Inspector General's Report Confirms CBP Contractor Was Hacked, Resulting In Sensitive Info Making Its Way To The Dark Web

from the collect-it-all,-protect-it-barely dept

Last year, a CBP vendor suffered a data breach affecting more than 100,000 people who had crossed the border at checkpoints. The CBP refused to name the contractor involved in the breach, but internal documents indicated it was Perceptics. Perceptics provided and maintained the system that photographed cars and their occupants as they crossed the border.

The vendor's involvement in the breach has now been publicly confirmed, thanks to an Inspector General's investigation of the incident. Sensitive information that was never supposed to be located on Perceptics' servers was obtained by hackers and (partially) distributed on the dark web. [h/t Motherboard]

The report [PDF] lists the extent of the damage, which was fairly minimal given what was involved.

The subcontractor’s network was later the subject of a malicious cyber attack that compromised approximately 184,000 traveler images from CBP’s facial recognition pilot. After removing duplicate images, CBP reduced its estimate to 100,000 individual images, of which they discovered 19 were posted to the Dark Web.

From which the IG draws this inevitable conclusion:

This incident may ultimately result in damage to the public’s trust in Government biometric programs.

Yes, whatever trust there is that hasn't been damaged yet, I guess.

Perceptics was authorized to be on-site to perform maintenance work. It was never authorized to transfer any photos to its own servers. But it did. And it did this in the worst way possible.

According to documentation from Unisys and CBP, Perceptics subsequently admitted to Unisys that it had downloaded approximately 184,000 traveler images from the equipment in conjunction with the work order tickets. Perceptics personnel accomplished this using an unencrypted USB hard drive that was eventually transported back to their corporate office in Knoxville, Tennessee. From there, subcontractor personnel uploaded CBP’s images to a Perceptics server.

This unauthorized data exfiltration led directly to another unauthorized data exfiltration.

Perceptics’ corporate network was subjected to a ransomware attack at some point prior to May 13, 2019. The attack compromised thousands of driver and passenger images that CBP captured during the VFS pilot. CBP determined that more than 184,000 traveler facial image files, as well as 105,000 license plate images from prior pilot work, were stored on the subcontractor’s network at the time of the ransomware attack. In addition, the hacker stole an array of contractual documents, program management documents, emails, system configurations, schematics, and implementation documentation related to CBP license plate reader programs.

Perceptics refused to pay the ransom and the hacker (d/b/a "Boris Bullet Dodger") released "9,000 unique files" on the dark web.

The Inspector General says Perceptics should never have taken files offsite. But it's not the only party to blame. CBP should have made this far more difficult to achieve.

Perceptics was able to make unauthorized use of CBP’s biometric data, in part because CBP did not implement all available IT security controls, including an acknowledged best practice. Additional IT security controls in place during the pilot could have prevented Perceptics from violating contract clauses and using an unencrypted hard drive to access and download biometric images at the pilot site.

The rest of the report is the CBP promising to secure barn doors as per the IG's recommendations. Certainly this will have some effect going forward. But the fact remains the CBP collects a lot of personal information that can be tied to border crossers' vehicles. All of this in one place continues to make the CBP -- and most government agencies -- tempting targets for malicious hackers.

Filed Under: border crossing, cbp, dark web, facial recognition, hacked, inspector general, leaked, security
Companies: perceptics, unisys

FBI And Half The World Bust Operators Of A Site That Made The Dark Web Searchable

from the deep-dot-web-is-dead,-making-way-for-deep-dot-web-2.0 dept

Because it's so much easier to bust websites than actual criminals, police in Israel have decided to arrest the people behind a dark web site that made the dark web searchable. Zack Whittaker has the details for TechCrunch.

The FBI have arrested several people suspected of involvement in running Deep Dot Web, a website for facilitating access to dark web sites and marketplaces.

Two suspects were arrested in Tel Aviv and Ashdod, according to Israel’s Tel Aviv Police, which confirmed the arrests in a statement earlier in the day. Local media first reported the arrests.

Arrests were also made in France, Germany and the Netherlands. A source familiar with the operation said a site administrator was arrested in Brazil.

