Another Internet connection. Hidden networks of the virtual world.

[CarderPlanet]

Hello, running in the shadows! Hello, random subscriber. I came across the fact that some subscribers (there are not many of them, but they are meticulous) ask to talk about some aspects of the Network. What is the regular Internet? And how it differs from the DarkNet, for example. This article is for everyone who is really interested.

Many people have probably encountered the words Clearnet, Deepweb, Darknet, and so on. All of these are parts of the multi-story internal structure of the Internet that has evolved over time. Knowing these terms allows you, if not to better understand the structure of the Network and the connection of its parts, then at least not to make yourself look like a redneck in a smart conversation. Let's try to understand what all these words mean, what the difference is, and what exactly is hidden behind these designations.

Other Internet
Let's start with the definition. What is Clearnet, Deepweb, and Darknet?

Clearnet is a part of the Internet resources that most users call the Internet itself, namely, everything that can be found using search engines and clicking on links.

Deepweb — a part of the Internet that is normally accessible but not indexed by search engines. Pages that are not linked to, sites that are prohibited from indexing, open database entries, password-protected sections of public sites, the contents of various archives, and so on. At its core, dark originates from the deep.

Darknet-networks that use the Internet for communication, but operate using their own protocols and non-standard ports. They are popularly called "hidden networks". To work with them, you need to install and / or configure something. This list includes I2P, HiddenServices in TOR., P2P and P2P networks, decentralized services like Bitmassage, and other exotic things.

Lost Net - lost networks. These are deeper layers than even Deep, which few people are interested in, because getting something out of there is quite difficult, and finding something worthwhile there is even more difficult. So, connected but not accessible nodes make up the Lost Net, and tracking addresses that have nothing on them allows you to detect large events like DDOS attacks from the "background noise".

From the point of view of anonymity and protection of personal information, darknets are of the greatest interest for a novice cyberstalker, and even for a fairly advanced shadow runner. So let's list and compare the most famous of them.

Darknet
Darknets themselves can be divided into groups based on the tasks they perform. This is a fairly conventional division with fuzzy boundaries, but it is easier to apply it than to describe all the features of each network separately.

File sharing services and instant messengers
In the first group, we will select networks intended for the exchange of information between users. This will include file sharing services and instant messengers.

DC (Direct Connect) — one of the first peer-to-peer networks for file sharing, which appeared in 2000 on the basis of a proprietary client. Then, with the help of reverse engineering, a free DC++ client was created, which became the most popular. The Direct Connect network consists of hubs-centralized nodes that index data from the entire network, and clients that store this data directly. The search for the necessary content is carried out on hubs, which, if necessary, connect the requesting client to another client that stores the necessary found data, after which the download goes directly.

eDonkey2000 is one of the first DHT-based file sharing networks. Unlike BitT, orrent, another popular DHT protocol, has a fully distributed search, while torrents rely on search through an external infrastructure-trackers.

TahoeLAFS is a distributed data storage system. Data uploaded to the network is encrypted, divided into small blocks, and uploaded to other trusted nodes with some redundancy. When downloading the uploaded data, the process goes in reverse order. Such a system implements the principle of "Least Authority File System", in which you can not be punished for storing one user, because files are never stored entirely on one server. In this system, encryption guarantees the privacy and security of all nodes, and block redundancy guarantees reliable storage. The creators specifically excluded the possibility of uploading their data to the nodes of random network users, as Freenet does, so it is assumed that the user is forced to search for reliable nodes himself. These can be your own machines, paid servers, or volunteer nodes.

Freenet is an anonymous network organized on the principle of a distributed data warehouse. It was originally created as a tool to counteract censorship on the Internet. Files or sites are stored by many random users. Unlike TahoeLAFS, it hides all data about the data source and its recipient. Although Freenet is essentially a repository, its protocol can be used to create distributed forums, mail, channels, and even real-time chats. At the time of its release in 2000, it was Freenet that influenced projects such as I2P, TahoeLAFS, and GNUnet.

Bitmessage is a protocol and Peer-to-Peer mail client of the same name with built-in encryption. Such email addresses are the users ' cryptographic keys themselves. The distribution of messages goes through all nodes, but only the owner of the key address can decrypt the messages intended for him. To protect against spam, the ProofofWork model was borrowed from Bitcoin: to send a new message, the client performs a processor-intensive brute-force operation,which takes some computer time. In addition to personal mail, Bitmessage has channels that are a kind of mailing list or chat. You can send messages either anonymously (on behalf of the channel) or from your personal address. As with Bitcoin addresses, to maintain anonymity, it is recommended to use a separate address for each task and change addresses frequently. In essence, Bitmessage is the" father " of Telegram.

Anonymous networks
The second group includes anonymizers (banned in the Russian Federation. Pff) — networks designed not for storing and transmitting content, but for providing secure anonymous access to it. This is primarily TOR.

