A notorious cybercrime gang, involved in a series of high profile ransomware attacks, has in recent months been sending out poisoned USB devices to US organisations.
Read more in my article on the Tripwire State of Security blog.
On January 5, 2022, the Department of Justice (DoJ) announced the FBI’s arrest of Italian citizen Filippo Bernardini at JFK International Airport in New York for wire fraud and aggravated identity theft. With the arrest of Bernardini, the DoJ unsealed a grand jury indictment dated July 14, 2021, of Bernardini that revealed a “multi-year scheme to impersonate individuals involved in the publishing industry in order to fraudulently obtain hundreds of prepublication manuscripts of novel and other forthcoming books.”
Credential stuffing is a cyberattack in which exposed usernames and passwords are used to gain fraudulent access to user accounts through large-scale, automated login requests. High account usage, password reuse, and vast volumes of breached credentials on the dark web create the perfect storm for cybercriminals to carry out credential stuffing campaigns, while tactics used by malicious actors make identifying and preventing credential stuffing attempts a significant challenge for organizations.
Adding to pressures is the fact that attackers purposely disguise credential stuffing to make fraudulent access attempts appear legitimate and escape detection. “Credential stuffing attacks are emulating the sorts of requests that a legitimate user would make,” Troy Hunt, security researcher and founder of data breach notification service Have I Been Pwned, tells CSO. “Attackers are asking: What does it look like to make a legitimate request? How can we emulate that? Where it starts to get really interesting is when we look at the combativeness between defenders and attackers.”
Who has been playing video games rather than hunting down criminals? How is a man alleged to have stolen manuscripts of unpublished books from celebrity authors? Which pot contains an elephant? And why has Graham been listening to podcasts about pest control marketing?
All this and much more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault.
Technology giant Panasonic has confirmed that one of its servers suffered a data breach which saw the personal information of job applicants accessed by an unauthorised party.
Read more in my article on the Hot for Security blog.
Researchers have figured how how to intercept and fake an iPhone reboot:
We’ll dissect the iOS system and show how it’s possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, it’s still running. The “NoReboot” approach simulates a real shutdown. The user cannot feel a difference between a real shutdown and a “fake shutdown.” There is no user-interface or any button feedback until the user turns the phone back “on.”
It’s a complicated hack, but it works.
Uses are obvious:
Historically, when malware infects an iOS device, it can be removed simply by restarting the device, which clears the malware from memory.
However, this technique hooks the shutdown and reboot routines to prevent them from ever happening, allowing malware to achieve persistence as the device is never actually turned off.
I see this as another manifestation of the security problems that stem from all controls becoming software controls. Back when the physical buttons actually did things — like turn the power, the Wi-Fi, or the camera on and off — you could actually know that something was on or off. Now that software controls those functions, you can never be sure.
Along with thwarting malware, the Pluton chip handles BitLocker, Windows Hello, and System Guard and might help prevent physical insider attacks. The technology is also being used in Azure Sphere in the cloud.
At times, the quest to stay on top of web application security can seem futile. It seems as though the adversaries are always a step ahead, and all we can do is try our best to contain the breaches.
In this blog, we’ll look at the root causes of concern for today’s CISO and share some practical strategies to deter cybercriminals.
The CISO role can be an unenviable one. With ongoing reports of new application vulnerabilities and threats on an upward trajectory, the race to safeguard your organization’s digital assets is unending.
And as a CISO, you have the ongoing struggle of understanding the scope of the issue yet managing the finite and appropriate resources to secure web applications. The most obvious cybersecurity strategy is to take a people-centric approach, with a 70-80% focus on staff awareness. This works as a stop gap measure, however, in the meantime cybercriminals are actively working to expand their attack methods to target weaknesses in web applications.
We are living in a software-defined world, and the vulnerability of web apps is a growing problem. Unfortunately, web app vulnerabilities can remain unremediated for an extended period of time – and cybercriminals know this.