That may have been who effected the arrests, as cops say. But the United States had its hand in this action. Deep Dot Web's landing page has been defaced by the FBI and its multitude of task force logos, indicating the investigative agency now controls the site.

The wording on the FBI's new landing page says something about money laundering, but that seems to a stretch. As Whittaker describes it, the site made money with referral links, connecting users with other sites. What it didn't do was offer any illegal items itself, even if it made it possible for users to find and purchase those items on their own.

Of course, if the site was taking a cut of the profits from illegal sales, that's a completely different thing. A percentage of contraband is just contraband. It doesn't seem to add up to money laundering, though, but that's what's alleged in the FBI's site seizure notice.

Whoever's behind this site had better hope they don't end up being tried in the United States. The person behind dark web drug marketplace Silk Road received consecutive life sentences from a New York judge. The DOJ recommended Ross Ublricht, a.k.a. the Dread Pirate Roberts, be held personally accountable for all $184 million-worth of drugs sold via the Silk Road.

Over in England, the person behind Silk Road 2.0 -- which did double the business of the original Silk Road -- received a five-year sentence for doing the same thing Ulbricht did, only better.

It's a big score for a number of law enforcement agencies around the world, but so far, none of them want to talk about it. None of the multiple agencies involved have delivered statements or returned requests for comment. So, we'll just have to wait to see how this will all shake out. The US government's dark web investigations have not been without their problems or free from vindictive prosecutorial behavior.

The international game of whack-a-mole will continue as governments around the world continue to believe they can keep buyers from finding sellers by shutting down one portal at a time.

Filed Under: dark web, deep dot web, fbi, money laundering, search
Companies: deep dot web

French Cop Arrested For Selling Sensitive Law Enforcement Info On The Dark Web

from the all-the-best-jobs-are-the-inside-ones dept

The problem with giving law enforcement access to so many databases full of personal info and so many tech tools to fight crime is that, inevitably, these will be abused. This isn't a law enforcement problem, per se. It's a people problem. When the job demands the best people but still needs to maintain minimum staffing levels, things like this happen:

A French police officer has been charged and arrested last week for selling confidential data on the dark web in exchange for Bitcoin.

[...]

French authorities also say the officer advertised a service to track the location of mobile devices based on a supplied phone number. He advertised the system as a way to track spouses or members of competing criminal gangs. Investigators believe Haurus was using the French police resources designed with the intention to track criminals for this service.

He also advertised a service that told buyers if they were tracked by French police and what information officers had on them.

The discovery of the officer's misconduct came to light after French police shut down a dark web market. That there was a cop selling cop stuff to criminals on the dark web is inevitable. If it wasn't this investigation, any of the dozens of others happening around the world would have uncovered a law enforcement officer doing bad things. Two of the federal agents involved in the Silk Road investigation ended up being charged with money laundering and wire fraud after they stole Bitcoin and issued fake subpoenas to further their own criminal ends.

Again, it's a people problem -- one that's present anywhere people are given power and access not present in most jobs. The problem is government agencies, in particular, tend not to hold their own employees accountable and work hard to thwart their oversight. The more brazen examples of government malfeasance are enabled by the dozens of smaller infractions that go unpunished until they're the subject of a lawsuit or government investigation.

More to the point, this is exactly why no government agency -- not to mention the private companies involved -- should be allowed to utilize encryption backdoors, as the EFF's Director of Cybersecurity, Eva Galperin, pointed out on Twitter. It's not just about the hundreds of malicious hackers who will see an inviting, new attack vector. It's that no one -- public or private sector -- can be completely trusted to never expose or misuse these avenues of access. And since that's a fact of life, sometimes the best solution is to remove the temptation.

Filed Under: backdoors, dark web, encryption, france, police, police database

Australian Police Ran A Dark Web Child Porn Site For Eleven Months

from the presiding-over-a-period-of-unprecedented-growth dept

Thanks to an investigation by Norwegian newspaper VG, a long-running child porn operation by Australian police has been (inadvertently) uncovered. An IT specialist at VG was monitoring forum activity and only stumbled on law enforcement's involvement on accident.

