Unit 5: Dark Web, Email, and Web Attacks - Subjective Questions

Surface Web:

• It consists of publicly accessible websites indexed by conventional search engines.
• Examples include news portals, public blogs, and educational websites.

Deep Web:

• It includes internet resources that are not indexed by ordinary search engines.
• Examples include private databases, subscription services, cloud storage, email inboxes, and online banking portals.
• The Deep Web is not inherently illegal; most of its content is private or access-controlled.

Dark Web:

• It is a deliberately hidden portion of the Deep Web that requires special software or authorization to access.
• Dark Web services may use anonymity networks such as Tor and addresses ending in .onion.
• It supports legitimate privacy-related activities but may also host illegal marketplaces, stolen data, malware services, and criminal forums.

Key distinction: The Surface Web is publicly indexed, the Deep Web is unindexed or restricted, and the Dark Web is intentionally concealed through anonymity technologies.

Dark Web anonymity is commonly provided through networks such as Tor, which uses onion routing.

Working principle:

1. The user's traffic is encrypted in multiple layers.
2. It is forwarded through a sequence of relays, typically an entry relay, a middle relay, and an exit relay.
3. Each relay removes only one encryption layer and knows only the previous and next hop.
4. Hidden services can communicate without directly revealing the server's public IP address.

Forensic challenges:

• IP address concealment: Investigators cannot normally identify a user from the destination's logs alone.
• Traffic encryption: Network monitoring may reveal Tor usage but not necessarily the content being exchanged.
• Pseudonyms: Offenders may use multiple aliases and disposable identities.
• Cryptocurrency payments: Transactions may require blockchain analysis and correlation with exchange records.
• Cross-border infrastructure: Relays, servers, victims, and suspects may be located in different jurisdictions.
• Volatile content: Marketplaces and forums may disappear quickly or frequently change addresses.
• Operational security: Criminals may use encryption, virtual machines, secure deletion, and cryptocurrency mixing services.

Investigators therefore rely on lawful traffic correlation, endpoint forensics, undercover operations, metadata analysis, blockchain analysis, seized-server evidence, and mistakes made by suspects.

A Dark Web investigation may follow these steps:

1. Receive and assess the complaint: Identify the alleged activity, victims, aliases, marketplace names, URLs, transaction identifiers, and relevant dates.
2. Obtain legal authorization: Secure warrants, court orders, or organizational approval before surveillance, account access, seizure, or undercover activity.
3. Preserve online content: Capture pages, timestamps, source information, messages, advertisements, and cryptographic hashes. Screenshots should be supported by more complete forensic captures where possible.
4. Collect network and endpoint evidence: Acquire relevant devices, memory images, browser artifacts, Tor configuration files, downloads, chat records, and wallet data.
5. Analyze identities and aliases: Correlate usernames, writing styles, email addresses, public-key fingerprints, reused images, and activity times across platforms.
6. Trace financial activity: Examine cryptocurrency addresses, transaction graphs, exchange deposits, withdrawals, and legally obtained customer records.
7. Correlate infrastructure: Analyze seized servers, hosting records, domain information, login records, and misconfigurations that may expose an IP address.
8. Conduct controlled operations: Where legally permitted, investigators may make controlled purchases or interact with suspects while documenting every action.
9. Maintain chain of custody: Record who collected, transferred, stored, examined, and presented each item of evidence.
10. Report findings: Present methods, timelines, hashes, limitations, and conclusions in a clear and reproducible report.

The investigation must remain legally authorized, ethically controlled, and forensically sound throughout.

Legal issues:

• Investigators may require warrants or court orders for searches, surveillance, account information, or device seizure.
• International infrastructure creates jurisdiction and mutual legal assistance problems.
• Undercover participation must remain within legal and organizational limits.

Ethical issues:

• Investigators should avoid unnecessary collection of innocent users' information.
• Exposure to illegal or harmful content must be handled under approved procedures.
• Controlled purchases and interactions should not amount to unauthorized encouragement of crime.

Evidentiary issues:

• A username or cryptocurrency address does not independently prove a person's identity.
• Web content can be altered, deleted, or fabricated.
• Screenshots alone may not establish authenticity or completeness.
• Evidence must be preserved with timestamps, metadata, cryptographic hashes, and a documented chain of custody.
• Conclusions should be based on corroboration among endpoint evidence, communications, financial records, server data, and witness testimony.

