5 ms·

How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.

by _8j50 4y ago

bell-cot 4y ago
Actual bad guys, hosting $Evil on purpose, are extremely unlikely to need any "change the URL" hints.
- _8j50 4y ago
  They don't need one but having one maximizes campaign life.
  - BoorishBears 4y ago
    How on earth does it do that? If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?
    - krisoft 4y ago
      Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots. You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc
      - bell-cot 4y ago
        Disagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information. (Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)
      - JamesBarney 4y ago
        A bad actor can do the same thing by putting together Mybadpage1.com Mybadpage2.com Mybadpage3.com
      - BoorishBears 4y ago
        Except if you're a malicious actor you can also do: msscanninghoneypot1.com msscanninghoneypot2.com msscanninghoneypot3.com You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that... edit: missed that multiple replies cover this
    - _8j50 4y ago
      You move it to xyz.com/anotherbadpage and tell MS it has been cleaned up. They do this all the time. Speaking from first hand experience. This is a very simple topic, why are there so many people not understanding this?!
      - JamesBarney 4y ago
        Bad actors know 1. It's detected (because Microsoft told everyone) 2. What was detected and where it was (because they put it there) Good Actors only know 1. So by telling someone 2 they are giving bad actors no new information, and good actors valuable information.
        wolrah 4y ago
        This assumes the bad actor only put one thing there. If they put multiple things there they don't know what was detected unless told.
        JamesBarney 4y ago
        But if a bad actor wants to know what's detectable they can just put each malware on separate domains.
        _8j50 4y ago
        1 is for domain only. 2, MS only knows some information that shows the site is malicious, it cannot tell if it is a compromise or just a malicious site unless it perhaps looks at reputation but even then the site owner should be able to tell new or malicious files on their webserver withour MS telling them, if they can't even do that they have bigger problems and threat actors do abuse anti-abuse systems like this all the time and they do deploy multiple things on your site as well as use it to attack other sites and monitor the reputation of their infrastructure.
lucb1e 4y ago
I considered that but it didn't seem logical. If it's on purpose, it would be trivial to change the URL and then go "ok it's clean now please remove the flag" How does keeping secret (from the bad guys) where the malware is thwart the bad guys?
- _8j50 4y ago
  MS is already stopping the bad guys by blocking the domain. You are supposed to do proper IR and clean up after yourseld including finding out the cause of the compromise which MS can't help with. What happens in the real world is people delete the file or webshell and think the bad guys are gone and if MS unblocks them then the campaign continues. Or the bad guys themselves do that pretending to be the site owner. MS analysts can only inspect the normal site and the malicious URL that has now been removed in order to unblock it. This is how abuse and IR works, I am surprised at the naivette of the responses here.
  - ascar 4y ago
    What are you even talking about? What is IR? What happens is a website is blocked and the site operator has no idea why. The defense of "we can't share any information as to why you got punished as it might help bad actors avoid punishment" should not be an acceptable stance. It's the equivalent of being thrown to prison without due process and just ignoring false positives. It's a very "natural" way of acting, but that does not make it the right one.
    - _8j50 4y ago
      IR is incident response, it means you find out everything the bad guys did and how it was compromised and fix it all. You should contact a security company or professional to help you if you don't know. I have used the webshells of compromised sites where the owner tries to cleanup but the webshell is still there hosting different campaigns. You should secure your site better and have someone who knows what they are doing (there are paid WAF and web security vendors) monitor and respond to security incidents. You are not being punished, MS is protecting its customers. You should blame the hacker not MS for the impact of the hack. It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.
iforgotpassword 4y ago
If you're hosting it on purpose, then you already know that it's the culprit and would've tried to change it anyways. I don't really see a scenario where telling the person who opened the ticket what the issue is would weaken the security measures or detection strategy.
- _8j50 4y ago
  That's not what is being said here, the domain is blacklistes and my comment was about MS not the bad guy telling the site owner the malicious URL. If you tell them the URL, they will change it and claim it was a compromise so they can increase campaign lifetime.
  - abpavel 4y ago
    Easy. Scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.
    - _8j50 4y ago
      That's exactly what I am saying...
  - BoorishBears 4y ago
    ... MS is telling everyone that the root domain is on a black list. A malicious actor doesn't need more than that, they already know the exact URL that malware resides at. A non-malicious actor doesn't know, so telling them the exact URL at least tells them where the compromised asset might be.
    - _8j50 4y ago
      Yes a malicious actor needs more than that because compromised domains are valuable and keeping them alive longer means more money... A non-malicious actor who needs the URL isn't monitoring or responding to the incident properly. Threat actors do take advantage of this and simulate a fake cleanup. Actually they exclude certain ips and asns on phishing kits so that visiting the url gives you a 404 or a webhosts "cleanup" page.
m3047 4y ago
I live in the USA. Victim blaming "they did something to deserve it" is at best unethical. In court theoretically I would have the right to demand to see evidence. "Hold my beer" is not likely to be sufficient except in egregious circumstances. With that said, there is an epidemic of muppet thinking right now. It's not just the intertubes. Suppose a credit card company pulls your credit report because they say you applied for credit with them. No funds are stolen. You demand they show proof. They say nope, because TTPs. So: how do I know it's a one-off, and not data theft by fraud at scale? Off goes a letter to the FTC... Do you think like a muppet? Here is satirical example (http://athena.m3047.net/temporizing.html http://athena.m3047.net/temporizing.html): TEMPORIZING FOUND NOT TO BE A FORM OF LYING "Temporizing", which is speculating from what we know now as to the motives of actors in the past and presenting that as historical fact, has been found not to be a form of lying. "Social proof demonstrates that temporizing is not lying" said a social commentator. The news was greeted optimistically as a good day for humanists and levels the playing field because "now the standards of proof we need to meet for the existence of society are the same as for religion". "People must have known about this in the past because it seems like they should have" said a man in the street. "Everybody who believes in science trusts society" said another.
- ranger_danger 4y ago
  In many of these extreme cases where it's non-obvious what is wrong, the victim IS often the one responsible. Example: Viral video shows police pulling unarmed (and allegedly innocent) suspect out of a parked car that sparks outrage. It's later found out that the victim was previously evading police pursuit just minutes before, and was trying to blend in with the other cars in a lot.
- _8j50 4y ago
  I have no idea what your post is about but from MS's perspective it isn't the site owners but MS's users around the world that are victims of thr threat actor that need protection. If it truly is a compromised site then the site owner is also a victim but as owners it is also their duty to secure and cleanup their site that is currently endangering the public.