In comparison to the FBI's takeover of the Playpen site, the Taskforce Argos operation was epic. The FBI held onto the seized Playpen seizure for only a couple of weeks. The Australian police served as replacement administrators for eleven months.

The government's turn as child porn site administrators began with the arrest of two men in the United States, one of them a Canadian citizen. Both were apparently actively abusing children as well as running the dark web site. According to data gathered by investigators, Childs Play had more than a 1 million registered users by the time it was shut down. (Estimates suggest fewer than 5,000 accounts could be considered active, however.) Based on estimates from multiple countries now involved in the law enforcement action, the eleven-month hosting effort has resulted in nearly 1,000 suspects being identified. Some have already been arrested.

The article is worth a read (as is the Guardian's more succinct take), if for no other reason than the sheer amount of detective work performed by a few journalists. The ends are worthy -- the arrest and punishment of child abusers -- but, as in the FBI's child porn operations, the means are highly questionable.

Presumably Australian law enforcement used something similar to the FBI's malware to reveal identifying information about the forum's users. No details have been provided to VG, but there's a good chance details will begin to surface as cases proceed to trial.

But it is concerning law enforcement felt a need to continue to distribute child porn for eleven months before deciding to shut down the site. It also seems highly possible the site was only shut down was because the operation had been uncovered by VG's detective work.

While impersonating one of the arrested forum moderators, police had to provide a monthly update post to prevent the site's warrant canary from kicking in. One requirement was to include a child porn image with this update, under the assumption law enforcement officers wouldn't be legally allowed to distribute this contraband.

That leads directly to another problematic aspect of the investigation: the website was relocated for easier exploitation.

It is VG’s understanding that when WarHead surrendered access to Childs Play and Giftbox each forum was stored on servers in separate European countries. Police, lawyers and the suspects themselves refuse to say which.

Police in Australia and the European country saw obvious benefits to having the Australian police, rather than a European force, running the site.

Australian laws give the police unusually broad powers to monitor suspicious activities online.

By consolidating the operation under Australian jurisdiction, investigators now had legal latitude to distribute child porn. The police may not have distributed much directly, but during the eleven months the site operated under new ownership, business was booming. According to statistics compiled by VG's investigation, hosted images quadrupled during that period, from 3,000 to over 12,000 total image. And some of the uploaded images became incredibly popular.

On 25 October 2016, two weeks after Argos took over the site, an unidentified user created a discussion thread featuring images of an eight-year-old girl being raped.

By August of this year, the post had been viewed 770,617 times – all while the police were running the website.

Some victims of child sexual abuse interviewed by VG are upset their images were redistributed by law enforcement. Others are a bit more pragmatic about the investigators' actions. But the redistribution of child porn by law enforcement raises a bunch of questions no one in law enforcement seems interested in answering.

Carissa Byrne Hessick, a professor of law at the University of North Carolina, questions [investigator Paul] Griffith’s argument. She is one of the world’s leading legal experts on investigating such abuse.

"It sounds like the police tell one story about how damaging the images are when others share them, and another story when the police share them.

That’s a kind of hypocrisy I really don’t like. But this sheds light on the argument that any and all sharing of such an image is abuse. If the police say they’re only sharing images that have been shared before, it means the police do not think all sharing is harmful," says Hessick.

The counterargument, of course, is law enforcement commits illegal acts for the greater good. But the argument is somewhat hollow when child porn convictions come with restitution orders based on the number of images shared. Eleven months running a child porn site seems like overkill, especially when the two principal members were already in custody by the time investigators took over.

Filed Under: australia, dark web

UK Law Enforcement Telling Citizens To 'See Something Say Something' About Dark Web Use

from the surfing-with-the-enemy dept

See Something, Say Something (UK Edition) has arrived! In the wake of terrorist attacks, local law enforcement are urging people to report "suspicious" activities. There's a long list of things to be on the lookout for, but most notable is the call to view certain internet use as suspicious, as Joseph Cox reports.

