Data About Your Company On The Dark Web
Any company wishing to stay on top of its security obligations will find getting a window into what happens on the Dark Web will prove invaluable.
The Dark Web, the part of the web not indexed by search engines such as Google and used for nefarious purposes, isn’t actually that big. One estimate suggests are only around 7,000 sites on the TOR network, while the FBI has said there are only around 800 criminal Internet forums worldwide.
But while there may not be massive amounts of these forums, it is where the vast majority of underhanded online activity takes place.
Luckily, a new wave of companies such as Webhose, RepKnight, Terbium labs, Massive, Recorded Future, Sixgill, Hold Security, and AlienVault are adding a new layer to traditional threat intelligence and trying to make the dark web as easily searchable as any normal, Google-able website. But what value does dark web monitoring bring to organisations and their security posture?
Why should companies monitor the Dark Web?
The main benefit to monitoring the dark web is that it can give you early warning signs that you’ve been compromised, well before you may have found any tell-tale signs internally. The average time to discover a breach in systems is now 57.5 days, according to FireEye, but as soon as a criminal has exfiltrated data they are likely trying to hawk your wares online.
Much of the illicit activity that goes on is either talking about exchanging questionable goods on forums or actually exchanging ill-gotten information on sites such as PasteBin, which means there can be plenty of indicators that an organisation has been compromised.
Is your company being spoken about on dark web forums, or are some of your employees’ (or worse, customers’) email addresses being shared on a data dump site? It could well be time to investigate your systems and look for indications of a breach.
“The go-to use case is companies wanting to know if they're being mentioned in the context of vulnerabilities,” says Webhose CEO, Ran Geva. “User accounts or vulnerabilities being sold on the dark web -- you want to know if you're exposed.”
Spun out of Israel-based social media monitoring service Buzzilla in 2016, Webhose takes information from both the dark and regular web and turns that into a machine-readable data feed (usually JSON or XML) that can then be parsed and analysed. Its customers include Salesforce, IBM, and departments within the US government.
One use case Geva is particularly keen on is employing Webhose to track cryptocurrency payments relating to illegal activity.
Given that all Bitcoin payments are housed within the OpenLedger, it can be relatively easy to identify which accounts have been associated with criminal dealings, for example the exchange of your company’s data, which can then be used as evidence in the future.
“Once I have a wallet address, I can explore what address sent money to this address, anyone who has sent money to this account is liable.”
While actually identifying owners of wallets can be difficult, Geva says many inexperienced criminals use public exchanges such as Coinbase where you have to make your identity known, leaving a breadcrumb trail for investigators.
Dark web monitoring can also help your security teams be more proactive. A study by Recorded Future found 75% of all disclosed vulnerabilities appear online before they’re listed in the National Vulnerability Database (NVD), on average a week earlier. The sooner a vulnerability is known to your company, the sooner you can fix it.
A 2016 report by Gartner suggested disgruntled employees are being recruited by criminals on the dark web to help use their insider knowledge to inflict damage on their employers and get revenge for whatever slight they’ve suffered. Being aware of any potential insider threat before they’ve acted could save a company a heap of trouble.
What kind of data should companies be looking for on the Dark Web?
Companies should be looking for data related to their organisation. At the very top level, this can simply be a mention of the company in general dark web communications, as being mentioned in criminal forums could often mean criminals are either interested in targeting you or perhaps already have your data.
The next stage beyond that is to look for internal information. This can include usernames, emails, but also company-related documents or personally identifiable information of employees or customers. Searching information-dump sites such as Pastebin is especially important for this part.
The third aspect of dark web monitoring is actively monitoring for exploit kits, malware, and other potential threats that aren’t specifically targeting your organization but could pose a threat.
“Enhancing visibility and gathering relevant, actionable intelligence from dark web sources helps security teams strengthen their security posture and put in place appropriate defense measures before adversaries can strike,” says Jose Miguel Esparza, Head of Threat Intelligence at Blueliv.
Companies of all shapes, sizes, and industries can find value in scouring the dark web. FishTankBank, a UK eCommerce site dedicated to selling aquariums and related equipment, began utilizing dark web monitoring after being hacked.
“As we dug into how the initial attack happened, we were informed that some of our sensitive data was posted on the dark web and this is likely where the hack originated from,” says owner Max Robinson. “We check for mentions of our brand and work with a consultant on a frequent basis so we can monitor it to help avoid any more issues like this from occurring.”
Combining deception technology and Dark Web monitoring
As with any new security trend, it is unlikely to be the magical silver bullet that renders your organisation impenetrable. It is merely another tool which may be helpful in the constant tit for tat between legitimate businesses and cyber criminals. And if used in conjunction with other security tools, it can be very useful indeed.
To augment dark web monitoring, companies can start to combine monitoring with deception technology and honey pots. These can come in the form of unique fake accounts within legitimate datasets which can act as a beacon in the noise of large data sets, or entirely fake data sets in decoy databases.
“These kinds of deception tactics are useful if the results are monitored effectively and analyzed to extract actionable conclusions,” says Blueliv’s Esparza. “It might help you in finding out what adversaries are doing with your stolen credentials and better understand the underground ecosystem.”
Criminals may already be moving away from the desktop Dark Web
In the same way the workforces of legitimate companies are becoming increasingly mobile-first, cyber-criminals are conducting more of their activities on the go. But this switch can make gleaning intelligence from the Dark Web harder.
A 2017 study by IntSights found a 30-fold increase in mobile dark web activity over the preceding 12 months, with the likes of Discord, Telegram, and WhatsApp being used to “trade stolen credit cards, account credentials, malware, drugs and to share hacking methods and ideas.”
The report claimed that Discord is “becoming the go-to-app for mobile Dark Web discussions”, while downloads of TOR’s mobile application, ORbot, stand at over 10 million.
“While the use of messaging apps for illicit activity has been on the rise for some time, the closure of Alphabay, Hansa and suspected compromise of Dream Market... has shaken confidence in more traditional dark web channels,” the report said.
This growing trend means the monitoring of criminal activity will become a more challenging task, admits the report, unless more advanced methods of data collection are developed.
“Cyber-criminals have been using instant messaging software like Jabber for years and using end-to-end encryption to avoid the interception of messages from third parties, so this is not really something new,” says Blueliv’s Esparza.
Radware security researcher Daniel Smith warns that while criminals constantly moving to new platforms is par for the course, it’s gaining the initial access that is the hard part, as once you’re in you can start to harvest information.
“In the case of discord and other apps, you need an invite to join. Other criminal forums on the Darknet sometimes require you to commit a crime before joining. That’s a major ethical barrier and most companies don’t want to cross the line.”
You Might Also Read:
What Is the Dark Web? Can You Access It?:
Is Your Data Being Sold On The Dark Web?:
