Phishing With A Darknet: Imitation of Onion Services

Barr-Smith, Frederick; Wright, Joss

doi:10.1109/ecrime51433.2020.9493262

Cited by 7 publications

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For a web crawler, a good selection of starting points (seed pages) is important. Many works use as seed a lists compiled by third parties [1,2,6,8,14,18,31,36,50,54], existing darknet search engines [1,2,18,31,50,54], or onion lists from previous works [2,4].…”

Section: Gathering Methods Of Onion Addressesmentioning

confidence: 99%

See 1 more Smart Citation

Inconsistencies in Darknet Researches

Platzer

Lux

2023

JCSANDM

View full text Add to dashboard Cite

The darknet terminology is not used consistently among scientific research papers. This can lead to difficulties in regards to the applicability and the significance of the results and also facilitates misinterpretation of them. As a consequence, comparisons of the different works are complicated. In this paper, we conduct a review of previous darknet research papers in order to elaborate the distribution of the inconsistent usage of the darknet terminology. Overall, inconsistencies in darknet terminology in 63 out of 97 papers were observed. The most common statement indicated that the dark web is a part of the deep web. 19 papers equate the terms darknet and dark web. Others do not distinguish between dark web and deep web, or between deep web and darknet.

show abstract

Section: Gathering Methods Of Onion Addressesmentioning

confidence: 99%

“…But marketplaces are also frequently duplicated. For example, the former Tor darknet marketplace AlphaBay was offered 165 times in a fake way under different onion addresses [6].…”

Section: Duplicates Of Onion Servicesmentioning

confidence: 99%

Inconsistencies in Darknet Researches

Platzer

Lux

2023

JCSANDM

View full text Add to dashboard Cite

show abstract

“…These attacks also require pre-existing fingerprints, limiting their applicability to known onion services. Fingerprint ambiguities due to factors like mirror websites [8,88] and characteristics of onion services can degrade precision [39,63]. Hence, an attack that can deanonymize IP addresses, eliminating exhaustive fingerprint collection, would be compelling, particularly when there is no prior knowledge of an onion service's existence.…”

Section: B Website Fingerprinting Of Tor Onion Servicesmentioning

confidence: 99%

Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum

Lopes,

Dong,

Castro

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Tor is one of the most popular anonymity networks in use today. Its ability to defend against flow correlation attacks is essential for providing strong anonymity guarantees. However, the feasibility of flow correlation attacks against Tor onion services (formerly known as "hidden services") has remained an open challenge. In this paper, we present an effective flow correlation attack that can deanonymize onion service sessions in the Tor network. Our attack is based on a novel distributed technique named Sliding Subset Sum (SUMo), which can be deployed by a group of colluding ISPs worldwide in a federated fashion. These ISPs collect Tor traffic at multiple vantage points in the network, and analyze it through a pipelined architecture based on machine learning classifiers and a novel similarity function based on the classic subset sum decision problem. These classifiers enable SUMo to deanonymize onion service sessions effectively and efficiently. We also analyze possible countermeasures that the Tor community can adopt to hinder the efficacy of these attacks.

show abstract

“…Aforementioned clear web crawlers such as Nutch or Mercator cannot be used without modifications to proxy a connection to the Tor network. For this reason, contributions have been 6 https://github.com/internetarchive/heritrix3 made in academia to develop time efficient and powerful dark web crawlers for acquiring and analysing web content from Tor and other ACNs.…”

Section: E Dark Web Crawlersmentioning

confidence: 99%

“…Program language: Python. [6] Self-developed N/A Used a crawler to find Tor sites that were identical. Program language: Python.…”

Section: Articlementioning

confidence: 99%

Exploring Dark Web Crawlers: A Systematic Literature Review of Dark Web Crawlers and Their Implementation

Bergman

Popov

2023

IEEE Access

View full text Add to dashboard Cite

Strong encryption algorithms and reliable anonymity routing have made cybercrime investigation more challenging. Hence, one option for law enforcement agencies (LEAs) is to search through unencrypted content on the Internet or anonymous communication networks (ACNs). The capability of automatically harvesting web content from web servers enables LEAs to collect and preserve data prone to serve as potential leads, clues, or evidence in an investigation. Although scientific studies have explored the field of web crawling soon after the inception of the web, few research studies have thoroughly scrutinised web crawling on the "dark web" or via ACNs such as I2P, IPFS, Freenet, and Tor. The current paper presents a systematic literature review (SLR) that examines the prevalence and characteristics of dark web crawlers. From a selection of 58 peer-reviewed articles mentioning crawling and the dark web, 34 remained after excluding irrelevant articles. The literature review showed that most dark web crawlers were programmed in Python, using either Selenium or Scrapy as the web scraping library. The knowledge gathered from the systematic literature review was used to develop a Tor-based web crawling model into an already existing software toolset customised for ACN-based investigations. Finally, the performance of the model was examined through a set of experiments. The results indicate that the developed crawler was successful in scraping web content from both clear and dark web pages, and scraping dark marketplaces on the Tor network. The scientific contribution of this paper entails novel knowledge concerning ACN-based web crawlers. Furthermore, it presents a model for crawling and scraping clear and dark websites for the purpose of digital investigations. The conclusions include practical implications of dark web content retrieval and archival, such as investigation clues and evidence, and the related future research topics.INDEX TERMS cybercrime, digital forensics, systematic literature review, dark web crawling, Tor

show abstract

Phishing With A Darknet: Imitation of Onion Services

Cited by 7 publications

References 19 publications

Inconsistencies in Darknet Researches

Inconsistencies in Darknet Researches

Flow Correlation Attacks on Tor Onion Service Sessions with Sliding Subset Sum

Exploring Dark Web Crawlers: A Systematic Literature Review of Dark Web Crawlers and Their Implementation

Contact Info

Product

Resources

About