Thus, technical attribution must be combined with legal authorization, careful documentation, and multiple independent sources of evidence.

An email system contains the following major components:

• Mail User Agent (MUA): The client used to compose, send, read, and organize messages, such as a desktop client or webmail interface.
• Mail Submission Agent (MSA): Accepts an outgoing message from an authenticated user and submits it for delivery.
• Mail Transfer Agent (MTA): Transfers email between mail servers, normally using SMTP.
• Domain Name System (DNS): Provides mail exchanger or MX records that identify the receiving mail server for a domain.
• Mail Delivery Agent (MDA): Places the received message in the recipient's mailbox.
• Mailbox server: Stores messages until they are accessed by the recipient.
• POP3 or IMAP service: Allows an email client to retrieve or synchronize messages.

Typical flow:

1. The sender composes a message in an MUA.
2. The message is submitted to an outgoing mail server.
3. The sending server queries DNS for the recipient domain's MX record.
4. SMTP transfers the message to the receiving server.
5. The receiving server stores it in the recipient's mailbox.
6. The recipient reads it through webmail, IMAP, or POP3.

An email message is generally divided into the header and the body.

Important header fields include:

• From: Claimed sender address.
• To and Cc: Primary and copied recipients.
• Date: Claimed message creation time.
• Subject: Message topic.
• Message-ID: Identifier usually generated by a mail system.
• Received: Records added by mail servers as the message travels through them.
• Reply-To and Return-Path: Reply destination and envelope return address.
• Content-Type: Indicates plain text, HTML, multipart content, or attachments.
• Authentication results such as SPF, DKIM, and DMARC evaluations.

Body and attachments:

• The body may contain plain text or HTML.
• MIME enables attachments, alternative body formats, and encoded binary data.

Forensic significance:

• Headers can help reconstruct the delivery route and timeline.
• They may reveal originating systems, mail servers, spoofed fields, authentication failures, and inconsistencies.
• Message IDs and timestamps can correlate an email with server logs and other mailbox records.

A header must be interpreted carefully because user-controlled fields can be forged, while server-added records are generally more useful when independently verified.

SMTP:

• Used to submit and transfer outgoing email.
• Operates between clients and submission servers and between mail servers.
• SMTP logs can show sender and recipient envelopes, queue identifiers, delivery status, timestamps, and server connections.

POP3:

• Used mainly to download messages from a server to a client.
• Messages may be removed from the server after download, depending on configuration.
• Relevant evidence may therefore remain primarily on the local device.

IMAP:

• Synchronizes mailboxes and folders between a server and one or more clients.
• Messages usually remain on the server, and actions such as reading, moving, or deleting may be synchronized.
• Both server-side and client-side artifacts can be significant.

Comparison:

• SMTP is primarily a sending and transfer protocol.
• POP3 is primarily a download-oriented retrieval protocol.
• IMAP is a server-based synchronization protocol.

Encrypted variants or secure sessions protect traffic in transit, but investigators may still recover evidence from endpoints, server logs, mailbox exports, and authorized provider records.

A complete email-header analysis involves the following procedure:

1. Preserve the original message: Export it in a format that retains the full header, body, attachments, and metadata.
2. Review the Received fields: Read them from the bottom upward because each mail server normally prepends a new entry.
3. Construct the route: Record server names, IP addresses, protocol details, and timestamps for each hop.
4. Normalize time zones: Convert timestamps to a common time zone before building the timeline.
5. Identify the earliest credible hop: The oldest trustworthy server-added entry may indicate the sending host or submission service.
6. Check DNS and IP information: Examine domain resolution, MX records, IP ownership, hosting providers, and whether an address is private or public.
7. Compare identity fields: Look for inconsistencies among From, Reply-To, Return-Path, envelope sender, and sending domain.
8. Evaluate SPF, DKIM, and DMARC: Determine whether the sending IP was authorized, the signed content remained intact, and domain alignment policies passed.
9. Correlate with logs: Compare timestamps, message IDs, queue IDs, and IP addresses with gateway, server, firewall, and provider logs.
10. State limitations: A header may contain forged fields, compromised servers, VPN addresses, relays, or provider infrastructure rather than the offender's physical location.

Attribution should be based on corroborated records rather than a single IP address or header field.

