3 ms·
They don't need one but having one maximizes campaign life.
by _8j50 4y ago
They don't need one but having one maximizes campaign life.
- BoorishBears 4y agoHow on earth does it do that? If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?
- krisoft 4y agoImagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots. You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc
- bell-cot 4y agoDisagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information. (Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)
- JamesBarney 4y agoA bad actor can do the same thing by putting together Mybadpage1.com Mybadpage2.com Mybadpage3.com
- BoorishBears 4y agoExcept if you're a malicious actor you can also do: msscanninghoneypot1.com msscanninghoneypot2.com msscanninghoneypot3.com You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that... edit: missed that multiple replies cover this
- _8j50 4y agoYou move it to xyz.com/anotherbadpage and tell MS it has been cleaned up. They do this all the time. Speaking from first hand experience. This is a very simple topic, why are there so many people not understanding this?!
- JamesBarney 4y agoBad actors know 1. It's detected (because Microsoft told everyone) 2. What was detected and where it was (because they put it there) Good Actors only know 1. So by telling someone 2 they are giving bad actors no new information, and good actors valuable information.
- wolrah 4y agoThis assumes the bad actor only put one thing there. If they put multiple things there they don't know what was detected unless told.
- JamesBarney 4y agoBut if a bad actor wants to know what's detectable they can just put each malware on separate domains.
- _8j50 4y ago1 is for domain only. 2, MS only knows some information that shows the site is malicious, it cannot tell if it is a compromise or just a malicious site unless it perhaps looks at reputation but even then the site owner should be able to tell new or malicious files on their webserver withour MS telling them, if they can't even do that they have bigger problems and threat actors do abuse anti-abuse systems like this all the time and they do deploy multiple things on your site as well as use it to attack other sites and monitor the reputation of their infrastructure.