Dark Web Monitoring – Are you Safe?

Have some questions about the dark web and dark web monitoring? Seen your work email on https://haveibeenpwned.com/ ?

Concerns around your security and worried someone is going to lock your business down and ask for a ransom…?

Alright, let’s dig into Dark Web Monitoring and why it is and isn’t to be worried about.

What is the Dark Web?

The dark web is a part of the internet that isn’t indexed by search engines. You’ve no doubt heard talk of the “dark web” as a hotbed of criminal activity — and it is. Researchers Daniel Moore and Thomas Rid of King’s College in London classified the contents of 2,723 live dark web sites over a five-week period in 2015 and found that 57% host illicit material. 

You can buy credit card numbers, all manner of drugs, guns, counterfeit money, stolen subscription credentials, hacked Netflix accounts and software that helps you break into other people’s computers. Buy login credentials to a $50,000 Bank of America account for $500. Get $3,000 in counterfeit $20 bills for $600. Buy seven prepaid debit cards, each with a $2,500 balance, for $500 (express shipping included). A “lifetime” Netflix premium account goes for $6. You can hire hackers to attack computers for you. You can buy usernames and passwords.

But not everything is illegal, the dark web also has a legitimate side. For example, you can join a chess club or BlackBook, a social network described as the “the Facebook of Tor.”

What Happens if you go on the Dark Web?

When you access the dark web, you’re not surfing the interconnected servers you regularly interact with. Instead, everything stays internal on the Tor network, which provides security and privacy to everyone equally. Worth noting: Dark web website addresses end with. onion instead of the surface web’s .com

What is the Dark Web used for?

The darknets which constitute the dark web include small, friend-to-friend peer-to-peer networks, as well as large, popular networks such as Tor, Freenet, I2P, and Riffle operated by public organizations and individuals. Users of the dark web refer to the regular web as Clearnet due to its unencrypted nature. The Tor dark web or Onionland uses the traffic anonymization technique of onion routing under the network’s top-level domain suffix .onion.

Can the Dark Web be Monitored?

Since the dark web is constantly changing, no one can guarantee that they monitor 100% of the dark web and private forums. Dark Web Monitoring goes beyond easily accessible sites and marketplaces, infiltrating private forums, social web, deep web and dark web. No one can prevent all cybercrimes or identity theft.

Can you remove your information from the Dark Web?

No, you can’t pay to remove the ID from the dark web. About 36 per cent of consumers who have seen ads for “dark web monitoring” incorrectly believe that identity theft services can remove their personal information from the cyber underground marketplace.

How much of the Internet is the Dark Web?

The dark web is a subset of the deep web that is intentionally hidden, requiring a specific browser—Tor—to access, as explained below. No one really knows the size of the dark web, but most estimates put it at around 5% of the total internet.

What is sold on the Dark Web?

They function primarily as black markets, selling or brokering transactions involving drugs, cyber-arms, weapons, counterfeit currency, stolen credit card details, forged documents, unlicensed pharmaceuticals, steroids, and other illicit goods as well as the sale of legal products.

Who invented the Dark Web?

The dark web was actually created by the US government to allow spies to exchange information completely anonymously. US military researchers developed the technology, known as Tor (The Onion Router) in the mid-1990s and released it into the public domain for everyone to use.

What’s Tor?

Tor is free and open-source software for enabling anonymous communication by directing Internet traffic through a free, worldwide, volunteer overlay network consisting of more than seven thousand relays in order to conceal a user’s location and usage from anyone conducting network surveillance or traffic analysis.

Can I tell if my email has been hacked?

The following six signs indicate that your email account may have been compromised:

1. Your password has been changed

One of the most obvious signs of your email being hacked is the fact that you can’t sign into it. If your email password is rejected as incorrect and you didn’t change it, it’s a strong indication that someone else has altered it. One of the first things many hackers do is change your password to prevent you from logging in.

2. Mails in your inbox that you don’t recognise

Sometimes a hacker won’t change your password so you won’t notice that anything’s wrong. If you think something is not right, check your sent mail folder to see if there are messages there that you didn’t send. If you do find some, then you know a hacker probably has access to your account.
Another sign to look out for is for password reset emails that come from other websites and which you didn’t request. A hacker may use access to your email to try and change your password on other sites. Hackers understand that many people use the same password across different websites and by trawling through your inbox they can see which websites you regularly use such as Amazon for example.

