Tor Black Markets: Economics, Characterization and Investigation Technique

The cyber threat is highly dynamic and evolves in parallel with the innovation of systems and communications, which are outside the control of government authorities and respond exclusively to business logic and free initiative, often contingent on implementation of illegal activities. In particular, the threat posed by the criminal use of the Internet goes far beyond the cybercrime, especially with the Tor network, where black markets are shifted with the shape of renown legal marketplaces as Ebay and Amazon. Hence even common crime can benefit of new modus operandi and new routes to deliver illegal goods or services, enforcing new investigation techniques to Law Enforcement Agencies (LEAs). This paper formerly analyses the goods/services categories of fourteen Tor marketplaces and the related vendors, while the last one provides a discussion on a novel investigative technique related to PGP Keys inter-relations. In particular, with the evolution/growth of the markets, the vendors are increasingly adopting open source tools and technologies, as PGP, which can be exploited to infer information such as the established relationships between users. This public information about the keys can be used to retrace social network of entities connected by PGP relationship and apply well-established graph analysis techniques. Finally, the paper analyses the strength and weaknesses of proposed methods, depicting future research directions.