Actively monitoring key web applications is difficult but necessary. While comprehending where you are vulnerable is critical, so is the requirement to act within real-world constraints without endangering your larger perimeter. So it’s understandable that, at times, the challenges may seem insurmountable.
Application defects require priority alignment with development teams, and protection tools must comply with customer experience (CX) and governance requirements. Additionally, cybersecurity skills are in high demand, and budgets are tight.
While it may be of little comfort – you are not alone – it’s equally difficult for other businesses to compete with the hugely successful and profitable business of cybercrime.
You may decide to pick your battles and only protect the sites connected to sensitive data, while ignoring the security of third-party hosted or brochureware sites. But the reality is that even brochureware sites offer rich assets for cybercriminals keen to harvest user passwords and credentials.
At first glance, it appears that the odds are against you being able to protect your web apps, let alone the entire perimeter. So let’s look at those odds and see why they are so daunting.
The asymmetry of task. Cybercriminals just need to find one way in, but you need to either eliminate or contain all of the ways in. While the traditional approach is only to protect what matters, those untended brochureware and third-party sites can become a real security problem.
The asymmetry of knowledge: Cybercriminals use a community approach to executing attacks, whereas you’re stuck in a stance of independent defense. There’s little communication or sharing of expertise from company to company; knowledge is siloed.
The asymmetry of resources: It’s hard to fight cybercrime on an uneven playing field. While the cybercriminals use stolen resources and criminal economics, you must battle for resources in a competitive job market and buy expensive, legitimate tools.
The asymmetry of incentive: Cybercriminals have a massive financial incentive to ‘win’. Whereas only disapprobation awaits you and your team should you fail to secure your entire perimeter.
The asymmetry of timing and target: Cybercriminals get to choose when and where they attack. But it’s unlikely that your internal expert cybersecurity team is equally ready and waiting to counterstrike at 2 a.m. over a long holiday weekend.
Even with all your organization’s resources and focus made available to you, the incredibly tough and constantly evolving external environment means the odds are clearly not stacked in your favor.
Now that we have established the difficulties in the external environment, let’s discuss your freedom to address these problems in a typical company.
As CISO, you are usually accountable for the security of the application fleet. For example, you own the governance, risk, and compliance (GRC) process, commission the application security testing, and own the risk register. But how much control do you have to directly address the identified risks?
The responsibility for eliminating risk through fixing or replacing apps sits with the product team. To align priorities, you must advocate with the product and development team. However, it’s not uncommon for product teams to assign a bug or a mistake in their code as a vulnerability and hand it back to your security operations team with a request to contain the threat. Passing the parcel from team to team is an exercise in frustration, wasted time, and distracted resources.
While the emphasis must be on attempting to eliminate all cyberthreats, that containment can’t interfere with the normal functioning of your applications. Although numerous security tools can detect suspicious activity through signatures and heuristics, you still need to decide what to block or allow and consider the impact (financial or otherwise) on the customer experience.
Should your security tool block a legitimate customer transaction, the response from the business revenue owner (or even higher in the organization) to ‘sort your security stuff out or it’s going to be removed!’ is usually swift.
As CISO, you are required to implement a method that both minimizes CX mistakes and rapidly addresses them. This requires extensive testing with your application (not just a generic tool) and the services of a 24x7x365 end-user facing expert response team – available at even 2 a.m. over a long holiday weekend.
So, where do you find these people, how do you afford them, and how long unitl they are executing with CMMI 3.0+ maturity?
Given that security flaws, published threats and application changes are continual, the requirement to mitigate them is incessant. You may be up to date today, but tomorrow, another 50 vulnerabilities are going to be released, and you need to start all over again.
Then, there’s the question as to whether changes to security tools settings are subject to change management. Does fine tuning your environment for new threats and making modifications to containment configurations comply with your GRC policy? Is turning things on or off at will a sound policy?
