CYBERTRUST

Shining Light
on the Dark Web
George Hurlburt, STEMCorp

Traditional endpoint protection will not

address the looming cybersecurity crisis Network Control Protocol (NCP) to
the Transmission Control Protocol/
because it ignores the source of the problem— Internet Protocol (TCP/IP). Just as
the US Department of Defense spun
the vast online black market buried deep
off the operational Milnet from the
within the Internet. research-oriented Arpanet, many
other purposeful networks arose.

O
Ultimately, the proliferation of net-
n 6 August 1991, almost a year and a half after works led to the classification of networks as national
proposing the World Wide Web (WWW), phys- (Class A), regional (Class B), or local (Class C) in scope. As the
icist and computer scientist Tim Berners-Lee number of Internet hosts grew, the Domain Name Service
published the fi rst website from his computer (DNS) permitted scalable resolution of hierarchically orga-
at CERN. Today, more than a billion websites continue to nized host names to workable Internet addresses. Today’s
fuel this highly disruptive and transformative technology Internet has 3.5 billion users, which accounts for almost
(www.internetlivestats.com/total-number-of-websites). 45 percent of the world’s 7 billion people (www.statista
To many, the WWW is a wondrous place. We follow the .com/topics/1145/internet-usage-worldwide). It subsumes
news and weather online, often in near real time. Stream- many networks, only a fraction of which can be seen by
ing videos entertain us or show us how to fi x that pesky the average WWW user.
leaking faucet. We gather data from Wikipedia and other
knowledge banks to answer questions. We keep in touch BEYOND THE WWW:
with distant loved ones and close friends via social media. THE DEEP WEB AND DARK WEB
We increasingly rely on the WWW to purchase goods and The openly searchable Internet, including the entire
services—to the point that the global ecommerce market, WWW, comprises only 6–10 percent of the whole Inter-
estimated to reach $2.3 trillion this year,1 is putting tradi- net.2 The remaining 90–94 percent holds content that is
tional retailers at risk of obsolescence. neither indexed nor cataloged. Much of this private data
The WWW resides on the Internet, whose transforma- includes holdings on corporate Class B and C internal
tive effect is far more immense. In January 1983, the Inter- networks (intranets), email and/or databases, academic
net became a reality when the Arpanet switched from the journals, or individually held information. This region,

100 COM PUTE R PUBLISHED BY THE IEEE COMPUTER SOCIET Y 0 0 1 8 - 9 1 6 2 / 1 7/ $ 3 3 .0 0 © 2 0 1 7 I E E E

 EDITOR
EDITORJEFFREY
EDITOR NAME
VOAS
NIST; [email protected]
Affiliation;

TABLE 1. Deep Web access control techniques.

Deep Web content Access control techniques
Private Web Private websites, such as intranets with public-facing webpages, typically require registration and login
using password or other authentication mechanisms to gain access to the private, more protected, side of
the website.

Contextual Web Elements of value can be discovered through a history of navigation across websites with common
contextual threads. For example, a unique semantic identity can be linked to an individual based on that
person’s online activity.

Dynamic content A dynamic page appears as a hidden response to a specific query or through submission of a specific element
or set of elements on a form. In either case, the resulting text fields are hard links to discover, much less
navigate, without direct reference to a domain.

Limited access Many websites use a mechanism to limit access to or prevent duplication of their content.
content » The Robots Exclusion Standard or the Robot Standard serves to discourage searching.
» A Completely Automated Public Turing Test to tell Computers and Humans Apart (CAPTCHA) requires
users to mimic a random code to assure they aren’t robots.
» A no-store directive serves to prohibit creating cached copies.

Non-HTML content The World Wide Web depends on Hypertext Markup Language (HTML) to perpetuate linkages. Non-HTML
pages are hard to discover and access, as the accepted links are absent.
» Textual content encoded as images, video fi les, or similar visual fi le formats, not discoverable via
search engines, are also difficult to isolate by other means.
» Scripted content involves links produced by JavaScript that are only accessible through links produced
by JavaScript or content that is dynamically downloaded from webservers via Flash or Ajax solutions.
» Specialized software, such as The Onion Router (TOR) or the Invisible Internet Project (I2P)
anonymous peer-to-peer distributed communication network, are required to access content not
otherwise discoverable on the WWW or Internet.

