Conversations in Cyberspace

Giulio D'Agostino

• Publisher: Business Expert Press
• Year: 2019
• ISBN:
  9781948976718
• Topic: Business
• Subtopic: Business Law
• Index: Business

Conversations in Cyberspace is a collection of insights on the current state of security and privacy in the Internet world.

The book contains a brief introduction to some of the most used open-source intelligence (OSINT) tools and a selection of interviews with some of the key figures in industrial control systems (ICS), advanced persistent threat (APT) and online/deep web members organizations. It aims to be an introduction to the relationships between security, OSINT and the vast and complex world hiding in the deep web.

The information provided will be beneficial to security professionals and system administrators interested in exploring today's concerns in database design, privacy and security-by-design, and deep web members organizations, including Cicada 3301, the Unknowns, Anonymous, and more.

CHAPTER 1

Introduction

Conversations in Cyberspace is a collection of insights and online conversations (both on IRC chats and encrypted e-mails) on the current state of security and privacy in the online world with a focus on the Deep Web. I have also included a brief introduction to some of the most used open-source intelligence (OSINT) tools and a selection of interviews with some of the key figures in industrial control systems (ICS), advanced persistent threat (APT) and hackers/hacktivists groups.

During the making of this short book, I have quickly realized I had to include interviews and insights from both people involved in the defense side of security and hackers/“crackers” who enjoy the intellectual challenge of creatively overcoming limitations and restrictions of software systems to achieve novel and unexpected outcomes.

The picture that comes out is a fascinating scenario where the cyberspace is becoming remarkably similar to the “physical space”; an increasing amount of people, groups and organizations are getting concerned about privacy, trust and information shared and promote both in the “clearnet” and the so-called “deep web.”

This book aims to be an introduction to the relationships between security, open source intelligence and the vast and complex world hiding in the deep web for both the security professional and the system administrator interested in exploring the today’s concerns in database design, privacy and security-by-design.

Offensive security, the team that developed the Kali Linux OPS, one of the most popular pen testing operation systems, cleverly summarizes the hacking spirit with the quote “the quieter you become, the more you can hear” borrowed from the 13th-century Persian poet, Jalāl ad-Dīn Muhammad Rumi.

October 31, 2018, Europe

Search Engines

Finding information on the Dark Web is not difficult. There are lists of Dark Web sites, and you will find Dark Internet search engines. The Onion sites provided in search results present challenges not found in a Bing or Google search results list.

The websites may be temporarily offline, a frequent problem with Dark Web Onion websites. Latency can make entering a query, obtaining results, and visiting the site in a results list time-consuming. Google-like response time is the exception.

The rule is to allocate sufficient time for Tor sluggishness. Additionally, the sites in the results list may be operated by law enforcement or an intelligence entity.

If a Dark Website looks too good to be true, approach with caution, registering or downloading content can allow malware in your computer.

We reiterate these warnings because most Bing and Google users are conditioned to enter a question, scan results list, and see websites confident that problematic destinations are filtered out.

Searching the Dark Web requires a more careful mindset. Keep in mind that you can use your sandboxed computing device to access ­Surface Web and Dark Internet websites.

Hidden Wiki

Among those easy-to-find “navigator” services for the Dark Web is the Hidden Wiki. With Tor up and running, enter the URL http://thehiddenwiki.org/ and click on a link. The selected Dark Web site will appear in the Tor browser.

If you are using the Tor software package, you can click on a link.

The site will display if it is online. Delays for a few Tor functions maybe 50 seconds or more.

The Hidden Wiki provides Onion links to chosen Dark Web sites in various categories.

The Hidden Wiki is another starting point for Dark Internet surfing. If a website does not resolve, you will have to try again later. You may also use the Paste-bin lookup methods described in the previous chapter to find out if a new Onion speech was posted. If the Hidden Wiki does not respond, an alternate supply of directory list is TorLinks in https://torlinkbgs6aabns.onion.

This website features similar categories and a similar number of listings. If your curiosity is participating in Dark Web forums, you may use the list of discussion groups to learn more about the conventions of Dark Internet services. The study team discovered that one has to build a relationship with the community of every forum. Some forums have a crowd-sourced score, like the consumer ratings on eBay or Amazon. The methods vary by Dark Web forum.

Ahmia

The Ahmia search system can be queried without the Tor software installed; however, to access a site, you will need to use your Tor-equipped computing device. The Surface Web URL is https://ahmia.fi; the Onion speech was http://msydqstlz2kzerdg.onion. The Ahmia code is an open source project with a repository on GitHub.

