October 22, 2018

Demystifying The Dark Web: Peeling Back the Layers of Tor’s Onion Services

by Philipp Winter, Annie Edmundson, Laura Roberts, Agnieskza Dutkowska-Żuk, Marshini Chetty, and Nick Feamster

Want to find US military drone data leaks online? Frolick in a fraudster’s paradise for people’s personal information? Or crawl through the criminal underbelly of the Internet? These are the images that come to most when they think of the dark web and a quick google search for “dark web” will yield many stories like these. Yet, far less is said about how the dark web can actually enhance user privacy or overcome censorship by enabling anonymous browsing through Tor. Recently, for example, Brave, dedicated to protecting user privacy, integrated Tor support to help users surf the web anonymously from a regular browser. This raises questions such as: is the dark web for illicit content and dealings only? Can it really be useful for day-to-day web privacy protection? And how easy is it to use anonymous browsing and dark web or “onion” sites in the first place?

To answer some of these pressing questions, we studied how Tor users use onion services. Our work will be presented at the upcoming USENIX Security conference in Baltimore next month and you can read the full paper here or the TLDR version here.

What are onion services?: Onion services were created by the Tor project in 2004. They not only offer privacy protection for individuals browsing the web but also allow web servers, and thus websites themselves, to be anonymous. This means that any “onion site” or dark web site cannot be physically traced to identify those running the site or where the site is hosted. Onion services differ from conventional web services in four ways. First, they can only be accessed over the Tor network. Second, onion domains, (akin to URLs for the regular web), are hashes over their public key and consist of a string of letters and numbers, which make them long, complicated, and difficult to remember. These domains sometimes contain prefixes that are human-readable but they are expensive to generate (e.g. torprojectqyqhjn.onion). We refer to these as vanity domains. Third, the network path between the client and the onion service is typically longer, meaning slower performance owing to longer latencies. Finally, onion services are private by default, meaning that to find and use an onion site, a user has to know the onion domain, presumably by finding this information organically, rather than with a search engine.

What did we do to investigate how Tor users make use of onion services?: We conducted a large scale survey of 517 Tor users and interviewed 17 Tor users in depth to determine how users perceive, use, and manage onion services and what challenges they face in using these services. We asked our participants about how they used Tor’s onion services and how they managed onion domains. In addition, we asked users about their expectations of privacy and their privacy and security concerns when using onion services. To compliment our qualitative data, we analyzed “leaked” DNS lookups to onion domains, as seen from a DNS root server. This data gave us insights into actual usage patterns to corroborate some of the findings from the interviews and surveys. Our final sample of participants were young, highly educated, and comprised of journalists, whistleblowers, everyday users wanting to protect their privacy to those doing competitive research on others and wanting to avoid being “outed”. Other participants included activists and those who wanted to avoid government detection for fear of persecution or worse.

What were the main findings? First, unsurprisingly, onion services were mostly used for anonymity and security reasons. For instance, 71% of survey respondents reported using onion services to protect their identity online. Almost two thirds of the survey respondents reported using onion services for non-browsing activities such as TorChat, a secure messaging app built on top of onion services. 45% of survey participants had other reasons for using Tor such as to help educate users about the dark web or for their personal blogs. Only 27% of survey respondents reported using onion services to explore the dark web and its content “out of curiosity”.

Second, users had a difficult time finding, tracking, and saving onion links. Finding links: Almost half of our survey respondents discovered onion links through social media such as Twitter or Reddit or by randomly encountering links while browsing the regular web. Fewer survey respondents discovered links through friends and family. Challenges users mentioned for finding onion services included:

  • Onion sites frequently change addresses and so often onion domain aggregators have broken and out of date links.
  • Unlike traditional URLS, onion links give no indication of the content of the website so it is difficult to avoid potentially offensive or illicit content.
  • Again, unlike traditional URLS, participants said it is hard to determine through a glance at the address bar if a site is the authentic one you are trying to reach instead of a phishing site.

A frequent wish expressed by participants was for a better search engine that is more up to date and gives an indication of the content before one clicks on the link as well as authenticity of the site itself.

Tracking and Saving links: To track and save complicated onion domains, many participants opted to bookmark links but some did not want to leave a trace of websites they visited on their machines. The majority of other survey respondents had ad-hoc measures to deal with onion links. Some memorized a few links and did so to protect privacy by not writing the links down. However, this was only possible for a few vanity domains in most cases. Others just navigated to the places where they found the links in the first place and used the links from there to open the websites they needed.

Third, onion domains are also hard to verify as authentic. Vanity domains: Users appreciated vanity domains where onion services operators have taken extra effort and expense to set up a domain that is almost readable such as the case of Facebook’s onion site, facebookcorewwwi.onion. Many participants liked the fact that vanity domains give more indication of the content of the domain. However, our participants also felt vanity domains could lead to more phishing attacks since people would not try to verify the entire onion domain but only the readable prefix. “We also get false expectations of security from such domains. Somebody can generate another onion key with same facebookcorewwwi address. It’s hard but may be possible. People who believe in uniqueness of generated characters, will be caught and impersonated.” – Participant S494

Verification Strategies: Our participants had a variety of strategies such as cutting and pasting links, using bookmarks, or verifying the address in the address bar to check the authenticity of a website. Some checked for a valid HTTPS certificate or familiar images in the website. However, a over a quarter of our survey respondents reported that they could not tell if a site was authentic (28%) and 10% did not even check for authenticity at all. Some lamented this is innate to the design of onion services and that there is not real way to tell if an onion service is authentic epitomized by a quote from Participant P1: “I wouldn’t know how to do that, no. Isn’t that the whole point of onion services? That people can run anonymous things without being able to find out who owns and operates them?”

