What is Dark Web / Deep Web?

 

Maybe you did not know, but there are two Internet. The classic Internet, the one you know and that you use everyday, on which you can read this article. It is very easily accessible and is indexed by the search engines. Next comes the deep web or the dark. Do you have question what is the dark web? Here’s the answer, web representing approximately 96% of the entire web on which there is a large number of un-referenced pages for various reasons: dynamic URLs generated on the fly, sites requiring authentication (banks, online organizations), data not included by the search engines.

And then there is a small subset of the deep web that can not be accessed without specific software, it is the  dark web.

What is dark web or deep web actually?

The dark web exists on darknets , superimposed networks using specific protocols integrating anonymization functions and constituted by people who connect among themselves in particular for exchanges of files. These networks are superimposed on the Internet, but require specific software to access them. Thus, they are not accessible or even visible to uninitiated people.

For example, among the widely used software, Tor software hides a darknet. Tor can be used to anonymize its activity on the Internet  when you surf the visible web, but it can also be used to access special sites ending in .onion that you would not be able to access with a standard browser. These sites use Tor to camouflage themselves on the web and only Tor users can access it, which makes them very little visible!

Tor’s hidden websites are the best-known darknet on the web, but there are of course other darkenets used for various purposes such as sharing secret files, pirated software or media files.

What are you going to find on the dark web?

On darknets hide websites that do not want to be accessible on the normal web where they could be found easily. These websites constitute what is called the dark web.

The dark web provides anonymity both to the websites that constitute it and to the visitors of these websites. Political dissidents in countries where authoritarian regimes leave very little room for opponents are likely to use the dark web to communicate and organize (we find a little spirit of “Radio London” and resistance during the 2nd World War II with its parallel communication networks).

Alert launchers can reveal secrets about the dark web using sites like the one from the American newspaper The New Yorker  accessible by Tor to guarantee a higher level of anonymity. Even Facebook can be accessed from Tor to ensure the security of users logging into countries where Facebook is censored or banned .

But beyond these positive uses and aiming to fight for freedom, the anonymity of the dark web allows the existence of a multitude of other sites that could not have been born on the normal web, for good reasons.

Indeed, many sites offer drugs, weapons, false documents or even stolen credit cards and even other services like credit card hacking and confidential information hacking. You will also find sites of online games or directories of criminals with classifieds of people proposing for an assassination. All these services are generally paid in Bitcoin, this virtual currency also guaranteeing a certain anonymity .

Moreover, the site of the dark web that has made the most talk about him in recent years is Silk Road, a huge black market place dedicated to the sale of drugs and on which payments were made in Bitcoin and buyers received their orders by mail as on any other e-retailer. Silk Road was brought to and end in November 2014 by the FBI.

 

 It is therefore very important to be aware that everything on the dark web is not necessarily reliable and legitimate (besides being illegal!). Indeed, even if this is not quantifiable because of the absence of statistics in this parallel world, much of what is there may well be scams to make money on the back of the “customers”. Difficult indeed for a client to go complaining to the police saying that the user Sniper77 did not perform his assassination service when he was well paid! One can also imagine that on these sites there are traps set by the police to take on the fact of people seeking illegal products or services.

In short, make sure not to use dark web

Now you know what is dark web, so in the end, there really are very few legitimate reasons that could lead you on the dark web. As we saw above, if you are a wake-up caller or if you live in a country where all freedoms are not guaranteed, dark web can be a valuable tool … for the rest, avoid all just to get there.

---

Note: Use Virtual Machine and scan on VirusTotal before downloading any program on Host Machine for your privacy.

5 key cyber security trends explained by a top expert

There are a few key trends in the cyber security world that impact all of us, as users.

Mikko Hypponen, one of the most renowned and trusted cyber security researchers in the world, shared 5 of these trends and we think you should know about them.

1. Nation states may be robbing banks.

It’s a known fact that nation states often create malware, especially for cyber espionage, but things may be a bit more complicated than we realize. The full article will set the proper context for this one.

2. Ransomware is not going away.

The technology associated with ransomware keeps evolving, as cyber criminals incorporate new tactics.

These apply to both technical aspects and the social engineering tricks played by attackers to lure potential victims.

3. Cyber crime as a business is growing.

 Online attackers are making big money off ransomware and other financial malware, but not only that.

They’re building what you could call “business empires”, complete with teams of developers, a business strategy and the skills to implement it.

4. Poor passwords are still a pain

Although cyber security specialists have been saying this for years, users continue to use weak passwords and, what’s worse, reuse them. This creates huge problems, especially in the event of a data breach.

Cyber criminals only have to try and see if those users have reused their passwords to gain control of millions of accounts.

We really hope you don’t do this.

