The Dark and Deep Web

The Dark Web is a part of the World Wide Web that requires special software to access. Once inside, web sites and other services can be accessed through a browser in much the same way as the normal web.

However, some sites are effectively “hidden”, in that they have not been indexed by a search engine and can only be accessed if you know the address of the site. Special markets also operate within the dark web called, “Darknet Markets”, which mainly sell illegal products like drugs and firearms, paid for in the crypto currency Bit coin.

There is even a crowd funded “Assassination Market”, where users can pay towards having someone assassinated because of the dark web’s almost total anonymity, it has been the place of choice for groups wanting to stay hidden online from governments and law enforcement agencies. On the one hand there have been whistle blowers using the dark web to communicate with journalists, but more frequently it has been used by pedophile groups, terrorists and criminals to keep their dealings secret.

There are a number of ways to access the dark web, including the use of Tor, Free net and I2P. Of these, the most popular is Tor (originally called The Onion Router), partly because it is one of the easiest software packages to use. Tor downloads as a bundle of software that includes a version of Firefox configured specifically to use Tor.

Tor provides secrecy and anonymity by passing messages through a network of connected Tor relays, which are specially configured computers. As the message hops from one node to another, it is encrypted in a way that each relay only knows about the machine that sent the message and the machine it is being sent to.

There are even special versions of search engines like Bing and Duck Go that will return onion addresses for Tor services.

It is a mistake to think that Tor is entirely anonymous. If a web site is accessed, it can still potentially find out information about whoever is accessing the site because of information that is shared, such as usernames and email addresses. Those wanting to stay completely anonymous have to use special anonymity services to hide their identity in these cases.

Services on the dark web would not have been as popular without a means of paying for them. This is something that Bit coin has made possible. A recent study by Carnegie Mellon researchers Kyle Soska and Nicolas Christin has calculated that drug sales on the dark net total US$100 million a year. Most, if not all, was paid for in Bit coin.

Bit coin is made even more difficult to track on the dark web through the use of “mixing services” like Bit coin Laundry, which enables Bit coin transactions to be effectively hidden completely.

The Questions raises that “How Dark Is The Dark Web”…?

The developers of Tor and organizations like the Electronic Frontier Foundation (EFF argue that the principal users of Tor are activists and people simply concerned with maintaining their privacy. Certainly, Tor has been used in the past for journalists to talk to whistleblowers and activists, including Edward Snowden).

However, even a cursory glance at the Hidden Wiki – the main index of dark websites – reveals that the majority of sites listed are concerned with illegal activities. Some of these sites are scams, and so it is not clear how easy it is to buy guns, fake passports and hire hackers from the services listed. But there are likely sites on the dark web where these things are entirely possible.

Although the dark web makes law enforcement agencies’ jobs much more difficult, they have had a great deal of success in bringing down sites and arresting their users and the people behind them. The most famous of these was the arrest of Ross Ulbricht, the person behind the most well known of the drug markets, Silk Road.

More recently, the FBI’s arrest of two users of a child abuse site on the dark web highlighted that they are now able to use a range of techniques to unmask Tor users’ real internet addresses.

Dark Net websites are accessible only through networks such as Tor ("The Onion Router") and I2P ("Invisible Internet Project"). Tor browser and Tor-accessible sites are widely used among the dark net users and can be identified by the domain ".onion". While Tor focuses on providing anonymous access to the Internet, I2P specializes on allowing anonymous hosting of websites. Identities and locations of dark net users stay anonymous and cannot be tracked due to the layered encryption system. The dark net encryption technology routes users' data through a large number of intermediate servers, which protects the users' identity and guarantees anonymity. The transmitted information can be decrypted only by a subsequent node in the scheme, which leads to the exit node. The complicated system makes it almost impossible to reproduce the node path and decrypt the information layer by layer. Due to the high level of encryption, websites are not able to track geo location and IP of their users, and users are not able to get this information about the host. Thus, communication between dark net users is highly encrypted allowing users to talk, blog, and share files confidentially.

