The Dark and Deep Web

The Dark Web is a part of the World Wide Web that requires special software to access. Once inside, web sites and other services can be accessed through a browser in much the same way as the normal web.

However, some sites are effectively “hidden”, in that they have not been indexed by a search engine and can only be accessed if you know the address of the site. Special markets also operate within the dark web called, “Darknet Markets”, which mainly sell illegal products like drugs and firearms, paid for in the crypto currency Bit coin.

There is even a crowd funded “Assassination Market”, where users can pay towards having someone assassinated because of the dark web’s almost total anonymity, it has been the place of choice for groups wanting to stay hidden online from governments and law enforcement agencies. On the one hand there have been whistle blowers using the dark web to communicate with journalists, but more frequently it has been used by pedophile groups, terrorists and criminals to keep their dealings secret.

There are a number of ways to access the dark web, including the use of Tor, Free net and I2P. Of these, the most popular is Tor (originally called The Onion Router), partly because it is one of the easiest software packages to use. Tor downloads as a bundle of software that includes a version of Firefox configured specifically to use Tor.

Tor provides secrecy and anonymity by passing messages through a network of connected Tor relays, which are specially configured computers. As the message hops from one node to another, it is encrypted in a way that each relay only knows about the machine that sent the message and the machine it is being sent to.

There are even special versions of search engines like Bing and Duck Go that will return onion addresses for Tor services.

It is a mistake to think that Tor is entirely anonymous. If a web site is accessed, it can still potentially find out information about whoever is accessing the site because of information that is shared, such as usernames and email addresses. Those wanting to stay completely anonymous have to use special anonymity services to hide their identity in these cases.

Services on the dark web would not have been as popular without a means of paying for them. This is something that Bit coin has made possible. A recent study by Carnegie Mellon researchers Kyle Soska and Nicolas Christin has calculated that drug sales on the dark net total US$100 million a year. Most, if not all, was paid for in Bit coin.

Bit coin is made even more difficult to track on the dark web through the use of “mixing services” like Bit coin Laundry, which enables Bit coin transactions to be effectively hidden completely.

The Questions raises that “How Dark Is The Dark Web”…?

The developers of Tor and organizations like the Electronic Frontier Foundation (EFF argue that the principal users of Tor are activists and people simply concerned with maintaining their privacy. Certainly, Tor has been used in the past for journalists to talk to whistleblowers and activists, including Edward Snowden).

However, even a cursory glance at the Hidden Wiki – the main index of dark websites – reveals that the majority of sites listed are concerned with illegal activities. Some of these sites are scams, and so it is not clear how easy it is to buy guns, fake passports and hire hackers from the services listed. But there are likely sites on the dark web where these things are entirely possible.

Although the dark web makes law enforcement agencies’ jobs much more difficult, they have had a great deal of success in bringing down sites and arresting their users and the people behind them. The most famous of these was the arrest of Ross Ulbricht, the person behind the most well known of the drug markets, Silk Road.

More recently, the FBI’s arrest of two users of a child abuse site on the dark web highlighted that they are now able to use a range of techniques to unmask Tor users’ real internet addresses.

Dark Net websites are accessible only through networks such as Tor ("The Onion Router") and I2P ("Invisible Internet Project"). Tor browser and Tor-accessible sites are widely used among the dark net users and can be identified by the domain ".onion". While Tor focuses on providing anonymous access to the Internet, I2P specializes on allowing anonymous hosting of websites. Identities and locations of dark net users stay anonymous and cannot be tracked due to the layered encryption system. The dark net encryption technology routes users' data through a large number of intermediate servers, which protects the users' identity and guarantees anonymity. The transmitted information can be decrypted only by a subsequent node in the scheme, which leads to the exit node. The complicated system makes it almost impossible to reproduce the node path and decrypt the information layer by layer. Due to the high level of encryption, websites are not able to track geo location and IP of their users, and users are not able to get this information about the host. Thus, communication between dark net users is highly encrypted allowing users to talk, blog, and share files confidentially.

The dark net is also used for illegal activity such as illegal trade, forums, and media exchange for pedophiles and terrorists. At the same time traditional websites have created alternative accessibility for the Tor browser in efforts to connect with their users. Pro Publica, for example, launched a new version of its website available exclusively to Tor users.

