August 31st, 2018 by admin
What Is The Dark Web?
The Dark Web is a
hidden universe contained within the “Deep Web.” It is in a sub-layer of the Internet that’s hidden from surface internet search engines like Google, BING, and Yahoo. With their billions of searches a day, their results total only 0.04% of what is in the deep web.
The other 99.96% of the Web houses:
- Countless databases
- Private networks
- Academic networks
- Government networks
- and the Dark Web
If you wanted to measure the
Dark Web against the surface internet, what you and I use daily, it is estimated to be about 550 times larger than the surface Web and growing. Picture it like this:
As you look at that image, it can be intimidating. When an individual or group can operate anonymously, the sheer size of the Dark Web holds a wealth of stolen data and illegal activity.
Where Does Dark Web ID Find Your Data On The Dark Web?
Here is a short list of source locations and the descriptions where compromised data, credentials, passwords, sensitive client or patient information turns up:
- Dark Web Chatroom: discovered in a hidden IRC
- Hacking Site: exposed on a hacked Website or data dump site
- Secret Theft Forum: published within a hacking forum or community
- P2P File Leak: leaked from a Peer-to-Peer file sharing program or network
- Social Media Post: posted on a social media platform
- C2 Server/Malware: harvested through botnets or on a command and control (C2) server
How Was The Data Stolen or Compromised?
Here are a few
identified method used to capture or steal your data:
- Tested: the compromised data was tested to determine if it is live/active;
- Sample: the compromised data was posted to prove its validity;
- Keylogger or Phished: the compromised information was entered into a fictitious website or extracted through software designed to steal PII;
- 3rd Party Breach: the compromised data was exposed as part of a company’s internal data breach or on a 3rd party Website;
- Accidental Exposure: the compromised information accidentally shared on a Web, social media, or Peer-to-Peer site;
- Malicious / Doxed: the compromised data was intentionally broadcast to expose PII.
Are We Still At Risk When Employees No Longer Work For Us?
While employees may have moved on from your organization, their company-issued credentials can still be active and valid within the 3rd party systems they used while employed.
In many cases, the 3rd party compromised systems or databases that have been in existence for 10+ years are holding millions of “zombie” accounts that can be used to exploit your organization.
Finding any credentials from past employees
should be a wakeup call to confirm you’ve shut down any active internal and 3rd party accounts. Not doing so poses a threat to the exploiting of your company.
Should We Be Concerned If A Password Identified Does Not Meet Our Network Criteria?
What many employers overlook are when employees recycle their passwords. They do it throughout their work and personal networks. If your internal requirement is to have a capital letter and unique character or number; it’s a common practice for employees to use a password they are familiar using, because they don’t want to forget their password. They will add a capital letter, exclamation mark, a number sign. (Example: Exposed Password: cowboys, Variation: Cowboys!, Cowboys#1, #1Cowboys, and so on.)
Now that you know this, here’s what hackers do. They will run scripts using Metasploit frameworks (hacking and pen testing tools) to literally “brute force” their way into your unsuspecting system. As you can see, the employee’s swapping password habits can be the undoing of your company.
When Your Personal or Company Data Shows Up On The Dark Web, Can It Be Removed?
The reality is, once the data gets posted for sale on the Dark Web, it is quickly copied and then distributed (re-sold or traded) to any significant number of cybercriminals, and all within a short span of time.
It is generally impossible to remove data that has spread on the
Dark Web. Individuals whose PII showed up on the Dark Web, we would highly encourage them to enroll themselves and their company into an identity and credit monitoring service immediately.
Like this article? Check out,
Cybersecurity Risks (Problems/Fixes) and
Did You Know? Your DNA Can Be Hacked! Or
The What, The How, and The Why of Managed Threat Detection and discover more.
Posted in: Technology News
