By now most people are aware of the dark web but it is still relatively new so naturally there is a wealth of confusion and misinformation regarding the subject. With that in mind, I thought it would be useful to answer the most common questions and to debug some of the noise surrounding this emerging area of IT security.
Can the Dark Web be monitored?
100% it can. Service providers like DarkInvader, exist to help organisations identify leaked data on the dark web. This is a blend of automated tools and human investigations. If the dark web service provider finds a match you will receive a notification.
Are Dark Web scans safe?
Short answer is yes, completely safe but to be clear, a dark web scanner will only find information, it can not prevent it from leaking, nor can it remove data from the dark web.
Is it illegal to view the Deep Web?
Definitely not, analysing the deep web is perfectly legal and should be encouraged as part of a robust approach to security. The beautiful part of the deep web is that your investigative activity will be anonymous.
How do companies monitor the Dark Web?
Put simply, companies use scanning tools, internal resources and service providers to look for leaked data on the dark web. Typical data examples would include, email addresses, names, phone numbers, passport numbers, medical records, company names, IDs, and so on.
What happens if you visit an illegal website?
The answer is yes, you could find yourself speaking to the authorities and at worst charged with breaking the law. In the same way that you would be breaking the law for entering an illegal backstreet counterfeiting shop, you could be in trouble for accessing illegal sites. The authorities are particularly interested in searches for child porn, weapons, explosives and so on.
Is it bad if your phone number is on the Dark Web?
Obviously it is not ideal, but at the same time, it is not an emergency. If your phone number is on the dark web then if it is used it is most likely to be used as part of a phishing attack. Providing you ignore all approaches via text for sensitive information the risk is relatively low.
How much does a Dark Web scan cost?
Dark web scanning prices vary. Typically for automated scanning you are looking at an £80 – £500 per month spread. More in depth manual services are more expensive. For example, open source intelligence gathering (OSINT) is harder to automate and requires more manual research therefore the charges are higher.
What happens if your email address is found on the Dark Web?
If your email is on the dark web, then it will have been part of a hack where data has been compromised. In most cases the email address will be used as part of a phishing scam or it could be used to access common internet accounts. For example most people will use eBay and Amazon, so the hacker already has one part of your authentication credentials. Often passwords are also compromised so in many cases both parts will be available for the hackers to utilise. If you encrypt your password and think you are safe, then think again. Hashed passwords can be cracked and there is a wealth of tools available to automate the cracking of encrypted passwords.
What do I do if you find company records on the Dark Web?
If company records are found on the dark web, then your organisation has been compromised and you can not ignore this. The only action to take is to undertake a full forensics investigation to understand how the breach occurred. If personal data is found then you have a legal obligation to inform the Information Commissionaires office.
