Veiled: A Browser-based Darknet - Not for Porn, Says HP

For those living in a box, Black Hat is currently underway in Las Vegas. The first talk of the day I attended was by Bill Hoffman and Matt Wood from HP's Security Labs. They discussed their browser-based darknet called Veiled. Billy is best known for his web security research while working for SPI Dynamics, acquired by HP, and authoring a book on AJAX security. Matt leads development on HP's Scwaler and SWFScan security tools.The idea is fairly straightforward. "A World Wide Web built on top of the World Wide Web", says Hoffman while on stage. Encrypt and upload files to a "routers" that split and store the files across the browser based network. The idea is to provide a way to store files remotely inside the darknet in a secure and distributed manner. P2P meets PGP meets distributed storage - sorry no P acronym for that.

The first usage case that came to many minds is illegal porn. The authors are very clear that this is not for illegal porn. After watching the presentation though, it is obvious that if an implementation of this went mainstream it would be used for all kinds of illegal activities.

Online storage of files for later retrieval by the owner, recipient or a group of recipients are examples of legitimate usage. Since files are encrypted and split across multiple members of the darknet, the files are not under the single control of any one party and they are secure from access by anonymous parties.

This research came out of HP's Security Labs but HP will not release the technology to make this a reality. The researchers are free to discuss and present the technology, but not release this technology into the wild.

Follow my random thoughts of Black Hat on twitter @adamely.