Unlinked content Not all HTML pages contain external links.

» Websites typically contain links from other websites, known as backlinks or in(bound) links. The
number and quality of backlinks are a major factor in determining a website’s ranking in search
engine results. However, search engines don’t usually detect all backlinks. In addition, not including
backlinks can prevent search engines and web crawling programs from discovering and indexing
website content.
» Web archival services can reveal now-defunct webpages across their history. Websites such as the
Wayback Machine (archive.org/web) allow viewing of old and often obsolete webpages that are often
no longer accessible by today’s search engines.

known as the Deep, Hidden, or Invisi- extortion; pedophiles circulating child organized, the Dark Web lacks an
ble Web, tends toward security by ob- pornography; drug, arms, and human ethos except, perhaps, that of “honor
scurity. As such, search and direct ac- traffickers; terrorists spreading propa- among thieves.” Trade is anonymous:
cess aren’t as straightforward as is the ganda, recruiting fighters, and plan- unknown buyers and sellers often
case in the WWW. Table 1 describes the ning attacks; digital media pirates; transact business using bitcoin and
wide range of techniques used to con- and cybermercenaries for rogue-state other crypto currencies. Ironically,
trol access to Deep Web holdings. intelligence services—communicate however, the Dark Web is readily ac-
Embedded within the Deep Web with one another and trade in hacking cessible via The Onion Router (TOR)—
is the Dark Web or Dark Net. It’s here tools, malware, ransomware, and var- freely downloadable, open source
that bad actors of all stripes—script ious illegal goods and services. This software that assures user anonymity
kiddies out to deface websites; pro- underground market is vast enough by disguising actual IP addresses (see
fessional hackers who break into cor- to contain its own search engines, Figure 1).3
porate and government networks to community forums, and rating sys- The Dark Web is a hub of botnet
steal data, wreak havoc, and commit tems just like the WWW. While highly activity. According to the most recent