Common forms of email-related crime include:

• Phishing: Deceptive messages designed to steal credentials or sensitive information.
• Spear phishing: Highly targeted phishing tailored to a particular individual or organization.
• Business Email Compromise: Impersonation or takeover of a business account to redirect payments or obtain confidential information.
• Email spoofing: Forging visible sender information to make a message appear legitimate.
• Malware distribution: Delivering malicious attachments or links that install ransomware, spyware, or remote-access malware.
• Spam and scams: Sending unsolicited advertisements, advance-fee fraud, lottery scams, or fake investment offers.
• Harassment and threats: Using email to intimidate, stalk, blackmail, or repeatedly abuse a victim.
• Data exfiltration: Sending confidential files outside an organization through email.
• Account takeover: Gaining unauthorized control of a mailbox and using it to steal information or impersonate the owner.

Investigators examine headers, mailbox activity, authentication logs, message content, attachments, URLs, endpoint artifacts, and financial records to establish the nature and source of the offense.

A complete email crime investigation may include:

1. Complaint and scope definition: Record the incident, affected accounts, suspected messages, financial impact, and relevant time range.
2. Legal and administrative authorization: Obtain consent, warrants, preservation requests, or court orders as required.
3. Immediate preservation: Prevent deletion by preserving mailboxes, provider records, server logs, authentication logs, and affected devices.
4. Evidence acquisition: Export original messages with complete headers, acquire mailbox files, image devices, and collect gateway or cloud audit logs.
5. Integrity verification: Calculate hashes, for example using SHA-256, and document collection tools and conditions.
6. Header and routing analysis: Examine Received fields, message IDs, timestamps, return paths, and authentication results.
7. Content examination: Analyze message text, HTML, attachments, embedded objects, URLs, and social-engineering language.
8. Account analysis: Review login IP addresses, forwarding rules, delegated access, password changes, multifactor events, and sent or deleted messages.
9. Endpoint and malware analysis: Examine browser history, downloads, persistence mechanisms, memory, and suspicious programs in an isolated environment.
10. Correlation: Combine email evidence with DNS, firewall, proxy, financial, provider, and witness information.
11. Timeline and attribution: Build a normalized chronology and distinguish verified facts from inferences.
12. Reporting and presentation: Explain the methods, evidence hashes, findings, limitations, and conclusions in a reproducible manner.

Chain of custody must be maintained throughout every stage.

Preservation and acquisition measures include:

• Preserve the original message rather than relying only on a screenshot or forwarded copy.
• Export messages in a format that retains complete headers, body content, attachments, folder information, and relevant metadata.
• Place legal preservation requests with service providers when records may expire.
• Acquire mailbox containers and create forensic images of relevant devices where authorized.
• Collect related mail-server, authentication, gateway, DNS, proxy, and cloud audit logs.
• Record the device, account, date, time, time zone, tool, operator, and acquisition procedure.
• Calculate a cryptographic hash, such as SHA-256, for acquired evidence. If the evidence is represented by data , its integrity value can be recorded as .
• Store master copies in protected, access-controlled storage and conduct analysis on verified working copies.
• Maintain a chain-of-custody log showing every collection, transfer, access, examination, and return.
• Document any unavoidable alteration, such as provider-side export changes or format conversion.

These controls help demonstrate that the evidence presented is the same evidence that was collected and that it was not improperly modified.

Technical indicators:

• Mismatch among From, Reply-To, Return-Path, and envelope-sender domains.
• SPF, DKIM, or DMARC failures and domain-alignment problems.
• Suspicious or inconsistent Received entries.
• Recently registered, misspelled, or look-alike domains.
• Displayed hyperlinks that differ from their actual destination.
• Unexpected attachments, risky file types, or misleading filename extensions.
• Login activity or sending infrastructure inconsistent with the claimed sender.

Content-based indicators:

• Urgent requests for payment, credentials, gift cards, or confidential information.
• Threats, artificial deadlines, or pressure to bypass normal procedures.
• Unusual grammar, formatting, branding, or tone.
• Requests to enable macros or ignore security warnings.
• Conversation hijacking in which a genuine email thread is reused with altered payment instructions.

No single indicator is conclusive. Investigators should compare the message with known legitimate communications and correlate it with server logs, domain records, endpoint evidence, and direct confirmation through a trusted communication channel.

