4 ms·

> Torrent Downloads: If an IP address detected downloading torrents, the risk level is considered extreme. Why? There is some more info in the README at Githu

by helb 9y ago

> Torrent Downloads: If an IP address detected downloading torrents, the risk level is considered extreme. Why? There is some more info in the README at Github (https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework), but nothing about why torrents induce extreme risk level.

balgan 9y ago
We will add this information, but essentially we and other partners have seen a high quantity of torrents infected with malware. We intend to fine tune this in the future to differentiate the torrents depending on category!
- helb 9y ago
  Thanks! Additional non-related questions: - How do you scan ipv6s? Scanning the entire space is easy for ipv4 (we do that for some router-security-related projects), but ipv6 space is freaking huge. - Have you considered using something like Shodan (https://www.shodan.io/ https://www.shodan.io/) API instead of scanning the address space by yourselves?
  - balgan 9y ago
    - For IPv6 rather than scanning the entire space, we are currently passively collecting addresses from multiple sources and scan specific addresses - We wouldn't use shodan as we developed our own custom scanners and methodologies of scanning to increase data quality which is extremely important for our customers (cyberinsurers, SoCs, cyberrating companies). We also do some specific things with data which you can check on http://blog.binaryedge.io/2016/11/18/bsides-lisbon-2015/ http://blog.binaryedge.io/2016/11/18/bsides-lisbon-2015/
- msla 9y ago
  You could also differentiate OSes, in that most malware is aimed at Windows machines.
  - balgan 9y ago
    Feedback like this is exactly why we made the formula open, we believe there is still lots that can be done with this. Please submit an issue on https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework so that we can have a discussion about impact/usefullness!
Ajedi32 9y ago
Also: > Web: The lack of at least one security header represents an extreme level of exposure Don't really get that one either. So any site not using HSTS, CSP, or Key Pinning, for example, is automatically at extreme risk?
- balgan 9y ago
  We agree that some of the "values" might seem a bit out of place`, we discussed them with multiple security professionals and tried to come up with the best with the different opinions we were given. Please please please submit an issue on the github. Far too many ratings work as blackboxes which is why we decided to "open" our formula. The link for the github is https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework
deedubaya 9y ago
I don't necessarily agree with the risk level, but if analyzing a traditional business network, torrenting probably isn't being used for legitimate uses. Thusly, it's likely it either being used by malware or maybe a ignorant/malicious user.
- yellowapple 9y ago
  The problem is that not all business networks are "traditional". Some might be pulling OS install media from a torrent (a lot of FOSS operating systems are distributed this way). Some might even be mirroring/seeding said media.

by helb 9y ago

balgan 9y ago

We will add this information, but essentially we and other partners have seen a high quantity of torrents infected with malware. We intend to fine tune this in the future to differentiate the torrents depending on category!

helb 9y ago
Thanks! Additional non-related questions: - How do you scan ipv6s? Scanning the entire space is easy for ipv4 (we do that for some router-security-related projects), but ipv6 space is freaking huge. - Have you considered using something like Shodan (https://www.shodan.io/ https://www.shodan.io/) API instead of scanning the address space by yourselves?
- balgan 9y ago
  - For IPv6 rather than scanning the entire space, we are currently passively collecting addresses from multiple sources and scan specific addresses - We wouldn't use shodan as we developed our own custom scanners and methodologies of scanning to increase data quality which is extremely important for our customers (cyberinsurers, SoCs, cyberrating companies). We also do some specific things with data which you can check on http://blog.binaryedge.io/2016/11/18/bsides-lisbon-2015/ http://blog.binaryedge.io/2016/11/18/bsides-lisbon-2015/
msla 9y ago
You could also differentiate OSes, in that most malware is aimed at Windows machines.
- balgan 9y ago
  Feedback like this is exactly why we made the formula open, we believe there is still lots that can be done with this. Please submit an issue on https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework so that we can have a discussion about impact/usefullness!

Ajedi32 9y ago

Also: > Web: The lack of at least one security header represents an extreme level of exposure Don't really get that one either. So any site not using HSTS, CSP, or Key Pinning, for example, is automatically at extreme risk?

balgan 9y ago
We agree that some of the "values" might seem a bit out of place`, we discussed them with multiple security professionals and tried to come up with the best with the different opinions we were given. Please please please submit an issue on the github. Far too many ratings work as blackboxes which is why we decided to "open" our formula. The link for the github is https://github.com/binaryedge/ratemyip-openframework https://github.com/binaryedge/ratemyip-openframework

deedubaya 9y ago

I don't necessarily agree with the risk level, but if analyzing a traditional business network, torrenting probably isn't being used for legitimate uses. Thusly, it's likely it either being used by malware or maybe a ignorant/malicious user.

yellowapple 9y ago
The problem is that not all business networks are "traditional". Some might be pulling OS install media from a torrent (a lot of FOSS operating systems are distributed this way). Some might even be mirroring/seeding said media.