What about risk management? If you tune something out, is the risk measured, identified, reported, and audited in line with the changing threat landscape? And are the impacts of those changes assessed for incremental risks?
The risk to CX introduces a significant pressure on the CISO to incrementally remove security controls. It’s only by proving the financial benefit of any introduced tools that the business and security get an equal vote. The necessary proof of value, however, only comes with an audit, and these tend to be well spaced throughout the year, and only focussed on specific apps. Namely, those connected to sensitive data, and not to brochureware.
Enough despair. There are practical strategies to help you hold cybercriminals at bay.
By applying the same rigorous tests to your security operations models as you do to software design, you get a head start. Proven approaches include operational programs that apply a military style to defining functional requirements, i.e. observe, orient, decide and act. In short:
Observe the problems so you can determine what they are
Find, orient, and prioritize your issues on a weekly cadence
Decide how you will fix them
Act by allocating development time and security operations time
And audit. It’s one thing to present a threat chart, but only a cost and benefit analysis holds real sway when it comes to security reporting.
Now we have established the costs to build what is required. What is the value to the business of this investment?
Considering the key value being reduction in expected breach loss, industry reports from the likes of IBM/Ponemon provide benchmarks by reporting average impact and likelihood of breach across industry, location and organization size.
If you consider an organization of US Healthcare company with 7,500 employees:
the average loss of a breach is $16M ($600 per employee). This scales up and down by industry (166% up for healthcare) and location (eg 220% up for US)
the likelihood of breach sits at 30% over two years
therefore expected loss is $5.3M
As this is all loss from breaches the web application component should be prorated. VDBR states that approximately 40% of breaches can be attributed to web application incursion, therefore the web application contribution is $2M over 2 years or $1M per year
So, with an annual budget which anticipates a loss of $1 million, what should you spend on avoiding it?
Economic researchers from the University of Maryland, Gordon-Loeb, have famously published research that concludes that 37% of expect losses from cyber events should be spent on avoidance.
This leads to a web application security program budget of $400k per annum and final reason to despair:
If a 7,500 person US Healthcare company has more than 5 web applications to protect, the business case is woefully underfunded.
Development costs are a major consideration for any CISO, so it’s small wonder that so many focus on only a few business-critical apps and don’t address the perimeter. And, the good news is – there are some game-changing strategies to be aware of:
Empower your security team to write code objects that manipulate the behavior of applications and eliminate threats and risks.
Edge compute introduces a range of benefits, including:
The ability to modify app behavior without touching it directly
Resolving vulnerabilities in hard-to-access legacy or third-party apps
Addressing apps under strict compliance without requiring recertification
Focused regression testing
The use of edge compute can divide your costs by 30. And if you look at the price of your threat protection, you can divide that by 10. So, we’re talking orders of magnitude change.
If outsourcing is acceptable to the business, contract a 24X7X365 specialist team of skilled security developers to build and deploy security controls and address development flaws outside of the cost base.
For a given scope, time, and price you’ll get committed time/cost outcomes. As well as running always-on teams of developers, these organizations have libraries of fixes, and utilize machine learning, automation, and edge compute deployment and operational experience to enhance outcomes. They have a community of knowledge, are aware of other defenses and attackers, and introduce cross-company knowledge to promote a community effect. And that’s before they even start to rely on tools.
So, what asymmetry problems does this approach solve for you?
Asymmetry of task: Cybercriminals just need to find one way in, but the economics of a third-party team allow you to cost-effectively eliminate or contain all threats to your entire perimeter.
Asymmetry of knowledge: Fight fire with fire. Cybercriminals use a community of attack, but the power of enhanced cross-company knowledge levels up the playing field.
Asymmetry of resources: While cybercriminals use stolen resources and criminal economics, your investment in shared resources narrows the competitive advantage.
Asymmetry of incentive: Cybercrime pays big time. But the specialist organization that fights cybercrime stands to benefit financially and reputation-wise from doing it well.
