Conversations At The Intersection Of Technology, CyberSecurity And Society.
Garth Griffin | Maurits Lucas
Sean Martin | Marco Ciappelli
ITSPmagazine’s Unusual Gatherings XXIX:
Are You — Yes We're Talking To You, Society — Afraid Of The Dark?
Ask most people, and they will likely tell you that the Dark Web consists mostly of underground criminal activity and stolen or illegal goods for sale. However, InfoSec professionals do not like to call it the Dark Web as this term can be misleading given that there could be other things in this space beyond what the initial negative picture one's perception may paint. But, I guess that this Dark Web label tells a much better story than the Onion Web, which is how this part of the Internet is built — or rather, accessed. So, this label sticks.
I suppose, if you think about it, "the dark forest" sets a much more dramatic tone than "the wooded area with many trees; trees so thick that it covers the light making it hard to see in it even during the day."
As you can see, words that evoke a certain mood are often much more effective when trying to capture one's attention than the more accurate collection of words that could be used to describe things. But, in today's podcast, we are doing precisely that: we are demystifying this story of the Dark Web — or are we?
To kick things off, let's start with the story of Little Red Riding Hood where she heads off into the forest — I mean, the Dark Web. Little Red Riding Hood is on a mission to bring some stuff to her grandma and, despite the recommendation from her cyber-aware mom, she decides to take a shortcut. This decision would prove to be a huge mistake as she will get phished by some impostor wolf posing as her grandma. This imposter will steal her credentials and then eat her alive — a lousy day for Little Red Riding Hood, for sure — perhaps a decent-enough day for the fake grandma though as they have a full belly and a set of credentials to go “info-shopping” with.
Thankfully, Little Red Riding Hood prepared herself for this unpleasant reality by bringing with her a lumberjack (or a hunter, depending on the version of the story 3.2 or 4.5) — essentially an "antivirus" in this context — that saved the day. In this version of the story, the big bad wolf is killed, and the lumberjack (or hunter) pulls Little Red Riding Hood back to life from a working backup (hip-hip-hooray for disaster recovery!). All is well that ends well, and the lumberjack travels to Fiji with grandma where they lived happily ever after.
Little Red Riding Hood, on the other hand, took her knowledge of this experience to enhance the rest of her life's journey, finding she could deliver packages faster than anyone else through this now-wolfless wooded shortcut. She started with books, then all sorts of odds and ends, and ultimately went on to conquer space. Or something like that. The story is a little fuzzy as the cloud storage service where this story is currently stored has been tampered with over the years...
But, just as the woods in this well-known fairy tale went darker and scarier, once Hollywood grabbed the story, you might find that maybe this "Dark Web" wasn’t that dark after all. Or was it?
To help us tell you the truth of the real Dark Web we are having today's conversation not with the Brothers Grimm but with Garth Griffin, Director of Data Science at Recorded Future, the author of the blog post that triggered this conversation, and Maurits Lucas, Director of Intelligence Solutions at Intel 471, a long-time friend of ITSPmagazine, and an expert in investigating cybercriminals and their nefarious activities.
Things we discussed and learned:
Listen to your Mom! Always!
The Dark Web is not as dark, scary, or as big as you may picture it.
So what is this Other Web? Is it well-defined or vague because of the way we refer to it? Isn't it made up of a different shade of gray instead?
What are "Onion" sites and how do they associate with the so-called Dark Web?
You may find that you picture the Dark Web like an alleyway not relegated to only a criminal underground community; instead, you might also see kids playing there as well.
All-in-all, the Dark Web isn't a place filled with only monsters; other creatures often hide there for reasons that are way more honorable and noble than that of thieves and assassins — you may find people and professionals there that require the anonymity of this space as they work to defend their rights and the rights of others.
Should regular businesses and regular people that do not even go into the Dark Web be worried about it at all? Or, should they be aware of the bad things that can happen to them in the clear web instead? Yes, is the answer — if you focus on this and think the clear web is safe you might walk into a sunny, and yet much more dangerous, place than this.
It is good to know what is risky out there so you can avoid it if you do not have to venture in it to achieve your goal. We, of course, mean noble intentions.