/d/DarkNetMarkets

N/A subscribers

N/A

Hey vendors, ever receive an encrypted threat from a customer? Here is what to do.

by /u/ugu · 0 votes · 2021-10-28 17:03:00

PGP has many feature which a lot of users are not aware of. Modern PGP clients generally try to make things very simple to use, and sometimes they either poorly document or completely leave out features which are useful under rare circumstances. One of these features is managing session keys. Simply put, the session key is a decryption key used to decrypt one specific message, and no other messages. In the past, many vendors have received threats like "give me free extra product or I will leave negative reviews!!!" from their customers, and the customers encrypt the message to the vendor, erroneously thinking that the vendor cannot prove he received such a message without sharing his own private key. And sometimes, that threat works, because many vendors do not know they can prove they received such a message either! Here is how you can publicly display the contents of a message encrypted to your private key.

First, create a file in your home directory called threat.txt. You can put any message you want in it. Then in your terminal, run the command:

gpg -aer YourPGPKeyUsernameHere threat.txt > threat.asc;
This will encrypt the message to your public key and save it to threat.asc. To get the session key, take an encrypted message and run this command on it:
gpg --show-session-key threat.asc;
This will display the session key. A session key will look something like this: 9:15BAF965CA65E39C37A64EAEAB41B795857043904C863D9E19FDB7EFE04F8DA1 Now you can publish the session key and the encrypted message. If you have a message encrypted to somebody else, and the session key to decrypt that message, you can decrypt it like so:
gpg --override-session-key="PUT_THE_SESSION_KEY_HERE" --decrypt threat.asc;


And this will display the decrypted contents of the message, even without having the full private key! You can use this to forward abusive or threatening encrypted messages to market staff members, and hopefully save some money from dishonest customers. I hope this helps somebody. Stay safe everyone :)

Comments (0)