Customer portal
Category

Opinion

"MI6"/
Opinion

MI6 to work with more tech companies

In his first speech as the new MI6 boss, Richard Moore has made it very clear that they need to work with innovative technology companies to help protect the UK in the future. He spoke at The International Institute for Strategic Studies today.

“I cannot stress enough what a sea change this is in MI6’s culture, ethos and way of working, since we have traditionally relied primarily on our own capabilities to develop the world-class technologies we need to stay secret and deliver against our mission”.

Guardian
Richard Moore

He emphasised how we are living through times where adversaries are feeling emboldened and have greater than-ever resources. He said how our world is being transformed by digital connectivity, increases in data and computer power.

He said he is paid to look at the threats and he said that the cyber attacks are growing exponentially.

His mission as Chief is to oversee the modernisation of MI6 and investing in the skills that they need in the digital age and partner with the right people and companies to help them stay ahead of our adversaries.

What we do here at SOS Intelligence, Dark Web Threat Intelligence plays a small, but important role in enabling companies and organisations to monitor what is happening on the Dark Web.

Focus on cyber threats

MI6’s focus on cyber threats is nothing new. They explicitly list this on their website:

The world increasingly interacts digitally through cyber space. Alongside the many benefits, it leaves individuals, organisations and governments open to cyber risks. These include the possibility of hostile cyber intrusions or attacks against the UK and the UK’s interests. The National Security Strategy identifies this as one of the four main areas of security risk to the UK.

Working as part of a cross-government effort, including GCHQ and it’s National Cyber Security Centre (NCSC), MI5 and law enforcement, SIS provides secret intelligence to help protect the UK from current and future cyber threats. These can come from a range of cyber actors, such as malign states, terrorists and/or criminals.

MI6
"SOS
Opinion

SOS Intelligence featured on BBC website

The headline is a scary one, but absolutely accurate.

How your personal data is being scraped from social media

Joe Tidy, Cyber security reporter, BBC News

Joe Tidy recently got in touch after we published our blog post last week, An investigation into the LinkedIn data sale on hacker forums.

We spoke at length about the data sale and the conflicting theories of how it was sourced. Joe has now written up his news article which you can read here and where we were featured.

The chief executive and founder of SOS Intelligence, a company which provides firms with threat intelligence, Amir Hadžipašić, sweeps hacker forums on the dark web day and night. As soon as news of the 700 million LinkedIn database spread he and his team began analysing the data.

Mr Hadžipašić says the details in this, and other mass-scraping events, are not what most people would expect to be available in the public domain. He thinks API programmes, which give more information about users than the general public can see, should be more tightly controlled.

“Large-scale leaks like this are concerning, given the intricate detail, in some cases, of this information – such as geographic locations or private mobile and email addresses. 

“To most people it will come as a surprise that there’s so much information held by these API enrichment services. 

“This information in the wrong hands could be significantly impacting for some,” he said.

Amir Hadžipašić, BBC News

We’d be very interested to speak to anyone who thinks they’ve been impacted by this.

Sadly, the vast majority of people won’t be aware that this can happen and also won’t be aware when a leak occurs. This is precisely where SOS Intelligence comes in.

We offer a free plan for anyone which takes seconds to set up and always monitoring of the email address you use on the Dark Web. What are you waiting for? You can sign up here.

"The
Opinion, The Dark Web, Tips

How Does the Dark Web Work? An In-Depth Guide (2021)

This is the authoritative 2021 guide to the Dark Web

If you are looking to understand:

  • The Dark Web basics
  • Where did the Dark Web come from?
  • What’s driving the growth of the Dark Web?
  • What activities take place on the Dark Web?
  • Which Dark Web threats can impact my organisation?
  • How to protect organisations from Dark Web activity?
  • What does Dark Web Monitoring do?

Then this guide will provide you with all of the answers you need.

Chapter 1: The Dark Web basics

What is the Dark Web? 

The Dark Web is a peer-to-peer interconnected network of computers that use the Tor Protocol, commonly known as the Tor browser.

Tor uses the top-level domain .onion which takes its name from the method of routing the Tor network’s users.

Anonymity is maintained by building a circuit each time a user tries to connect to a certain .onion domain.

The circuit becomes a multi-layered encryption chain, with each layer unwrapping the next one until it gets to its destination. Hence the reference to an onion.

This method ensures that the relaying nodes on the network between sender and recipient never know who the other one is. They only know the next layer as they unwrap it.

It provides 100% anonymity whilst on the network.

The Dark Web is essentially the containing of that encrypted traffic within the Dark Web itself.

Is the Dark Web 100% anonymous?

There are only 2 places where you can breach Dark Web anonymity.

Either the client end before you transmit data onto the Tor network or via the other end using an Open Relay.

Anyone can download and install an Open Relay and capture information then pass it out onto the internet if the data hasn’t been sufficiently secured within itself.

Chapter 2: Where did the Dark Web come from?

The Tor Project is an open-source foundation that was started as a US Navy research project.

It was originally part of the National Security Agency, a national-level intelligence agency of the United States Department of Defense.

It’s likely that it predates its official launch by a number of years.

The early development of the .onion protocol was designed to allow spies to communicate with each other and contact their commanders via the internet in as safe and secure a manner as possible.

For it to work properly, they needed a sufficient number of nodes in order to allow traffic to pass anonymously.

Too few nodes would simply allow adversaries to intercept and attack their encrypted data.

So (the story goes) the Tor Project was started as a free open source project to encourage widespread use.

