A deep web hacker operating under the pseudonym of ‘Phishkingz' has recently claimed to have generated over $1 million from phishing Alphabay accounts during the last 14 months. PGP Key: Enter PGP key info on the registration page. This key is used to encrypt and decrypt the data which you processed on the marketplace. AlphaBay Market Welcomes you! A fter the completion, now you are taken to the official page of the site. Since AlphaBay is a Dark Web marketplace, which is only accessible via the Tor Browser, the bug could have been exploited by law enforcement to unmask users real identities who deal in drugs and other illegal activities. But, AlphaBay members using the PGP key and encrypting their account details would be on a safer side. The buyer would post that anonymized public key in his or her user profile. The vendors and buyers would communicate by encrypting their own messages and using public PGP keys. But that's a lot of. This video will show you how to setup PGP on Alpha BayGPG4Win download Linkthis video helped you out please donate so.
Just days before he was set to go to trial in Fresno, California, a Brooklyn man agreed to the government's assertion that he sold heroin and cocaine on AlphaBay. That site is one of the largest Dark Web marketplaces currently operating since Silk Road was seized and shut down in 2013.
On Friday morning, lawyers representing Abdullah Almashwali appeared before US District Judge Dale A. Drozd and filed a guilty plea to three counts of drug charges, likely in exchange for a lighter sentence. Almashwali was charged in August 2016 along with a co-conspirator, Chaudhry Ahmad Farooq. Farooq pled guilty in January 2017 and has yet to be sentenced.
According to an affidavit filed by a special agent with the Drug Enforcement Administration, the two men—selling under the names 'DarkApollo' and 'Area51'—made key mistakes online that ultimately betrayed them. Those monikers advertised that they were directly importing heroin from Afghanistan.
It was seemingly easy for Special Agent John Rabaut to find them. As he wrote:
Initial analysis of DARKAPOLLO and AREA51's public PGP key indicated that both keys were registered to the same email address: Adashc3l@gmail.com. A social-media search for the phrases Adashc3d31 and Adashc3d resulted in the discovery of a Twitter, Instagram, and Facebook account belonging to someone identified as 'Ahmed Farooq' or 'Ch. Ahmed Farooq' (Hereinafter referred to as FAROOQ). The Facebook profile belonging to FAROOQ indicated that he resided in Brooklyn, New York.
Consent search
In May 2016, Rabaut, working undercover, set up two purchases from AREA51 and had them sent to a Fresno address—both turned out to be heroin.(Fresno is also the location of the scheduled September 19, 2017 trial of David Ryan Burchard. According to the affidavit by special agent Matthew Larsen of Homeland Securities Investigations (HSI), the FBI estimates that Burchard was the 18th largest vendor on Silk Road. That made Burchard the third-largest US-based vendor on the notorious and now-shuttered online drug market.)
AdvertisementIn the Almashwali case, Rabaut sent the packages to a DEA lab, which managed to lift fingerprints off of the packages. The prints came back with a match for Almashwali, who was arrested in 2008 on a charge of receiving stolen property.
The DEA agent then partnered with an inspector from the United States Postal Inspection Service. The inspector was able to determine that the postage on those packages was purchased via a 'self-service kiosk' (SSK) at a Brooklyn post office.
As Rabaut continued:
Due to SSK transactions being a non-face-to-face transactions, photos are taken during each transaction that is conducted. Inspector Burger retrieved the photo of the suspect who purchased the postage for [undercover] PARCEL #1 and provided the photo to me. I positively identified the individual in the photo as ALMASHWALI.
Almashwali was arrested near his apartment in Brooklyn on August 2, 2016—Farooq was also being watched and also was arrested the same day. Once in the apartment, investigators quickly found a slew of digital evidence that implicated Farooq, as was outlined in an April 11, 2017 trial brief:
Case agents obtained consent to search [Farooq's] apartment and found several items of evidence, including a MacBook computer and an iPhone 6 Plus. The MacBook computer was logged into DARKAPOLLO's Alpha Bay account, allowing case agents to take screen shots of account records. Agents also found packaging materials, including boxes full of padded envelopes and stacks of USPS and FedEx envelopes. They also located silver Mylar envelopes that matched the Mylar envelopes used to send the heroin in Parcels #1 and 2.