Police in the capital have reportedly been handing out leaflets listing what authorities deem as suspicious activity, in the hope that vigilant community members can continue to provide helpful information to law enforcement. Perhaps, in a sign of how online communities play an increased role in radicalization, the leaflet specifically points to use of the dark web as a potential link to terrorism.

"Be aware of what is going on around you—of anything that strikes you as different or unusual, or anyone that you feel is acting suspiciously—it could be someone you know or even someone or something you notice when you are out and about that doesn't feel quite right," another version of the leaflet, which is part of a national campaign and not London specific, reads.

Specifically, it asks citizens to report someone "visiting the dark web or purchasing unusual items online." Not exactly the sort of thing one's likely to catch shoulder-surfing. The leaflet also recommends reporting people for engaging in suspicious photography -- something that's worked out oh so well here in the US.

As Cox points out, tying terrorism to dark web use is kind of pointless. While the dark web is no doubt used by some terrorists, it certainly isn't where most of their activity takes place.

[M]uch of the communication between Islamic State supporters takes place on social media, such as Telegram. And the group's and supporters' propaganda videos are often distributed on everyday social network sites.

What an "education" campaign like this has the potential to do is turn any deviation from normal web use into something inherently suspicious. If law enforcement likes chasing down worthless tips, depicting things non-terrorists do as terrorist-centric is a good way to get that ball rolling.

I don't doubt the public can play a part in preventing terrorist attacks, but the leaflet asks citizens to become intrusive extensions of the government. Most citizens aren't going to know whether their friends and neighbors surf the dark web, much less have any idea if they're "carrying out suspicious transactions on their bank account." The upshot will be a generalized heightened level of suspicion that will most likely manifest itself as expressions of citizens' inherent biases and bigotry.

Filed Under: dark web, law enforcement, say something, see something, uk

Facebook Joins Tor, And The Dark Web Gets A Little More Useful (If A Little Less Cool)

from the good-news dept

Just a couple months ago, we wrote about how the folks behind Tor were looking for ways to deal with the fact that much of the web treats Tor visitors differently. It's a tough problem to solve, as we noted, because for all the benefits that Tor provides by allowing people to be anonymous, it's also very much a tool that is abused by some for nefarious purposes, including spamming and attacks. For sites that have any sort of heuristic systems in place (including us at Techdirt), it often defaults to treating many, if not all, Tor users as second-class citizens. This isn't an easy problem to solve, by any means. We've done our best to train our systems to minimize the hassle for Tor users, and yet they are still more likely to run into issues than non-Tor users (sometimes because of upstream efforts). We're certainly watching this effort closely, in hopes that we can benefit from it as well.

However, it looks like Facebook has taken a rather bold move to help Tor users: setting up its very own Tor hidden service, effectively creating a special "hidden" Tor version of Facebook that is designed for Tor users. Yes, Facebook has joined the dark web. It may not seem as cool as various dark markets and such, but it actually is rather important in helping to validate the use of Tor and the fact that not everything on Tor hidden services are about selling drugs or hiring hitmen, as some reports seem to imply.

This is a pretty big move, because Facebook was rather aggressive in treating tor users badly in the past, sometimes accusing them of hacking their own account, kicking them out or just displaying stuff weirdly. Obviously, users logged into Facebook over Tor are identifying themselves to Facebook, but it does provide more security and privacy for others, and works more seamlessly for those who wish to use Tor regularly.

As Runa Sandvik also notes, this is the first time that a certificate authority has issued a legitimate SSL certificate for a .onion address (Facebook is at https://facebookcorewwwi.onion/ in case you were wondering). Having both of these things happen at once may, as Andy Greenberg jokes, feel sort of like when your parents joined Facebook, but it also, hopefully, is the beginning of more widespread recognition that the Tor hidden services can be useful -- and not just for questionable enterprises. Hopefully others follow Facebook's lead.

