Illuminating the dark web
Download as PPTX, PDF19 likes27,503 views
The document discusses the dark web, detailing its structure, characteristics, and the technology behind it, notably the Tor network. It covers the complexities of anonymity, illegal activities associated with the dark web, and challenges faced by law enforcement in addressing these issues. Additionally, the document highlights that while much of the dark web's content may be legitimate, it poses significant risks to individuals and companies, emphasizing the importance of security measures.
Illuminating the dark web
- 1. 1 Illuminating the Dark Web Simon Bryden Consulting Systems Engineer, EMEA
- 2. 2 Introduction to the dark web The Onion Router and Hidden Services Dark Web Takedowns Protecting yourself from the dark web Illuminating the Dark Web
- 3. 3 “The iceberg” Surface Web Deep Web Dark Web
- 4. 4 Protected by authentication layer or paywall Not linked from any other pages Not referenced by search engines Deep Web characteristics
- 5. 5 Anonymous Special access software Associated with illegal activities Dark Web characteristics
- 6. 6 Illegal content Illegal marketplaces Cybercrime services Cryptocurrency services What can be found on the Dark Web?
- 7. 7
- 8. 8
- 9. 9
- 10. 10 Journalism Legal markets Social Media Repressed minorities Legal dark web services
- 12. 12 • Based on technology developed by the US Naval Research Laboratory in 1990s • Designed to protect US intelligence communications online • Tor project launched in 2002, first public release in 2004 • The Tor Project Inc. launched in 2006 as a non-profit organisation What is Tor?
- 13. 13 Tor can provide two levels of anonymity: Anonymous access to surface web services • The Tor network provides an anonymous access through the Tor network. • The Tor network “exit node” connects to the surface web server Anonymous access to hidden services • The Tor network provides complete end-to-end anonymity • Hides the identity of both client and server How muchAnonymity does Tor Provide?
- 14. 14
- 15. 15
- 16. 16 How Anonymous? “Alice is using the Tor service” Tor relay nodes are publicly known “Someone is connecting to Bob from the Tor network” “We can see this traffic”
- 17. 17 How Anonymous? “Alice is using a VPN service” HTTPS VPN Provider “Someone is connecting to Bob from the Tor network”
- 18. 18 Tor Browser
- 19. 19 Volunteers. Often universities and other institutions Most people host Relay or Guard (Entry) nodes Nodes cannot become guards unless they are stable, and have at least 2Mbytes/s bandwidth Running an Exit node opens up the potential of receiving abuse complaints Exit nodes are often blocked by providers or website owners Who Owns the Tor Nodes?
- 20. 20 Where are the relays? Germany UK Netherlands USA France
- 22. 22 • Hidden services provide anonymity for the server • Servers are identified by an onion address such as 4nrvt5xpejyo27zf.onion • These are not resolved by DNS, rather by the Tor network itself • Most importantly: • There is no link between server name and server address Tor Hidden Services
- 23. 23 Tor Hidden Service Operation RP
- 26. 26 • It’s more than just Tor! • Payment methods • Delivery of goods • All other system tools and applications must be anonymized • Ancillary communications (forgotten passwords, tech support) • Web services platforms (Wordpress, Joomla etc. are full of vulnerabilities) Perfect anonymity is Difficult
- 27. 27 In 2013, the FBI managed to infiltrate “Freedom Hosting”, a hosting operation serving child pornography sites It inserted an exploit kit which targeted a vulnerability in Firefox 17 (used in Tor browser) This resulted in the download of a file which would report back the identity of the user Resulted in the arrests of the owner, and many of the consumers The Silk Road marketplace was reportedly identified through a non-anonymized captcha Freedom Hosting Silk Road
- 28. 28 Child sex abuse marketplace More than 8 terabytes of data Used bitcoin – 7,300 recorded transactions from more than 1 million user addresses UK National Crime Agency used BitCoin transaction analysis to identify users Arrests of 337 users made in 38 countries 23 abused children identified and rescued Abusers found, not by using offensive hacking, but by simply tracing bitcoin transactions Welcome To Video
- 29. 29 Dark Web Markets Silk Road Data leaked via CAPTCHA US DEA and FBI June 2013 Silk Road 2.0 Bitcoin Vulnerability FBI & Europol Nov 2014 AlphaBay Email address leakage July 2017 Dream Market Sustained DDoS Attacks? March 2019 Wall Street Market Careless use of VPN Europol May 2019 Deepdotweb.com Dark web links site Taken down because of links to illegal markets FBI, Europol, NCA May 2019 Hansa Addresses leaked in IRC logs Operation Bayonet (multinational law enforcement)
- 31. 31 Case 1: Employees access dark web sites
- 32. 32 Case 2: Employees hosting dark web sites
- 33. 33 Case 3: Anonymous external reconnaisance
- 34. 34 Several sites provide the list in convenient form: https://check.torproject.org/exit-addresses (exit nodes only) https://www.dan.me.uk/tornodes (exit only, or all relays) http://blutmagie.de (exit only, or all relays) Security vendors often have automatically-updated node lists built in to their solutions. Tor Detection by RelayAddresses
- 35. 35 Good news: It is possible to detect the Tor protocol Not so good news: Tor provides explicit means to avoid being detected Fortinet has built-in application detection of Tor, I2P, FreeNet, and others, as well as popular proxy applications such as Psiphon and Ultrasurf. Tor does makes it possible to use private relay nodes and personalized transport protocols which can make detection close to impossible. However, in practice, there are many associated difficulties with these techniques. Detection by Protocol
- 36. 36 • Dark web is more about the technology than the content • Much of the content is legal and legitimate • Tor is by far the most popular access technology • It is very difficult to make a site 100% anonymous • The dark web can present a risk to legitimate users and companies • Simple security measures can deter all but the most determined attackers Key Takeaways
- 37. Come and see us at stand 14