The dark net is also used for illegal activity such as illegal trade, forums, and media exchange for pedophiles and terrorists. At the same time traditional websites have created alternative accessibility for the Tor browser in efforts to connect with their users. Pro Publica, for example, launched a new version of its website available exclusively to Tor users.

Many hackers sell their services either individually or as a part of groups. Such groups include x Dedic, hack forum, Trojan forge, Maza faka, dark 0de and The Real Deal dark net market. Some have been known to track and extort apparent pedophiles. Cyber crimes and hacking services for financial institutions and banks have also been offered over the Dark web. Attempts to monitor this activity have been made through various government and private organizations, and an examination of the tools used can be found in the Procedia Computer Science journal. Use of Internet-scale DNS Distributed Reflection Denial of Service (DRDoS) attacks has also been made through leveraging the Dark Web. Many hacking groups such as Code Green also recruit Hackers depending on their skills. There are many scam onion sites also present which end up giving tools for download that are infected with trojan horse or backdoor.

There is regular law enforcement action against sites distributing child pornography – often via compromising the site by distributing malware to the users. Other content includes sexualized torture and killing of animals and some kind revenge porn.

There are at least some real and fraudulent websites claiming to be used by ISIL (ISIS), including a fake one seized in Operation Onymous. In the wake of the November 2015 Paris attacks an actual such site was hacked by an Anonymous affiliated hacker group GhostSec and replaced with an advert for Prozac. The Rawti Shax Islamist group was found to be operating on the dark web at one time.

In the 2000s, use of the term child abuse images increased by both scholars and law enforcement personnel because the term "pornography" can carry the inaccurate implication of consent and create distance from the abusive nature of the material. A similar term, child sexual abuse material, is used by some official bodies and similar terms such as "child abuse material", "documented child sexual abuse", and "depicted child sexual abuse" are also used, as are the acronyms CAM and CAI. The term "child pornography" retains its legal definitions in various jurisdictions, along with related terms such as "indecent photographs of a child" and others. In 2008, the World Congress III against the Sexual Exploitation of Children and Adolescents stated in their formally adopted pact that "Increasingly the term 'child abuse images' is being used to refer to the sexual exploitation of children and adolescents in pornography. This is to reflect the seriousness of the phenomenon and to emphasize that pornographic images of children are in fact records of a crime being committed."

Interpol and policing institutions of various governments, including among others the United States Department of Justice, enforce child pornography laws internationally. Since 1999, the Interpol Standing Working Group on Offenses Against Minors has used the following definition:

Child pornography is the consequence of the exploitation or sexual abuse perpetrated against a child. It can be defined as any means of depicting or promoting sexual abuse of a child, including print and/or audio, centered on sex acts or the genital organs of children.

Children of all ages, including infants are abused in the production of pornography. The United States Department of Justice estimates that pornographers have recorded the abuse of more than one million children in the United States alone. There is an increasing trend towards younger victims and greater brutality; according to Flint Waters, an investigator with the federal Internet Crimes Against Children Task Force, "These guys are raping infants and toddlers. You can hear the child crying, pleading for help in the video. It is horrendous." According to the World Congress against Commercial Sexual Exploitation of Children, "While impossible to obtain accurate data, a perusal of the child pornography readily available on the international market indicates that a significant number of children are being sexually exploited through this medium.

Masha Allen was adopted at age 5 from the former Soviet Union by an American man who sexually abused her for five years and posted the pictures on the Internet. She testified before the United States Congress about the anguish she has suffered at the continuing circulation of the pictures of her abuse, to "put a face" on a "sad, abstract, and faceless statistic," and to help pass a law named for her. "Masha's Law," included in the Adam Walsh Child Protection and Safety Act passed in 2006, includes a provision which allows young people 18 and over to sue in civil court those who download pornographic images taken of them when they were children. "Downloading" includes viewing without actual download; many successful prosecutions are completed through using residual images left on the viewer's computer.

