Referencing (Have I Been Pwned): Validated email addresses were then run through Have I Been Pwned (HIBP) to determine if they had appeared in any past data breaches. This was a critical step for identifying high-value targets—emails likely used on other platforms, thus increasing the potential for further attribution.
6. High-Value Target Identification: The final high-value targets were defined as those email addresses possessing WHOIS registration information and appearing in one or more data breaches.

The analysis of 705 public keys yielded several significant findings:

• PGP Key Reuse: While the majority of vendors (approximately 70%) utilized unique public keys for their profiles, a substantial 30% (resulting in 479 unique keys from 705 profiles) demonstrated poor OpSec by reusing the same public key across multiple vendor profiles. Some keys were found on as many as six or seven different profiles.
• Email Inclusion: Of the 479 unique public keys, 218 (just under half) contained an email address with verifiable WHOIS registration information, indicating a direct failure to adhere to the "leave email blank" best practice.
• Prevalence of Clearnet Emails: The most common email domains observed were overwhelmingly clearnet services, with Gmail leading significantly. Other common clearnet domains included Hotmail and Yahoo. Encrypted email providers like ProtonMail, Riseup, and Tutanota were present but far less common than expected for security-conscious users. A particularly notable finding was a vendor operating with an America Online (AOL) email address, highlighting extreme OpSec negligence.
• Data Breach Exposure: Only 61 of the 218 emails that had WHOIS information were found in past data breaches, identifying these as the most immediate high-value targets.
• Concerning Data Breaches: The data breaches linked to these emails included social media platforms (MySpace, LinkedIn, Twitter), indicating vendors used the same email for personal and illicit activities. More critically:
• Neopets (2013 breach): Seven different darknet vendors used emails compromised in this decade-old breach, suggesting long-term email reuse and increased digital footprints.
• Verifications.io breach: This breach affected 18 vendors and contained a trove of personally identifiable information (PII) including full names, dates of birth, phone numbers, and physical addresses—described as the "holy grail for identifying somebody."
• Police.one breach: One vendor's email was found in this breach, which originated from a forum for law enforcement professionals. This highly unusual finding strongly suggested a potential OpSec failure by an undercover law enforcement officer rather than a genuine darknet vendor.

These findings collectively demonstrate that despite widespread awareness of PGP and OpSec recommendations within the darknet community, a significant portion of vendors continue to make fundamental errors that leave them vulnerable to OSINT-driven attribution.

Technical Deep Dive

▶ Watch: Understanding PGP: Public and private key mechanics (2:50)

The technical foundation of Simwindie's approach rests on exploiting the inherent structure of PGP keys and leveraging various OSINT tools and techniques. PGP, based on the OpenPGP standard, uses an asymmetric encryption scheme. Each key pair consists of a public key, which can be widely distributed, and a private key, which must be kept secret. When a PGP key pair is generated, certain user-specified metadata, such as a name, username, or email address, is embedded within a component called the User ID packet of the public key. This packet is not encrypted and is therefore publicly readable.

To extract this crucial information, Simwindie employed command-line tools:

• The gpg --list-packets <public_key_file> command is fundamental. This utility, part of the GnuPG (GNU Privacy Guard) suite, parses the specified PGP key file and outputs its internal structure, including all packets.
• To narrow down the voluminous output to the relevant section, grep is used to filter for lines containing "User ID packet." This isolates the string where the vendor's chosen identity information resides.
• Once the User ID packet string is obtained, regular expressions (regex) are applied to identify patterns that match a standard email address format (e.g., [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}). This allows for the automated extraction of potential email addresses from hundreds of keys.