Filed Under: certificate authority, dark web, ssl, tor
Companies: facebook

As Silk Road 2.0 Pops Up, The Government Needs To Avoid The Temptation Of Moral Panic

from the moral-panic-a-coming dept

Plenty of digital ink has been spilled about the supposed launch of Silk Road 2.0, a near copy of the original infamous Silk Road "dark web" shopping site for all sorts of illegal things. But, perhaps more interesting is how Congress suddenly feels the need to jump in and try to understand the dark web and things like Bitcoin:

The Senate Homeland Security Committee, officials tell TIME, plans on holding hearings on Bitcoin within the month. The committee sent letters to nine federal agencies in July asking for their thoughts on Bitcoins and other virtual currencies in the hopes of developing a holistic approach to the so-called cryptocurrency that neither stifles the currency’s potential nor enables criminals to abuse it.

This should be cause for concern. After all, it wasn't that long ago, that Senator Chuck Schumer absolutely flipped his lid about Bitcoin, claiming that Bitcoin itself was "money laundering" after some of the first news stories about the original Silk Road came out. The fact that he so immediately conflated the dark web with Bitcoin should be problematic already -- though, one hopes that he's since learned some more about Bitcoin and has realized his original statements were exaggerated.

Of course, any time Congress gets involved, especially with the kind of story that can be portrayed the way Silk Road has been portrayed, you almost expect the moral panic and grandstanding to reach a fever pitch. The one (minor) good sign in all of this is that the Senator who is putting together that hearing on Bitcoin, Tom Carper, seems to be going out of his way to make it clear that he isn't looking to have a kneejerk reaction to all of this -- especially if it might stifle important innovations. After news broke of the new Silk Road, he was quick to put out the following statement:

“This new website – launched barely a month after Federal agents shut down the original Silk Road -- underscores the inescapable reality that technology is dynamic and ever-evolving and that government policy needs to adapt accordingly. Rather than play ‘whack-a-mole’ with the latest website, currency, or other method criminals are using in an effort to evade the law, we need to develop thoughtful, nimble and sensible federal policies that protect the public without stifling innovation and economic growth. Our committee intends to have that conversation – among others - at our hearing this month on virtual currency.”

That's a whole hell of a lot better than Schumer's "it's money laundering!" grandstanding from two years ago -- but that doesn't mean that others in Congress will be as willing as Carper to take a careful, measured and informed approach to all of this. While it sounds good to create policies that "protect the public without stifling innovation and economic growth," in practice that's often a lot more difficult than most people think -- and Congress often has an uncanny ability to say one thing and put in place policies that do the exact opposite.

While some people like to mock concepts like the dark web and Bitcoin, there's a tremendous amount of important innovation happening within and around each of them. While they may initially be used, in part, for illegal activity, that's going to become less and less of the predominant use, and all sorts of powerful new tools and services are likely to develop -- if allowed. Bitcoin, in particular, has many powerful uses beyond just being a currency (in fact, that may be one of its least interesting characteristics), but overly regulating it based on moral panics might kill that off. I already know a few entrepreneurs and investors who are unwilling to commit to some really interesting Bitcoin projects, just because they know the regulatory situation might destroy the space overnight. Hopefully, Congress will avoid that temptation to go on a full out moral panic -- but their track record with these kinds of things isn't that great.

Filed Under: bitcoin, chuck schumer, congress, dark web, homeland security committee, moral panics, silk road, tom carper

Shallow Surveillance Efforts Like PRISM Will Only Catch The 'Stupidest, Lowest-Ranking Of Terrorists'

from the better-watch-out-for-the-skin-deep dept

Government officials keep assuring the public that these surveillance programs are in place to track terrorists and prevent further violent activity aimed at our nation. But much of what the government actually tracks and collects is nearly useless. It's aimed at the sort of platforms and communication devices used by the general public -- the sort of people who make use of the "top level" because they actually have nothing to hide.

Leonid Bershidsky argues that casting the net wide, but only to a shallow depth, won't actually "catch" anything but the most inept of terrorists.

The infrastructure set up by the National Security Agency, however, may only be good for gathering information on the stupidest, lowest-ranking of terrorists. The Prism surveillance program focuses on access to the servers of America’s largest Internet companies, which support such popular services as Skype, Gmail and iCloud. These are not the services that truly dangerous elements typically use.

