2298

This paper examines the influence of scientific appearance (SA) on post dissemination and analyses a dataset of important actors in Germany, specifically those involved in the dissemination of disinformation on the social media platform Telegram. SA is identified through textual elements such as predefined keywords or digital object identifiers (DOIs). Characteristics and behaviours of actors with and without SA are compared using metadata such as forward counts and original posts. The additional content analysis provides insights into SA's usage and impact. The findings indicate that SA may influence the dissemination of posts and demonstrate how different methods can be applied for studying social media platforms.

Since darknet marketplaces became popular, many came online and went offline after a short time, often taken down by law enforcement or performing exit scams. In order to succeed in running a darknet marketplace, operators need to earn trust from the users of their platform. However, in anonymous environments like darknet marketplaces, it can be difficult to determine which technical measures or policies intended to build trust can actually be trusted.In this paper we evaluate the trustworthiness of the darknet marketplace UnderMarket 2.0. By scraping and analyzing data from the marketplace, we reveal that numerous fraud indicators exist. We show in a further evaluation that UnderMarket 2.0 intentionally uses various measures to gain trust in order to defraud customers.

Darknet marketplaces in the Tor network are popular places to anonymously buy and sell various kinds of illegal goods. Previous research on marketplaces ranged from analyses of type, availability and quality of goods to methods for identifying users. Although many darknet marketplaces exist, their lifespan is usually short, especially for very popular marketplaces that are in focus of law enforcement agencies.

Recently, steganographic techniques for hiding data in file system metadata gained focus. Tools for commonly used file systems were published but the exFAT file system did not get much attention – probably because its structure provides only few suitable locations to hide data. In this work we present two approaches to hide data in the exFAT file system. While the first approach is more flexible regarding embedding locations, it is rather fragile and provides a lower embedding rate. The second approach, called exHide, has stricter requirements for embedding, but is rather robust and provides a reasonable embedding rate. We describe the design of both approaches, evaluate them, and discuss their weaknesses and advantages.

Tor onion services can be accessed and hosted anonymously on the Tor network. We analyze the protocols, software types, popularity and uptime of these services by collecting a large amount of .onion addresses. Websites are crawled and clustered based on their respective language. In order to also determine the amount of unique websites a de-duplication approach is implemented. To achieve this, we introduce a modular system for the real-time detection and analysis of onion services. Address resolution of onion services is realized via descriptors that are published to and requested from servers on the Tor network that volunteer for this task. We place a set of 20 volunteer servers on the Tor network in order to collect .onion addresses. The analysis of the collected data and its comparison to previous research provides new insights into the current state of Tor onion services and their development. The service scans show a vast variety of protocols with a significant increase in the popularity of anonymous mail servers and Bitcoin clients since 2013. The popularity analysis shows that the majority of Tor client requests is performed only for a small subset of addresses. The overall data reveals further that a large amount of permanent services provide no actual content for Tor users. A significant part consists instead of bots, services offered via multiple domains, or duplicated websites for phishing attacks. The total amount of onion services is thus significantly smaller than current statistics suggest.

Darknet marketplaces are an interesting research area. Most marketplaces are hosted in the Tor network as an anonymous onion service. In this paper we provide a generic approach to build a framework for the collection and analysis of product prices and supplies in such marketplaces. We focus on the technical details how to implement such a framework and how to collect, organize, and analyze the product data. For our framework implementation we provide an evaluation based on collected data from three large marketplaces and present an approach to enrich the analyzed data with additional information from external sources.

Anonymity networks and hidden services like those accessible in Tor, also called the "darknet", in combination with cryptocurrencies like bitcoin provide a relatively safe environment for criminal online activities. While this is a challenge for law enforcement, it brings opportunities for researchers to monitor these activities as they are often not really hidden but rather obfuscated and/or anonymized. In this paper we discuss such a monitoring approach for product sales in the darknet. We collect bitcoin addresses and data about product offerings in a number of shops run as hidden services in Tor. We then analyze transactions in the bitcoin blockchain that can be mapped to specific product sales in these shops.

A digital forensics examiner often has to deal with large amounts of multimedia content during an investigation. One important part of such an investigation is to identify illegal material like pictures containing child pornography. Robust image hashing is an effective technique to help identifying known illegal images even after the original images were modified by applying various image processing operations. However, some specific operations lead to increased false negative rates when using robust image hashing. One of the most challenging operations today is image cropping. In this work we introduce an approach to counter cropping operations on images by combining image segmentation and efficient block mean image hashing. We show that we are able to achieve high detection rates for images where cropping operations where applied on the original known source. This further improves the robustness of our image hashing approach.

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices. In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.

Benford Analysis is a statistical method used for detecting financial fraud. It compares the distribution of digits in data with the Benford Distribution. But there are often disadvantages ranging from uncomfortable rates of false positives up to total inapplicability of the method. We identified the inaccurate fit of typical data to the Benford Distribution as reason for these deficits. So we propose to use adaptive distributions of digits instead. For that we introduce a procedure which derives the distribution of digits from a ``model'' for the distribution of data. The term ``model'' means an abstract distribution which reflects basic properties of the data. This paper identifies different models and analyzes their relevance and performance. We show that model-based Digit Analysis provides a more reliable and more generally applicable tool for fraud detection to auditors.

Increasing amounts of data require improvements in effectiveness and efficiency of forensic tools. If new tools have been developed, they have to be evaluated, e.g. by applying test data. 3LSPG has recently been proposed as a framework for generating synthetic test data by simulating activities of subjects using Markov chains. However, the generation of test data should also be efficient. In this paper, we show how to improve the efficiency of 3LSPG considerably compared to its original proposal. We show how to speed-up the calculation of state transition probabilities in the Markov model of 3LSPG by proposing an algorithm that is much faster and more reliable than the one originally used. The simplex algorithm serves as basis for our algorithm although it is typically used for the different purpose of solving optimization problems. Our algorithm helps to enable the creation of synthetic data for forensic tool testing with 3LSPG in significantly shorter time.