Beyond basic extraction, the methodology integrates several sophisticated OSINT steps:

• Hashing for Link Analysis: Before packet extraction, the raw public key files are hashed (e.g., using SHA256). Comparing these hashes allows investigators to quickly identify instances where the exact same public key has been reused across multiple darknet market profiles. This is a direct indicator of poor OpSec and immediately links otherwise disparate vendor personas.
• WHOIS Queries for Domain Validation: After extracting email addresses, the domain portion (e.g., gmail.com, protonmail.com) is queried using WHOIS. WHOIS is a protocol that allows users to query databases to determine the registrant or assignee of an Internet resource, such as a domain name. This step is critical for filtering out non-existent or intentionally fabricated email addresses that might match a regex pattern but don't correspond to a real, registered domain. Validating domains ensures that subsequent OSINT efforts are focused on legitimate email addresses.
• Have I Been Pwned (HIBP) Integration: Email addresses confirmed by WHOIS are then submitted to the Have I Been Pwned (HIBP) service. HIBP maintains a database of billions of records from known data breaches. A hit on HIBP signifies that the email address has been exposed in one or more past breaches, indicating potential reuse on other platforms and providing a direct link to other potentially attributable information. This is a powerful filter for identifying "high-value targets"—emails that are likely to yield further investigative leads.
• Info Stealer Log Analysis (e.g., Hudson Rock): In one of the case studies, Simwindie demonstrated the power of analyzing info stealer logs. These logs, often collected by security firms like Hudson Rock, contain data exfiltrated from compromised systems, including saved credentials, browser history, and other sensitive user information. By cross-referencing PGP-derived email addresses with info stealer logs, investigators can uncover a wealth of contextual clues, such as other associated email addresses (e.g., same username on different domains) or even evidence of the vendor's own malware infection, which can provide direct attribution.
• Metadata Analysis: For documents uploaded to public platforms (like Scribed in one case study), the analysis of metadata is crucial. Metadata embedded in files (e.g., author name, creation date, software used, last modified by) can often reveal information that the uploader intended to keep private. While most modern social media and file-sharing platforms strip metadata, some, like Scribed, do not, creating significant OpSec risks for users who are not diligent.

These technical steps, when combined, form a robust framework for transforming PGP keys from an anonymous communication tool into a powerful pivot point for OSINT investigations, systematically reducing the anonymity of darknet vendors.

Demo / Proof of Concept

▶ Watch: Darknet vendor PGP use case for encrypted messaging (4:00)

While no live demonstration was conducted, Simwindie presented three detailed case studies that served as compelling proofs of concept, illustrating the practical application of his methodology to identify "persons of interest" from darknet vendor PGP keys. These case studies highlight various OpSec failures and the diverse paths to attribution.

Case Study 1: The "Hacker for Hire" (Cameroon Nexus)

This vendor offered a wide array of services including bank fraud, credit card fraud, and various drugs, all priced identically—a pattern indicative of a scammer. The vendor's PGP key included a Gmail account. While this email appeared in multiple data breaches, the primary pivot came from the vendor's extensive clear net presence. The vendor had aggressively spammed their products across numerous platforms, including social media, DeviantArt, gun selling sites, and even "furry warrants" (likely forums or communities). Each post consistently included the same Gmail address found in their PGP key, alongside other usernames and phone numbers (which proved to be dead ends).

A breakthrough occurred when one of the domains registered by the vendor was found to suggest a base of operations in Cameroon. Crucially, the Gmail address also appeared in multiple ripoff reports, where victims detailed being scammed by this vendor. In their correspondence with victims, the vendor provided a specific name and city in Cameroon for money order payments. A quick search confirmed this name to be a real individual in that city, establishing a person of interest. Simwindie noted that while this individual is a strong lead, they could potentially be a money mule rather than the primary vendor.

Case Study 2: The "Fake Identity Documents" Vendor (Nigerian Nexus)

This vendor specialized in fraudulent identity documents. Unlike the previous case, this vendor exhibited better OpSec by not spamming their Gmail account (from their PGP key) across the clear net, leading to initial dead ends with conventional OSINT tools. The critical pivot emerged from a document located on Scribed, a document-sharing platform. This document was an application for unemployment benefits during the COVID-19 pandemic, filed by someone using the vendor's PGP email, and subsequently denied due to "lack of proper identification"—a stark irony given the vendor's specialty.