APRIL 2017 101

CYBERTRUST

administrator of the online criminal attention in recent years highlight the

marketplace Silk Road, while he was Dark Net’s role as a breeding ground of
logged into the site on a laptop through cybercrime, which is becoming ever
a temporarily encrypted TOR connec- more destructive and costly. A 2014
tion over the library’s public Wi-Fi sys- report by the Center for Strategic and
tem. Since the site’s launch in January International Studies estimated the
2011, more than 100,000 buyers had annual losses to the global economy
used it to conduct $1.2 billion worth of from cybercrime to be $445 billion,12
bitcoin transactions for illegal drugs but a 2015 study by Jupiter Research
and other unlawful goods and services projected that, with the rapidly in-
ranging from pirated media to forged creasing digitization of consumer and
documents to murder for hire.5 Ulbricht business data, those costs will more
later received a life sentence and was or- than quadruple by 2019.13
dered to pay more than $180 million in In response to this growing threat,
restitution for an array of felonies.6 both governments and companies are
There have been other high-profile investing considerably more money in
incidents. In November 2014, EU and cybersecurity products, services, and
US police agencies seized hundreds of research. Worth $3.5 billion in 2004,
TOR “.onion” domains used by mul- the global cybersecurity market is ex-
tiple illegal drug markets, including pected to reach $120 billion this year,14
Silk Road 2.0—which emerged on with cumulative spending to eclipse​
the Dark Web shortly after Ulbricht’s $1 trillion over the next five years.15
arrest7—­a nd other black-market oper- Traditionally, practical security
Figure 1. A metaphorical view of the ations and arrested 17 people in Opera- solutions have focused on protecting
Internet. The Onion Router (TOR) provides tion Onymous.8 In February 2015, the endpoint devices such as desktops, lap-
easy access to the Dark Web while also FBI seized a server for a TOR-hidden tops, tablets, point-of-sale terminals,
protecting users’ anonymity. child porn site called Playpen and de- bar-code readers, and smartphones
ployed malware to reveal the true IP from attack when connected to the In-
addresses of the site’s 215,000 users, ternet and other networks. Such solu-
Imperva Incapsula Bot Traffic Re- resulting in more than 50 prosecu- tions include ­a ntivirus/­a ntimalware
port (www.incapsula.com/blog/bot tions to date.9 In another recent case, protection, intrusion detection and
-traffic-report-2016.html), bots com- an international task force took down prevention, patch distribution, a fire-
prised 52 percent of Internet traffic in the Avalanche syndicate, a global traf- wall, application and device manage-
2016, with 29 percent having malicious ficker in Botnet malware, in a series of ment, network access control, URL
aims such as distributed denial of ser- raids on 1 December 2016 after 4 years blocking, email server protection,
vice (DDoS). Most alarmingly, 94.2 of painstaking surveillance.10 Agents directory integration, automated
percent of domains surveyed experi- from 30 countries arrested 5 kingpins; backup, password management, file-
enced at least one bot attack within a confiscated 37 servers; took more than level encryption, vulnerability scan-
90-day period. Meanwhile, bots with 200 others offline; and seized, blocked, ning, and incident reporting. Available
latent payloads, such as the more than or disrupted more than 800,000 do- tools vary according to an organiza-
350,000 automated Twitter accounts mains. Avalanche had used more tion’s size and resources and can be
making up the “Star Wars” botnet,4 than 20 families of malware to infect managed and operated by in-house IT
are also surfacing from the depths of victims in 180 countries, causing hun- staff or third-party vendors. The global
the Dark Web. dreds of millions of dollars in damage. endpoint security market, valued at
While the Dark Web, as part of the Red hat hackers have also scored $11.6 billion in 2015, is estimated to
Internet, can’t be shut down, it can be hits. In February 2017, a member of grow to $17.4 billion by 2020.16
disrupted. Law enforcement agencies the vigilante group Anonymous took However, dark clouds are gathering.
have expended considerable resources 10,000 child porn sites offline—an esti- The sheer number of devices in
to penetrate the Dark Web and expose mated 20 percent of the Dark Web—and the emerging Internet of Things—­
its anonymous users, occasionally leaked users’ account information.11 projected to soar from over 17 billion
with success. in 2016 to about 30 billion in 202017—
On 2 October 2013, at a branch of the A CYBERSECURITY CRISIS suggests that trying to secure every
San Francisco library, federal agents The Ulbricht, Avalanche, and other device would be prohibitively ex-
apprehended Ross William Ulbricht, cases that have garnered international pensive and ultimately futile. While

