Posted on June 14, 2018

A cybersecurity company sets a trap to see what happens to personal and proprietary information once it hits the dark net. The results should be a red flag and frighten everyone.  

While many may have heard about the ‘dark net’, only those that are embedded as part of cybercrime or the ones that are fighting it, are familiar with this segment of the internet. For the rest of us, it is a topic wrapped in mystery and a place that we dare not go. But this is the location where all of the stolen personal identity data can be found and one cyber security company set out to find out exactly how fast the information is exchanged.

Bitglass, a security company made the decision to ‘bait’ cybercriminals and then follow the bread crumbs. They created fake spreadsheets containing false data: social security numbers, names, credit card numbers, phone numbers and addresses. They ‘watermarked’ the spreadsheets so that when they were either opened or downloaded it would secretly transmit the IP address, country of origin and device type back to them.

The experiment was designed to last twelve days and they then placed the spreadsheets in locations on the dark net known to buy and sell personal information as well as other sites that were famous for the black market dealings: DropBox, Paste-slampeech and Onion-pastebin. The spreadsheet information did not contain any ‘ownership’ identity, nor was there any charge or fee to download/open. For experienced cybercriminals, this may have been a red flag as a setup, but it didn’t stop the rest.

In the twelve days, the company monitored the transmissions as they watched it travel to over twenty two different countries and was viewed almost 1,100 times. The information was spread over five continents, and most of those were in North America, Europe, Africa, Asia and South America. There were forty seven different parties involved in downloads, with most of those in Nigeria, Brazil and Russia, with the highest percentage in Nigeria and Russia.

CEO of Bitglass, Nat Kausik, stated: “Our goal was to see how liquid the market is for breached data. We were curious to see what happens to it after a breach.” Kausik also made note that there was a significant percentage of participation from overseas university networks. These are locations that are known to have the availability of open WiFi.

For the perpetrators, anyone that may have tried to use the fake credit card or identity information would have immediately seen a failure and realized that they had been duped. Bitglass couldn’t follow any activity beyond just the files themselves, but the experiment did demonstrate both the speed and access of private data.

Whether you have left your network unprotected, experienced a breach or didn’t place priority on shredding important proprietary documents, criminals are willing to do just about anything to gain this information and there is a market on the dark net to make profit.

Protecting your data is now considered part of doing business.