The peculiar nature of Scribed, which requires users to upload their own documents to download others, meant the vendor had likely uploaded this incriminating document. Further investigation of the vendor's Scribed account revealed a trove of files: various bank and credit card statements, government documents (many appearing to be templates or edited forms), files containing full names, dates of birth, and Social Security Numbers, and even Photoshop tutorials for creating fake IDs. Amidst these, other documents, such as study guides for Nigerian examinations, suggested a Nigerian nexus.

The ultimate breakthrough came from the metadata of one of the uploaded documents. Despite the vendor's general efforts to scrub files, one document retained metadata showing a unique author username. This username, when searched, appeared in only two places: a Nigerian English language forum and a Facebook profile. This led to the identification of a person of interest located in Nigeria.

Case Study 3: The "Adult Content Ripper" (Brazilian Nexus)

This vendor specialized in selling ripped content from adult video platforms, specifically advertising ripped OnlyFans content for Brazilian users. The vendor had two separate PGP public keys: a more recent one with a fake email (good OpSec) and an older one containing a Hotmail email address. The two keys were linked by the vendor's consistent username and branding across all darknet market profiles.

The Hotmail address was particularly valuable as it contained a very unique username that also included a full, unique real name. Pivoting off this username revealed its use across multiple sites, including Pinterest (where pins were exclusively in Portuguese), Pornhub, Fansly, and various message boards. The advertising of content for Brazilian users, combined with the Portuguese Pinterest activity, strongly suggested a Brazilian country of interest.

The vendor's email also appeared in data breaches dating back to 2013. However, the most significant lead came from info stealer logs, specifically from the Azerole Info Stealer, accessible via Hudson Rock. These logs provided contextual clues, showing the vendor also possessed a Gmail account with the same character count and first letter as their Hotmail, implying the same username. This provided three new email addresses for pivoting. Further enumeration led to a Yahoo email, also using the same username, which was tied to a Facebook page. This Facebook page had only a handful of followers, all located in Brazil. Crucially, these followers shared a mutual friend who had the same name and username as the initially identified person of interest, also residing in Brazil. This multi-layered corroboration solidified the attribution to a person of interest in Brazil.

These case studies vividly demonstrate that despite the perceived anonymity of the darknet, persistent investigation and the systematic exploitation of OpSec failures in PGP key creation can lead to successful attribution.

Defensive Implications

▶ Watch: OSINT pivot: Exploiting PGP public key metadata (6:00)

The findings presented by Simwindie carry significant defensive implications for both darknet vendors seeking to maintain anonymity and for law enforcement/security professionals aiming to unmask them.

For Darknet Vendors:

• PGP OpSec is Paramount: The optional information entered during PGP key creation is a critical vulnerability. Vendors must understand that anything they put in the User ID packet of their public key can be extracted and used against them.
• Strict Adherence to Uniqueness: The recommendation to use a unique PGP key and a unique, non-attributable email address for every darknet market profile is not optional. The study showed that 30% of vendors failed on key reuse, and nearly half failed on email inclusion. Reusing either allows investigators to link profiles.
• Leave Email Blank: The absolute best practice is to leave the email address field in the PGP key entirely blank. If no email is present, there is no pivot point for email-based OSINT.
• Avoid Clearnet Emails at All Costs: Using services like Gmail, Hotmail, or Yahoo for PGP keys is an egregious OpSec error. These providers are subject to legal processes that can compel them to release user data. Even if encrypted email providers are used, PGP should still be applied as an additional layer.
• Never Reuse Personal Information: The most critical rule is to never use an email address, username, or name that has been used for any personal clear net activity (social media, forums, online services, past data breaches). The Verifications.io and Neopets breaches demonstrated the devastating impact of such reuse.
• Metadata Stripping: Vendors must be extremely diligent in stripping all metadata from any files they upload to public platforms (e.g., document-sharing sites, forums). As seen in Case Study 2, even one unscrubbed document can provide a unique identifier.
• General Malware Hygiene: The third case study highlighted compromise via info stealers. This underscores the need for robust endpoint security and extreme caution regarding phishing or malicious software, as these can directly expose credentials and other sensitive information, regardless of PGP practices.