Truly dangerous people are smart enough to know to avoid anything easily tracked, surveilled or easily exposed. There may be a little value in catching anything that briefly rises to the surface or surveilling the "public faces" of terrorism, but those serious about their agenda will be operating far below these easily-tapped sources.

In a January 2012 report titled “Jihadism on the Web: A Breeding Ground for Jihad in the Modern Age,” the Dutch General Intelligence and Security Service drew a convincing picture of an Islamist Web underground centered around “core forums.” These websites are part of the Deep Web, or Undernet, the multitude of online resources not indexed by commonly used search engines.

The Netherlands’ security service, which couldn’t find recent data on the size of the Undernet, cited a 2003 study from the University of California at Berkeley as the “latest available scientific assessment.” The study found that just 0.2 percent of the Internet could be searched. The rest remained inscrutable and has probably grown since. In 2010, Google Inc. said it had indexed just 0.004 percent of the information on the Internet.

If someone or something doesn't want to be found on the internet, it's easy to stay hidden, or at the very least, continue to operate below the dragnet. On top of what's not being indexed, there are options available to go completely off the grid. This makes steady communication difficult, but not impossible. What does happen on the net is encrypted or otherwise obfuscated.

Communication on the core forums is often encrypted. In 2012, a French court found nuclear physicist Adlene Hicheur guilty of, among other things, conspiring to commit an act of terror for distributing and using software called Asrar al-Mujahideen, or Mujahideen Secrets. The program employed various cutting-edge encryption methods, including variable stealth ciphers and RSA 2,048-bit keys.

As Bershidsky puts it, tools like the PRISM system and phone metadata are much better suited for surveilling those who don't have any reason to suspect the government has an interest in their movements and actions. In other words: American citizens, the same people who are supposedly not being targeted.

If the FBI and the NSA are only interested in catching clumsy would-be terrorists who can't be bothered to stay off open channels, then, much like the programs themselves, they can only offer us a false sense of security. Being saved from the bench warmers of the terrorism world doesn't ultimately do anything to increase safety, but it does give these agencies something to point to when their actions are questioned. (The FBI has practically set up its own "Busting Stupid Terrorists" cottage industry.) "We stopped [insert plausible but impressive number here] attacks, therefore we need to continue collecting 'dots' and multiple haystacks of connective material."

Whatever the FBI and NSA are gathering from skimming the web's surface is only a minute percentage of what's available. It would seem that deeper, targeted efforts would be much more effective, rather than simply asking for everything and working backwards. But if the actual intent is to surveill American citizens (with prevented acts of terrorism being a bonus), then these agencies are in the perfect position to do exactly that.

Filed Under: dark web, deep web, encryption, nsa, nsa surveillance, prism, terrorism, terrorists

Navigating The Deep, Dark Web

from the dig-in dept

We recently ran an excerpt from Cole Stryker's new book, Hacking the Future about the importance of anonymity. Here's the second excerpt from this book, our latest book club selection. This time it's about navigating parts of the web that not everyone knows about... We'll be hosting a chat with Stryker in the near future, to be announced soon.

I first heard whispers of the deep Web on 4chan. It was often positioned by active users as a place where even the most hardened /b/tard (a nickname for heavy users who hang out on 4chan's "random" board a lot) can find things to shock the system. The deep Web is depicted there as the submerged portion of an iceberg. The Web that we know is the tip, and the massive portion underwater is the deep Web.

"I've just come back from the deep Web," they say, "and look what I found." They share ghastly images and stories, perpetuating the legend of this vast underbelly among underbellies. In these conversations I was led to believe that the deep Web—also called the invisible Web, the darknet, undernet, and several other sinister-sounding names—was home to the sort of content that would get you thrown in jail if it were ever traced back to you. This is true, to an extent, but technically the deep Web comprises anything that isn't crawlable by major search engines like Google. This can mean dynamic URLs that have a long string of parameters that might confuse spiders (the software that "crawls" Web sites to index them for search). Any content that's behind a pay wall or other password authentication is technically included in the deep Web. This would include your e-mail or a pay-to-view newspaper Web site. Any content that lies behind a form, like a survey or poll, often can't be crawled. Some sites purposefully exclude spiders using robots.txt, a file that tells spiders to steer clear of certain Web pages for various legitimate, legal reasons. Pages that are made up of flash content obviously can't be crawled because there's no raw text on the page. So to say that the deep Web is the seedy back alley of the Internet is not entirely accurate.