Many hackers sell their services either individually or as a part of groups. Such groups include x Dedic, hack forum, Trojan forge, Maza faka, dark 0de and The Real Deal dark net market. Some have been known to track and extort apparent pedophiles. Cyber crimes and hacking services for financial institutions and banks have also been offered over the Dark web. Attempts to monitor this activity have been made through various government and private organizations, and an examination of the tools used can be found in the Procedia Computer Science journal. Use of Internet-scale DNS Distributed Reflection Denial of Service (DRDoS) attacks has also been made through leveraging the Dark Web. Many hacking groups such as Code Green also recruit Hackers depending on their skills. There are many scam onion sites also present which end up giving tools for download that are infected with trojan horse or backdoor.

There is regular law enforcement action against sites distributing child pornography – often via compromising the site by distributing malware to the users. Other content includes sexualized torture and killing of animals and some kind revenge porn.

There are at least some real and fraudulent websites claiming to be used by ISIL (ISIS), including a fake one seized in Operation Onymous. In the wake of the November 2015 Paris attacks an actual such site was hacked by an Anonymous affiliated hacker group GhostSec and replaced with an advert for Prozac. The Rawti Shax Islamist group was found to be operating on the dark web at one time.

In the 2000s, use of the term child abuse images increased by both scholars and law enforcement personnel because the term "pornography" can carry the inaccurate implication of consent and create distance from the abusive nature of the material. A similar term, child sexual abuse material, is used by some official bodies and similar terms such as "child abuse material", "documented child sexual abuse", and "depicted child sexual abuse" are also used, as are the acronyms CAM and CAI. The term "child pornography" retains its legal definitions in various jurisdictions, along with related terms such as "indecent photographs of a child" and others. In 2008, the World Congress III against the Sexual Exploitation of Children and Adolescents stated in their formally adopted pact that "Increasingly the term 'child abuse images' is being used to refer to the sexual exploitation of children and adolescents in pornography. This is to reflect the seriousness of the phenomenon and to emphasize that pornographic images of children are in fact records of a crime being committed."

Interpol and policing institutions of various governments, including among others the United States Department of Justice, enforce child pornography laws internationally. Since 1999, the Interpol Standing Working Group on Offenses Against Minors has used the following definition:

Child pornography is the consequence of the exploitation or sexual abuse perpetrated against a child. It can be defined as any means of depicting or promoting sexual abuse of a child, including print and/or audio, centered on sex acts or the genital organs of children.

Children of all ages, including infants are abused in the production of pornography. The United States Department of Justice estimates that pornographers have recorded the abuse of more than one million children in the United States alone. There is an increasing trend towards younger victims and greater brutality; according to Flint Waters, an investigator with the federal Internet Crimes Against Children Task Force, "These guys are raping infants and toddlers. You can hear the child crying, pleading for help in the video. It is horrendous." According to the World Congress against Commercial Sexual Exploitation of Children, "While impossible to obtain accurate data, a perusal of the child pornography readily available on the international market indicates that a significant number of children are being sexually exploited through this medium.

Masha Allen was adopted at age 5 from the former Soviet Union by an American man who sexually abused her for five years and posted the pictures on the Internet. She testified before the United States Congress about the anguish she has suffered at the continuing circulation of the pictures of her abuse, to "put a face" on a "sad, abstract, and faceless statistic," and to help pass a law named for her. "Masha's Law," included in the Adam Walsh Child Protection and Safety Act passed in 2006, includes a provision which allows young people 18 and over to sue in civil court those who download pornographic images taken of them when they were children. "Downloading" includes viewing without actual download; many successful prosecutions are completed through using residual images left on the viewer's computer.

Terrorist and non-state actors have used different modes and mediums to spread their message and communicate with their comrades. The dawn of the Internet has also provided such groups with unparalleled opportunities to establish communications and operational links that were not possible before. Starting from websites, terrorist groups moved to more interactive mediums like chat rooms and forums. It was social media platforms, such as Facebook and Twitter that truly revolutionized how militants, terrorists and non-state actors communicated with each other, recruited sympathizers and supporters and disseminated their propaganda.

