Analytics // Security Monitoring
11/1/2013
09:57 PM
Connect Directly
RSS
E-Mail
50%
50%

Monitoring Where Search Engines Fear To Tread

The deepweb -- anonymized networks that are not indexed by search engines -- are hard to monitor, yet companies should seek out signs in their networks

The Tor Onion Routing network has long been a favorite way for privacy-seeking online users to add a series of anonymizing layers between themselves and sites on the Internet. From hackers and dissidents to companies and governments seeking to cloak their activities online, Tor has gained a significant following of users.

Yet anonymizing networks, or darknets, are also used by online criminals looking to hide their tracks. Two recent incidents underscore the appeal: One, the Silk Road, an online bazaar of drugs and illegal goods, was operated as a hidden site until the FBI arrested the alleged owner of the site in San Francisco in early October. The other, a recent botnet known as Mevade, or Sefnit, routed its command-and-control traffic through the Tor network to hide the locations of infected nodes. The botnet traffic had a tremendous impact on Tor, driving its measure of simultaneous users from approximately 800,000 to more than 5 million, according to statistics on the Tor Project site.

Companies need to watch their networks for signs of the presence of darknets and for traffic to anonymous sites created to evade search engine crawlers, known as the deepweb, says Jon Clay, a security technology expert with antivirus firm Trend Micro.

"The criminals are using these techniques," he says. "The question that an organization needs to look at, and discuss among themselves, is whether these communications channels, such as the TOR network, is something that employees should be using internally. If not, then you need to flag that and investigate any detections."

The recent takedown of Silk Road has spotlighted the use of the deepweb sites and hidden services for illegal activities. In a report published following the arrest of the suspected operator of Silk Road, Trend Micro stressed that Tor is only the best known of the deepweb networks. Other networks and technologies for anonymizing communications and creating hidden services include the Invisible Internet Project (I2P), Freenet, and alternative domain roots.

Each technology has legitimate uses. Tor allows users to hide the source of their traffic, hidden services are used by many journalists as a drop box for anonymous sources, and alternative domain roots have offered top-level domains for certain groups of people, such as Kurdish, Tibetan, and Uyghur ethnic groups. The technologies serve a legitimate role by giving people in oppressive regimes the ability to communicate.

[The Tor-based 'LazyAlienBiker' -- a.k.a. Mevade -- botnet's attempt to evade detection using the anonymous Tor network ultimately exposed it. See How The Massive Tor Botnet 'Failed'.]

Whether a company should block deepweb sites and darknets is a discussion for management, but each company should look for signs of the anonymizers to know whether they have a problem, says Wade Williamson, a senior security analyst with network-security firm Palo Alto Networks. The first step should be a survey of systems on the network to look for such applications, he says.

"If you see Tor or one of these other anonymizing networks on a computer in your network, that should be a canary in the coal mine," Williamson says. "You at least need to investigate at that point."

Many cybercriminals tend to create their own anonymization networks, which are fairly easy to detect and block, once analyzed by security firms. The team behind Tor, which was originally created by the U.S. Naval Research Laboratory to protect government communications, has made that technology much harder to find.

While some groups and threat-intelligence firms compile lists of Tor relays and exit nodes to allow companies to block communications with those sites, unlisted bridge relays can act as intermediaries to bypass such blocking. The Tor project has even created obfuscated bridge relays to defeat techniques for inspecting traffic and blocking Tor-like traffic.

In the end, companies serious about blocking any sort of anonymizing traffic may want to only allow IP addresses and domains with known, good reputations, says Trend Micro's Clay.

"You want to have as much information as you possibly can, and if you don't know if an IP or a domain is bad, you might block it," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Robert Lemos is a veteran technology journalist of more than 16 years and a former research engineer, writing articles that have appeared in Business Week, CIO Magazine, CNET News.com, Computing Japan, CSO Magazine, Dark Reading, eWEEK, InfoWorld, MIT's Technology Review, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.