3 ms·
Great question. I've been dealing with APTs from Russia (and to a lesser extent China) for two years now, and there is nobody out there to help independent site
by vallismortis 7y ago
Great question. I've been dealing with APTs from Russia (and to a lesser extent China) for two years now, and there is nobody out there to help independent sites.
GDPR recently drove us to build our own application level firewall from scratch, which turned up behavior that is never reported by CloudFront or Google Analytics - those services are only hiding the severity of the problem.
- katbyte 7y agoMaybe a silly question, but what is an APT?
- ianthiel 7y agoAdvanced Persistent Threat https://attack.mitre.org/groups/ https://attack.mitre.org/groups/ https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat
- AnimalMuppet 7y agoAdvanced Persistent Threat - a hacking group that finds an open door (or creates on by phishing), gains access, spreads little backdoors and malicious code into a bunch of machines, any of which, if removed, can be re-created by the others. Not easy to detect, very hard to get rid of once infected. Many groups have differences in the tools they use, which enables those in the know to say "Oh, that's APT X" when they look at an infection. You may have heard of "Fancy Bear". That's one APT out of Russia. For more information, see https://en.wikipedia.org/wiki/Advanced_persistent_threat https://en.wikipedia.org/wiki/Advanced_persistent_threat
- agdpf 7y agoIf you keep getting pwned by APTs and you need to build a WAF then the security of your codebase is, er, poor, to say the least.
- KirinDave 7y agoThis seems like the worst possible reason not to have a WAF.
- vallismortis 7y agoRight, you got it. Sometimes I feel like we're being attacked by bespoke systems, but it really must be off-the-shelf stuff since our full content is easily licensable. We shouldn't be worth the trouble. We just weren't getting enough information from Bing or Google Analytics or CloudFlare, and when I developed a realtime activity dashboard, patterns started emerging: distributed web scrapers, registration bots, vulnerability scans, and some of these in tandem (i.e., scans commencing immediately after blocking a block of addresses). And many of these are coming from cloud hosts, Azure being the worst, with Google a close second. This is the type of traffic they don't want you to see, so those respective analytics services just supress it because it would be a negative advertisement if we could actually see what is happening realtime. I compared the numbers - Google was consistently underreporting our traffic by at least 40%, and a lot (not the majority, but enough to be noticible) of that traffic was coming their own hosted servers (not the indexing bots, but the user cloud instances). CloudFlare implements temporary bans but I needed something permanent for those threats that were recognizable based on their request patterns. The ARIN squatting is the latest thing I'm seeing - a lot of requests coming from netblocks that are former DoD and RedHat addresses. The publicly available ARIN databases aren't entirely up-to-date and the bad guys know it, some of the checks we depend on have to be taken with a grain of salt. So far, I've been able to develop business rules to separate out the human activity from the carefully constructed scraper/probe attempts, but I fear that if they get just a bit more sophisticated I may lose that ability.
- cameronbrown 7y agoWouldn't distributed scrapers be blocking Google Analytics scripts by default? Or are you sending data there server-side?
- 7y ago