Ahmia, operated from Finland, bills itself as a “search engine for solutions resident on the Tor anonymity network.”

The system does not maintain Internet Protocol filters and logs results to knock out child abuse hyperlinks.

The system is integrated with GlobalLeaks and Tor2Web.

The system was created by JuhaNurmi, who is the chief executive of the Finnish company Dignify Ltd. (https://dignify.fi). Dignify offers data mining and cyber security research providing information about drug markets and other law enforcement issues.

At the top of the splash screen is a link to “Statistics.” The information, when it is available, is helpful. The index contains links to about 5,000 DarkWeb sites. hmia was a 2014 Google Summer of Code project. The goal was to improve the Ahmia system.

In July 2015, Ahmia published a list of Websites which were made to collect traffic from “real” Dark Web sites. In the summer of 2016, Ahmia has been offline more than it has been online.

Grams

Grams is situated at http://grams7enufi7jmdl.onion. One enthusiast clarified Grams as “the Google of the Dark Web.” In a 2014 interview, a Grams’ system administrator said Grams utilizes a proprietary search technology which displays results from e-commerce websites as well as other kinds of Dark Websites.

Users can add websites to the Grams system for indexing and inclusion in the system.

Grams does not support index child pornography. The process is operated by what appears to be an Eastern European digital money service. Grams offers unique attributes; for instance, a vendor and product search, and the user-friendly Flow, which enables the use of plain English to locate a specific Dark Web site. In 2015, the study team used Grams to find Pappy Van Winkle whiskey after a major shipment was stolen.

The lack of relevance underscored the issues Grams poses to an investigator.

Grams does a fantastic job of pointing a researcher to complete, free books available on Dark Web websites.

The service does an excellent job of indexing medication-related sites. With the inclusion of the Flow service, it is easy to locate specific Dark Web sites provided that the investigator knows the title of the site.

I have found that Grams was able to yield useful results, but its inclusion of irrelevant, off-topic results generated manual inspection of the result pages necessary. Used in concert with other Dark Internet search systems, Grams is acceptable.

Not Evil

Not Evil, located at https://hss3uro2hsxfogfq.onion, is a re-branding of TorSearch and Evil Wiki. The links are filtered. The relevance algorithm takes into consideration what users click on. Not Evil’s operator keeps a low profile. The service does not accept DarkWeb advertising. The system allows a user to start a secure conversation with another not Evil user with a chatbot identified as “Ned,” an acronym for not Evil Drone. The not Evil system includes a “chat” function from inside Tor. One can begin a conversation about a query using a chatbot or an anonymous user. Also, not Evil displays the number of items in the index which match the query. Along with the search, the system provides the number of links the not Evil system has indexed. Finally, not Evil provides an application programming interface so that not Evil’s performance can be integrated into other applications.

Onion Link

Onion Link can be found at http://onion.city Why is this Dark Web search system interesting is that it appears to use the Google custom search function as well as the Ahmia index to create results? The index comprises links to approximately 20,000 Dark Web sites, depending on the study analysis of Onion Link search results. About six years back, Google operated a Dark Web site, then that website was taken offline. Since that time, Google has not revealed information about its Dark Internet activities. Google did invest in Recorded Future, a company which indexes Dark Internet content. One hypothesis the study team devised was that Google might index some Dark Web content for its research and to support the work of their Google-backed Recorded Future. In late 2016, Google’s indexing of glue websites decreased based on our evaluation queries.

Torch

The Torch search system presents a search box, Dark Web advertising, and a link for people wanting to advertise on the Torch system. Notice that when this screenshot was taken, Torch reports that its index contains about 500,000 Dark Web pages, which is about one-third fewer than in other Dark engines. Torch is one of the lower profile Dark Web search programs. One useful feature of the system is term highlighting. The relevancy score produced by the search system makes it easy to spot the frequency of the terms in the indexed site. Results list entries reveal a date where the Torch indexing subsystem visited a site. Torch Dark Web search can be useful. We recommend using it from inside a sandbox.

Free Search Methods

Free Dark Internet search methods provide convenient, easy access to many Dark Web sites. However, none of the systems is without serious shortcomings. The approach I have developed involved crafting a query and then running that query on the five search systems discussed in this chapter. I then downloaded the first five sets of results and merged them. I then visited the Dark Websites which seemed to be most relevant to the specific issue we were investigating. What is obvious is that the time and effort needed to carry out manual queries and results analysi...

Table of contents

• Cover
• Halftitle
• Title
• Copyright
• Abstract
• Contents
• 01_Chapter 1
• 02_Chapter 2
• 03_Bios
• 04_Index
• 05_Adpage