Sophos Cloud Optix
There is a lot more to the web than that which immediately meets the eye.
In fact, the “visible” layer of the web that you and I can easily access via popular search engines is only part of the story.
Hidden on the net is online content which is not so easily accessed, known as the Deepnet (also sometimes called Darknet, the Deep Web or Hidden Web).
Whilst a lot of this content consists merely of websites not indexed by search engines and only accessed by a handful of people, some parts of it are hidden a lot deeper.
A part of the Deepnet is accessed through the anonymity network known as Tor.
Originally sponsored by the US Naval Research Laboratory when released in 2002, Tor is widely used around the world for protecting anonymity online.
Visiting a website through Tor re-routes your connection through a randomised path of other Tor users’ computers before reaching the target web server, effectively hiding your originating location from that server.
But why all the cloak and daggers?
It may not be surprising to hear that, whilst Tor is used for many legitimate or moral purposes, this part of the internet is also home to a wide range of criminality and illegal content.
Unlike normal websites, these pages on the Deepnet do not have friendly URLs.
Instead, a seemingly random string of characters followed by “.onion” provides access to these hidden websites. Deepnet pages such as “The Hidden Wiki” provide listings of these URLs to facilitate use of the Deepnet.
Here is a selection of websites listed:
- Banker & Co.– Professional Money Laundering Service
- Paypal4free – Hacked Paypal accounts for cheap, with balances
- Eris – #1 Deepweb Dealer – Cannabis, LSD, DMT, Mushrooms, and MDMA!
- All Purpose Identities – Get your Fake ID in the form of US and Canada Drivers Licenses, passports and many more
- Rent-a-Hacker – Professional hacker for hire, DDOS, hacking, ruining people, espionage etc
- Contract Killer – Kill your problem (snitch, paparazzo, rich husband, cop, judge, competition, etc). (Host: FH)
- Crime Network – A place to network and get better at your craft
The really scary thing is that this is just scratching the surface of the illegal activity and content traversing the Deepnet. The deeper you start to dive into websites – whose .onion address is perhaps only known to a select group of people – the darker the content becomes.
There has been much speculation as to how good Tor actually is at making your online activities anonymous. We have previously seen how a Tor-hidden online narcotics store was brought down by authorities, and yet also how Tor has stymied a FBI child abuse investigation.
The time and effort required by law enforcement agents to track nefarious Tor users (even when possible) is infeasible.
Tor “end nodes”, the computers that are the ends of the randomly chosen path across the globe that Tor traffic takes, could be in any country.
In addition, it’s most likely that the owners of computers acting as end nodes for Tor traffic have no idea of what criminal traffic is passing through their machines.
Politicians and governments might like to believe that they are able to police the internet, but the difficulty of actually enforcing online legislation approaches impossibility when well defined sovereign borders no long exist.
Some are not willing to wait and subsequently let crime go unchallenged.
In October last year, Anonymous controversially took matters into its own hands by taking down alleged child pornography websites, including Lolita City, as part of Operation Darknet.
Vigilantism aside, the existence of the Deepnet poses a bigger question: what is the cost of online anonymity to society?
The concept of human rights gets a bit confused in an online setting. In fact some people say the human rights framework isn’t applicable to online phenomenon and moral philosophy should be considered instead for deeming what is right and wrong.
Certainly, Tor has many moral uses. The Tor Project enables freedom of speech to those living under oppressive regimes and protects human rights activists working overseas from prosecution.
Tor is a powerful tool for the well-intended and the nefarious alike.
It simultaneously provides malware authors clever methods for hiding their malicious command-and-control servers from those trying to shut them down, as well as aiding malware analysts in their research.
It is common for malware authors to blacklist traffic from known anti-virus vendor IP addresses, so researchers often use Tor to overcome this.
Balancing the ethical and moral uses of anonymity networks against the opportunity for abuse by criminals poses the question, should users be allowed to be anonymous online?
Let us know your views by taking our quick poll.
Web illustration from Shutterstock.
I do like TOR and the .onion-network. I use it from time to time to find answers to technical questions, uncensored facts and uncensored debates. Then there's the other part. The part I wish wasn't there. But to be honest, noone unknowingly stumbles upon those sites while surfing the .onions, unlike the clearnet, the regular web, where a perfectly legit search could in as little as 2-3 steps go from totally harmless information to child abuse and hurtcore sites. Granted, it doesn't happen often. But on TOR, if you're not actively looking for it, you will most likely not find it.