Terrorist and non-state actors have used different modes and mediums to spread their message and communicate with their comrades. The dawn of the Internet has also provided such groups with unparalleled opportunities to establish communications and operational links that were not possible before. Starting from websites, terrorist groups moved to more interactive mediums like chat rooms and forums. It was social media platforms, such as Facebook and Twitter that truly revolutionized how militants, terrorists and non-state actors communicated with each other, recruited sympathizers and supporters and disseminated their propaganda.

The self-proclaimed Islamic State (IS) perfected the use of social media, which became the preferred source for the so-called ‘jihadists’ or ‘soldiers of the Caliphate’. In response, tech companies have been compelled to take down Facebook and Twitter accounts affiliated with IS. The unintended cost of this policy is that supporters, sympathizers and members of jihadist groups have moved into the deep web and the dark net.

"In Computer Science, we often got bored and decked around. One day we ran into the deep web. The most disturbing site we found was a comprehensive guide for cooking women. We're not talking about a short joke here. This page had information on what body types to use for specific cuts, how to prepare these cuts, and how to cook the girl so she lives as long as possible. It horrifies me that people way worse than the freaks on Criminal Minds exist.”

So security concerns for SMBs re: "Deep Web" would be as follows:

1. User's navigating the "Deep Web" is infected much in the same way that users on the "Surface Web" are (by browsing and general internet activities)

2. Malware that utilizes Tor for data exfiltration and/or command and control

Start by rejecting inbound and outbound traffic on port 9001, this is the default port for Tor. This will not prevent the user or malicious actor from using the service (as this can be configured for commonly permitted ports such as 80) but is a good start if there is no legitimate business need for port 9001.

Configure your Antivirus product to prevent common tor executable from running on company resources (Tor, Privoxy, Tor Browser), these executables can also be renamed to work around this, however this is a good first line of defense.

If your firewall supports it (and a fair amount of modern UTMs do) configure your firewall to inspect for Tor traffic and block the traffic from passing, this is going to depend on your firewall so consult the manufacturer's documentation. Some APT software also has provisions for rejecting this traffic and/or the associated executables from leaving the host or running, so you may also want to consult the documentation for your APT/Malware/Antivirus software to see if this can be leveraged.

If you're most concerned with user activity a software white listing application would reject unapproved software from running, in concert with APT defenses this could also be an appealing way to address these risks associated with malware/malicious actors.

The above should give you a head start and provide you with a reasonable level of confidence that traffic leaving or entering the network is not leveraging Tor.

Simply, white list applications allowed to be used on your environment, don't allow any browsers such as TOR, I2P etc.

But you still need other/network access controls for those laptops, phones, gaming systems, internet toasters and other IoT connected B.S. that you can't impose a policy on.

My combination of DNS filtering, no IP in a URL restriction, good firewall rules preventing just as much OUTBOUND traffic as in, and leaving all ports in a dead VLAN by default, have all served me well so far - and I'm not paying for any "subscription" products to do it.

The Dark Web sounds scary, right? You've probably heard of it, maybe in connection to online drug markets or rumors of terrorist plotting.

A sweeping survey of over 24,000 people worldwide by a Canadian think tank shows that 71% of internet users believe the Dark Web "should be shut down."

The Dark Net, or Deep Web or a dozen other names, isn't a single set of sites so much as a network of sites that you need special protocols or software in order to find.

Shutting down the network would mean shutting down every site and relay. In the case of the private web browser Tor, this means simultaneously shutting down over 7,000 secret nodes worldwide. The combined governments of various countries have enough trouble keeping the Pirate Bay from operating right on the open web, never mind trying to shut down an entire network of sites with encrypted communications and hidden IP addresses hosted worldwide.

