Exploring the Deep Web

More documents

Recommendations

Info

AppendixCatching NionSpy (aka Mewsei or MewsSpy)In the following example that is related to malware that steal confidential information, we looked for theprevalent query string’s parameters in a short and recent time window. This allowed us to identify new threatsas soon as they appeared in the Deep Web. In particular, two parameters—xu and xd—experienced a surgein popularity over the past week. Xu was associated with more than 1,700 distinct values consisting of binaryblobs. Further investigation revealed that xu was used by NionSpy to leak stolen credentials (online banking,etc.) that are then captured by a keylogger and posted to a dropzone in the Deep Web. Xd, meanwhile, wasused to register a new infection to the botnet. This registration included information like the victim’s machinename and OS version, communicated in form of a JSON string like the following:[REDACTED]2xx.onion:80/si.php?xd={“f155”:”MACHINE IP”,”f4336”:”MACHINENAME”,”f7035”:”5.9.1.1”,”f1121”:”windows”,”f6463”:””,”f2015”:”1”}By counting the queries associated with the registration, we were able to build a profile of the number of newvictims per day, along with the amount of data leaked.Most prevalent URI query string’s parameters (by value)44 | Below the Surface: Exploring the Deep Web
Number of new victims per day (in blue) and traffic to the drop zone (in green)45 | Below the Surface: Exploring the Deep Web
Page 1 and 2: Below the Surface:Exploringthe Deep
Page 3: Interestin the Deep Web peaked in20
Page 6 and 7: What are the uses of the Deep Web?A
Page 8 and 9: The state of the Deep WebMany studi
Page 10 and 11: Looking at the language distributio
Page 12 and 13: What makes up the Deep Web?Many use
Page 14 and 15: The following table provides a brea
Page 16 and 17: VAWTRAK C&C server that shows a leg
Page 18 and 19: 18 | Below the Surface: Exploring t
Page 20 and 21: The availability of illegal narcoti
Page 22 and 23: Bitcoin and money-laundering servic
Page 24 and 25: Sites that offer counterfeit US$20
Page 26 and 27: Unverified PayPal accounts sold in
Page 30 and 31: Leaked details: Government, law enf
Page 34 and 35: As shown, prices vary based on the
Page 36 and 37: The Deep Web and the real worldMain
Page 38 and 39: Law enforcement and the Deep WebLaw
Page 40 and 41: The future of the Deep WebWhile pub
Page 42 and 43: ConclusionThe Trend Micro Forward-L
Page 46 and 47: References1. The Tor Project, Inc.
Page 48: Created by:The Global Technical Sup

Exploring the Deep Web

Create successful ePaper yourself

Delete template?

Save as template?