Slashdot Mirror
New IP Address Blacklist Based On Web Chatter
itwbennett writes: A new approach to assembling blacklists analyzes chatter on the dark and open Web and can find malicious IP addresses that would have been missed using honeypots and intrusion detection systems, according to a report by security startup Recorded Future. On traditional blacklists, 99 percent of the addresses are for inbound activity, 'when someone is attacking your system from an external address,' said Staffan Truvé, chief scientist and co-founder at Recorded Future. On Recorded Future's new list, half of the addresses are for outbound activity, 'when an intruder is already in your systems, and is trying to connect to the outside world to exfiltrate data,' said Truvé. For example, Recorded Future identified 476 IP addresses associated with both the Dyreza and the Upatre malware families — only 41 of which were known to existing blacklists.
Seems like IPs sending out their sensitive data to attackers would normally be termed "victims"?
If you're scanning for chatter and using that to blacklist IPs, surely there's a high rate of false positives. Is any screening done to prevent IPs from being improperly listed and is there any way to get removed from such a blacklist?
Somebody create a piece of malware that connects to random IP addresses!
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
In their report they suggest blacklisting IP addresses that were infected 3-6 months ago and have been clean since then. In marketing speak, that's called "new approach". In real world, that's called stupidity.
Come on submitters and editors. Can't you understand that whitelists and blacklists have a racist history? The accepted terms are "allow list" and "block list". This isn't that hard.
It sounds to me like it's blacklisting the IPs being connected to. Easy to spoof, though, just have your malware connect to dozens of random IPs along with the few actual IPs you're using, then the list becomes so full of false positives that it is rendered useless.
Already been done, I suspect: Pawn Storm Group Makes Trend Micro IP Address a C&C Server
does anyone have the list of 476 IPs?
The problem with IPs found this way is that they are often associated with hundreds to thousands of web sites, and the bad actors shift between these backends rapidly. For instance I have seen cases where there are a few Wordpress generated sites out of thousands being used to host malware configs and updates at a single IP of a low-end hosting provider. I have seen many similar instances where the IP was associated with AWS. The most precise way to blacklist sites like this is by hostname and not by IP.
Once IPV6 is widely adopted, the idea of having any meaningful data associated with an IP address is DEAD.
The bad guys will have a nearly limitless pool of IPs to spoof and choose from, and they'll just discard them every few seconds or minutes and a get a new batch to use. That's because IPV6 has a mind-bogglingly immense address space. How much? Well....
Let's assume every single one of the 100 billion stars in the galaxy is inhabited, and each star has a population of 10 trillion humans in orbit around it, and each human has 1 billion devices that need IP addresses.
In that case, only 1/340,282nd of the possible 128-bit IPv6 addresses would need to be assigned.
Put another way, IPv6 would (will) provide roughly 5,000 assignable IP addresses for every square micrometer of the Earth's surface.
Good luck banning that suspect IP...it will have been used for a few seconds and then "thrown away", never to be used by the spammer again.
Just cruising through this digital world at 33 1/3 rpm...
# Tails is a spam system that aims to preserve shitposting and in your face advertising. It helps you to have to sort through more crap on the internet and make you wish for censorship so that you don't have to see idiots making off-topic posts about it almost anywhere, which they won't stop even if you ask them to explicitly.
Has information security reached the point at which old is new? InfoSec and network researchers have been analyzing backscatter since the late 90s. If it's useful that's great but, calling it new and innovative is inaccurate.
For whatever reason, the most negative people on /. always manage to get first posts. Some posters have already pointed out limitations but let's talk about the benefits of this.
If a bunch of hosts on my network start communicating in a way that they never have before, that me the sign that an infiltration has occurred. Inbound scanning looks for things trying to get through your firewall from the outside. But as we also point out on /. all the time, does almost nothing against social engineering attacks. It's not hard to get people to plug in USB thumb drives. (I've seen them given out by vendors at security conferences!) Nor can they resist attaching their personal devices to the corporate network.
Now you have a bunch of hosts making outbound connections to new places. Encrypted outbound traffic to IP addresses where FCrDNS fails. Worth investigating.
Of course this isn't a perfect solution, but it has at least some value. There is no claim that this is a replacement for other technologies only a supplement.