It has become increasingly popular over the years and undergone a number of significant iterations since its release in 2002.

Chapter 3: What’s driving the growth of the Dark Web?

The Tor Project quickly gained users thanks to its advanced anonymity properties.

Let’s face it, you build a road and people are going to start driving on it.

Yet here’s the thing:

There are numerous key global events that have seen spikes in growth of Tor.

These include the following:

  • Government clampdowns on file sharing following successful lobbying by Hollywood and the music industry forcing ISPs to block access to torrent hosting websites
  • Key political moments such the Arab Spring in 2010

Meanwhile, various Hacking Communities began using it because it became the ‘cool thing’ to do.

Chapter 4: What activities take place on the Dark Web?

Most of the activity taking place on the Dark Web is as dull and trivial as the rest of the Internet.

In truth, for all its negative connotations the Dark Web shouldn’t be something to be afraid of.

Of the 95,317 sites we currently track, less than 5% are flagged as having potentially abusive content on them.

However:

There is also a significant amount of fraud taking place here, along with a percentage sharing abusive content.

The biggest threat to organisations comes in the form of Ransomware.

What is Ransomware?

Ransomware is the process of hackers encrypting and stealing sensitive company and customer data then ransoming it back to the organisation for profit.

Let’s look at this in more detail in the next chapter.

Chapter 5: Which Dark Web threats could impact my organisation?

In June 2017, the chief technology and information officer for Maersk, a Danish shipping and logistics giant, returned from his honeymoon to discover that the company has suffered a major malware attack.

The attack on its IT systems was so bad that the company was virtually unable to operate, even to the point that its ship’s captains were forced to navigate the globe using paper and pen.

4 years later and the company is still remediating, estimated costs to date are as much as £300 million.

No one is sure whether this attack was Ransomware gone wrong (no public request for payment has been made) but the damage to its business continues to be felt to this day.

The different types of Dark Web attack

The Dark Web enables hackers to remain anonymous whilst providing them with a marketplace to force you as the victim to pay to have your data decrypted.

It gives them a foothold, a place where they can publicly advertise to the world all of the organisations they have hacked.

This data often includes intellectual property, financial information, and customer data and is usually placed on the Dark Web and made free to download until the organisation pays to have it removed.

These are very professional operations with call centers, helplines, and live-chats. Some of them even provide a ‘Get 1 File for Free’ service to prove that the decryption works.

Human Driven Ransomware

This term describes when a group of hackers come together and plan an attack. This would often involve them having a good look around your network before they begin encrypting specific files and servers.

They typically look to exploit vulnerabilities in your network and appear to be reasonably agnostic when it comes to sectors and industries.

Victims could be a dental surgery or multinational aerospace company. The primary motivation is getting you to pay for your encryption keys.

Another way into your systems is via ‘phishing’.

This could involve an IT employee’s credentials are stolen and where the company doesn’t have sufficient protection to prevent the hackers from gaining access to the system.

Ransomware Trends

Ransomware is developing and maturing into a more industrialised activity, with a much greater trend towards automation.

A lot of Ransomware programmes will automatically send your encryption keys off to an onion domain that is spun up just for you, gaining access through something as simple as a Word or Excel document that executes a Macro in the background.

The Macro will then automatically begin to encrypt your data and spin it out onto the Dark Web.

Apart from disabling Macros, patching applications to keep things up-to-date, not opening docs you aren’t sure about and using good security software there isn’t much more you can do.

At present we are aware of between 26-30 active ransomware groups.

If you find yourself on a Ransomware site, there is nothing you can really do except pay and begin remediating.

However, police forces are active on the Dark Web looking to take down operations and have had some success. Dutch police were recently so pleased to have taken down one botnet network that they even posted about it as themselves on a hackers’ forum.

Chapter 6: How to protect organisations from illegal Dark Web activity?

Protecting your organisation from hacking and Ransomware is a difficult task, especially when a concerted hacking campaign coupled with human error comes into play.

If as an IT Professional and/or diligent CTO you have done everything within your power to secure the network and Ransomware still finds its way through a lot of it will simply come down to bad luck.

Hackers work hard to ensure that they are fully undetectable and use dynamic systems that generate malicious downloads on the fly, making it difficult to defend against these types of attacks.

The priority then becomes managing the fallout and particularly the PR as best as you can.

A data breach quickly moves from being an IT problem to a business problem. If you can show that you have behaved competently and done as much as you can there is a chance to come out of it looking better.

Our Dark Web Monitoring tool supports you in this process by providing early warnings of any Dark Web activity around your brand.

SOS gives you awareness, time, and context by letting you know if your information is out there; what information that is; and who is talking about it.

Having these instant alerts can be very reassuring, giving you time to react with the full knowledge of just how big your exposure is.

Now we’d like to hear from you. Have you been affected by any of the issues raised in this guide? Do you have any concerns around data breaches and threat intelligence?

Please get in touch if you need to find out more using the contact info below. And if you’ve found this information helpful, please feel free to share it on your social networks!

1 2 3
Privacy Settings
We use cookies to enhance your experience while using our website. If you are using our Services via a browser you can restrict, block or remove cookies through your web browser settings. We also use content and scripts from third parties that may use tracking technologies. You can selectively provide your consent below to allow such third party embeds. For complete information about the cookies we use, data we collect and how we process them, please check our Privacy Policy
Youtube
Consent to display content from - Youtube
Vimeo
Consent to display content from - Vimeo
Google Maps
Consent to display content from - Google
Spotify
Consent to display content from - Spotify
Sound Cloud
Consent to display content from - Sound