How Darknets Reveal Attackers, Methods, and Targets

TL;DR

Darknet monitoring reveals unsolicited probes, vulnerability searches, botnet traffic, and command-and-control activity that can strengthen threat intelligence. The term darknet also covers privacy-focused overlay networks, while the deep web simply refers to content behind authentication. Despite enormous potential address spaces, observed darknet usage is much smaller than popular iceberg imagery suggests.

Transcript

All right, let's talk about the darknet. Uh, so this is a result of a few years of work. Uh, there are a couple of darknets out there, and we will go through them in roughly the next half hour. So this is a picture of the internet as of around two thousand and one. It's really a picture of all the routers on the internet, 'cause you can't actually ... Read More

Key Insights

• Darknet sensors are observation points in unassigned internet space or infrastructure not allocated to customers. Traffic reaching them is unsolicited, making these sensors useful for identifying scanning, probing, botnet behavior, and attempts to discover vulnerable systems or network defenses.
• Mirai traffic is visible as repeated Telnet probing from compromised devices. The monitored sample remained busy even at midnight in California, illustrating that automated hostile activity continues regardless of local working hours and can consume extremely large amounts of bandwidth.
• Attack traffic originates heavily from well-connected countries because those locations contain more connected machines that can become infected. Source geography alone does not establish intent, responsibility, or whether a machine's owner knowingly participated, so the presenter avoids labeling countries as friends or foes.
• The surface web is content that open search engines can discover, while the deep web is content protected by authentication. Email accounts, bank accounts, and corporate files belong to the deep web because search engines cannot crawl them through required usernames and passwords.
• Darknets are overlays built on the existing internet and usually require special software plus knowledge of correct operation. Tor, I2P, Freenet, Perfect Dark, Tribler, GnuNet, RetroShare, and ZeroNet illustrate different approaches to anonymity, encrypted sharing, and decentralized distribution.
• A dark network's theoretical address capacity does not indicate how much content people actually use. Tor hidden services have a potentially vast onion address space, yet the presentation emphasizes that real utilization is much smaller than popular iceberg diagrams imply.
• Trackerless and distributed systems resist simple takedowns because they lack a single central directory or tracker. Tribler uses trackerless BitTorrent, while GnuNet distributes directory information through a hash table, requiring intervention against more than one central component.
• ZeroNet automatically serves downloaded or viewed pages back to other participants. This design creates a serious legal risk when a user encounters prohibited material, because viewing can lead immediately to both possession and redistribution without a separate publishing action.

Questions & Answers

Q: What is a darknet in internet security?

A darknet can mean unassigned internet infrastructure, such as IP space or fiber that has not been allocated to a customer, where sensors observe unsolicited traffic. The term also describes overlay networks built on the existing internet that require specialized software. These overlays can support anonymity, encrypted communication, decentralized directories, file sharing, or hidden services.

Q: How can darknet monitoring improve threat intelligence?

Darknet monitoring exposes traffic directed toward addresses or infrastructure that should not host ordinary customer services. That traffic can reveal automated scans, Telnet probes, vulnerability searches, botnet activity, attempted attacks across many protocols, and command-and-control behavior. Organizations can use these observations to understand attackers' methods, likely targets, and the activity occurring beyond their normal perimeter telemetry.

Q: What is the difference between the surface web, deep web, and darknet?

The surface web consists of openly available content that search engines such as Google, Bing, or DuckDuckGo can discover. The deep web consists of information behind authentication barriers, including email, bank accounts, and corporate files. A darknet is an overlay network or unassigned internet space, depending on context, and usually requires specialized tools or monitoring arrangements.

Q: Why does unused IP space receive network traffic?

Unused or unassigned IP space receives traffic because automated systems continually search the internet for accessible devices, services, and vulnerabilities. In the monitored traffic, many packets were Telnet probes associated with Mirai, alongside activity spanning many protocols. Because legitimate customer services should not exist at those destinations, incoming packets can provide a useful view of scanning and attack behavior.

Q: How does Tor separate a user's identity from a destination?

Tor is used by people who want to separate where they are from where they are going on the internet. It also provides hidden services as a closed network. The presentation does not give a detailed routing explanation, but it identifies Tor as both a privacy mechanism and a platform used for markets, dissident communications, botnets, and command-and-control services.

Q: Why are decentralized darknet services difficult to shut down?

Decentralized services avoid a single component whose removal would disable the entire system. Tribler uses trackerless BitTorrent, so there is no central tracker to take down. GnuNet uses a distributed hash table, meaning participants hold portions of the directory. These designs require action against a broader network instead of intervention at one obvious central service.

Q: What risks can users face when browsing ZeroNet?

ZeroNet combines BitTorrent for file transfer with blockchain-based identity and can use Tor to conceal an IP address. When someone downloads or views a page, the system automatically serves that material to other users. The presenter warns that encountering child abuse material can therefore create possession and distribution problems immediately, even when the user merely stumbled onto the content.

Q: What did researchers find on Tor hidden services?

The cited research examined what used Tor hidden services and found that botnets dominated several of the most requested sites. Command-and-control activity was a major observed use, measured through requests and the duration for which services remained active. This finding contrasts with the common public focus on drug markets, even though Silk Road helped drive research attention toward Tor.

Summary & Key Takeaways

• The presentation distinguishes unused internet infrastructure from privacy-oriented overlay networks. Sensors placed in unassigned address space or fiber not assigned to customers can observe unsolicited traffic, including Telnet probes associated with Mirai, vulnerability searches across many protocols, and activity originating from infected machines in well-connected countries.

• The surface web contains material that search engines can discover, while the deep web contains resources protected by authentication, such as email, banking information, and corporate files. Darknets are overlays requiring specialized software and knowledge. Their theoretical address spaces may be enormous, but their observed use is comparatively limited.

• Privacy and peer-to-peer systems serve different purposes and carry different risks. Tor separates a user's location from an internet destination and supports hidden services, while other networks emphasize encrypted sharing, distributed directories, or trackerless transfer. Research cited in the presentation found botnet command-and-control services among Tor's most requested hidden sites.