Pretty Good Pivot

Introduction to PGP Keys in OSINT Investigations

This presentation focuses on utilizing Pretty Good Privacy (PGP) keys, often overlooked, as a powerful pivot point in Open Source Intelligence (OSINT) investigations, particularly when dealing with darknet vendors. PGP keys are common on darknet markets and can provide valuable real-world attribution information if vendors make mistakes during their creation.

About the Speaker

Sin, also known as Sin Wendy, is a certified cybercrime investigator with over 10 years of experience in OSINT. They specialize in tracking and unmasking online targets and run the OSENT Dojo, offering free resources and challenges for those new to the field.

How Darknet Vendors Use PGP

PGP is a method for securing messages and files using encryption. It relies on a pair of keys: a public key, shared with others to encrypt messages sent to the owner, and a private key, kept secret by the owner to decrypt messages. Public keys can also be used to verify signatures made with a private key. Darknet vendors commonly use PGP to encrypt communications with buyers. When a vendor sets up on a new market, they typically make their public key available. A buyer can then acquire this public key to encrypt their initial message to the vendor, which also includes the buyer's public key. The vendor uses their private key to decrypt the message and obtain the buyer's public key, allowing for secure, encrypted communication moving forward.

PGP Keys as an OSINT Pivot Point

Investigators are interested not in the encrypted messages themselves, but in the public keys. When creating a PGP key pair, users can optionally include information like a name, username, or email address. While this information doesn't need to be real, it is stored with the public key and can be accessed by anyone who obtains it. Federal law enforcement has previously arrested darknet vendors based on information they included in their PGP key pairs. Vendors are often advised to create unique PGP keys for each market profile to prevent linking them. However, a common recommendation, and a significant oversight, is the handling of the email address associated with the key. Best practice suggests leaving it blank. If an email must be included, it should not be a personal, clear-net email address, but rather one from a provider that encrypts by default, and ideally, not one tied to real-world identity.

Case Study: PGP Key Creation Habits

Starting in 2023, the speaker collected public keys from vendors on 10 darknet markets, focusing on those selling digital items like malware or cracked software. Out of 710 vendor profiles analyzed, 705 made their public keys available, highlighting their commonality. To manage this data, automation was used:

Public Key Hashing: To identify duplicate public keys across different vendor profiles.

Pattern Matching: Using gpg --list-packets and grep to isolate user ID packets, and regex to identify potential email address formats.

WHOIS Lookups: To verify if identified email domains had registration information, filtering out non-real email addresses.