A safe forensic approach includes:

1. Preserve the original: Save the message and attachment without opening or modifying them.
2. Hash the evidence: Calculate cryptographic hashes to identify the file and verify integrity.
3. Perform static analysis: Examine file type, extension, magic bytes, metadata, strings, macros, scripts, digital signatures, and embedded objects.
4. Inspect URLs without casual browsing: Extract displayed and actual destinations, expand shortened links through approved tools, and examine domains, redirects, and reputation data.
5. Use isolation: Open or execute suspicious content only in an approved sandbox, virtual machine, or controlled analysis environment with suitable monitoring.
6. Conduct dynamic analysis: Observe processes, files, registry changes, persistence, DNS queries, network connections, and attempted credential access.
7. Collect indicators of compromise: Record hashes, domains, IP addresses, filenames, mutexes, registry keys, and behavioral patterns.
8. Correlate findings: Compare indicators with endpoint, proxy, DNS, firewall, IDS, and email-gateway logs.
9. Document limitations: Sandbox evasion, encrypted files, remote content, and expired URLs may affect the result.

Potentially malicious content should never be executed on a production or ordinary investigator workstation.

An Intrusion Detection System (IDS) monitors events or activity to identify suspected attacks, policy violations, or abnormal behavior and then generates alerts.

Major types include:

• Network-based IDS (NIDS):

  • Monitors network packets or flows at selected points.
  • Useful for detecting scans, exploit patterns, command-and-control traffic, and protocol anomalies.
  • Encrypted traffic and high data rates may reduce visibility.

• Host-based IDS (HIDS):

  • Runs on or monitors an individual system.
  • Examines system calls, files, logs, processes, account activity, and integrity changes.
  • Provides endpoint context but must be deployed and maintained on relevant hosts.

• Wireless IDS:

  • Monitors wireless networks for rogue access points, suspicious clients, and wireless attacks.

• Application or protocol-based IDS:

  • Monitors activity associated with a particular service or application protocol.

An IDS generally detects and reports suspicious behavior; it does not necessarily block the activity automatically.

Signature-based detection:

• Compares activity with known attack patterns, rules, byte sequences, or indicators.
• Advantages: Accurate for known threats, easy to understand, and often produces clear alerts.
• Limitations: May miss new, modified, obfuscated, or previously unknown attacks and requires regular signature updates.

Anomaly-based detection:

• Establishes a baseline of normal behavior and identifies significant deviations from it.
• Advantages: Can detect unknown attacks, unusual account activity, and previously unseen behavior.
• Limitations: May generate more false positives, requires careful training and tuning, and can treat gradually learned malicious activity as normal.

Key distinction: Signature detection asks whether activity matches a known malicious pattern, whereas anomaly detection asks whether activity differs from expected behavior.

A practical security system often combines both methods and enriches alerts with asset importance, threat intelligence, user context, and historical data.

An Intrusion Prevention System (IPS) monitors traffic or host activity and can automatically stop suspected malicious behavior.

IDS operation:

• Usually monitors activity passively or receives copies of network traffic.
• Generates alerts for investigation.
• Normally does not directly interrupt the communication.
• A missed alert primarily affects detection, while a false positive mainly creates investigation workload.

IPS operation:

• Commonly operates inline, meaning traffic passes through it.
• Can drop packets, block sessions, reset connections, quarantine hosts, or apply temporary filtering rules.
• Provides faster containment.
• A false positive may disrupt legitimate business traffic, so rules require careful tuning.

Similarity: Both may use signatures, anomaly detection, reputation data, and protocol analysis.

Difference: The IDS mainly provides visibility and alerts, whereas the IPS combines detection with automated preventive action. Organizations may deploy both functions as part of the same security platform.

A Web Application Firewall (WAF) monitors and controls HTTP and HTTPS traffic between clients and web applications.

Purpose:

• Protect web applications from malicious requests and reduce exposure to common application-layer attacks.

Placement:

• It is generally positioned in front of the web application as a reverse proxy, gateway, cloud service, or integrated application-delivery component.
• For HTTPS inspection, it must process traffic at a point where authorized decryption is available.

Main functions:

• Validate request methods, headers, cookies, parameters, body content, and size.
• Detect or block patterns associated with SQL injection, cross-site scripting, path traversal, and malicious uploads.
• Apply positive security rules that allow only expected input or negative rules that block known malicious patterns.
• Enforce rate limits and virtual patches.
• Restrict bots, suspicious IP addresses, or geographic sources according to policy.
• Record requests, actions, rule identifiers, and response information for investigation.

