6 ms·
Norse Attack Map
- wnevets 11y agowhat is norse, and why does it hate st. louis?
- libraryatnight 11y agoSeems like China hates St Louis?
- daveloyall 11y agoI've never posted a link to a Fox News affiliate before... Here goes! http://fox2now.com/2015/07/08/is-st-louis-under-a-cyber-attack-threat-map-points-to-china/ http://fox2now.com/2015/07/08/is-st-louis-under-a-cyber-atta... Ok, so.. Norse Corp, the ones that make the map, has offices in St. Louis.
- ganeumann 11y ago"We are not under attack. We are not going to die. You have to come to work tomorrow." Awesome.
- daveloyall 11y agoWow, that FOX site has actually replaced the original article with the one you see now. There's NO mention of the change.
- jessaustin 11y agoWe're shocked.
- ironchef 11y agoThat's because of all the defense / Intel work in St. Louis (Scott afb etc). And to the other commenter talking about Kirksville, that's where the JSS is.
- twakefield 11y agoLOL, I had the same initial reaction. Apparently Norse monitors global cyber attacks[1]. So the real question is not why they hate St. Louis but why does China hate St. Louis? I found the link while reading conspiracy theories about the NYSE shut down this morning[2]. I have no idea about the quality of the data. I just thought the visualization was cool. [1] http://norsecorp.com/ http://norsecorp.com/. [2] http://www.zerohedge.com/news/2015-07-08/what-first-world-cyber-war-looks-global-real-time-cyber-attack-map http://www.zerohedge.com/news/2015-07-08/what-first-world-cy...
- conpermiso 11y agoThere are 16 colo centers in St. Louis according to http://www.datacentermap.com/usa/missouri/st-louis/ http://www.datacentermap.com/usa/missouri/st-louis/, I wonder if anyone interesting has rack space there.
- d1str0 11y agoNorse has offices in St. Louis and I'm sure that's where they host the majority of their honeypots. Thus, you see a lot of attacks hitting St. Louis.
- d1str0 11y agoNorse Corp. is a threat intelligence company. I believe one of their HQ is located in St. Louis and is where they currently host many of their honeypots. That is why you see St. Louis being attacked a lot.
- jessaustin 11y agoWhat's even funnier is all the attacks aimed at Kirksville. What a funny little one-horse town that is.
- tcas 11y agoAre there any open source map platforms like this for integrating into real time data feeds (i.e. if we want to track sales by region etc...) onto a map? I know about http://cesiumjs.org/ http://cesiumjs.org/ but it was extremely resource intensive heavy last time I tried to use it. EDIT: it looks like they use http://leafletjs.com/ http://leafletjs.com/ -- looks interesting
- joaoqalves 11y agoHi. You can try https://map.blueliv.com/ https://map.blueliv.com/ Disclaimer: I work there.
- MayMuncher 11y agoYou can take a look at http://www.jsgraphs.com/ http://www.jsgraphs.com/ which has a list. http://echarts.baidu.com/doc/example-en.html#map http://echarts.baidu.com/doc/example-en.html#map http://echarts.baidu.com/doc/example/map9.html#-en http://echarts.baidu.com/doc/example/map9.html#-en http://echarts.baidu.com/extension/BMap/doc/example.html#-en http://echarts.baidu.com/extension/BMap/doc/example.html#-en http://echarts.baidu.com/doc/example/map12.html#-en http://echarts.baidu.com/doc/example/map12.html#-en
- clwg 11y agoThere's this https://github.com/hrbrmstr/pewpew https://github.com/hrbrmstr/pewpew it's as much a criticism of these sorts of security visualizations as it is a means to create them.
- finnn 11y agoYou could use Logstash and Kibana to make a similar looking map from actual logs, but i don't think you'd be able to do the shooting animation, but I'm not too well versed in Kibana. Maybe with a plugin?
- rza 11y agoI don't know much about network security. Is there a difference between the kind of attacks that would be caught by honeypots vs targeted attacks? Do these statistics depend heavily on how they setup their honeypots, which I assume is limited by the company's logistics.
- libraryatnight 11y agoSeems like China needs to go to internet time-out.
- yeukhon 11y agoHow do they collect this data?