Asymmetry of timing and target: Cybercriminals never sleep, and neither does the always-on specialist security team that becomes an extension of your own team.
By applying existing techniques that are proven and effective in other parts of the business, and in other industries, to cybersecurity, the cause is hopeful.
However, there are specific challenges that you need to address including the external asymmetry which favors the cybercriminal. It’s also important to take a real-world approach to internal constraints; consider and address them and build them into a program where they are solved (before you deploy any security tools).
It’s also critical to align priority and budget. Manage the customer experience risks and ensure that auditing produces an equal vote in terms of giving security a proper seat at the table.
And seriously consider the value of edge compute. At a time where tools on their own are not enough, it provides a genuine alternative to advocating with the development manager. Consider outsourcing to specialist teams, or even augmenting your own team with AI (which can be built internally or purchased) and apply it to the tasks of risk elimination and threat containment.
It’s a tough environment out there and understanding your capabilities and limitations to secure the business is just part of the journey.
AT&T Cybersecurity Consulting with the help of RedShield can start you on the path to managing risk in your application portfolio.
In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by “Wazawaka,” the hacker handle chosen by a major access broker in the Russian-speaking cybercrime scene.
Wazawaka has been a highly active member of multiple cybercrime forums over the past decade, but his favorite is the Russian-language community Exploit. Wazawaka spent his early days on Exploit and other forums selling distributed denial-of-service (DDoS) attacks that could knock websites offline for about USD $80 a day. But in more recent years, Wazawaka has focused on peddling access to organizations and to databases stolen from hacked companies.
“Come, rob, and get dough!,” reads a thread started by Wazawaka on Exploit in March 2020, in which he sold access to a Chinese company with more than $10 billion in annual revenues. “Show them who is boss.”
According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.
Wazawaka also said he’d teamed up with DarkSide, the ransomware affiliate group responsible for the six-day outage at Colonial Pipeline last year that caused nationwide fuel shortages and price spikes. The U.S. Department of State has since offered a $5 million reward for information leading to the arrest and conviction of any DarkSide affiliates.
Wazawaka seems to have adopted the uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder — not privately sold to the highest bidder. In thread after thread on the crime forum XSS, Wazawaka’s alias “Uhodiransomwar” can be seen posting download links to databases from companies that have refused to negotiate after five days.
“The only and the main principle of ransomware is: the information that you steal should never be sold,” Uhodiransomwar wrote in August 2020. “The community needs to receive it absolutely free of charge if the ransom isn’t paid by the side that this information is stolen from.”
Wazawaka hasn’t always been so friendly to other cybercrooks. Over the past ten years, his contact information has been used to register numerous phishing domains intended to siphon credentials from people trying to transact on various dark web marketplaces. In 2018, Wazawaka registered a slew of domains spoofing the real domain for the Hydra dark web market. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.
“I used to steal their QIWI accounts with up to $500k in them,” Wazawaka recalled. “A dealer would never go to the cops and tell them he was selling stuff online and someone stole his money.”
Wazawaka used multiple email addresses and nicknames on several Russian crime forums, but data collected by cybersecurity firm Constella Intelligence show that Wazawaka’s alter egos always used one of three fairly unique passwords: 2k3x8x57, 2k3X8X57, and 00virtual.
Those three passwords were used by one or all of Wazawaka’s email addresses on the crime forums over the years, including wazawaka@yandex.ru, mixseo@mail.ru, mixseo@yandex.ru, mixfb@yandex.ru.
That last email address was used almost a decade ago to register a Vkontakte (Russian version of Facebook) account under the name Mikhail “Mix” Matveev. The phone number tied to that Vkontakte account — 7617467845 — was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia.
DomainTools.com [an advertiser on this site] reports mixfb@yandex.ru was used to register three domains between 2008 and 2010: ddosis.ru, best-stalker.com, and cs-arena.org. That last domain was originally registered in 2009 to a Mikhail P. Matveyev, in Abakan, Khakassia.
