Slashdot Mirror
The Words That Indicate Malicious Domain URLs
An anonymous reader writes: Researchers from AT&T have released research which improves the identification-rate of malicious URLs — such as those used for C&C servers or to distribute malware to redirected victims — by individuating words in the domain names. Though many of the words that Wei Wang and Kenneth Shirley were able to group as 'malign' are predictable, there is a strange recurrence of basketball-related words in the URL lexicon of malice, with 'bad' domains using names such as LeBron James, Kobe Bryant and Michael Jordan. By contrast 'golf' is least likely to be seen in a dangerous URL, along with state names, scenery and realty.
'nuff said.
Seriously, it seems they know how to entice the befuddled masses in to clicking on their garbage.
Nobody expects gold to be sinister, that's just misdirection.
The real evil is in the golf.
Lost at C:>. Found at C.
This kind of research is almost self-defeating.
When you put out there a list of words that help flag a domain as "bad", you're just signaling to the malware makers to avoid those words.
Then you can make a new list of words. And then they'll avoid those words.
Eventually, the malware domains will be essentially indistinguishable from the real domains.
That's lose-lose for everyone.
Unfortunately, keeping the list secret does no good either. If it's truly secret, then no one can use it to fight malware. If it's only "secret" as in "not widely published", then the malware makers will still find it and use it.
There is no right choice.
I cannot remember the last time I visited a legitimate website with a hyphen in the URL.
The paper is interesting, but I doubt it's very effective. An awful lot of the malicious URLs we seen in our filters are legitimate web sites that have been compromised and had malicious content inserted. We have thousands of malicious URLs containing "wp-content", just to give you an idea...
You know, if you weren't waiting to post these stupid comments on Slashdot, you'd have more time to fap.
Get free satoshi (Bitcoin) and Dogecoins
Unless that's the thing that gets him/her going.
You're looking for quotes? See my journal.
sourceforge.net
cnet.com and download.com
softpedia.com
Silence is a state of mime.
I can't believe that's a word...
Coincidence?
The first studies that showed "password" "0000" "1234" etc. were among the most-common passwords/PINs was published so long ago that I don't remember when it was.
Studies since then and even recent ones keep showing similar results.
PS: It's time for me to change my /. password. I'm trying to decide between passw0rd and 1248, any advice?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So you only enjoy one of your two penises? That's only half the fun!
Get free satoshi (Bitcoin) and Dogecoins
Stop spamming. You realise that if you had an account here, it would be banned, as you are no better than any of the other spammers that crop up. You didn't listen to Nietzsche and now the abyss is staring deep into you. You are now the problem you sought to alleviate. Happy?
Ladies and gentlemen, here we have APK pretending to be some kind-hearted supporter of himself, in a vain attempt to lend credence to his tenuous position. APK thinks so highly of this audience that he spams us and thinks we're retarded.
The real irony is his anti-advertising solution can't block his advertising. He's his own worst enemy, yet has no idea. Mental illness is a bitch.
Because thanks to this valuable research, all the "bad URL owners" will get different "bad" ones. I propose to go to soccer instead, with the FIFA serving as easy example why these are "bad".
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
www.goat-simulator.com
Unless you consider motivating people to wasting time to be malicious....
Note: google(url:goat) gives you many more of these insidious "goat" pages, including one that seems to be "non-vet" medical emergency services for goats.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You can't tell people about this kind of research because then the malignant people change their words. The only benefit is in keeping it quiet.
The sounds sinister. That's enough.
Table-ized A.I.
There was some bot on here spamming (just last night it was here still) something about J Lebron in the URL but it went to a dead link in Turkey. I checked the site out and it seems you can volunteer to do some digging there with the archaeologists. I have always wanted to do that but this one looked way to complicated (like needing to apply nine months ahead)/
"So long and thanks for all the fish."
"Talos has discussed domain shadowing before at a high level. It’s a technique where threat actors use compromised registrant accounts to create large amounts of malicious subdomains. This is what Talos has found Nuclear using in this most recent campaign. It has been effectively rotating IP addresses, subdomains, and parent domains at a relatively quick rate." ref
There's a new Command and Conquer coming out? Hmm, or am I being scammed?