The self-proclaimed Islamic State (IS) perfected the use of social media, which became the preferred source for the so-called ‘jihadists’ or ‘soldiers of the Caliphate’. In response, tech companies have been compelled to take down Facebook and Twitter accounts affiliated with IS. The unintended cost of this policy is that supporters, sympathizers and members of jihadist groups have moved into the deep web and the dark net.

"In Computer Science, we often got bored and decked around. One day we ran into the deep web. The most disturbing site we found was a comprehensive guide for cooking women. We're not talking about a short joke here. This page had information on what body types to use for specific cuts, how to prepare these cuts, and how to cook the girl so she lives as long as possible. It horrifies me that people way worse than the freaks on Criminal Minds exist.”

So security concerns for SMBs re: "Deep Web" would be as follows:

1. User's navigating the "Deep Web" is infected much in the same way that users on the "Surface Web" are (by browsing and general internet activities)

2. Malware that utilizes Tor for data exfiltration and/or command and control

Start by rejecting inbound and outbound traffic on port 9001, this is the default port for Tor. This will not prevent the user or malicious actor from using the service (as this can be configured for commonly permitted ports such as 80) but is a good start if there is no legitimate business need for port 9001.

Configure your Antivirus product to prevent common tor executable from running on company resources (Tor, Privoxy, Tor Browser), these executables can also be renamed to work around this, however this is a good first line of defense.

If your firewall supports it (and a fair amount of modern UTMs do) configure your firewall to inspect for Tor traffic and block the traffic from passing, this is going to depend on your firewall so consult the manufacturer's documentation. Some APT software also has provisions for rejecting this traffic and/or the associated executables from leaving the host or running, so you may also want to consult the documentation for your APT/Malware/Antivirus software to see if this can be leveraged.

If you're most concerned with user activity a software white listing application would reject unapproved software from running, in concert with APT defenses this could also be an appealing way to address these risks associated with malware/malicious actors.

The above should give you a head start and provide you with a reasonable level of confidence that traffic leaving or entering the network is not leveraging Tor.

Simply, white list applications allowed to be used on your environment, don't allow any browsers such as TOR, I2P etc.

But you still need other/network access controls for those laptops, phones, gaming systems, internet toasters and other IoT connected B.S. that you can't impose a policy on.

My combination of DNS filtering, no IP in a URL restriction, good firewall rules preventing just as much OUTBOUND traffic as in, and leaving all ports in a dead VLAN by default, have all served me well so far - and I'm not paying for any "subscription" products to do it.

The Dark Web sounds scary, right? You've probably heard of it, maybe in connection to online drug markets or rumors of terrorist plotting.

A sweeping survey of over 24,000 people worldwide by a Canadian think tank shows that 71% of internet users believe the Dark Web "should be shut down."

The Dark Net, or Deep Web or a dozen other names, isn't a single set of sites so much as a network of sites that you need special protocols or software in order to find.

Shutting down the network would mean shutting down every site and relay. In the case of the private web browser Tor, this means simultaneously shutting down over 7,000 secret nodes worldwide. The combined governments of various countries have enough trouble keeping the Pirate Bay from operating right on the open web, never mind trying to shut down an entire network of sites with encrypted communications and hidden IP addresses hosted worldwide.

There isn't even a single Deep Web. Most people who refer to the Deep Web are referring to the Tor Network, a network with a special browser that allows you to set up and view websites anonymously. There are other networks as well, like Free Net or I2P.

But maybe the biggest barrier to shutting down the Dark Web is that not everything happening there is illegal, which means there are no real grounds for shutting it down. The government has successfully shuttered illegal services, but many people are using the Deep Web for honest means, like setting up support networks for survivors of abuse, or just running a literary magazine.

So for the pearl-clutchers afraid of the Dark Web: Embrace it. It's not all bad, and either way, it's here to stay.

The NSA and other intelligence agencies could "benefit from analyzing customer web data to look for connections to non-standard domains," Chertoff wrote. In other words, he's suggesting that if security agencies can tell people are going somewhere on the dark web, they can make inferences from it. "This can be done without intruding on users' privacy as only the destinations of the web requests need to be monitored and not who is connecting to them" he wrote, which seems like wishful thinking.

#Credit: MIC Networks