Mikhail Matveev is not the most unusual name in Russia, but other clues help narrow things down quite a bit. For example, early in his postings to Exploit, Wazawaka can be seen telling members that he can be contacted via the ICQ instant message account 902228.
An Internet search for Wazawaka’s ICQ number brings up a 2009 account for a Wazawaka on a now defunct discussion forum about Kopyovo-a, a town of roughly 4,400 souls in the Russian republic of Khakassia:
Also around 2009, someone using the nickname Wazawaka and the 902228 ICQ address started posting to Russian social media networks trying to convince locals to frequent the website “fureha.ru,” which was billed as another website catering to residents of Khakassia.
According to the Russian domain watcher 1stat.ru, fureha.ru was registered in January 2009 to the email address mix@devilart.net and the phone number +79617467845, which is the same number tied to the Mikhail “Mix” Matveev Vkontakte account.
DomainTools.com says the mix@devilart.net address was used to register two domains: one called badamania[.]ru, and a defunct porn site called tvporka[.]ru. The phone number tied to that porn site registration back in 2010 was 79235810401, also issued by MegaFon in Khakassia.
A search in Skype for that number shows that it was associated more than a decade ago with the username “matveevatanya1.” It was registered to a now 29-year-old Tatayana Matveeva Deryabina, whose Vkontakte profile says she currently resides in Krasnoyarsk, the largest city that is closest to Abakan and Abaza.
It seems likely that Tatayana is a relative of Mikhail Matveev, perhaps even his sister. Neither responded to requests for comment. In 2009, a Mikhail Matveev from Abaza, Khakassia registered the username Wazawaka on weblancer.net, a freelance job exchange for Russian IT professionals. The Weblancer account says Wazawaka is currently 33 years old.
In March 2019, Wazawaka explained a lengthy absence on Exploit by saying he’d fathered a child. “I will answer everyone in a week or two,” the crime actor wrote. “Became a dad — went on vacation for a couple of weeks.”
One of the many email addresses Wazawaka used was devdelphi@yandex.ru, which is tied to a more recent but since-deleted Vkontakte account for a Mikhail Matveev and used the password 2k3X8X57. As per usual, I put together a mind map showing the connections referenced in this story:
Analysts with cyber intelligence firm Flashpoint say Wazawaka’s postings on various Russian crime forums show he is proficient in many specializations, including botnet operations, keylogger malware, spam botnets, credential harvesting, Google Analytics manipulation, selling databases for spam operations, and launching DDoS attacks.
Flashpoint says it is likely Wazawaka/Mix/M1x has shared cybercriminal identities and accounts with multiple other forum members, most of whom appear to have been partners in his DDoS-for-hire business a decade ago. For example, Flashpoint points to an Antichat forum thread from 2009 where members said M1x worked on his DDoS service with a hacker by the nickname “Vedd,” who was reputedly also a resident of Abakan.
All of this is academic, of course, provided Mr. Wazawaka chooses to a) never leave Russia and b) avoid cybercrime activities that target Russian citizens. In a January 2021 thread on Exploit regarding the arrest of an affiliate for the NetWalker ransomware program and its subsequent demise, Wazawaka seems already resigned those limitations.
“Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka said of his own personal mantra.
Which might explain why Wazawaka is so lackadaisical about hiding and protecting his cybercriminal identities: Incredibly, Wazawaka’s alter ego on the forum XSS — Uhodiransomware — still uses the same password on the forum that he used for his Vkontakte account 10 years ago. Lucky for him, XSS also demands a one-time code from his mobile authentication app.
Wazawaka said NetWalker’s closure was the result of its administrator (a.k.a. “Bugatti”) getting greedy, and then he proceeds to preach about the need to periodically re-brand one’s cybercriminal identity.