Fourth, onion lookups suggest typos or phishing. In our DNS dataset, we found similarities between frequently visited popular onion sites such as Facebook’s onion domain and similar significantly less frequently visited websites, suggesting users were making typos or potentially that phishing sites exist. Of the top 20 onion domains we encountered in our data set, 16 were significantly similar to at least one other onion domain in the data set. More details are available in the paper.

What do these findings mean for Tor and onion services? Tor and onion services do have a part to play in helping users to protect their anonymity and privacy for reasons other than those usually associated with a “nefarious” dark web such as support for those overcoming censorship, stalking, and exposing others’ wrong-doing or whistleblowing. However, to better support these uses of Tor and onion services, our users wanted onion service improvements. Desired improvements included more support for Tor in general in browsers, improvement in performance, improved privacy and security, educational resources on how to use Tor and onion services, and finally improved onion services search engines. Our results suggest that to enable more users to make use of onion services, users need:

  • better security indicators to help them understand Tor and onion services are working correctly
  • automatic detection of phishing in onion services
  • opt in publishing of onion domains to improve search for legitimate and legal content
  • better ways to track and save onion links including privacy preserving onion bookmarking.

Future studies to further demystify the dark web are warranted and in our paper we make suggestions for more work to understand the positive aspects of the dark web and how to support privacy protections for everyday users.

You can read more about our study and its limitations here (such as the fact our participants were self-selected and may not represent those who do use the dark web for illicit activities for instance) or skim the paper summary.

When The Choice Is To Delete Facebook Or Buy A Loaf Of Bread

By Julieanne Romanosky and Marshini Chetty

In the last week, there has been a growing debate around Facebook and privacy. On Twitter, the newly formed #deletefacebook movement calls for users who are upset over the data breach of over 50 million Facebook accounts by Cambridge Analytica to rid themselves of the platform altogether. But like others have stated, deleting Facebook may not be the easy option for everyone on the platform because in some countries, Facebook is the Internet. In fact, in 63 countries around the world, Facebook has introduced the Free Basics platform which includes Facebook and offers marginalized users limited “free” browsing on the Internet. More importantly, our recent study, jointly conducted with the University of Maryland [5], suggests that deleting Facebook and Free Basics for low income users could be the difference between saving enough money to afford a loaf of bread or not.

What is Facebook’s Free Basics and why is it being used by low income users?: Free Basics was founded in 2013 by Facebook with the goal of connecting rural and low-income populations to the Internet for the first time. While Free Basics appears as a single app, it is actually a platform for hosting a variety of data-charge free or “zero-rated” applications and the available content changes depending on the country and unpaid partnerships with local service providers, i.e., no two Free Basics offerings are the same. However, all versions provide access to a lite version of Facebook (with no images or video) and select other third party apps such as Bing and Wikipedia. Educational materials, news, weather reports dominate the application topics in Free Basics across countries. Other apps cover health care, job listings, search engines, and classifieds. Here is what the app interface looks like in South Africa:

Free Basics in South Africa

What did we do to investigate Facebook and Free Basics usage?: We interviewed 35 Free Basics users in South Africa, one of the countries that the platform is offered in. We spoke to a combination of current low-income users and non-regular student users. Including both groups in our study allowed us to form a more comprehensive understanding of the impact of zero-rated services, the factors that affect the adoption of these services, and the possible use of these services in more developed countries than if we studied users or non-users alone or those who were unconnected and low-income only. Both groups were asked to talk about their online habits (i.e. time spent online, what websites or apps they used etc), how much money they typically spent on Internet access, and how, if at all, they worked to keep their mobile Internet costs down.

How do low income users use Facebook’s Free Basics?: We found, particularly, the low income users on Free Basics were able to cut their mobile data costs significantly, with one participant in our study exclaiming that they could now afford a loaf of bread with the money saved from being online for “free”. The service also drove users to the “free” apps included in the platform even when they preferred other apps that were not “free” to use. Interestingly, all the participants who used Free Basics regularly were not “unconnected” users who had never been online prior to using the platform. Instead, these participants had been using the Internet as paying customers but they had heard about the platform from others (often through word of mouth) as a way to save on Internet costs. For these users, deleting Facebook and its relevant resources would be like deleting a lifeline in an already expensive data landscape. The platform was not without limitations for our participants however. Since our participants were already online, they were also very conscious of the fact that the apps included in the platform were, in their perception, “second-rate” – for instance, the Facebook app on the platform does not include images or video unless users pay for them. [Read more…]

Avoid an Equifax-like breach? Help us understand how system administrators patch machines

The recent Equifax breach that leaked around 140 million Americans’ personal information was boiled down to a system patch that was never applied, even after the company was alerted to the vulnerability in March 2017.

Our work studying how users manage software updates on desktops and mobile tells a story that keeping machines patched is far from simple. Often, users do not want to apply patches because they do not trust the vendors who create the patches, the patches are applied in ways that cause too much downtime, or because the user interface changes updates make, upset users’ workflow. However, if we are going to better understand and help improve the way patches are applied so that breaches like the Equifax one are easier to avoid, we need to also study how system administrators patch multiple machines. The end goal of this work is to improve the software updating experience for everyday users as well as system administrators and enhance cybersecurity overall—after all what’s a patch really worth if it’s never installed.

You can help us to achieve this goal by forwarding our survey for system administrators who manage software updates to people you know in the United States who are over 18 years of age. If you are a system administrator who manages updates for your organization, we’d greatly appreciate you taking 10-15 minutes to complete this survey. System administrators who manage updates can also participate by signing up for an hour remote interview. As a token of our appreciation, we are raffling off a Samsung Galaxy S8 to participants who complete the survey. Each interviewees will also be given a $20 Amazon gift card.

To learn more about our work, visit our project page, and please reach out to us at any time if you have any questions.