There isn't even a single Deep Web. Most people who refer to the Deep Web are referring to the Tor Network, a network with a special browser that allows you to set up and view websites anonymously. There are other networks as well, like Free Net or I2P.

But maybe the biggest barrier to shutting down the Dark Web is that not everything happening there is illegal, which means there are no real grounds for shutting it down. The government has successfully shuttered illegal services, but many people are using the Deep Web for honest means, like setting up support networks for survivors of abuse, or just running a literary magazine.

So for the pearl-clutchers afraid of the Dark Web: Embrace it. It's not all bad, and either way, it's here to stay.

The NSA and other intelligence agencies could "benefit from analyzing customer web data to look for connections to non-standard domains," Chertoff wrote. In other words, he's suggesting that if security agencies can tell people are going somewhere on the dark web, they can make inferences from it. "This can be done without intruding on users' privacy as only the destinations of the web requests need to be monitored and not who is connecting to them" he wrote, which seems like wishful thinking.

#Credit: MIC Networks

Deepening Split In Rebels

TTP Offshoot JuA’s Rebel Commanders Launch HuA. A splinter group of the Tehreek-i-Taliban Pakistan (TTP), Jamaat-ul-Ahrar (JuA) has been further splinted into two groups in what appears to be a serious blow to JuA terrorists operating against Pakistan.