“I’ve had some business with Bugatti,” Wazawaka said. “The guy got too rich and began recruiting Americans as affiliate partners. What happened now is the result. That’s okay, though. I wish Bugatti to do some rebranding and start from the beginning As for the servers that were seized, they should’ve hosted their admin panels in Russia to avoid getting their servers seized by INTERPOL, the FBI, or whatever.”
“Mother Russia will help you,” Wazawaka concluded. “Love your country, and you will always get away with everything.”
If you liked this post, you may also enjoy Who Is the Network Access Broker “Babam”?
The internet has opened up wonderful new possibilities in our world, making life easier on many levels. You can pay your bills, schedule your next family vacation, and order groceries with the click of a button. While the internet offers many positive benefits, it also has some negatives. Although not entirely used for illicit purposes, the dark web is one part of the internet that can be used by criminals for illegal purposes, like selling stolen personal information.
But just what is the dark web? Basically, it’s a part of the internet that isn’t indexed by search engines. As an average internet user, you won’t come across the dark web since you need a special browser to access it. It’s certainly not something you need to stress about in your day-to-day browsing, and you shouldn’t let it scare you off the internet. Unless you actively seek it out, you’ll likely never have any contact with the dark web in your lifetime.
A better understanding of what the dark web is and the possible threats it contains can help you protect yourself, though. This guide provides the essential information you need, explaining the different levels of the web and revealing how you can stay safe. With this knowledge, you can continue to browse online with confidence. Find out more below.
The “dark web” refers to websites that aren’t indexed by search engines like Google and Bing. This might seem strange since most people want their websites to be found through specific searches. Practices like search engine optimization (SEO) are specifically implemented to help websites perform well and rank higher in search engine results.
So, why would someone not want their website to be picked up by a search engine? The primary purpose is to preserve privacy and anonymity. The individuals and organizations on the dark web often engage in illegal activities and want to keep their identities hidden — something that is difficult to do with an indexed website.
It’s important to note that the dark web should not be confused with the deep web, which is a part of the internet individuals access regularly. Although the terms are sometimes used interchangeably, they actually refer to different things. Deep web content — which isn’t picked up by search engines, either — includes pages that typically require additional credentials to access. Your online banking accounts and email accounts, for instance, are examples of deep web content.
The internet is home to billions of websites — an estimated 1.7 billion to be exact, although that number changes every day as new sites are made and others are deleted. Your daily internet activity likely falls within the publicly available and readily accessible portion of the internet (otherwise known as the surface web). However, there are additional “levels” of the internet beyond that top level. Read on to learn more.
The internet you use to search for more information is referred to as the surface web or open web. This is the readily visible part of the internet anyone can access with an internet connection and a normal web browser like Safari, Mozilla Firefox, or Google Chrome. Other terms for the surface web include the visible web, lightnet, or indexed web.
Examples of content you’ll find on the surface web include:
Open media websites and news sites like those affiliated with blogs, newspapers, magazines, and other publications. An example would be the home page of a newspaper like The New York Times or a media company like BuzzFeed.
Business websites for everything from major corporations to smaller local businesses. An example could be the website for a huge corporation like Bank of America or one for a smaller business like a local bakery.
Mainstream social media platforms like Facebook, Instagram, LinkedIn, and Twitter. Although you likely use these tools via an app, they all have dedicated websites.
E-commerce sites used for buying goods and services, like Amazon, Walmart, Target, apparel retailers, and beyond. Any company that sells products online can be considered an e-commerce site.
Basically, the sites you use daily — from your favorite news site to a local restaurant — are part of the surface web. What makes these websites part of the surface web is that they can be located via search queries and have recognizable endings like .com, .edu, .gov, or .org. You are able to find websites on the surface web because they are marked as “indexable,” meaning search engines can index and rank them. The sites are readily available on the search engine results pages (SERPs).
Interestingly, the surface web only makes up around 4% of the total internet, meaning the internet is a lot more than what you see on the surface. Think of it as an ocean — there’s the top layer of water you can see and then there’s the vast world beneath. The remainder of the internet is what’s below the surface.