How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.

by _8j50 4y ago

How does MS know they aren't hosting it on purpose? That might cause them to just change the malicious URL.

bell-cot 4y ago

Actual bad guys, hosting $Evil on purpose, are extremely unlikely to need any "change the URL" hints.

_8j50 4y ago
They don't need one but having one maximizes campaign life.
- BoorishBears 4y ago
  How on earth does it do that? If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?
  - krisoft 4y ago
    Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots. You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc
    - bell-cot 4y ago
      Disagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information. (Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)
    - JamesBarney 4y ago
      A bad actor can do the same thing by putting together Mybadpage1.com Mybadpage2.com Mybadpage3.com
    - BoorishBears 4y ago
      Except if you're a malicious actor you can also do: msscanninghoneypot1.com msscanninghoneypot2.com msscanninghoneypot3.com You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that... edit: missed that multiple replies cover this
  - _8j50 4y ago
    You move it to xyz.com/anotherbadpage and tell MS it has been cleaned up. They do this all the time. Speaking from first hand experience. This is a very simple topic, why are there so many people not understanding this?!
    - JamesBarney 4y ago
      Bad actors know 1. It's detected (because Microsoft told everyone) 2. What was detected and where it was (because they put it there) Good Actors only know 1. So by telling someone 2 they are giving bad actors no new information, and good actors valuable information.
      - wolrah 4y ago
        This assumes the bad actor only put one thing there. If they put multiple things there they don't know what was detected unless told.
        JamesBarney 4y ago
        But if a bad actor wants to know what's detectable they can just put each malware on separate domains.
      - _8j50 4y ago
        1 is for domain only. 2, MS only knows some information that shows the site is malicious, it cannot tell if it is a compromise or just a malicious site unless it perhaps looks at reputation but even then the site owner should be able to tell new or malicious files on their webserver withour MS telling them, if they can't even do that they have bigger problems and threat actors do abuse anti-abuse systems like this all the time and they do deploy multiple things on your site as well as use it to attack other sites and monitor the reputation of their infrastructure.

lucb1e 4y ago

I considered that but it didn't seem logical. If it's on purpose, it would be trivial to change the URL and then go "ok it's clean now please remove the flag" How does keeping secret (from the bad guys) where the malware is thwart the bad guys?

