4 ms·
Microsoft OneDrive Has 60% Jump in Hosting of Malicious Files
- bobthepanda 7y agoI can’t tell for the life of me what that bar graph is supposed to tell; the bars clearly add up to more than 100%.
- groovybits 7y agoEach individual bar is not meant to add to 100%. Its saying, for the selected quarters, what percentage of traffic was malicious. Ex: * In Q4 2018, less than 20% (out of 100%) of wetransfer's traffic was marked as malicious. * In Q1 2019, over 60% (out of 100%) of OneDrive's traffic was marked as malicious. Etc.
- ryanmercer 7y agoThe left/baby blue-ish color is 4th quarter 2018, the right/red is 1st quarter 2019. Q4 looks like 75%, Q1 looks like 80%. That said the title doesn't really make sense "File share services being used to host attacks" should probably be something more like "percentage of increase in files that are malicious" or some such.
- pwinnski 7y agoThis is why we can't have nice things. I guess it's good news for Microsoft, though: people are aware of OneDrive!
- hackerooo 7y agoI'll give you another set of sites which are whitelisted by browsers: github, bitbucket, gitlab, sourceforge If you want to trick someone into running an executable, you need to put it on a whitelisted site, otherwise they will have to slog through 5 different very scary warnings before they are allowed to run it. The funny thing: most of HN is against this kind of browser protection, I wouldn't be surprised if they disable uncommon software warnings.
- ValentineC 7y ago> I'll give you another set of sites which are whitelisted by browsers: github, bitbucket, gitlab, sourceforge I might expect them to be whitelisted by firewalls, but why browsers?
- la_barba 7y agoBrowsers do a has-this-site-ever-been-known-to-host-malware URL check. https://en.wikipedia.org/wiki/Google_Safe_Browsing https://en.wikipedia.org/wiki/Google_Safe_Browsing
- deleted 7y ago[deleted]
- bin0 7y agoWhile that's true, I do get at least a little suspicious if the repository only contains binaries on a site which is designed to host source. Same if it's a little-known repository. Besides, what is some one going to do, encourage me to "download the update to adobe reader" on github? Source hosting sites would certainly be valuable in a highly-targeted attack, but it is often the case that such actors will simply find another way.
- keanebean86 7y agoMicrosoft product life cycle: 1> Microsoft sees successful tool and decides to copy it 2> truck loads of marketing money is spent 3> the product captures 5-10% of the market 4> most people either don't care or mock it 5> at some point articles come out about how the product is mostly malware 6> Microsoft quietly kills the product 2 years later
- draw_down 7y agoWe're not supposed to say that stuff anymore! Microsoft is good now, because Linux.
- belltaco 7y agoCan you give some examples that you think follow that product cycle?
- keanebean86 7y agoIt's mostly the windows phone and app store. Bing except the malware and shutting down part.
- twblalock 7y agoI remember back when I had a Lumia 920 and searched the app store for “Facebook” there were several pages of results for apps called “Facebook” that all had similar icons. Searches for other popular apps had similar results. The store was full of fraudulent copies of popular apps in addition to the real ones.
- savethefuture 7y agoReplace Microsoft with Google and its pretty close.
- xx_alpha_xx 7y agoI don't think this is really news, or surprising. At some point any cloud-based service supporting public sharing of user-generated content will be used, either obviously or non-obviously, for malicious purposes - content hosting, C&C, etc. For the service providers, this becomes a very difficult game of cat and mouse.
- redm 7y agoI'm a little surprised to see this because OneDrive scans and provides malware information [1] where not every cloud storage does. I would expect apps, including theirs, would make use of this and warn the user. Maybe they broke something as their malware property is currently "empty" and I don't remember it being that way. [1] https://docs.microsoft.com/en-us/onedrive/developer/rest-api/resources/malware?view=odsp-graph-online https://docs.microsoft.com/en-us/onedrive/developer/rest-api... contained in driveItems and other responses: https://docs.microsoft.com/en-us/onedrive/developer/rest-api/resources/driveitem?view=odsp-graph-online https://docs.microsoft.com/en-us/onedrive/developer/rest-api...
- LinuxBender 7y agoThey didn't go into these details in the story, but could it be that the payload is encrypted and then hijacked blog sites are used to host the javascript to decrypt the payload? Asking because I have seen that a few times, but never saw it on onedrive.
- SlowRobotAhead 7y ago>but never saw it on onedrive. I have. It hasn't been what you suggest. You're not wrong you could host somewhere encrypted and escape detection. But that means you still need to point to a scam site to execute the package. But the way this works is that you're sent an email with a legit Microsoft domain. Sometimes even a legit Microsoft Share email that points to a onedrive stored file. The whole point is that your payload is hosted on a legit service that Apple, Dropbox, Microsoft, etc really do own. So that if you're trained to look at the URL, you see something legit, not share.filez-mikrozoft.kom I've had to instruct my employees to look at the context, not just the hosting link. Do you know this person? Where you expecting a file? If you aren't sure can you contact them via some other form than email?
- LinuxBender 7y agoI am curious how they are uploading malicious content without encrypting it to evade detection. I've had coworkers (red team) use special packers to return "all green" on virustotal, but it doesn't take long for it to get flagged.