The deep web refers to any page on the internet that isn’t indexed by search engines as described above. The deep web is the first level beneath the “surface” of the visible web — and it’s significantly larger than the surface web, accounting for an estimated 96% to 99% of the entire internet.
It’s important to note that just because this type of content isn’t on the surface doesn’t mean it’s nefarious or has ill intent. A lot of the time, this content isn’t indexed because it includes pages that are meant to be hidden to protect consumer privacy, such as those that require login credentials.
Here are some examples of content on the deep web:
Fee-based content like news articles that are behind a paywall or membership-only content requiring login credentials are considered part of the deep web. For example, if you pay to access members-only content in a content creator’s fan club, you are using fee-based content.
Databases containing protected files that aren’t connected to other areas of the internet. These could be public or private files, like those from government entities or private educational institutions.
Intranets for educational institutions, corporate enterprises, and governments are used for exchanging and organizing internal information. Some of it is sensitive and not meant for public dissemination. Intranets usually require a login and are part of the deep web.
Secure storage platforms like Dropbox or Google Drive also require you to log in to upload and download files and photos. There are also proprietary data storage solutions used by companies that frequently handle sensitive data, such as law firms, financial institutions, and health care providers. An example might be a patient portal via a hospital or doctor’s office, where you can access your personal medical records.
Essentially, any webpage that requires a login is part of the deep web. That said, deep web content doesn’t necessarily have to fall into any of these categories. Any page that is non-indexable is technically also considered part of the deep web. It doesn’t have to require a login or contain sensitive data. Website creators and managers can mark pages as non-indexable if desired.
It’s worth noting that sometimes a single organization’s website will include elements of both the surface web and the deep web. Take a college or university website, for example. Most schools have a comprehensive website providing information about the school’s history, campus location, student body, available programs of study, extracurricular activities, and more.
However, many schools also have an intranet — sometimes linked from the main university page — that’s accessible only for students or staff. This is where students might sign up for classes and access their school email, for example. Since this is sensitive information and requires a unique login, it doesn’t need to be made publicly available via search engines.
In fact, it’s better in the interest of privacy that these pages aren’t readily visible. It helps to protect the user’s data. From this example, you can see that the “deep web” doesn’t have to be scary, illicit, or illegal. It serves a legitimate and useful purpose. You shouldn’t be afraid of the deep web. It’s further important to distinguish the deep web from the dark web — as the next section explains.
As mentioned, the deep web and the dark web sometimes get confused. However, they are distinct. Technically, the dark web is a niche or subsection within the deep web. It consists of websites that aren’t indexable and can’t be readily found online via web search engines. However, the dark web is a carefully concealed portion of the deep web that people go out of their way to keep hidden.
What makes the dark web distinct from the broader deep web is the fact that dark web content can only be accessed via a special browser. The Tor network is often used to access the dark web.
Additionally, the dark web has a unique registry operator and uses security tools like encryption and firewalls, further making it inaccessible via traditional web browsers. Plus, the dark web relies on randomized network infrastructure, creating virtual traffic tunnels. All of these technical details serve to promote anonymity and protect dark web users’ privacy.
The short answer is no, it’s not illegal to browse the dark web. In fact, there are instances where individuals can use it for good. Whistleblowers, for instance, can find the anonymity available through the dark web valuable when working with the FBI or another law enforcement organization.
That said, while it’s not illegal to browse the dark web, it’s also not completely void of criminal activity. Putting yourself in close proximity with illegal activities is rarely a good idea and could heighten your risk of being targeted by a criminal yourself. It’s often best to leave that part of the deep web alone.
There are also many technological threats on the dark web. Malicious software, also known as malware, is a critical concern and can affect unsuspecting users. Even simply browsing the dark web out of curiosity can expose you to such threats, like phishing malware or keyloggers. While an endpoint security program can identify such threats if they end up on your computer, it’s ideal to avoid them altogether.
