ThreatSTOP just updated our Vyatta install script to fully support the latest Vyatta version: 6.2. The new script is backwardly compatible to earlier Vyatta versions however an upgrade is not required for earlier versions of Vyatta. This is just a part of our ongoing Vyatta relationship to fight bots and criminal malware - as mentioned in this press release that came out today. The combination of ThreatSTOP and Vyatta provdes an extremely cost effective method of stopping bots calling home and blocking the servers that deliver bots and other malware that may be used either as a standalone solution or as a method to augment an existing firewall.Read More
In the first of many announcements to come, ThreatSTOP is proud to announce that web security vendor EdgeWave (formerly St.Bernard Software) has embedded our botnet blocklist into their flagship product iPrism. Specifically, our outbound blocklist against command and control hosts was embedded in iPrism in addition to its existing URL, virus, malware, spyware and phishing blocking features for a more comprehensive security solution.Read More
Thanks to an email from one of the folks evaluating ThreatSTOP, I did a quick comparison check to see how much quicker ThreatSTOP is to report bad IP addresses. This is very important as new, unknown IP addresses, can wreak havoc until they are tracked down.
A brief aside: once an IP address becomes known as, say, a botnet C&C host it will start to get blocked. In fact we quite often see IP addresses fall down the slippery slope of recividism. First they start out as malware droppers or C&C hosts, then they become phishing sites or spammers, finally they become recon bots searching for open ports and vulnerabilities in servers. The key to this progression is that the IP address gradually becomes better known as bad and that the things it does first, when it is unknown, are the most dangerous to the Internet. Hence the quicker they are picked up the quicker people can protect against them.
So, getting back to the responsiveness question. Our evaluator compared us to McAfee's Trusted Source (which is BTW an awesome resource) and noted that we appeared to report IP addresses faster. That is to say we'd report an IP address as bad and then some time later Trusted Source would also report it as bad. Well this was something that needed a bit of confirmation so I took our current list of the botnet C&C hosts and compared it with the list from 24 hours earlier. Of the 1911 ip addresses currently in that feed 44 were new (I'll append the list to this post) and I checked all 44 with Trusted Source.
16 were either 'unverified' or 'minimal risk' for both web and email.
12 were listed as bad for email but either 'unverified' or 'minimal risk' for web
6 were listed as bad for web but either 'unverified' or 'minimal risk' for email
10 were listed as bad for both web and email.
Of the 22 that were listed as bad for email and hence could be assumed to have history, ThreatSTOP knew about half (13) as being definitively bad and 11 we had no knowledge of other than as botnet C&C. However I'm unclear about the accuracy of McAfee's Email rating since a number of those (in fact it was probably all 11 but I gave up checking) had no email data graphs of history so it seems likely that the email report was as fresh as the the botnet one and probably related.
Finally I did a sample of the 41 that were between 24 and 48 hours old and McAfee's Trusted Source appeared to know about almost all of them as bad for web. That is to be expected.
So to recap. 44 new addresses in 24 hours of the most dangerous sorts on the Internet - that is botnet C&C hosts. Of those ThreatSTOP in fact already knew of 11 as did McAfee. We were blocking 16 that McAfee had no idea of. We blocked 6 at about the same time that McAfee knew about them and 11 more may have been known by McAfee first, but not necessarily as botnet C&Cs.
I imagine I'll run this test again in a week or two to confirm this finding but it looks like yes ThreatSTOP is faster to identify bad IP addresses, and since they get automatically downloaded onto our subscriber's firewalls, far faster to provide protection against bots calling home with stolen data.
One of the ways that ThreatSTOP keeps our IP reputation feeds up to date is that we process the firewall logs of our subscribers to see what attacks they are currently experiencing. We also want to feed the data back to other security researchers because we only mine the logs for certain information and others will find other useful information from them if they can analyze them. However there is a problem. Customers are usually unwilling to see their internal data distributed all over the place. Hence we've been looking for a way to reliably anonymize the data so thatRead More
The Register has an article today about how IPv6 will make (spam) blocklists fail. The article is correct that current DNSBL techniques - as developed by Paul Vixie & co - will struggle but that doesn't in fact mean that IPv6 kills IP (or DNS) reputation, all it means is that the exact technique used by the current DNSBL solutions is not IPv6 compatible.Read More