Last August we began an inventory of the content found within the dark web. The claim remains the same: the content found on the dark web hardly differs from that of the standard web. Browsing this space and publishing on it in complete anonymity, however, makes most of these actions ill-intentioned.
The dark web is thus a variation on the standard web, with an added measure of freedom.
Following on from the previous article, this one deals with the following content:
Code repositories
The dark web contains many sites hosting code. The obvious parallel on the standard web is GitHub, a web service for managing and hosting software development.
The dark web has these web services too, in derived versions.
Ill-intentioned people can be found there. They offer ready-to-use malware, or personal backups of code repositories. The aim is always the same: to find a space for free and uncensored expression. That philosophy, which is constitutive of the dark web, means code repositories can be malicious in nature (as in the screenshot below) just as easily as harmless, with communities of open source software developers or personal backups kept for educational purposes.
A developer’s personal site on the dark web is shown in the screenshot below. It appears to be still active: the projects presented go back several years, but some are updated regularly.
On investigation, the exposed code appears harmless, and is an identical copy of their GitHub on the standard web.
The developer also states a preference for the code behind their projects to be consulted on the dark web, so as to guarantee absolute freedom.
Private repository containing various copies of source code
Example of malware freely available on the dark web; the source code is published so that any attacker can make it their own.
Community site for developers attached to open source projects
Finally, on the boundary between source code hosting and file hosting, the dark web also has ‘paste’ web services — popularised on the standard web by the best known of them, Pastebin.
Pastebin is a web application for publishing a message in text form, usually source code or URLs, anonymously and publicly.
These applications are popular and easy to use, allowing text to be posted and published quickly. They exist on the dark web too, offering stronger anonymity and a guaranteed freedom of tone.
These services can therefore be used:
- to circulate malware source code quickly between malicious actors,
- to post download links for data leaks
- or to publish small ads for the sale of weapons or drugs.
Page of the DeepPaste site, one of the main pastes on the dark web.
The service also offers several display and publishing options.
File hosting sites
The second-to-last category of site found within the dark web is file hosting. As with the previous categories, this type of digital service follows the same pattern as on the standard web, with a few additions of its own.
What is hosted on these sites is accordingly varied, from the most ordinary to the most sensitive. Press reviews can be found, as seen in the first part of this trilogy on the different types of dark web site, along with malware and data leaks. There are as many hosting sites as there are types of file to host.
Showcase site of a cybercriminal group
In the screenshot above we find public projects linked to cybercriminal communities — here, Darkmode Repository. The folder names (‘hall of shame’ and ‘marketplace’) leave little room for doubt, and the associated activities are easy to imagine.
This kind of file hosting site can serve, for instance, as a shop window for a community of hackers. It is a way for them to gain exposure and sell more hacking and cyberattack services — or simply a matter of honour, and of establishing their standing in a competitive environment.
Still in the realm of illegal activity, there are sites hosting some or all of the files from data leaks. These leaks, obtained through cyberattacks, are exposed on the dark web as a means of coercion, to press the victim into paying a ransom (as in a ransomware attack).
These attacks, which spread widely with the Covid-19 pandemic, exponentially accelerated the exposure surface of information systems, and with it the number of attacks.
The screenshot above illustrates a data leak caused by ransomware against a large company. The company having chosen not to pay the ransom, the cybercriminal group decided to publish some of the stolen data in the open.
Freely accessible site hosting private data obtained through a cyberattack
Online library of freely accessible software
Finally, there are more ‘conventional’ file hosting sites. These software libraries let visitors pick the programs they want through clearly labelled categories.
The screenshot below shows the Digital Thrift Shop site, where users can download:
- data leaks (dataleak)
- databases
- malware (ransomware)
- but also books,
- and educational videos.
In the end, the dark web contains the same types of site as the standard web. The guaranteed freedom of expression and anonymity, however, allow criminal activity to flourish.
A lawless territory, the dark web carries as many risks as it does freedoms. This inventory shows that the dark web, while an integral part of the web, is a space of its own, ruled by anarchy, commercial logic and free expression.