102 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

endpoint protection will still have make discovery of who is hosting and perpetrators without running afoul of
value for some time, it’s unlikely to be visiting a given site next to impossible. civil liberties advocates.
a long-term solution. Sites will be far less discoverable and For this approach to work, however,
In addition, some researchers are will be accessible by invitation only.23 there must be a reliable baseline of in-
beginning to question the efficacy of In addition, bitcoin, once the crypto- formation on cybercriminal behavior.
the most straightforward endpoint currency of choice on the Dark Web, Over the years, many have called for
protection: antivirus software. They is being rapidly replaced by Monero, data on DDoS attacks, breaches, and
note that sometimes innately insecure which offers stealth mechanisms that other cybercrimes to be shared openly
antivirus packages aggressively attach prevent the indirect tracing of those for the benefit of all. Corporations,
themselves to other software such as conducting transactions—a vulnera- however, have been reluctant to admit
browsers and word processors, signifi- bility that has dogged bitcoin.24 The they’ve been attacked, or to acknowl-
cantly adding to system overhead.18 same open source tools touted by pri- edge the full extent of damage, for fear
Others claim that endpoint solutions vacy advocates to protect personal of loss of market share or reputation or
leave data residing within networks, data and to elude government censor- the imposition of further regulation.
including clouds, at risk, yet organi- ship and surveillance are also fueling Yet, making such data readily
zations continue to spend 10 times as widespread criminal activity. available is essential to establishing
much on endpoint security than on Given the Dark Web’s sophisticated cybercrime patterns in different eco-
fundamental data encryption.19 Still infrastructure and the superior tech- nomic sectors. Toward this end, IBM
others advocate for redesigning oper- nical capabilities of many of its deni- has opened its extensive cybersecurity
ating systems from the ground up to
protect networks by default.20
Efforts are underway to consider
whether the Internet itself, which has
Emerging machine learning, data mining,
evolved incrementally, should be com-
pletely re-architected. The National
and analytics tools are poised to become
Science Foundation, for example, is formidable offensive weapons in the fight
exploring such clean-state approaches against cybercrime.
in its Future Internet Design (FIND)
and Global Environment for Network- zens, traditional forensic techniques event dataset to public scrutiny.27 In
ing Innovations (GENI) initiatives.21 are unlikely to have a substantial or addition, various companies, secu-
However, such ambitious projects are lasting effect. However, emerging ma- rity firms, government agencies, and
in their infancy and, if ever realized, chine learning, data mining, and an- nonprofits issue regular reports on
won’t be implemented anytime soon. alytics tools are poised to become for- data breaches. Verizon, for example,
There are also proposals to better se- midable offensive weapons in the fight publishes an annual Data Breach Inves-
cure parts of the Internet—such as against cybercrime. tigations Report with lessons learned
eHealth networks22—through tar- Because the Internet is a large net- from a dataset that, as of 2016, con-
geted improvements in technology, work of networks with trillions of tained more than 100,000 incidents
policy, and digital literacy, but such inter­connected nodes, patterns indic- and 2,200 confirmed data breaches in
schemes have limited effectiveness. ative of potentially harmful or illegal 82 countries.28
activity—for example, botnets, mal- What’s needed is a well-secured,
PENETRATING ware distribution, and peer-to-peer file publicly accessible repository of
THE DARK WEB sharing—can be discovered through cyber­crime data, perhaps run by a
The root of many, if not most, cyber- advanced algorithms and visualization public–­private intermediary, to which
security threats lies not at the edge software.25 These tools can not only companies and other entities could
of the Internet but deep within it, in help target and disable Dark Net sites contribute without fear of negative
the Dark Web. Endpoint protection is but also provide legal evidence against consequences. This differs signifi-
thus doomed to fail because it only ad- identified offenders. Law enforcement cantly from a security practices rat-
dresses the symptoms of cybercrime, agencies often employ secret and con- ing system, previously proposed in
not the disease itself. troversial techniques to take down ille- this column, although the two could
However, the Dark Web is becoming gal sites and arrest their operators—in work synergistically. Promising ini-
harder to crack as privacy and encryp- some cases, foregoing prosecution to tiatives in this direction include the
tion techniques become more sophis- avoid revealing the technology they VERIS (Vocabulary for Event Record-
ticated. TOR is reportedly adding a used26—but AI and big data analytics ing and Incident Sharing) Community
layer of privacy later this year that will offer an alternative method to discover Database (vcdb.org), which collects