- d1str0 11y agoHoneypots
- bithead 11y agoThat would, in my view, mean I shouldn't take the map as accurate.
- nkozyra 11y agoWhat does "accurate" mean? It's not comprehensive - what it does is show you where their honeypots get the most attacks from over time. That said, it's not all that useful - there's no shocking information here. As mentioned, it's largely a marketing tool.
- fineman 11y agoCorrect. But you could do a pretty good idea with some honeypots (customers) and a few agreements with ISPs to see where similar packets go.
- daveloyall 11y agoThe company that runs this attack map published a blog post about China yesterday. http://darkmatters.norsecorp.com/2015/07/07/chinas-new-security-law-is-retort-for-u-s-sanctions-policy/ http://darkmatters.norsecorp.com/2015/07/07/chinas-new-secur... [EDIT: removed 'unflattering'.]
- daveloyall 11y agoIf Norse wanted to make this data useful, they'd present it as a CSV, too. How else could I determine if one entity owns all the St. Louis targets??? :)
- kjs3 11y agoThey actually sell that sort of data feed. The map is an ad.
- deleted 11y ago[deleted]
- jackdawjack 11y agoThis is more of a sales pitching device (and it's a nice one) than a useful tool
- kyrra 11y agoI've seen maps like this discussed[0] on /r/netsec/ and other similar forums and from my understanding, they are mostly useless. It's aggregates some data to make a very pretty site, but doesn't really give you anything actionable. Normally you need to run it through real monitoring tools with various thresholds configured so you can alert the proper teams to act when something odd is going on. [0] http://www.reddit.com/r/netsec/comments/2xuai9/pewpew_your_very_own_ip_attack_map_with_d3js/ http://www.reddit.com/r/netsec/comments/2xuai9/pewpew_your_v...
- tomphoolery 11y agoThe Norse Map used to have a little "about" section that explained how the map is a general aggregation of data and designed to show at a very high level what is going on, but doesn't provide any deep insight into each attack. The famous disclaimer "for entertainment purposes only" comes to mind, but in reality I think the Norse Map is just a really neat and sort-of functional advertisement for the capabilities of Norse. If you go to http://norsecorp.com http://norsecorp.com, you'll see that the company behind the map is a security firm that wants you to pay for "real-time visibility into global cyber attacks", which means either signing up for their service that alerts you of weird activity on your network, or purchasing their appliance that can help block attacks at the point of entry. I'd conclude that the map is not really meant to actually provide real threat warnings, but rather a way to see into what the Norse Intelligence Service is capable of monitoring.
- meowface 11y agoNorse is generally considered a joke by all the professionals I know in the infosec and threat intelligence industries, and not just for their silly map. Even moreso after their recent Iran report, done in conjunction with the political thinktank American Enterprise Institute. No bias there at all.
- secfirstmd 11y agoAgree, though I think the value in this is purely demonstrative to non-tech people, just to try to emphasise specific concepts.
- trhway 11y agointeresting that attacks come directly from China instead of say some botnets distributed around the world.
- kalleboo 11y agoChina probably has the most compromised PCs due to the levels of piracy there.
- brock_r 11y agoThought it was a video game. Tried shooting back at China.
- britknight 11y agoShall we play a game?
- guiambros 11y agoNops. The only winning move is not to play.
- curiousjorge 11y agoHow about global thermonuclear war?
- AdieuToLogic 11y agoA strange game. The only winning move is not to play. How about a nice game of chess?
- tomphoolery 11y agoPlot twist, you are China.
- sweis 11y agoThis map has much better pew pew sounds: http://threatbutt.com/map/ http://threatbutt.com/map/
- bognition 11y agoNot sure how they are getting their attack data. Especially since they are classifying shodan as an "attacker"
- leoc 11y agoWith a title like that, I was at first expecting to see a map of coastal attacks against northern Europe.
- closetnerd 11y agoI expected Russia to be active.
- ldubinets 11y agoTheir homepage says "Norse Tracks over 200,000 tor exit nodes". Tor metrics [1] says there exist 1,000 ish Tor exit nodes. So is Norse's statement a blatant lie? [1] https://metrics.torproject.org/relayflags.html https://metrics.torproject.org/relayflags.html
- finnjohnsen2 11y agoWhat about that spot mid Russia which just pulsates? attacking itself?