TOR (The Onion Router) is a network for anonymous access to Internet resources, built on the principle of onion routing (hence the name). In this network, traffic from one node mixes with traffic from other nodes, passes through several randomly selected intermediate nodes, and reaches the target through the last node, called the exit node. Mixing and redirecting traffic does not allow you to find out the true IP address of the client; the only thing that the server will see is the address of the exit node.

JonDonym is another anonymizing network where mixing cascades are used instead of onion routing. Traffic from the client passes through one specialized server, mixes with the traffic of other users, reaches another server, where it is mixed again, and so on several more times. A large amount of data from all network users passes through the mixing servers, which makes it impossible to profile individual users, but the small number and lack of diversity of cascading servers simplifies various attacks on the network. Another disadvantage of mixing cascades is that the server is public and can be disabled by a court order of the country in which it is located.

Hidden Services
In the last group, we will gather networks with HiddenServices — small Internets with their own sites, domains, and services like in Clearnet, but accessible only within these darknets and only according to their rules. These are I2P, TOR, and Freenet. The principles and mechanisms of internal operation of these networks ' programs will be described below.

Tor Hidden Services. Although the Tog network was created as a means for anonymous access to Internet resources, the internal infrastructure of the network allowed developers to create so-called hidden services, the location and IP address of which is unknown to anyone. First, the hidden service creates its own encryption key and distributes it over the network. It then selects the meeting nodes, signs them with its own key, and distributes their addresses over the network. Now, if any client wants to contact this hidden service, it searches for the meeting nodes of the corresponding service and contacts them. Through these meeting nodes, the client transmits to the hidden service a set of data necessary for communication: the addresses of its own meeting nodes, a unique token for authentication, and an encryption key. All this data is encrypted and visible only to the hidden service itself, so that the meeting nodes cannot listen in. After receiving the client's contact details, the hidden service communicates with them through several intermediate nodes, authenticates, and communicates as in a normal Tog connection. Addresses of hidden Tor services contain a domain .onion.

I2P is an anonymous, decentralized network based on tunnels. Each communication service generates a public encryption key, which is also a unique address, and builds a tunnel by selecting several random intermediate nodes. The service then anonymously advertises the last node of the tunnel as a communication node. A customer who wants to contact this service searches for contact details in the network database. After receiving the contact details, the client points them to the last node in its own tunnel.

The established connection goes through the sum of all nodes in the service and client tunnels, and at each intermediate node, the connection is additionally encrypted. Unlike Tor and Freenet, it allows you to transfer many of the usual protocols with some modifications — BitTorrent, XMPP, IRC, mail, and even other networks such as eDonkey2000 and Gnutella. The network supports TCP and UDP connections. To make it easier to distribute keys that are also addresses, the network has a special infrastructure for assigning readable addresses to address keys, example. i2p, which also allows you to automatically add newly registered addresses.

Freenet. As mentioned above, Freenet is based on distributed storage. At the first launch, the user selects how much disk space they want to allocate to the network. This space becomes part of a distributed system. The program also creates its own public encryption key. Based on this key, neighboring nodes are selected according to the "proximity" principle, that is, with similar keys.

Proximity allows other nodes to predict the location of the desired node and request the location from neighbors with a similar key. Data transfer based on packet connections or tunneling is not possible, so communications are based on transferring files distributed over distributed storage. To place a file in the system, it is first securely encrypted and assigned a unique identifier that is distributed over the network through the routing table. Nodes that have similar IDs download the file and add it to their storage. This "proximity" will again help you predict the location of the file from the routing table. The owner of the hosted file has its ID, description string, and key. They allow you to create a special link for accessing the file — SSK, signed with your own key. These links must be distributed by other means of communication.

To access a file from an SSK link, the client requests the presence of a unique identifier in the routing tables of its neighboring nodes. Those query based on the" proximity " of the table of their neighbors, until they get to the location of the file. Then it is downloaded through intermediaries and decrypted. Many applications work on the basis of file transfer on the Freenet network: a decentralized FMS forum system, a distributed mail system, and even a chat. Sites inside Freenet are called freesite.

As you can see from the description, the principle of operation of all networks is different, and each network will perform some tasks better than others.

Tog was created, roughly speaking, as a proxy (see the articles earlier on this channel), and is extremely effective at hiding the client's IP address, so hidden services are more of an addition than the main task of the network. The range of applications is also affected by the lack of many functions.

I2P was created as a separate, isolated network with its own services and provides an almost full-fledged analog of the regular Internet. Tunnels in I2P provide anonymity to all users, since it is almost impossible to calculate the source due to the large number of intermediate nodes. End-to-end and intermediate encryption protects against external and internal wiretapping of communications.

Freenet was created as a secure network for circumventing censorship, but due to the specifics of the repository, creating web services with dynamic content is not possible, and sites on Freenet are always static pages. Another disadvantage of Freenet as a repository is that unpopular files on the network are gradually deleted to free up space.

Schematically, the division of the Internet looks like this:

My job is to take you running ones to the very depths of the DarkNet. And even deeper. And I'll end this article with a phrase that all old - school cyberstalkers remember and know: "Depth, depth, I'm yours."..