APRIL 2017 103

CYBERTRUST

and disseminates data from publicly crisis. Cybercrime is a cancer, spread- /sites/andygreenberg/2013/11/06
disclosed breaches in an open format ing from the Dark Web into the rest of /silk-road-2-0-launches-promising-a
from various government agencies, the Internet. Eradicating this disease -resurrected-black-market-for-the
media reports, and press releases, will require understanding dynamic, -dark-web/#7280363161c5.
and Gemalto’s Breach Level Index nonlinear network mechanics to pre- 8. A. Greenberg, “Global Web Crack-
(breachlevelindex.com). vent sick cells from clustering into down Arrests 17, Seizes Hundreds
Beyond the goal of detecting and malignant growths that threaten to of Dark Net Domains,” Wired, 7 Nov.
gaining information about cybercrim- stifle the exchange of goods and ser- 2014; www.wired.com/2014/11
inals hiding in the Dark Web, there’s vices worldwide. It ultimately calls for /operation-onymous-dark-web-arrests.
the question of what to do about exploiting advances in big data min- 9. D. Kravets, “Playpen Moderator
them. It’s impractical to root out ev- ing and analytics to create automated Sentenced to 20 Years in Prison,” Ars
ery perpetrator—investigations are mechanisms that systematically iden- Technica, 7 Feb. 2017; arstechnica
time-consuming and expensive and tify and eliminate cybercriminals. .com/tech-policy/2017/02/moderator
often require simultaneous raids by -for-darknet-child-porn-site-playpen
multiple law enforcement agencies at REFERENCES -gets-20-years.
locations around the world as well as 1. “Worldwide Retail Ecommerce Sales 10. J. Greuel, “It Took 4 Years to Take
costly, lengthy legal proceedings. In Will Reach $1.915 Trillion This Year,” Down ‘Avalanche,’ a Huge Online
many cases, the criminal enterprise eMarketer, 22 Aug. 2016; www Crime Ring,” Wired, 2 Dec. 2016;
itself is small but, because of its huge .emarketer.com/Article/Worldwide www.wired.com/2016/12/took
online reach, does far more extensive -Retail-Ecommerce-Sales-Will-Reach -4-years-take-avalanche-huge
economic damage than comparable -1915-Trillion-This-Year/1014369. -online-crime-ring.
syndicates in the pre-Internet days. 2. M.K. Bergman, “The Deep Web: 11. A. Verma, “20% of the Dark Web
Consequently, we might have no Surfacing Hidden Value,” J. Electronic Taken Down by Hacker, Here’s How
alternative than to fight fire with fire Publishing, vol. 7, no. 1, 2001; quod.lib He Did It,” Fossbytes, 6 Feb. 2017;
and employ the same tactics used by .umich.edu/j/jep/3336451.0007.104 fossbytes.com/20-dark-web-taken
Dark Web sites against them, includ- %20?view=text;rgn=main. -anonymous-hackers.
ing DDoS attacks and malware infiltra- 3. M. Chertoff and T. Simon, The Impact 12. Center for Strategic and Int’l Studies,
tion. This approach, however, would of the Dark Web on Internet Governance Net Losses: Estimating the Global Cost
require carefully crafted guidelines and Cyber Security, Centre for Int’l of Cybercrime; Economic Impact of Cy-
to avoid ensnaring legitimate users Governance Innovation and Cha- bercrime II, June 2014; www.mcafee
or causing other unintended negative tham House, Feb. 2015; www.our .com/us/resources/reports/rp
consequences. Although most Dark internet.org/sites/default/files -economic-impact-cybercrime2.pdf.
Web content is illicit,29 not all TOR us- /publications/GCIG_Paper_No6.pdf. 13. J. Moar, The Future of Cybercrime &
ers are cybercriminals; journalists, po- 4. “Cybersecurity Experts Uncover Security: Financial & Corporate Threats
litical activists, and citizens in coun- Dormant Botnet of 350,000 Twitter & Mitigation 2015–2020, Juniper Re-
tries with extreme censorship also use Accounts,” MIT Technology Rev., 20 search, 5 Dec. 2015; www.juniper
the software to provide anonymity. Jan. 2017; www.technologyreview research.com/researchstore/strategy
.com/s/603404/ cybersecurity -competition/cybercrime-security
-experts-uncover-dormant-botnet /financial-corporate-threats

W
ith the Internet’s explosive -of-350000-twitter-accounts. -mitigation.
growth, vast, intertwined 5. D. Segal, “Eagle Scout. Idealist. Drug 14. A. Ross, “Want Job Security? Try
networks now underlie ev- Trafficker?,” The New York Times, 18 Online Security,” Wired, 25 Apr. 2016;
ery facet of life, from commerce to en- Jan. 2014; www.nytimes.com/2014 www.wired.co.uk/article
tertainment to communication. Such /01/19/business/eagle-scout-idealist /job-security-cybersecurity-alec-ross.
networks are continually changing, -drug-trafficker.html. 15. S. Morgan, Cybersecurity Market
making it difficult to predict their evo- 6. A. Greenberg, “Silk Road Creator Report: Q 1 2017, Cybersecurity Ven-
lution. This reality can be unsettling— Ross Ulbricht Sentenced to Life in tures, 17 Feb. 2017; cybersecurity
even scary—when applied to activity Prison,” Wired, 29 May 2015; www ventures.com/cybersecurity
driven by humanity’s darker side. .wired.com/2015/05/silk-road-creator -market-report.
In dealing with cybercrime, the -ross-ulbricht-sentenced-life-prison. 16. Endpoint Security Market by Solution
security community must rethink 7. A. Greenberg, “‘Silk Road 2.0’ (Anti-Virus, Antispyware/Antimal-
its approach. Endpoint protection is Launches, Promising a Resurrected ware, Firewall, Endpoint Device Control,
important but will never address the Black Market for the Dark Web,” Intrusion Prevention, Endpoint Appli-
source of the growing cybersecurity Forbes, 6 Nov. 2013; www.forbes.com cation Control), Service, Deployment

