Dark underbelly lurks, waiting to strike
Information sinking into the deep web puts your identity at risk
Tangled and sinister — the dark web is as foreboding as it sounds. It’s where stolen identities go to die, only to rise zombie-like from the dead.
“Having your information on the dark web can mean your personal information is at risk,” said a representative from Experian. “Your Social Security number, phone number, even email address can be compromised.”
Experian is the leading global information services company, providing data and analytical tools. The company collected a panel of security experts to discuss the dark web and how consumers can protect their personal data from appearing on it.
Mike Bruemmer is vice president of consumer protection at Experian. Eva Velasquez is CEO of the Identity Theft Resource Center. Patrick O’Toole Sr. manages security operations at PenFed Credit Union.
Trending AR VR Articles:
As Experian explained, the internet can be looked at as three different levels: publicly available world wide web, the deep web and the dark web.
“The dark web acts as a marketplace for thieves,” Velasquez said. “There they can buy and sell personally identifiable information and services.”
Bruemmer has an article at SecurityInfoWatch that explains what the dark web is and how to keep yourself safe.
“Think of an iceberg with the top being the open internet,” he said. “The deep web is under the surface with the dark web on the bottom.”
Peeling Onion
O’Toole recalled that the dark web had government origins.
“It’s essentially The Onion Router — or TOR — Network, which was established and developed by the U.S. Naval Research Lab and Defense Advanced Research Projects Agency,” he said. “It was established as a means for people to browse the internet anonymously. They could get around firewalls in case their government shut down internet traffic.
“The dark web can only be accessed if you have a certain type of software — operating pretty similarly to a virtual private network.”
To keep yourself off the dark web, the Ask Experian Blog helps you know what everyday things can put your identity at risk.
“Per Experian, 93 percent of the internet is the deep web,” Velasquez said. “It includes internal company sites, school intranets and business databases versus the dark web, which is a hidden network of websites.”
There are ever-greater depths.
“The deep web is a place that cannot be accessed by standard search engines,” Bruemmer said. “The dark web is a subset of the deep web and uses proprietary protocols.
“The TOR network is an example of a browser used to access the dark web,” he said.
Going deep
O’Toole described the three layers of the internet: the “surface” web, the “deep” web and the “dark” web:
- The “surface” web is any website that can be searched and indexed by a typical search engine that we are all familiar with: Google or Bing. You can find their websites by typing information into them.
- The next layer is the “deep” web, which is anything that a surface search engine can’t find. An example would be a college’s online library’s database. It is publicly accessible. You just have to search for their hosted content.
- The next layer is the “dark” web. This is a closed environment not accessible from the surface internet and it is intentionally hidden from open access.
“To be able to access the dark web you need a specific software application like the TOR browser to access the content,” O’Toole said. “Even then, you do not have full access to the various sites you may find there.”
Information gets on the dark web in conventional ways.
“It’s posted in blogs, websites and chat rooms just like the open internet,” Bruemmer said. “Keep in mind, the dark web has mostly stolen info.”
This year alone, there have been over 22 million records exposed from data breaches, as recorded by the Identity Theft Resource Center.
“These records do not always end up on the dark web but are at risk,” Velasquez said.
Deceptive appearances
At first glance, the subsurface might seem conventional.
“A lot of the dark web is comprised of marketplaces, chat forums and other e-commerce sites,” O’Toole said. “Personal data found on the dark web can be from a data breach where information is stolen from legitimate sources.
“Things up for sale on marketplaces include stolen credit card, bank account and social security numbers,” he said. “Hackers get this data from breaches at restaurants, stores and banks. They can sell it on the dark web in exchange for other goods.”
O’Toole added that “plenty of criminal and illegal activity occurs on the dark web. Stolen goods, illegal drugs, guns or stolen personal data are up for purchase.”
Underworld transactions are matters of take and give.
“Sellers will post that they have personal data for sale in various chat rooms and market places,” O’Toole said. “Buyers can purchase them directly by providing the desired payment for the item.
