Analytics // Security Monitoring
11/1/2013
09:57 PM
50%
50%

Monitoring Where Search Engines Fear To Tread

The deepweb -- anonymized networks that are not indexed by search engines -- are hard to monitor, yet companies should seek out signs in their networks

The Tor Onion Routing network has long been a favorite way for privacy-seeking online users to add a series of anonymizing layers between themselves and sites on the Internet. From hackers and dissidents to companies and governments seeking to cloak their activities online, Tor has gained a significant following of users.

Yet anonymizing networks, or darknets, are also used by online criminals looking to hide their tracks. Two recent incidents underscore the appeal: One, the Silk Road, an online bazaar of drugs and illegal goods, was operated as a hidden site until the FBI arrested the alleged owner of the site in San Francisco in early October. The other, a recent botnet known as Mevade, or Sefnit, routed its command-and-control traffic through the Tor network to hide the locations of infected nodes. The botnet traffic had a tremendous impact on Tor, driving its measure of simultaneous users from approximately 800,000 to more than 5 million, according to statistics on the Tor Project site.

Companies need to watch their networks for signs of the presence of darknets and for traffic to anonymous sites created to evade search engine crawlers, known as the deepweb, says Jon Clay, a security technology expert with antivirus firm Trend Micro.

"The criminals are using these techniques," he says. "The question that an organization needs to look at, and discuss among themselves, is whether these communications channels, such as the TOR network, is something that employees should be using internally. If not, then you need to flag that and investigate any detections."

The recent takedown of Silk Road has spotlighted the use of the deepweb sites and hidden services for illegal activities. In a report published following the arrest of the suspected operator of Silk Road, Trend Micro stressed that Tor is only the best known of the deepweb networks. Other networks and technologies for anonymizing communications and creating hidden services include the Invisible Internet Project (I2P), Freenet, and alternative domain roots.

Each technology has legitimate uses. Tor allows users to hide the source of their traffic, hidden services are used by many journalists as a drop box for anonymous sources, and alternative domain roots have offered top-level domains for certain groups of people, such as Kurdish, Tibetan, and Uyghur ethnic groups. The technologies serve a legitimate role by giving people in oppressive regimes the ability to communicate.

[The Tor-based 'LazyAlienBiker' -- a.k.a. Mevade -- botnet's attempt to evade detection using the anonymous Tor network ultimately exposed it. See How The Massive Tor Botnet 'Failed'.]

Whether a company should block deepweb sites and darknets is a discussion for management, but each company should look for signs of the anonymizers to know whether they have a problem, says Wade Williamson, a senior security analyst with network-security firm Palo Alto Networks. The first step should be a survey of systems on the network to look for such applications, he says.

"If you see Tor or one of these other anonymizing networks on a computer in your network, that should be a canary in the coal mine," Williamson says. "You at least need to investigate at that point."

Many cybercriminals tend to create their own anonymization networks, which are fairly easy to detect and block, once analyzed by security firms. The team behind Tor, which was originally created by the U.S. Naval Research Laboratory to protect government communications, has made that technology much harder to find.

While some groups and threat-intelligence firms compile lists of Tor relays and exit nodes to allow companies to block communications with those sites, unlisted bridge relays can act as intermediaries to bypass such blocking. The Tor project has even created obfuscated bridge relays to defeat techniques for inspecting traffic and blocking Tor-like traffic.

In the end, companies serious about blocking any sort of anonymizing traffic may want to only allow IP addresses and domains with known, good reputations, says Trend Micro's Clay.

"You want to have as much information as you possibly can, and if you don't know if an IP or a domain is bad, you might block it," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8015
Published: 2014-12-22
The Sponsor Portal in Cisco Identity Services Engine (ISE) allows remote authenticated users to obtain access to an arbitrary sponsor's guest account via a modified HTTP request, aka Bug ID CSCur64400.

CVE-2014-8017
Published: 2014-12-22
The periodic-backup feature in Cisco Identity Services Engine (ISE) allows remote attackers to discover backup-encryption passwords via a crafted request that triggers inclusion of a password in a reply, aka Bug ID CSCur41673.

CVE-2014-8018
Published: 2014-12-22
Multiple cross-site scripting (XSS) vulnerabilities in Business Voice Services Manager (BVSM) pages in the Application Software in Cisco Unified Communications Domain Manager 8 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug IDs CSCur19651, CSCur18555, CSCur1...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.