The good – allowing opressed information a safer channel to communication, and uncensored opinions – far outweighs the bad in my very humble opinion. It would be sweet if the publishing on TOR that is made possible only by inflicting harm to the helpless would simply disappear, but that won't happen until the actual people who have urges to inflict harm vanishes. Won't happen on the .onions, won't happen on the clearnet, won't happen IRL. Evil people are everywhere, online and offline.
Lucid argument, well made. There are many avenues to banality and depravity – that don't require the Tor network to be a scapegoat. The "Clearnet" itself is just as much a vehicle.
What I would like to see (and this may well be the case – excuse my ignorance) is a well maintained "like-minded" multi proxy network. One that doesn't need to hide beneath the apron of the internet – that is easily accessible and gives users the easy way to opt in to secure and private web access without all the stigma attached to TOR.
Cheers.
people have used legitimate tools for shady purposes forever. I am quite certain the U.S. mail has been used at some point to send mail that was not legal and I know the roads have been used for illegal purposes…so we have to look at the concept versus the execution..is the concept of online anonymity inherently wrong or is the execution wrong or is it just regrettable but normal activities (i.e. someone taking advantage of an opportunity)
Interesting that you use all the standard bromides: drugs,child abuse etc and spend most of the article castigating the dark net, yet only give one small paragraph near the end on why so many people use it. Yes, I'm on Facebook so the authorities have access to all my info at anytime but when I am away from that I have a reasonable expectation that I can surf without being spied on simply because they want to track everyone everywhere. The authorities want it to be all secrecy for them and no privacy for us. And that's why I think Tor is a very good good thing for internet users.
An excellent article.
I would have to disagree with those that feel that “some people say the human rights framework isn’t applicable to online”.
That is just plain wrong.
If someone chooses to publish a book, magazine or article and use a pseudonym, that is perfectly acceptable in the “Print” world. Should some one need to know the author’s name, it can be found.
The same is true about online publications. If it requires more effort than some are willing to put in, then perhaps they are not committed enough to the cause, or cannot abide by due process or just too lazy to do the work.
“The same is true about online publications.”
Actually, no. For most of the Internet, yes, but within the context of Tor you are incorrect. It is not a question of being lazy or avoiding due process. Tor was specifically designed to defeat due process. You cannot serve a warrant on a user or server that you cannot locate. There is no attribution.
The problem is that there is an exit node operator who is currently being prosecuted for someone using Tor to access child abuse sites through his node. This has resulted in staggering drop of Tor exit nodes in the past couple of weeks. This isn't good at all for people who need to use Tor to conceal their identity for legitimate reasons.
Nice hatchet job Sophos, tarring Tor usage with a criminal brush…
Don't blame the messenger. Blame the users. I've spent a fair amount of time on TOR. There are legal sites. There are also a LOT of questionable sites, and sites boasting illegal services/wares.
Look at it this way:
If TOR was a wall where you could write encrypted messages supporting various political affiliations or even declaring undying love to a significant other – and was thus encrypted, we could all agree that this constitutions a humane moral imperative as a service.
But TOR is not this sublime encrypted paradise, more commonly it's a polluted vessel for wanking behind the veil of secrecy – to a large part.
The paradox is then – do we police and enforce something which is intrinsically free – encouraging a nominal censorial culture for the good of all?
OR Do we seek to improve it? By which I mean, entrust custodians to watch for nefarious content and child abuse – and actively remove them from the network?
In Other words, do we stop shirking our responsibility- demand a secure passage of communication (and yes I have thought of this – we may need to maintain and elect our peers as custodians – for without this – where are we? )
Any way, thoughts anyone?
The whole point of Tor (for better or worse) is that nobody can read the content of the communications, or know the source and destination. The aim is absolute secrecy and security of communications. Anything less, and Tor isn't fit for purpose, and something else must take its place. Society has made this neccessary.
How would you implement such a system? First off, you'd have to define 'nefarious content' – in some countries that means criticising the government, and in others it means criticising religion. Secondly, child abuse has nothing to do with Tor, as it's committed offline.
And there's the inevitability of the wrong people becoming custodians, which would put the lives of those under repressive regimes at risk.
“Child abuse has nothing to do with Tor, as it’s committed offline.”
Wow. That is the single most ignorant statement on Tor I have ever read.
By your logic Tor has nothing to do with anything because everything in the real world happens off line.
Tor provides a safe haven for the world-wide distribution of child pornography. I’m not talking about a few pictures of nudist children or old Coppertone commercials. I’m talking about actual sadistic abuse. Tor has the effect of providing the perpetrators of this abuse a simple, effective and relatively safe mechanism for sharing the fruits of their labors.