A WAF is not a replacement for secure coding, patching, authentication controls, or application testing. Encrypted payloads, custom application logic, API formats, and poor tuning can limit its effectiveness.

IDS:

• Focuses on detecting suspicious activity and generating alerts.
• May monitor broad network or host activity.
• Often operates out of band and normally does not block traffic directly.

IPS:

• Detects and automatically prevents suspicious activity.
• Often operates inline at network boundaries or internal segments.
• Can drop packets, terminate sessions, or block sources.

WAF:

• Specializes in HTTP and HTTPS traffic directed to web applications and APIs.
• Understands web parameters, cookies, methods, sessions, and application-specific rules.
• Can block malicious application requests while allowing legitimate web traffic.

Defense-in-depth use:

1. A perimeter IPS blocks known network exploits and obviously malicious traffic.
2. A WAF examines requests for application-layer attacks.
3. A network IDS monitors traffic for suspicious behavior that was not blocked.
4. A host-based IDS monitors files, processes, logs, and integrity on the server.
5. Centralized logging correlates alerts with application, authentication, DNS, proxy, and endpoint records.

No single control provides complete protection. Layering them reduces dependence on one technology and provides more evidence for incident response and digital investigation.

SQL injection:

• Untrusted input is interpreted as part of a database query.
• It may allow unauthorized reading, modification, or deletion of data and, in severe cases, broader server compromise.
• Defenses include parameterized queries, least-privilege database accounts, validation, and secure error handling.

Cross-site scripting (XSS):

• Untrusted content is executed as script in a user's browser.
• It may steal session data, modify pages, or perform actions in the victim's context.
• Defenses include context-aware output encoding, safe templating, input handling, and Content Security Policy.

Cross-site request forgery (CSRF):

• A logged-in user's browser is tricked into sending an unwanted authenticated request.
• Defenses include anti-CSRF tokens, SameSite cookies, origin checks, and reauthentication for sensitive actions.

Path traversal:

• Crafted path input attempts to access files outside an intended directory.
• It may expose credentials, configuration files, or source code.
• Defenses include canonicalization, allow-listed identifiers, safe storage APIs, and restricted file permissions.

Malicious file upload:

• An application accepts a harmful executable, script, or disguised file.
• It may lead to malware hosting, stored XSS, data theft, or server compromise.
• Defenses include type and content validation, randomized names, storage outside executable directories, size limits, and malware scanning.

Secure design and coding remain essential because perimeter controls may not understand every application-specific vulnerability.

A forensic workflow may proceed as follows:

1. Confirm and scope the incident: Identify affected applications, hosts, accounts, data, endpoints, and the suspected time range.
2. Preserve evidence: Secure WAF, IDS or IPS, load-balancer, web-server, application, authentication, database, operating-system, DNS, and cloud logs before rotation occurs.
3. Record integrity: Export evidence through approved methods, calculate hashes, restrict access, and maintain chain-of-custody documentation.
4. Normalize time: Convert timestamps from different time zones and account for clock drift.
5. Identify the initial request: Use WAF or IDS alerts to locate suspicious source addresses, request paths, methods, headers, parameters, user agents, and rule identifiers.
6. Trace the request across layers: Correlate request IDs, session IDs, account names, source addresses, and timestamps with web-server and application logs.
7. Examine application effects: Determine whether the request caused authentication bypass, file creation, process execution, configuration changes, or unusual errors.
8. Analyze database activity: Look for unauthorized queries, mass reads, modified records, new accounts, or privilege changes.
9. Assess persistence and lateral movement: Examine scheduled tasks, web shells, new services, outbound connections, credential use, and access to other systems.
10. Determine data impact: Establish what information was viewed, altered, deleted, or exported.
11. Contain and remediate: Isolate affected assets, disable compromised accounts, remove persistence, patch the vulnerability, rotate secrets, and add carefully tested detection rules.
12. Report: Present a timeline, evidence sources, hashes, verified findings, assumptions, limitations, and recommended controls.

Source IP addresses alone should not be treated as conclusive attribution because proxies, compromised hosts, VPNs, and shared infrastructure may have been used.