However, there are parts of the deep Web, accessible only with the use of certain anonymizing software, where baddies sometimes hang out. The deep Web is rife with readily available child pornography, terrorist rhetoric, drug and sex trade—all manner of taboo and hateful communication.

One such piece of anonymizing software is called the Onion Router, or Tor, briefly mentioned earlier. Tor reroutes communications coming from your computer around the world across a distributed network of volunteer-run nodes that make up the Tor Network. Tor passes users' traffic through three servers before sending it along to its destination. The network was originally sponsored by the U.S. Office of Naval Research to help military agents abroad bypass firewalls and other "censorware" in countries like China. For this reason, some speculate that the service is routinely monitored by the U.S. government and cannot be trusted.

Technically, Tor is not an anonymizing service so much as an obfuscating one. Tor alone can't keep anyone anonymous; it's merely one item in the smart anon's tool belt. Tor works to anonymize your Internet connection, but can also be applied to specific programs. The most popular program used in tandem with Tor is the Internet browser. The Tor team has built a Firefox extension that applies several "onion-like" layers of obfuscation to data communicated through Firefox. Because Tor routes your traffic around the world, it's not very fast. The more people volunteer to contribute their machines as nodes, the faster Tor will get.

I thought I'd check it out for myself. I downloaded the Tor software, ran the executable file, and installed the software. When I ran the program, within seconds a browser window opened saying, "Congratulations. Your browser is configured to use Tor. Please refer to the Tor Web site for further information about using Tor safely. You are now free to browse the Internet anonymously." I typed in a URL I found on 4chan for an underground deep Web portal called Hidden Wiki, waited about thirty seconds (an eternity in the era of Wideband and FIOS), and a blank page popped up, reading "Looking for Hidden Wiki?" The last two words were blue, indicating a hyperlink, so I clicked it, and up popped a page that looked just like Wikipedia. A sidebar listed the categories that are available to browse: blogs, books, political advocacy, but also drugs and underage erotica. I clicked on a link called "Killer for Hire."

This can't possibly be for real, can it?

You can call me Slate. All you need to know is that I am well trained and can perform what you need done. I do not need to know your situation with the hit and prefer not to. I’m hired when you want to make sure that the hit doesn’t get traced back to you.

• Minimum age for hit is 18.
• I do not care of the gender of the hit.
• I do not kill pregnant women.
• I do not torture the target.
• If hit is a political figure, or is in law enforcement (judges, policemen) there will be an additional fee.
• For an additional fee, I can set it up as a “suicide” or an “accident”
• Hit will take place within 4 weeks.
• Hits outside of the continental US will require an additional 2 weeks of logistics and $5000 in travel fees.
• Once the hit has been made I will message you with a picture or a video and the remaining balance must be paid in full.

A second hit-man site sounds like a Hollywood Russian mafioso wrote it. "It is mutual interest to make everything anonymously," he warns, insisting, "it is not a joke." He gives careful instructions on how to pay through Bitcoins (more on this soon) and reiterates the need for total anonymity on both sides of the transaction. "I don't know you and you don't know me." If these sites are jokes, they are convincingly conceived. Moving on from the hit men, there are firearm salesmen, hackers for hire ("destroy your enemies!"), an extensive list of Bitcoin traders, illegal gambling sites, white supremacist blogs, whistle-blowing blogs, new world order conspiracy chat rooms, transnational activists, Anonymous operation forums, hacker/phreaker communities, and porn. Oh, the porn. Genital mutilation, necrophilia, zoophilia, watersports, etc. Anything you can imagine is at your fingertips. Which brings us to child pornography. I don't have the guts or inclination to click through to any of these sites, but they're there. And according to people hanging out on 4chan, the stuff available from the Hidden Wiki is only a shallow fraction of what's out there were one prone to dig deeper.