The forensic case agent imaged the iPhone 6 Plus and the MacBook computer, which contained backups of several digital devices, including an iPhone 6 Plus (for the same phone that was found in Farooq's apartment), an iPhone 6s Plus, and an iPhone 5c. The iPhone 6 Plus (both the actual phone and the backup) and iPhone 6s Plus belonged to Farooq, while the iPhone 5c appears to have belonged to the defendant. These devices contained thousands of text messages, including hundreds of text messages between the defendant and co-defendant Farooq in which they discuss the distribution of narcotics and dark-web marketplaces.
Consent search
In May 2016, Rabaut, working undercover, set up two purchases from AREA51 and had them sent to a Fresno address—both turned out to be heroin.(Fresno is also the location of the scheduled September 19, 2017 trial of David Ryan Burchard. According to the affidavit by special agent Matthew Larsen of Homeland Securities Investigations (HSI), the FBI estimates that Burchard was the 18th largest vendor on Silk Road. That made Burchard the third-largest US-based vendor on the notorious and now-shuttered online drug market.)
AdvertisementIn the Almashwali case, Rabaut sent the packages to a DEA lab, which managed to lift fingerprints off of the packages. The prints came back with a match for Almashwali, who was arrested in 2008 on a charge of receiving stolen property.
The DEA agent then partnered with an inspector from the United States Postal Inspection Service. The inspector was able to determine that the postage on those packages was purchased via a 'self-service kiosk' (SSK) at a Brooklyn post office.
As Rabaut continued:
Due to SSK transactions being a non-face-to-face transactions, photos are taken during each transaction that is conducted. Inspector Burger retrieved the photo of the suspect who purchased the postage for [undercover] PARCEL #1 and provided the photo to me. I positively identified the individual in the photo as ALMASHWALI.
Almashwali was arrested near his apartment in Brooklyn on August 2, 2016—Farooq was also being watched and also was arrested the same day. Once in the apartment, investigators quickly found a slew of digital evidence that implicated Farooq, as was outlined in an April 11, 2017 trial brief:
Case agents obtained consent to search [Farooq's] apartment and found several items of evidence, including a MacBook computer and an iPhone 6 Plus. The MacBook computer was logged into DARKAPOLLO's Alpha Bay account, allowing case agents to take screen shots of account records. Agents also found packaging materials, including boxes full of padded envelopes and stacks of USPS and FedEx envelopes. They also located silver Mylar envelopes that matched the Mylar envelopes used to send the heroin in Parcels #1 and 2.
The forensic case agent imaged the iPhone 6 Plus and the MacBook computer, which contained backups of several digital devices, including an iPhone 6 Plus (for the same phone that was found in Farooq's apartment), an iPhone 6s Plus, and an iPhone 5c. The iPhone 6 Plus (both the actual phone and the backup) and iPhone 6s Plus belonged to Farooq, while the iPhone 5c appears to have belonged to the defendant. These devices contained thousands of text messages, including hundreds of text messages between the defendant and co-defendant Farooq in which they discuss the distribution of narcotics and dark-web marketplaces.
Judge Drozd is scheduled to sentence Almashwali on July 24, 2017, at 1:30 p.m. and Farooq on May 15, 2017. The two men face a maximum sentence of 20 years in prison and a $1 million fine, which will almost certainly be reduced.
UPDATE 10:30am ET: The headline has replaced the word 'keyserver' with the phrase 'public key' to more accurately reflect what is described in the affidavit.
Table of Contents
- 4Sending and receiving public keys
This tutorial explains how to set up Thunderbird to digitally sign, encrypt and decrypt messages in order to make them secure.
The email infrastructure that everyone uses is, by design, not secure. While most people connect to their email servers using a secure ('SSL') connection, some servers allow unsecured access. Furthermore, as the message moves through its transmission path from sender to recipient, the connections between each server are not necessarily secure. It is possible for third parties to intercept, read and alter email messages as they are transmitted.
When you digitally sign a message, you embed information in the message that validates your identity. When you encrypt a message, it appears to be 'scrambled' and can only by read by a person who has the key to decrypting the message. Digitally signing a message ensures that the message originated from the stated sender. Encrypting ensures that the message has not been read or altered during transmission.
To encrypt messages, you can use the public-key cryptographic system. In this system, each participant has two separate keys: a public encryption key and a private decryption key. When someone wants send you an encrypted message, he or she uses your public key to generate the encryption algorithm. When you receive the message, you must use your private key to decrypt it.