It is an easy brush to use since research has demonstrated that almost 1/2 of the resources in the hidden services areas of Tor are dedicated to criminal activity.
Not a hatchet job at all. In fact, it falls well short of presenting the cesspool that Tor actually is.
I feel that as long as humans are involved there will always be a case of "good" and "evil".
If we want to destroy the mediums in which humans can be good or evil as a solution to our problems, well…we may as well just kill ourselves now.
The internet is not bad, people are bad. A criminal element will exist where ever a non criminal element exists, because that is who they feed on. Regardless of what restrictions you put in place, that element will find a way to circumvent it. Forcing the rest of us to give up our freedoms so that "SOME" of the criminal element are more easily caught is not a good idea (in my opinion). Voluntary, sure. If you want to voluntarily subscribe to some sort of passport authentication, by all means, do so.
I don't know what the answer is, but I don't think punishing the non-criminal element (or mass punishment) is the answer. If only it were possible for everyone to police it themselves. You know, report criminal activity when you discover it. I know, what good would that do. The authorities don't have the man power, resources, will or expertise to pursue a tenth of what they have on their plate right now. The ISPs and hosting sites don't have any incentive (the opposite, it would cut into their profits). But, if you do nothing, don't complain (as loud) when someone else does.
I would thoroughly endorse Doodle's comments, with one exception. Words are important. It's not "people" who are "bad", it's too many terrestrial humans. The universe(s) are teeming with "people". Measure "goodness" or "badness" in terms of species' social maturity; our own society has far too many "bad" members, and is thus a "bad" society driven by amorality. It is deeply primitive, and a vast distance from maturity. It has nothing to do with technology, but self-regulating morality. Unless and until our society can achieve such a state, in which the numbers of "bad" members are reduced to insignificance or disappear entirely, there will be no possibility of constructing any system of any technology that can selectively evade the machinations of the "bad" segments. In other words, not until our society reaches its evolutionary zenith.
You are absolutely right about our race as we know it. Your comment should be used as a quotation and written somewhere on a clearly visible spot. In my opinion people have been able to reach something like “zenith” in several particular civilizations (Egyptians, Romans, Ottoman Empire, maybe even Golden Era around 80’s), but we haven´t achieved this on level of whole human race and I agree that we are far from it. Moreover when civilization reach the golden top it stays here for some time and then (sadly) start to fade – we can experience it here in EU society. And as you say it has nothing to do with technology. So TOR is only a tool. Guns don´t kill people….people kill people….in same way: TOR doesn´t sell drugs and abuses children – people do it.
At least in the US, privacy is a right. I believe Tor, PGP, and the like provide we little people with some degree of privacy. I teach Intro to Comp Sci at a local college and urge all my students to both use Tor and consider serious encryption. It is frightening how many of my students have no idea how technology can be used against them. Anonymity is precious, please help preserve it.
As I have argued for many years, man made or nature made, someone will abuse it. Does shutting it down fix the problem? Of course not, other avenues will be found and abused. As with drunk driving and other imagined or unimagined ideas the person using it is responsible for the correct use or 'moral' use of the Internet. If you say stop it, then the line is not defined and never will be. Peoples sexuality is a multifaceted stone even to some very dark corners, but we and never will be able to stop it.
I'm not advocating anything except we need to have an open internet, because if someone draws a line, it'll probably not be where most of us want it.
Tor and the Deepnet: What price does society pay for anonymity?
Let's reframe this question, as the author made the assumption anonymity costs society. Let's ask how better off society is because of anonymity, how many people are now free to criticise regimes, seek help and advice on very personal matters, expose wrongdoing without fear of being identified by repressive governments, insurance firms and their employers.
Think about agay person in a redneck part of the United States, or an abuse victim who needs help without the risks of being stigmatised and blacklisted by society (something the anti-privacy brigade conveniently ignores).
People are also getting jailed for posting 140-character messages on Twitter, so the threat is real enough to justify anonymity there as well.
Without anonymity, the threat to innocent people would become far greater – criminals would have a bigger reason to commit identity theft, thereby implicating innocent people in other crimes, and there'd be more information available to work on.
Thought provoking stuff.
To be honest I am afraid about a dark side of total anonymity but I am even more afraid about a possibility of total control
Round and round, your arguments swirl. But it is foolishness. If the deepnet is not free from “policing’ or “censorship’ by ANYONE – Law enforcement, individuals, or self-proclaimed hacking hero “Anonymous”; then it is no longer free, it is no longer safe, it is just a slightly more difficult to access version of the regular net. It is worthless.
Tor doesn’t kill people — people kill people