3. You receive unexpected emails

Hackers that gain access to compromised email accounts will search for personal information such as who you bank with or credit card companies you use. It’s possible that some personal information is revealed such as user names and other identifying data like account numbers.
Fraudsters will use this information to create messages from your bank or credit card provider and they will incorporate personal data they find to give the messages a veneer of authenticity. They may even try to call you citing this information. This can make it difficult to determine whether the mail/call is genuine.
If in doubt, and the messages arrive out of the blue, don’t respond or call the bank to verify that they are trying to contact you or not as the case may be.

4. Different IP addresses show up on your log

This is a good way of determining whether someone is using your account. An IP address is essentially a digital address that reveals your physical location. Some email service providers have a tool that reveals your IP address and every time you log into your account the IP address is recorded.
For instance, if you have a Gmail account, scroll to the bottom of the page and in the far right corner, you will see, in very small font Details. Clicking on this reveals the IP address locations from which your account has been accessed. If you only access the account from home or work the IP address log will show the same address. If there are different IP numbers in the log, it means your account is also being accessed from another location.
If you don’t use a Gmail account, search the internet for your email providers name and how to locate IP addresses.

5. Are friends receiving spam messages from you?

If your friends tell you they’ve received spam from your email address, it’s safe to assume your security has been compromised and your email. You should then assume that your personal data is a risk and take the necessary steps to secure yourself (see list below).

6. The sky is clear

If there are no signs that your email account has been compromised that is all well and good. However, if you want to be absolutely certain you can check HaveIBeenPwned.com. This is a really useful tool that not only gives you a list of the top ten leading breaches (startling reading) but also allows you to see if your email account has been compromised in a data leak. You simply key in your email address and you’ll get an immediate answer.

Is have I been pwned safe?

The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you’re concerned about the intent or security, don’t use it.

What happens if I’ve been pwned?

If your email has been pwned, it means that the security of your account has been compromised. It could mean your passwords and email addresses have ended in the hands of cybercriminals. Hacking an account using your email address is possibly the first step of identity theft.

What can hackers do with your email address?

If hackers gain access to your email, they could have an open doorway to any number of other devices and accounts. They can use your email to reset other account passwords, gain access to credit information, or even delete accounts, such as social media profiles.

Dark Web Monitoring – What you need to know for your Business

Stolen user credentials (emails and passwords) found on the Dark Web can indicate that your company or a 3rd party application or website that your employees use has been compromised, so you can take immediate action. Cybercriminals traffic and buy stolen credentials so they can infiltrate your networks to steal your data. By monitoring the Dark Web for Threat intelligence about stolen user data associated with your company’s domains, you can be alerted when a compromise is detected, then respond to stop a potentially costly and widespread data breach.

SAAS BUSINESS APPLICATIONS INCREASE RISK

While web-based applications allow employees to do their jobs from almost anywhere, they also open your organization to risk. Payroll and HR platforms, CRM and Marketing Automation tools, travel sites, banking sites, and social media accounts are accessed by your employees many times throughout the day. Staffers may use their work email to log in to these sites every day, and human behaviour patterns guarantee that at least some of them are reusing passwords, potentially the same ones they use to log in to your network.

EMAIL MONITORING FOR HIGHLY TARGETED EXECS AND PRIVILEGED USERS

Your executives and administrative users often have greater access to systems, information, and sensitive data. If their personal email credentials are compromised, the attacker may be able to use social engineering to trick other employees into giving them access to corporate systems or reuse the same user credentials to gain access to them. Therefore, it’s important to monitor the personal email addresses of your executive and administrative users, in addition to their corporate email accounts.

EXTEND SECURITY TO THE SUPPLY CHAIN

Some cyberattacks against your company will come from exposures involving third-party vendors in your supply chain. Interwoven systems of vendors and partners present security risks as data is shared across networks. The growing need for cyber supply chain risk management has prompted forward-thinking organizations to add Dark Web monitoring to vendor due diligence.

QUICKLY PROVIDE YOUR IT SECURITY TEAM THREAT INTELLIGENCE

Your security teams are resource-constrained and focused on detecting and mitigating threats, rather than installing yet another new technology for monitoring. Dark Web ID takes just minutes to set up and will start showing compromise results right away. Reporting is flexible and can be integrated with other alerting and remediation platforms, with available API.

HOLISTIC VISIBILITY

By adding Dark Web ID monitoring to your security strategy, you’ll gain a more complete picture of your company’s security posture. You’ll have an early warning mechanism before a breach can occur, and invaluable data analytics to evaluate where employees may need security awareness training or where multi-factor authentication and single sign-on is beneficial.

Conclusion

If you have concerns about your businesses safety and are looking to put a monitoring solution in place, please give us a call today.