104 COMPUTER  W W W.CO M P U T E R .O R G /CO M P U T E R

 Type, Organization Size, Vertical, and Concealing Their Source Code,” Ars
GEORGE HURLBURT is chief sci-
Region—Global Forecast to 2020, TC Technica, 9 Jan. 2017; arstechnica­
entist at STEMCorp, a nonprofit that
2287, Marketsand­Markets, Nov. 2015; .com/tech-policy/2017/01/feds
works to further economic devel-
www.marketsandmarkets.com -may-let-playpen-child-porn
opment via adoption of network
/Market-Reports/endpoint-security -suspect-go-to-keep-concealing
science and to advance autonomous
-market-29081235.html?gclid -their-source-code.
technologies as useful tools for hu-
=COCym_LGl9ICFQQvaQodI14Nfg. 27. C. Barlow, “Where Is Cybercrime Re-
man use. He is engaged in dynamic,
17. A. Nordrum, “Popular Internet of ally Coming From?,” TED Talk, Nov.
graph-based Internet of Things
Things Forecast of 50 Billion Devices 2016; www.ted.com/talks/caleb
architecture. Hurlburt is on the edi-
by 2020 Is Outdated,” IEEE Spectrum, _barlow_where_is_cybercrime
torial board of IT Professional and is
18 Aug. 2016; spectrum.ieee.org _really_coming_from.
a member of the board of governors
/tech-talk/telecom/internet/popular 28. 2016 Data Breach Investigations Re-
of the Southern Maryland Higher
-internet-of-things-forecast-of-50 port, Verizon, 2016; www.verizon
Education Center. Contact him at
-billion-devices-by-2020-is-outdated. enterprise.com/verizon-insights-lab
[email protected].
18. S. Anthony, “It Might Be Time to Stop /dbir.
Using Antivirus,” Ars Technica, 27 29. C. McGoogan, “Dark Web Browser
Jan. 2017; arstechnica.com Tor Is Overwhelmingly Used for
/information-technology/2017/01 Crime, Says Study,” The Telegraph,
/antivirus-is-bad. 2 Feb. 2016; www.telegraph.co.uk Read your subscriptions
19. P. Kuper, “The State of Security,” /technology/2016/02/02/dark-web through the myCS
publications portal at
IEEE Security & Privacy, vol. 3, no. 5, -browser-tor-is-overwhelmingly
http://mycs.computer.org
2005, pp. 51–53. -used-for-crime-says-study.
20. P A. Loscocco et al., “The Inevitabil-
ity of Failure: The Flawed Assump-
tion of Security in Modern Comput-
ing Environments,” Proc. 21st Nat’l
Information Systems Security Conf.
(NISSC 98), 1998, pp. 303–314.
21. A. Feldmann, “Internet Clean-Slate

got flaws?
Design: What and Why?,” ACM SIG-
COMM Computer Communication Rev.,
vol. 37, no. 3, 2007, pp. 59–64.
22. Safety and Security on the Internet:
Challenges and Advances in Member
States, World Health Org., 2011; www
.who.int/goe/publications/goe
_security_web.pdf.
23. A. Greenberg, “It’s About to Get Even
Easier to Hide on the Dark Web,”
Wired, 20 Jan. 2017; www.wired.com
/2017/01/get-even-easier-hide-dark
-web.
24. A. Greenberg, “Monero, the Drug
Dealer’s Cryptocurrency of Choice, Is
on Fire,” Wired, 25 Jan. 2017; www Find out more and get involved:
.wired.com/2017/01/monero-drug
-dealers-cryptocurrency-choice-fire.
cybersecurity.ieee.org
25. E. Nunes et al., “Darknet and
Deepnet Mining for Proactive
Cybersecurity Threat Intelligence,”
arXiv:1607.08583, 2016; arxiv.org
/pdf/1607.08583.pdf.
26. C. Farivar, “Feds May Let Playpen
Child Porn Suspect Go to Keep

APRIL 2017 105