5. Cyber crime empires are bigger than you can imagine

Although no one can accurately and fully track all the money cyber criminals are making, their transactions amount to astounding sums!

If these cyber crime-as-a-business enterprises would be legitimate, they would be HUGE!
 

Was your account was involved in a data breach? What to do about it

The odds are against us when it comes to data breaches. Most likely than ever, one of our accounts will be breached. And it doesn’t even have to be our fault, as history proved.

In May 2016, a cluster of mega data breaches was dissected in the media. More than 642 million social accounts were compromised - and it happened in less than two weeks.

LinkedIn, MySpace, Amazon, Twitter, Badoo - they were all affected, more or less directly.

Here’s what you should do in order to reduce the damage:
 

1. Keep calm and change your password. I’m talking about the password for the hacked account - log in as soon as you find out about the breach. Change the password, make sure you set up a new, strong and unique one.
2. Activate two-factor authentication, if the hacked service offers you this option. It will act as a second layer of protection, besides the initial password. Every time you’ll want to log in from a new device or browser, it will request you to authenticate using a second pass code, that’s unique and time sensitive. You’ll receive that one on your mobile phone - via a special app or text message.
3. In case you were reusing the initial password, will you please stop doing that? Connect to all your other accounts and change their passwords. Start with the email account that was linked to the hacked account. Repeat the previous steps (new, strong and unique password, and activate two-factor authentication).

And, in the future, make sure you don’t recycle your passwords. EVER.

Acunetix Integrated with OpenVAS for Network Pentest

Acunetix, the pioneer in automated web application security software, has announced that all versions of the Acunetix Vulnerability Scanner now support network security scanning. Network security scans are possible thanks to the seamless integration of Acunetix with the powerful OpenVAS security solution. Until now, network security scanning functionality was available only in Acunetix Online.



There are many advantages of running network security scans in Acunetix. Having a single integrated dashboard with both web and network vulnerabilities gives the best possible risk visibility and saves a lot of time and effort. Network scans may also benefit from other Acunetix features, such as issue tracker integration and comprehensive reporting.

More Features in the Latest Build

OpenVAS integration is introduced as part of the latest Acunetix version 12 build (build 12.0.190515149). This new build also includes:

    1.Support for IPv6
    2.Improved usage of machine resources
    3.Added support for Selenium scripts as import files
    4.Multiple vulnerability checks for SAP
    5.Unauthorized access detection for Redis and Memcached
    6.Source code disclosure for Ruby and Python

Introduction To Shodan

Shodan is the search engine that allows users to find out the specific data. It is different from Google and other search engine as the other search engine only index the web. Shodan indexes other things like webcam, cell phones, salon facilities, specific medical services, automobile accessories, television, books and everything that you think you can find out on the internet. There are several courses available that empower you to understand the use of the specific index for shodan.

Do you know how Shodan works?
 
Whatever the services are running on open ports, they use banners. A banner publicly shows the whole product and services range on the internet about with the specification of the nature of the business. Shodan shares the example of FTF banner. Remember, Shodan doesn’t not index any web content. It is linked with query ports 80 and 443.
There are other services do exist as well on other ports that offer the service-specific information but it is not sufficient to indicate that your published banner is true or not. In many cases, it is considered true. Interestingly, there are many enterprises that don’t use Shodan, even they usually block Shodan from crawling their network. Cybercriminals don’t need Shodan to target vulnerable devices in order to connect to the designed network. Remember, blocking Shodan doesn’t mean that you have taken all safety measures. However, Shodan has the ability to minimize the risk factors.
Shodan scares people those have not sufficient technical knowledge and they don’t know how to use the internet. The most well-known news agency CNN named it “scariest search engine on the internet” in 2013. Simply, you can’t let anyone knows about where your power plants are so that you can be safe from unwanted threats. The real worth of Shodan lies in helping protectors to gain greater visibility into their own networks. If you don’t know what is the asset that you actually have to protect then you can’t design your defending strategies. Shodan is the search engine that provides the greater visibility of insecure functions, the cyber-physical world in which we actually live.

Securing Network
 
In the modern world, many enterprises like to share about their businesses a lot on the internet. For example, what enterprises do, how they do and other information that reflects their business identity. In the same case, employees also plug things on the internet to show the business visibility and later it can also be the reason for cyber-attacks. In order to protect you, Shodan helps you by making it easy to search a subnet or domain for connected devices, open ports, default credentials, even known vulnerabilities. Cybercriminals can only have the visibility to the same thing, so it stops the entrances of threats before they decide to attack. Shodan supports user to search for the devices vulnerable to certain activities. Additionally, it helps defenders to show their identity to own devices for security. Even during the information collective phase, it does penetrating testing. Moreover, paid members can also get access to API.