_8j50 4y ago
MS is already stopping the bad guys by blocking the domain. You are supposed to do proper IR and clean up after yourseld including finding out the cause of the compromise which MS can't help with. What happens in the real world is people delete the file or webshell and think the bad guys are gone and if MS unblocks them then the campaign continues. Or the bad guys themselves do that pretending to be the site owner. MS analysts can only inspect the normal site and the malicious URL that has now been removed in order to unblock it. This is how abuse and IR works, I am surprised at the naivette of the responses here.
- ascar 4y ago
  What are you even talking about? What is IR? What happens is a website is blocked and the site operator has no idea why. The defense of "we can't share any information as to why you got punished as it might help bad actors avoid punishment" should not be an acceptable stance. It's the equivalent of being thrown to prison without due process and just ignoring false positives. It's a very "natural" way of acting, but that does not make it the right one.
  - _8j50 4y ago
    IR is incident response, it means you find out everything the bad guys did and how it was compromised and fix it all. You should contact a security company or professional to help you if you don't know. I have used the webshells of compromised sites where the owner tries to cleanup but the webshell is still there hosting different campaigns. You should secure your site better and have someone who knows what they are doing (there are paid WAF and web security vendors) monitor and respond to security incidents. You are not being punished, MS is protecting its customers. You should blame the hacker not MS for the impact of the hack. It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.

iforgotpassword 4y ago

If you're hosting it on purpose, then you already know that it's the culprit and would've tried to change it anyways. I don't really see a scenario where telling the person who opened the ticket what the issue is would weaken the security measures or detection strategy.

_8j50 4y ago
That's not what is being said here, the domain is blacklistes and my comment was about MS not the bad guy telling the site owner the malicious URL. If you tell them the URL, they will change it and claim it was a compromise so they can increase campaign lifetime.
- abpavel 4y ago
  Easy. Scenario: Malicious attacker looks for exactly what Microsoft detected, and fixes each specific detection while keep operating the undetected ones. The end result would be operational malicious site, without being detected.
  - _8j50 4y ago
    That's exactly what I am saying...
- BoorishBears 4y ago
  ... MS is telling everyone that the root domain is on a black list. A malicious actor doesn't need more than that, they already know the exact URL that malware resides at. A non-malicious actor doesn't know, so telling them the exact URL at least tells them where the compromised asset might be.
  - _8j50 4y ago
    Yes a malicious actor needs more than that because compromised domains are valuable and keeping them alive longer means more money... A non-malicious actor who needs the URL isn't monitoring or responding to the incident properly. Threat actors do take advantage of this and simulate a fake cleanup. Actually they exclude certain ips and asns on phishing kits so that visiting the url gives you a 404 or a webhosts "cleanup" page.

m3047 4y ago

I live in the USA. Victim blaming "they did something to deserve it" is at best unethical. In court theoretically I would have the right to demand to see evidence. "Hold my beer" is not likely to be sufficient except in egregious circumstances. With that said, there is an epidemic of muppet thinking right now. It's not just the intertubes. Suppose a credit card company pulls your credit report because they say you applied for credit with them. No funds are stolen. You demand they show proof. They say nope, because TTPs. So: how do I know it's a one-off, and not data theft by fraud at scale? Off goes a letter to the FTC... Do you think like a muppet? Here is satirical example (http://athena.m3047.net/temporizing.html http://athena.m3047.net/temporizing.html): TEMPORIZING FOUND NOT TO BE A FORM OF LYING "Temporizing", which is speculating from what we know now as to the motives of actors in the past and presenting that as historical fact, has been found not to be a form of lying. "Social proof demonstrates that temporizing is not lying" said a social commentator. The news was greeted optimistically as a good day for humanists and levels the playing field because "now the standards of proof we need to meet for the existence of society are the same as for religion". "People must have known about this in the past because it seems like they should have" said a man in the street. "Everybody who believes in science trusts society" said another.

ranger_danger 4y ago
In many of these extreme cases where it's non-obvious what is wrong, the victim IS often the one responsible. Example: Viral video shows police pulling unarmed (and allegedly innocent) suspect out of a parked car that sparks outrage. It's later found out that the victim was previously evading police pursuit just minutes before, and was trying to blend in with the other cars in a lot.
_8j50 4y ago
I have no idea what your post is about but from MS's perspective it isn't the site owners but MS's users around the world that are victims of thr threat actor that need protection. If it truly is a compromised site then the site owner is also a victim but as owners it is also their duty to secure and cleanup their site that is currently endangering the public.