Dark Web.

What is the dark web?

CISA describes the dark web as overlay networks that use the internet and require specific software or credentials to access. It separates three layers. The surface web is indexed by search engines and needs no special software. The deep web is not indexed by search engines and needs special software or credentials, for example an internal company portal or a bank account page. The dark web needs the Tor Browser, may need extra credentials, and its Tor addresses end in .onion.

What is Tor?

CISA explains that Tor is built for private browsing and site hosting. It routes traffic through several nodes and encrypts it at every step. The layers of encryption are compared to an onion, which is where the name The Onion Router and the .onion ending come from.

Is the dark web the same as crime?

No. CISA says many people use the dark web for fully legitimate reasons, such as political dissidence and private communication. CISA also says many people use it because of the cybercriminal communities that thrive there. CISA adds that some criminal communities use ordinary websites or other privacy-focused hosting, and that people sometimes call those communities “the dark web” in everyday speech too.

What happens there?

CISA describes a large ecosystem for cybercrime and cybercrime as a service. Sites that sell payment cards can hold very large stocks, and some sell full identity packs used for identity theft. CISA separates two kinds of site:

• Forums are discussion focused. They may be used to coordinate sales, and sales there are hard to track.
• Marketplaces work like online shops. Buyers can rate sellers, and the site usually holds payment in escrow.

Some sites are invite only, charge an entry price, or ask a new member to be vouched for.

What is the life cycle of stolen data?

CISA says stolen data tends to filter down through communities. It can be traded between close associates, then posted in closed forums, then on larger marketplaces, and finally posted for free on forums and paste sites. Data is sold and resold many times.

Why does it matter?

Stolen data can be traded there for a long time, so a company can have its information in circulation without knowing it. Because data passes from closed groups to open ones, an early sighting can give a company time to react. For example, a company that sees its staff logins on offer can reset those accounts. Security researchers use context about sites, actors and markets to judge what they find, because CISA notes that scams between users are common. A claim of a leak is a reason to check, not proof.

How do you keep watch?

CISA warns not to visit these sites from a corporate network. Decide what you want to find, such as your domains, brand names and staff names. Then rely on a service or trained analysts with safe access. When something appears, check your own systems and reset any exposed accounts.

Is the dark web the same as the deep web?

No. The deep web is everything not indexed by search engines, including ordinary private pages. The dark web is a smaller part that needs tools such as Tor.

Related pages in the Knowledge Hub

• Leaked credential monitoring
• Data leak detection