“Oftentimes, sellers will barter with buyers for other goods or sell items in exchange for bitcoin currency,” he said. “There isn’t much dollars-and-cents exchange taking place on the dark web.”
According to Experian, social data can be sold for as little as $1. A passport goes for up to $1,000 to $2,000.
For more information, the Ask Experian Blog explains what other information is sold for on the dark web.
Online shoppers
“It’s just like online shopping for thieves,” Velasquez said. “Add a single Social Security number to your cart or buy in bulk.”
The exchange can even take on a bucolic atmosphere.
“Think of a farmer’s market,” Bruemmer said. “You can sample and buy what you want. Remember, you have to pay in bitcoin or another similar currency.”
Virtually any piece of data can be traded or sold on the dark web.
“Most of the information is credit cards and email account info,” Bruemmer said. “However, any personally identifiable information can be found at a price.
“You can find the plans for the MQ-9 Reaper Drone there, according to the Wall Street Journal,” he said.
Old-fashioned economics drive the cost or value of information sold on the dark web.
“It is the law of supply and demand,” Bruemmer said. “However — especially with credit cards — it also depends how new they are. Like the farmer’s market, fresher is better, but the data never goes completely bad.”
The “good stuff” is like gold.
“The more sensitive the information, the more valuable it is to thieves who intend to use it for nefarious purposes,” Velasquez said.
Good hygiene
Rather than wonder if your data is on the dark web, the better question might be, “How do you know your information isn’t there?”
“Don’t wait to find out if your information is on the dark web,” Velasquez said. “There are simple things you can do every day to keep up good identity hygiene.”
In fact, Experian’s blog includes an article by Velasquez, “What Identity Theft Has in Common with Brushing Your Teeth.”
Bruemmer recommended the free Experian Triple Dark Web Scan for Social Security numbers, email and phone numbers. As he noted, “Sandra’s birthday invite is valuable.”
O’Toole also suggested prevention programs.
“Services provided by organizations such as LifeLock will monitor for your personal data on the dark web,” he said. “You provide them the information you’d like them to monitor. They can alert you if it appears on the dark web or any risky site.
“We highly recommend taking advantage of these services,” he said.
All is not lost if information is on the dark web.
“Credit monitoring services from large or reputable organizations are great to have,” O’Toole said. “Also, explore the options to ‘freeze’ your credit so it is harder for others to open accounts without your knowledge.”
Those who need help after identity theft can contact Identity Theft Resource Center advisers at (888) 400–5530. They can assist with questions and provide a remediation plan for free.
“Monitor your accounts, get a new credit card, un-publish your cellphone number and be aware of any strange free credit offers,” Bruemmer said.
First, protect
Before theft occurs, there are ways to protect your identity.
“Experian’s IdentityWorks theft protection is a great preventative measure, but your own awareness is your best friend,” Bruemmer said.
“Look out for strange junk mail, funny financial transactions or an increase in spam phone calls,” he said. “These may be early indicators.”
The best protection is being smart.
“Bottom line: be aware and safe on the internet,” O’Toole said. “Don’t use the same password for every account. Use complex passwords. Know the signs of internet phishing.
“Use a credit-monitoring service,” he said. “Keep a close watch on your various accounts — bank and credit. Your credit scores and reports are a good source. Also ensure you take advantage of free yearly credit score reports.”
If skepticism doesn’t reap rewards, it might prevent loss.
“Phishing is the №1 way people get their information stolen,” O’Toole said. “If it sounds too good to be true, it probably is. Stay wary and stay safe online.”
Don’t compound mistakes by making more mistakes.
“Stop reusing passwords,” Velasquez said. “If one account is breached, that means your other accounts that have that same password are also exposed. Only use strong, unique passwords and two-factor authentication.”
Practicing the “good identity hygiene” she mentioned, Velasquez urged consumers to take those skills and fix their accounts.
About The Author
Jim Katzaman is a manager at Largo Financial Services and worked in public affairs for the Air Force and federal government. You can connect with him on Twitter, Facebook and LinkedIn.