A video statement released on 11 November 2017 confirmed a belligerent revolt against JuA resulting in formation of new group, the Hizb-ul-Ahrar (HuA) in Nangarhar province of Afghanistan. Mukarram Khan, a senior Ahrar leader was named chief of HuA. Mukarram who had earlier served as an important commander for JuA, left parent group along with many commanders over serious internal clashes and policy differences with its leadership including attacks against innocent minority Christians, killing civilians, extortion, kidnapping for ransom and other acts he deemed un-Islamic. However, Dr Aziz Yousafzai is appointed as the group’spokesman.
Mukarram Khan, who belongs to Mohmand Agency, was serving at key positions as head of the group’s intelligence unit and was the main character behind the JuA’s terrorist activities. He was JuA’s spokesperson and member of the group’s central ‘shura’ or council until last month. HuA under Mukarram followed the same pursuit of JuA which their key leadership announced at the time of its split from TTP. During August 2014, JuA announced Umer Khalid Khurasani as the chief of new group and Ehsanullah Ehsan as its spokesperson on the same grounds which HuA is now claiming to justify its disintegration.
The cracks surfaced in the ranks of the group recently after some of Khorasani’s supporters allegedly shot and injured Mukarram, the close confidants of the JuA chief Omar Khalid Khorasani. This was actually one of the basic reasons of Mukarram’s parted ways with the group as commanders of his faction appeared in a video last month and told their supporters that a “plot of Khorasani’s group to kill Mukarram has been failed”. Some commanders delivered brief speeches but Mukarram did not appear in the video, as he has been receiving treatment of injuries he had received in the attack by his JuA militants”. The meeting of HuA commanders to announce independent group in a video message was held in Afghanistan’s eastern Kunar province, adjacent to JuA hideouts in Nangarhar’s Lalpura area.
In an audio message to the dissident commanders, Mukarram accused Khorasani-led group of involvement in the killing of innocent people. He referred several major attacks, including the deadliest attack on a town in Wagah border, in 2014, which killed nearly 60 people and injured more than 100 others. He also mentioned the suicide attack on innocent Christians in a public park of Lahore in March 2016, in which 73 people were died and more than 350 were injured. He said Christians had not been in war with them, and the attack on the innocent non-Muslims “cannot be justified”. Mukarram also mentioned the bombing in December 2015 on the National Database and Registration Authority (Nadra) in Mardan, KPK which claimed the lives of at least 26 people and injured 50 others.
The group seems to be in trouble with swift escalation of serious internal rifts. HuA chief accused JuA of involving in extortion of money; links with Indian intelligence RAW, Afghan intelligence NDS and fighting with other militant groups. Rebel commander Mukarram along with other members tried numerous times to convince the leadership for change in such policies but failed. According to some militant sources, nearly 40 percent of the JuA commanders support the new splinter group at present and more could join them in view of reservations over the policies of JuA leadership after Khorasani. In February 2107, the Islamabad Lal Masjid condemned JuA for exploiting the name of its deputy imam Ghazi Abdul Rasheed, who was killed in July 2007 when the security forces raided the mosque. Lal Masjid had also described the JuA as an anti-Islam and anti-state group for attacks on civilians.
It is tradition in TTP to rebel against its leadership. In September 2014, differences within TTP deepened which resulted in formation of new splinter group JuA after the expulsion of a commander from parent outfit. TTP leadership removed Commander Abdulwaki, alias Omar Khalid Khorasani from the position of chief of Mohmand agency unity and also cancelled his basic membership. Differences in Taliban ranks deepened at a time when they were under attack by the security forces in their sanctuary of Kunar Afghanistan. Differences always remain in the Taliban ranks but their brand of Sharia always failed to resolve them, even instead their disputes declared varieties of Sharia under different TTP factions. If it is all about Sharia than resolution of any dispute in TTP is very simple but it is rather clash about the distribution of their foreign masters’ funds that always remain bone of contention. Additionally, the long charge sheets against TTP leadership caused frequent splits as they are frequently being accused of serving their personal and foreign interests.
It was JuA un-Islamic policies and relation with secret agencies hostile to Pakistan that disappointed many leaders who additionally had been frustrated from assault of Pak Army under operation Radd ul Fasaad (RUF). All these factors collectively forced the group’s senior leader and spokesperson Ehsanullah Ehsan to surrender in front of the security forces in April 2014. It was considered a serious blow to the terrorist outfit as he issued a charge sheet in a video as well as in an interview to a private TV channel against JuA and TTP leaders, particularly both groups’ links with regional intelligence networks. Similarly, in April 2017 eight other important members of the JuA had laid down their weapons and surrendered before the Army in Mohmand Agency. Operation RUF is continued successfully while these terrorist organizations are frequently been being exposed. The Pakistan Army with the support of entire nation is determined to take operation RUF to its logical conclusion as operation Khyber-4. The losses and splits in terror organizations under operation RUF can be clearly seen in continuation of the earlier operations with the support of the people and the institutions.
Pakistan Army dislodged the facilitators and abettors of militants and broken their connection with their leadership sitting across the border. The writ of the state was being restored and no power could fight the state as Pakistan has made a lot of progress, but more work need to be done. The only development in terrorist circles is that while sitting in sanctuaries of Afghan safe heavens, they are further splinting over policies and tactics after failure in executing any harm to Pakistan. Border management mechanism and active surveillance on the borders has ruined cross border operation of TTP, its factions and other terrorist organizations. The army along with FC would build 338 check posts by 2019 to strengthen border with Afghanistan, besides fencing it along KPK and FATA. 42 forts had already been built; while 63 more would be built along the Pak-Afghan border.
There is lack of leadership quality in TTP that they had been involved in bloody internal clashes that has even taken lives of their known members. Ehsan Ullah Ehsan in a statement prior surrender said that the leadership of TTP had no policy to deal with this situation and disclosed that nearly 200 Taliban from Mehsud tribe have lost lives as the result of internal fighting. Taliban had killed the TTP Rawalpindi chief Commander Nadeem Abbas alias Enteqami but his killers have not yet been brought to justice by TTP leadership. It is still a mystery as to who has killed the members of central council Asmatullah Shaheen Bitani and Tairq Afridi. These fasadis terrorist organizations are constantly splinting and further weakened as all Pakistanis stand united with its Army against 'fasaad and fasadis' together.

#Pakistan Cyber Force (PCF)