Deep and Dark on the Web By: Todd Careless

Be Prepared Criminal activity that is spanned by the Dark Web includes: theft of intellectual property financial fraud hacking and terrorism  Organizations must take proactive steps to be prepared for these threats.  In order to be ready, companies need to be well informed about this type of criminal activity in order to prevent and overcome any potential threats.  

Dangers “The possibility of users infecting their computers with malware – software that targets a computer with malicious intent –when visiting the dark web is high unless precautions are taken.” According to a Motherboard article, casual visitors to a dark web site can unknowingly expose their computers to the following programs: Vawtrack: Designed to gain access to victims’ financial accounts Skynet: Used to steal bitcoins or engage in DDoS (distributed denial of service) attacks on other websites using the victim’s computer Nionspy: Can capture keystrokes, steal documents, and record audio and video using the infected computer” (The Dark Web is Becoming a Safe Haven for Malware)   http://motherboard.vice.com/read/malware-is-using-the-dark-web-to-stay-hidden

The Web We Want to Know (WWW) The Internet is a Giant, Huge, Gargantuan and Very BIG Network We see the tip of the proverbial iceberg of information Less than 1% according to some sources Over 550,000,000 registered domains Works just like a network, only bigger Got to know the address CSA Conference 04 Deep and Dark Web-April 2016

WWW = World Wide Web Lots of data out there for the taking Google and others take it and serve it up for you from the tips of the icebergs seen Go or trace only so far as the doors open How? Indexing Spiders and other crawlers Analytics What you SEE is What you Get It’s what you can’t see…. Link after link after link TV news site-stories fade away from search index engines. Go to site to find out more CSA Conference 04 Deep and Dark Web-April 2016

Legitimate Deep Below the Iceberg Deep Web Corporate Areas Personnel Area (W-2, Vacation, IRA…) Financial Area (Investments, Filings…) Group Think/Collaboration Area (SharePoint) Academic Areas Personnel Areas (Scheduling, Football Tickets…) Financial Area (Tuition, Housing…) Group Think/Collaboration Area (Blackboard, Online classes…) Password protected sites Legitimate CSA Conference 04 Deep and Dark Web-April 2016

Deeper you go-Darker it Gets Dark Web Anything and Everything Drugs Legal and Illegal Sex Child Exploitation Rock & Roll Music Software Silk Road Investigation Illegitimate

Can’t Get There from Here Normal Browsers go to Normal Places Internet Explorer Chrome Firefox Safari Opera Camino Confined to WWW Known Areas Areas it can see Areas it can index CSA Conference 04 Deep and Dark Web-April 2016

Get Off the Highway Interstate Road System = WWW Big Cities on the Highways hold the information Exit at your Peril Lots of Land outside the Big Cities Need to ask directions Regular Maps don’t work Enter Tor

The Onion Router Tor Special Browser for Special Places Anonymous browsing through servers Hops are encrypted and random Circuits of encrypted networks Difficult to trace

Letter inside Package inside Box The Tor pathway is a circuit of three parts The address is on outside of each part Entry Node First connection Sends Box to Relay Node (Connects) Relay Node Opens the Box Sends Package to Exit Node Exit Node Opens the Package and reads the Letter Layers of the Onion… Like a letter inside a package inside a box. CSA Conference 04 Deep and Dark Web-April 2016

Different Routes Entry Relay Exit Address are routed through different nodes Entry Relay Exit

Tor-The Good, The Bad, The Ugly Originated by USG for whistleblowers and other dissidents Companies use it to find out about the competition Journalist to communicate with sources LEO for research and intelligence Any and All Criminal Activity Naval Research Laboratory created it. London student to investigate foreign entities without revealing them. CSA Conference 04 Deep and Dark Web-April 2016

How Do You Pay for It? Bit by Bit Bitcoin Exchanging something of value: Electronically Virtual currency Decentralized No backing by any government authority or system Conceptualized by Satoshi Nakamoto in 2008 Initial purchase of Bitcoins from bank to place in your “wallet” then free to spend

Comparing Virtual to Real Peer to Peer Computer generated Currency USD GBP MXN Regulated Spending limits Assets Frozen Centralized Bank Bureau of the Mint Currency BTC No Regulations No Limits Nothing to Freeze

Digital Forensics and the Dark Web Digital forensics tools can be used to shed light on potential activity on the Dark Web: Look at URL’s visited by your employees Identify any accessed sites on the Dark Web Identify any processes that are running Determine if any of them are malicious

Questions?