Cyberstudy
PDF p.236 In progress

Deep and Dark Web

Open PDF at p.236 13 flashcards

Summary

PDF p.236

The deep web and dark web are sources of threat intelligence, providing valuable insights into cyber adversaries' tactics, techniques, and procedures (TTPs). While the deep web includes non-indexed parts of the Internet, the dark web consists of sites and services accessible only through anonymizing networks like TOR.

In plain words

Supplementary — not from your PDF

The deep web is any content that search engines don't index, such as pages behind logins, and is mostly harmless. A dark net is an anonymizing overlay network such as TOR, Freenet or I2P. The dark web is the sites reachable only through a dark net. It hosts both legitimate uses (privacy, avoiding censorship, journalism) and criminal marketplaces. Threat researchers monitor it for leaked data and emerging TTPs.

Detailed explanation

PDF p.236
  • Deep Web
    • Definition: Parts of the World Wide Web not indexed by search engines.
    • Examples: Pages requiring registration, unlinked pages, nonstandard DNS, encoded content.
    • Purpose: Often used for legitimate purposes but can include concealed areas.
  • Dark Net
    • Definition: An overlay network using software like TOR, Freenet, or I2P to anonymize usage.
    • Function: Prevents third parties from knowing about the network or analyzing activity.
    • Example: Onion routing with multiple layers of encryption and relays.
  • Dark Web
    • Definition: Sites, content, and services accessible only over a dark net.
    • Access: Often hidden from search engines, accessible via "word of mouth" bulletin boards.
    • Purpose: Used for both illicit activities and legitimate purposes.
  • Legitimate Uses
    • Privacy and Anonymity: Enhanced privacy for whistleblowers, journalists, activists, or individuals under repressive regimes.
    • Access to Censored Information: Bypassing censorship in countries with strict Internet controls.
    • Research and Information Sharing: Insights into criminal activities and emerging threats for cybersecurity professionals.
  • Threat Research
    • Purpose: Discover TTPs of cyber adversaries.
    • Methods: Analyzing customer networks, operating honeynets, infiltrating dark web forums.
    • Challenges: Continually shifting landscape as adversaries adapt.

Important terms

taken from the text above
Deep Web
Parts of the World Wide Web not indexed by search engines.
Dark Net
An overlay network using software like TOR, Freenet, or I2P to anonymize usage.
Dark Web
Sites, content, and services accessible only over a dark net.
Privacy and Anonymity
Enhanced privacy for whistleblowers, journalists, activists, or individuals under repressive regimes.
Access to Censored Information
Bypassing censorship in countries with strict Internet controls.
Research and Information Sharing
Insights into criminal activities and emerging threats for cybersecurity professionals.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Your online banking pages are part of the deep web.
  • TOR's onion routing wrapping traffic in layers of encryption.
  • A threat intelligence service alerting that company credentials appeared for sale.

Scenario

A monitoring service finds a list of the company's employee email addresses and passwords posted on a dark web forum. The company forces password resets and checks for MFA coverage.

Common mistakes

Supplementary — not from your PDF
  • Treating 'deep web' and 'dark web' as the same thing.
  • Assuming everything on the dark web is illegal.

Practical skills

Supplementary — not from your PDF
  • Explain the difference between the deep web, dark nets and the dark web.

What I should remember

Key Points PDF p.236
  • Deep Web
    • Definition: Non-indexed parts of the Internet.
    • Examples: Registration-required pages, unlinked pages.
  • Dark Net
    • Definition: Anonymizing overlay network.
    • Function: Prevents third-party analysis.
  • Dark Web
    • Definition: Sites/services on a dark net.
    • Access: Hidden, "word of mouth" URLs.
  • Legitimate Uses
    • Privacy: For whistleblowers, journalists, activists.
    • Censorship Bypass: Access to restricted information.
    • Research: Cybersecurity insights.
  • Threat Research
    • Purpose: Discover cyber adversaries' TTPs.
    • Methods: Network analysis, honeynets, dark web infiltration.
    • Challenges: Adversaries' adaptations.