Contents
Data captured by hackers – recently those from NZZ or CH-Media – often appear on the dark web. Why there?
It’s all about this: Sensitive data from the media companies CH Media and NZZ has once again ended up on the dark web. The hacker group “Play” published another sentence, the two media houses announced last week. Just a few days earlier, hackers had already published data from schools in the canton of Basel-Stadt on the dark web. The authorities apparently refused to pay the ransom. For the layman, the question arises as to why data captured by hackers is published on the dark web of all things – after all, not everyone can access the data without special effort.
It’s about the proof: “Cyber criminals are often not looking for a lot of attention – above all they want to show the victims of blackmail that they have actually captured data,” says SRF digital editor Jürg Tschirren. The risk of being caught after the publication of stolen data – for example, because the authors of the data publication could be traced back – is much lower on the Darknet than on the “normal” Internet. Hence the publication on the Darknet. However, some cybercriminals also use the dark web to offer stolen data such as passwords or credit card information for sale.
Above all, cybercriminals want to show the victims of blackmail that they have actually captured data.
This is the Dark Web: The dark web is a part of the internet that is not accessible via traditional search engines or browsers. It is a network of encrypted websites and services that can only be accessed through special software such as the so-called TOR browser. On the dark web, users can remain anonymous and disguise their identities and activities. It is often associated with illegal activities such as drug dealing, arms dealing, or child pornography. However, there are also legitimate reasons to use the dark web, such as protecting privacy and circumventing censorship and surveillance in authoritarian regimes.
How the dark web works: On the “normal” Internet, a request for access to a website goes to a server via a browser. This sends the request to the relevant website. The operator of the server sees where the request comes from and which website is accessed. In the dark web, the TOR browser also sends the corresponding request to a server, but in this case the sender is no longer recognizable – this is similar to when a car drives into a tunnel, the license plate number is exchanged there and it is changed when you exit has a new identity. If, in the case of the TOR browser, this is done several times in a row via several servers, it is practically impossible to find out the original sender. The destination of the request is also obfuscated in the same way.
How to trick TOR: Theoretically, however, it is also possible to unmask a sender or addressee on the Darknet. For example, special police departments or secret services control a large number of these servers, figuratively speaking, many of these tunnel entrances and exits. After extensive research, the specialists can in some cases trace back the data exchange and still find out who is originally behind a server request.