Perhaps the most notorious site available through Tor is the Silk Road, a black market where users can find 340 different illegal drugs: weed, cocaine, heroin—a digital bazaar of pills, tabs, and powders. If I wanted, I could easily order up a smorgasbord of illicit substances and have it delivered within a few days. You have to pay a Bitcoin just to browse the site—its inaccessibility keeps out most looky-loos. The site doesn't have everything, of course. You won't find any chemicals that are easily weaponized. Sellers promote their wares through a reputation system that isn't much different from the one popularized by eBay. The site only accepts Bitcoins, which, along with mandatory Tor usage, help to ensure the anonymity of buyers and sellers. The Silk Road is one of many hubs for black-market drug trade on the deep Web. It's difficult to tell if the DEA (Drug Enforcement Administration) is going to crack down on this sort of thing, or if we're peering into the future. Anonymizing applications and efforts to pierce such software seem to be progressing apace.

Freenet is another piece of software used to mask identity online. It's been downloaded over 2 million times. Freenet's creator, Ian Clarke, is concerned about the freedom to communicate. He grew up in the south of Ireland in the ‘80s in a family of Protestants, whom he says are fastidious about staying out of Irish politics. From a young age he was interested in understanding people who held different views.

I remember reading [Sinn Féin' leader] Gerry Adams's autobiography at a time when most people considered him a terrorist. I can remember that if he was interviewed on TV they had to use an actor to do a voiceover, because it was illegal to broadcast his actual voice. It wasn't that I agreed with Gerry Adams' beliefs or actions, but I did feel that it was far more productive to understand where people are coming from, to try to step into their shoes, rather than simply demonizing them, which was official government policy at that time. It left me with a strong sense of the futility of censorship, and the value of free communication.

My experience with Freenet's "Linkageddon," one of several directories, is similar to that of Tor's Hidden Wiki. Some of it is innocuous (Bob Chapman's Financial Analysis), some of it funny (Anti–Harry Potter fundamentalists), and some of it horrific (ubiquitous underage porn). Everything looks like an old Geocities page.

Clarke describes Freenet like a decentralized postal system, where people carry each other's mail. For instance, you need to get a letter to your friend Bob in Boston, and your friend Diane is going to Boston for a business trip. You give Diane your letter and have her hand off the letter to James, who happens to live in Bob's neighborhood. The system is decentralized and doesn't rely on any one person more than the others. If Bob can't deliver your letter, you might ask Cheryl, who will be passing through Boston as well. The advantages to this system are such that James doesn't have to know who's sending the letter, and there's no central postal hub that can restrict the delivery of mail through censorship or incapacity. According to research by Freedom House, Freenet is one of the most popular anonymity systems used in China. This was no accident. Clarke says that he intended for the software to be used by activists.

Filed Under: anonymity, dark web, encryption, tor

How Deep Should Deep Search Go?

from the faux-form-entries dept

For years, people have talked about the "deep web" or "dark web" of information that's hidden from the public (and search engines), sometimes behind registration or paywalls, but more often behind specific forms. That is, there's a lot of information that's dynamically generated on the fly, based on how someone fills out a form. For a search engine, that's problematic, as it doesn't get to see any of that information and inform people that it's there (even if it's "public" info). However, it looks like Google is attacking this problem by setting up its spiders to actually enter information into public forms to try to dig a layer or two deeper. The search engine is trying to be quite careful on this, as obviously it might make people question whether a search engine should be entering "fake" data into a form to dig deeper into it. It appears that Google is only doing this on specific sites -- and is paying attention to all robots.txt type info that wards off its spider. As for the more interesting question of what Google is entering into forms, apparently it tries to guess reasonable info from the context of the site. Who knows how well this actually works? But it's an interesting experiment. However, how long will it be until someone freaks out when they realize some info they thought was "private" or hidden from search engines is made public by this process?

Filed Under: dark web, databases, deep search, hidden information, search engines
Companies: google