Antti Tuomi, Principal Security Consultant - F-Secure.

Silk Road was one of the first dark market on the web that was created by Ross Ulbricht.It was a digital marketplace that connected vendors of illegal drugs with potential buyers. Vendors would advertise their wares on listings maintained by Silk Road, which was similar to the kinds of listings you might find on any legitimate e-commerce marketplace.

The anonymity it offers is something that even the US’s NSA could not unmask. There are millions of dark web sites run by as many volunteers but all hidden faces and it also becomes difficult to track precisely who is viewing what website.

“As a concept, the deep/dark web is not new at all. Wherever there is an interest in discussing or trading in a non-public setting, people will find a way, whether it is a conventional black market or a restricted forum on the web. Furthermore, these restricted sites have existed even before the World Wide Web; restricted access bulletin boards were used to trade pirated software (such as illegal software, games, media et cetera) already way before the web.As such, the dark web is just one way the underground scene and black markets are accessible to people who wish to access them,” says Antti Tuomi, Principal Security Consultant - F-Secure.

Where Dark web was created by online activists to avoid surveillance, it has become a pet peeve for regulators, because they know that dark web is here to stay and that they can do very little about it. 

There has been an increase of late in international sources of illegal drugs through the use of marketplaces on the Dark Web, and there have been arrests for these activities. Illegal dark web sites are often hosted by individuals or organizations that want to do business in illegal materials, such as drugs, firearms, stolen identities, credit card numbers and so on. For example, the Silk Road dark web drug market was hosted under the nickname of “Dread Pirate Roberts”, and operated by taking a commission of all sales performed through the site. 

Of course, the most likely motivation for running a site is monetary benefit, or access to the goods traded on it, as well as the connections to vendors visiting the site.Operating these sites comes at a risk though and few people have both the technical and the opsec (operational security) skills to remain unidentified.

There are evidences that show that media and the Internet can be controlled and manipulated to great effect. This has created a void and a lot of misgivings. Dark web is rising fast to fill that void, to become a sort of Fifth Estate that gives voice to the unwanted. “For example, Facebook recently announced a version of its website that can be accessed over the Tor network, which will make it easier to access the site from countries that restrict the service, such as China and Iran,” Rahul says.

So is addressing dark web/deep web on the agenda of security vendors today?

“Addressing the threats emanating from dark web or deep web is very much on the agenda of most security vendors. However, you must first understand that the dark web is a subaltern movement that is constantly evolving and cannot be supressed. If an organization is under attack from inside or outside, there is a possibility of the attackers using the dark web for cover and as a launchpad. Monitoring the dark web does boost your security and identify breaches and vulnerabilities. It is prudent to keep an eye on the dark web for mentions of your organization, names, email addresses, and sensitive assets,” says Rahul Kumar, Country Manager – WinMagic. 

“In general, security vendors are interested in monitoring what goes on in the dark web, especially when it concerns underground markets that trade in vulnerabilities, exploits, malware, hijacked servers and accounts. This information is valuable for picking up possible threats and attacks quickly, meaning protection can be rolled out to customers as soon as possible,” Antti explains.

Other unlawful aspects, such as trading in narcotics, pirated media and so on, are of more interest to the police. When the police want to take a site down, they may ask security vendors for information to help them with do this.  In the corporate context, security companies protect their customer by detecting and blocking access to suspicious sites.  

In an incident of clampdown on Darknet that took place in September, Europol and the US Department of Justice jointly announced the success of a sting operation against the dark web's black markets, including the seizure of AlphaBay. According to Europol, the market is estimated to have generated more than a billion dollars in sale of drugs, stolen data, and other illegal goods over its three years online. While AlphaBay’s closure had previously been reported as an FBI operation, the agency confirmed that takedown, while Europol also revealed details of its tightly coordinated Hansa takeover.

Dark Web in India…

In September last year, cyber security solutions company Seqrite, along with its partner seQtree detected and notified the Indian government about a possible breach of India’s National Internet Registry – IRINN (Indian Registry for Internet Names and Numbers). Apparently, the hackermanaged to gain access to National Internet Registry and as a result posted thousands of credentials for sale on a Darknet platform.

The size of the deep or dark web traffic from any region, leave alone India, is difficult to estimate. One does come across news reports of raids by authorities, who often point to the role played by deep or dark web. In any case, one cannot assign a value to or quantify this secretive market: In fact, there is a belief that this murky world of business is yet to rise in stature to give serious trouble to the industry at large. 

According to Antti, in India, using the dark web is not illegal unless doing so with criminal intent.  Reports claim that in India a majority of the people are still unaware about its existence; and even those are aware about its presence, indulge in it passively. There have been numerous arrests, closures, exits, and seizures by international authorities over the past four years. As a result, the darknet market activity has decentralized even further, creating a market for escrow accounts and exchanges and diversify. 

Dark web however can be used for both good and bad purposes and can involve a lot of people from journalists to drug peddlers.“Since the basis of the technologies used for the dark web is to make the traffic as anonymous and hard-to-track as possible, the most significant good uses for them are human rights, journalism, and privacy.For example, the Reporters without Borders organization advocates using Tor as a part of an attempt to be able ‘to communicate in a safe and anonymous manner with sources, whistle-blowers and dissidents’. As for country-wide self-defence, the military and police forces likely already have their own methods and environments for cooperating, and likely do not have a similar need for anonymity,” discusses Antti. 

However, as in any country, it gets very difficult to stop this kind of online activity without making access of the Dark Web illegally. in doing so, you run the risk of shutting down some very legitimate uses, such as utilizing ToR to maintain one's privacy for any legal activity as well. For example, journalists working under oppressive governments might use Tor to keep themselves and their sources safe. According to the ToR project, even law enforcement might use ToR.

“One significant way in which legislation could be improved is the international cooperation for taking down sites and services that do clearly act illegally. Being able to locate, confiscate, and take down services across country borders is often difficult – especially if the services are hosted in so-called “bulletproof hosting” environments, and in countries or locations that are notoriously reluctant to co-operate with the authorities,” says Antti. 

Samrita Baruah
samrita@varindia.com