The protocol used to encrypt emails is called PGP (Pretty Good Privacy). To use PGP within Thunderbird, you must first install:
- GnuPG: (GNU Privacy Guard): a free software implementation of PGP
- Enigmail: a Thunderbird add-on
These two applications also provide the capability to digitally sign messages.
To install GnuPG, download appropriate package from the GnuPG binaries page. Follow the installation instructions provided for your particular package. For more information on installing PGP on specific operating systems, refer to:
To install Enigmail:
- In Thunderbird, select Tools > Add-ons.
- Use the search bar in the top right corner to search for Enigmail.
- Select Enigmail from the search results and follow the instructions to install the add-on.
Pgp Key Alpha Bayside
Create your public/private keys as follows:
- On the Thunderbird menu bar, click OpenPGP and select Setup Wizard.
- Select Yes, I would like the wizard to get me started as shown in the image below. Click to proceed.
- The wizard asks whether you want to sign all outgoing messages or whether you want to configure different rules for different recipients. It is usually a good idea to sign all emails so that people can confirm that the email is indeed from you. Message recipients do not need to use digital signatures or PGP to read a digitally signed message. Select Yes, I want to sign all of my email and click to proceed.
- Next, the wizard asks if you want to encrypt all your emails. You should not select this option unless you have the public keys for all the people that you expect to send messages to. Select No, I will create per-recipient rules for those who send me their public keys and click to proceed.
- The wizard asks if it can change some of your mail formatting settings to better work with PGP. It is a good choice to answer Yes here. Click to proceed.
- Select the email account for which you want to create the keys. You need to enter a password in the ‘Passphrase' text box which is used to protect your private key. This password is used to decrypt messages, so don't forget it. The password should be at least 8 characters long and not use any dictionary words. (See this Wikipedia article for information on creating strong passwords.) Enter this password twice and click to proceed.
- The next screen displays the preferences you configured. If you are satisfied, click to proceed.
- When the process of creating your keys is completed, click to proceed.
- The wizard will ask if you want to create a ‘Revocation certificate' which you would use if the security of your key pair was compromised and you needed to inform others that it is no longer valid. If you want to create the file click on and follow the steps on the subsequent screens. Otherwise, click .
- The wizard finally informs you that it has completed the process. Click to exit the wizard.
Sending your public key via email
To receive encrypted messages from other people, you must first send them your public key:
Pgp Key Darknet
- Compose the message.
- Select OpenPGP from the Thunderbird menu bar and select Attach My Public Key.
- Send the email as usual.
Receiving a public key via email
To send encrypted messages to other people, you must receive and store their public key:
- Open the message that contains the public key.
- At the bottom of the window, double click on the attachment that ends in '.asc'. (This file contains the public key.)
- Thunderbird automatically recognizes that this is a PGP key. A dialog box appears, prompting you to ‘Import' or ‘View' the key. Click to import the key.
- You will see a confirmation that the key has been successfully imported. Click to complete the process.
- Compose the message as usual.
- To digitally sign a message, select OpenPGP from the Thunderbird menu and enable the Sign Message option. To encrypt a message, enable the Encrypt Message option. The system may ask you to enter your Passphrase before encrypting the message.
- If your email address is associated with a PGP key, the message will be encrypted with that key. If the email address is not associated with a PGP key, you will be prompted to select a key from a list.
- Send the message as usual.
When you receive an encrypted message, Thunderbird will ask you to enter your secret passphrase to decrypt the message. To determine whether or not the incoming message has been signed or digitally encrypted you need to look at the information bar above the message body.
If Thunderbird recognizes the signature, a green bar (as shown below) appears above the message.
If the message has been encrypted and signed, the green bar also displays the text 'Decrypted message'.
If the message has been encrypted but not signed the bar would appear as shown below.
If you believe that your private key has been 'compromised' (that is, someone else has had access to the file that contains your private key), you should revoke your current set of keys as soon as possible and create a new pair. To revoke your current set of keys:
- On the Thunderbird menu, click OpenPGP and select Key Management.
- A dialog box appears as shown below. Check Display All Keys by Default to show all the keys.
- Right-click on the key you want to revoke and select Revoke Key.
- A dialog box appears asking if you really want to revoke the key. Click to proceed.
- Another dialog box appears asking you to enter your secret passphrase. Enter the passphrase and click to revoke the key.
Send the revocation certificate to the people you correspond with so that they know that your current key is no longer valid. This ensures that if someone tries to use your current key to impersonate you, the recipients will know that the key pair is not valid.