For Law Enforcement and Security Professionals:

• PGP Keys as a Rich OSINT Source: Investigators should actively seek out and analyze PGP public keys on darknet markets. These are not merely for encrypted communication but are a readily available and often overlooked source of actionable intelligence.
• Automated Analysis is Essential: Manually sifting through hundreds of PGP keys is impractical. Implementing automated scripts for hashing, gpg --list-packets extraction, regex for emails, WHOIS lookups, and HIBP checks is crucial for efficiently identifying high-value targets.
• Cross-Platform Linkage: PGP-derived information, especially email addresses, can serve as powerful pivot points to link anonymous darknet activities to clear net personas, social media profiles, domain registrations, and other online activities.
• Leverage Metadata and Info Stealer Logs: Metadata analysis of any publicly available documents linked to a vendor, and the use of commercial or private info stealer log analysis services (like Hudson Rock), can provide deep contextual clues and direct attribution leads that are otherwise inaccessible.
• Acknowledge Attribution Challenges: While a "person of interest" can often be identified, investigators must remain mindful that this individual may not always be the primary actor (e.g., money mules, unwitting associates). Further corroboration is often necessary to establish high confidence in attribution.
• OpSec Awareness for Undercover Operations: The "Police.one breach" finding serves as a stark reminder for law enforcement agencies to maintain rigorous OpSec for their own undercover operations, ensuring that official or personal information is never inadvertently linked to darknet activities.

In essence, the talk reinforces that the human element remains the weakest link in the chain of anonymity. Even the most sophisticated encryption and anonymization technologies cannot compensate for fundamental human OpSec failures, offering persistent opportunities for skilled OSINT investigators.

Key Takeaways

• PGP keys are a critical and readily available OSINT data point: Darknet vendors widely adopt PGP, making their public keys easy to find, yet these are often overlooked as a source of intelligence for unmasking them.
• Widespread OpSec failures in PGP key creation: Despite recommendations, a significant portion of darknet vendors make fundamental errors, such as reusing PGP keys (30% of profiles), including email addresses (nearly 50% of unique keys), and using clearnet email services (e.g., Gmail, Hotmail).
• Email addresses are powerful pivot points: Emails embedded in PGP keys, especially those found in past data breaches (61 identified in the study), provide direct links to other online activities and personal information, including full names, dates of birth, phone numbers, and physical addresses (e.g., Verifications.io breach).
• Automated analysis is key for efficiency: Tools and techniques like hashing for link analysis, gpg --list-packets for data extraction, regex for pattern matching, WHOIS for domain validation, and Have I Been Pwned for breach correlation are essential for systematically processing large datasets of PGP keys.
• Metadata and info stealer logs offer deep insights: Beyond direct key content, analyzing metadata in uploaded documents and leveraging info stealer logs (e.g., Azerole Info Stealer via Hudson Rock) can provide crucial contextual clues and lead to direct attribution.
• Darknet anonymity is vulnerable to human error: The talk conclusively demonstrates that Tor and encryption do not guarantee anonymity when fundamental OpSec practices are neglected, making darknet vendors just as susceptible to OSINT-driven attribution as any other online target.

About the Speaker(s)

Simwindie, who also goes by Sin or Sin Wendy on social media, is a Certified Cyber Crime Investigator and a Sensei at Austin doz. He brings over a decade of experience in open-source intelligence (OSINT), having held roles in both the federal government and, more recently, the private sector. His expertise lies in leveraging OSINT methodologies for the precise tracking and unmasking of various bad actors online. Beyond his professional work, Simwindie is a dedicated educator in the OSINT community, running the OSINT Dojo. This platform provides free resources and engaging challenges, offering a gamified learning environment for those new to the field to develop essential OSINT skills and earn digital badges.