Further, if you try to buy something on the dark web — even if it’s not illegal — there’s a chance you’ll be scammed. Dark web criminals use a variety of tricks to con people. For example, they may hold money in escrow but then shut down the e-commerce website and take off with the money. Due to the anonymous nature of the dark web, it’s very difficult for law enforcement to find such perpetrators.
Given its anonymous nature, the dark web clearly has an obvious appeal for cybercriminals. But just what do they use it for? The most obvious type of internet activity is the buying and selling of black market goods and services, from illegal drugs to illegal content. Cybercriminals may also run scams when selling such items, for example by taking a person’s money and not delivering the required product.
There are dark websites dedicated to the purchase and sale of illegal products or services (usually using untraceable cryptocurrencies like bitcoin) including:
Financial information like cloned credit cards with PIN, credit card details, online bank account logins, and more. People can then use these details to make legitimate purchases, negatively impacting your financial status and ruining your credit score in the process.
Account details for hacked accounts like email accounts, eBay accounts, social media accounts, streaming services, and more. For example, a person may buy a reputable eBay seller’s login details and then use their real account to make fake sales, pocketing the money and ruining the seller’s reputation in the process.
Personal data that can be used to steal someone’s identity, such as their name, address, Social Security number, and more. Identity theft is a serious problem that can negatively impact everything from your credit score to your private medical data.
Illegal services like people claiming to be able to fix credit scores for a fee. Many of these “services” are scams. They may also be law enforcement masquerading as criminals in an attempt to catch people who are up to no good.
Illegal goods like unregistered firearms and drugs. Law enforcement is increasingly cracking down on cybercriminals and the dark web.
Browsers like Tor, an open-source and free software, allow people to access dark websites where these goods are available, like a digital marketplace. These websites may look similar to any other surface or deep website you’d encounter. However, they differ in their domain suffix, ending in “.onion” instead of more obvious options like “.com” (Tor is actually short for The Onion Router, which is also where the term “onion routing” comes from — referring to anonymous communication on the dark web).
Onion sites often use scrambled names that make their URLs difficult to remember, minimizing the odds of being reported to authorities. It’s possible to search the dark web using specialized dark web search engines like Grams or link lists like The Hidden Wiki. However, these sources tend to be slow and unreliable, just like the dark web itself.
Some of this information can be extremely valuable on darknet forums. For example, while a Social Security number might go for $2, email credentials could sell for as much as $120,000. Hackers can make a lot of money and do so with less worry that they might get caught. Thanks to the Tor browser’s layers of encryption and IP scrambling, it’s difficult to track people down on this part of the web.
Again, although the dark web isn’t inherently bad, you should still be proactive in preventing your personal information from falling into the wrong hands. Here are a few ways you can help keep you and your family safe online:
Protect your devices with passwords and antivirus software: One of the first lines of defense is to protect your devices. With passwords, ensure they’re unique and strong across accounts and keep them in one place, like a password manager. It’s also important to have antivirus software installed on your browsing devices to protect them from malware and other threats (you can even take this a step further by using a virtual private network or VPN).
Think before oversharing on social: Social media keeps us connected with our family and friends, but before you click “share,” make sure you’re not revealing any personal information like your home address or something else that could be compromising.
Sign up for a monitoring service: Whether it’s reviewing your credit report or an identity protection plan with 24/7 monitoring, additional trusted eyes on your accounts will help them stay protected.
The dark web might sound scary. The fact is, an everyday internet user like yourself likely won’t have any contact with this level of the internet. That said, it’s still important to take as many precautions as you can to keep your family and your technology safe.
McAfee provides everyday internet users with the tools they need to surf safely and confidently. Our award-winning antivirus software protects against threats like phishing, malware, and ransomware, and we also offer identity protection plans that come with a personalized Protection Score to check the health of your online information. Start browsing with confidence by using McAfee.
The post The Dark Web: A Definitive Guide appeared first on McAfee Blogs.
