Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as "malicious". While a lot of time, this is truly bad, there are other times that websites share the same IP with a lot of others, therefore it gets flagged because of the host. A lot of this is occurring for in the cloud stuff as well. So with that being said, how do you truly determine if a site is bad or not? I currently use various website such as:

Robtex, ISC, Ipvoid, Urlvoid, MyWOT, McAfee Site Advisor, Virustotal, Anubis, various malware domain lists, etc.

But even then, data is sometimes questionable and inconsistent. Are there any additional websites and/or tools you all would recommend for further analysis. Maybe Cuckoo or some type of hardened Linux box where you can actually go to the website and search for redirects or be able to pull the various files from the site that your "infected machine" is trying to get. Any information would be appreciated!

share|improve this question
    
I guess to add onto this. I am really looking for a good tool/distro that I can put in a virtual environment and go to all of these websites that I'm curious about and it give me detailed information about the page. –  user1841 Mar 24 '11 at 16:37
    
I usually prefer something from this list: code.google.com/p/it-sec-catalog/wiki/… –  anonymous Mar 24 '11 at 17:47
    
its worth noting that some of these site only effect certain operating systems. So if I visit this site with windows 7 and chrome I get redirected to a legit site. If I visit with IE and XP it downloads a virus. So it's not always easy to tell if it isn't consistent. –  WalterJ89 Mar 25 '11 at 1:56
add comment

migrated from serverfault.com Mar 24 '11 at 14:30

This question came from our site for professional system and network administrators.

7 Answers

How do I tell which sites are malicious? I don't. I don't try. There's no good, reliable way to detect that a site is malicious. It's not a good use of your time. Life is too short to mess with that.

Instead, it's a better use of your time to make sure your software is set up so that if a site is malicious, it can't do any harm. Turn on automatic updates. Use a browser that has a good security track record (Chrome has been taking a real leadership role in security lately). Uninstall plugins you don't need, like Java and Silverlight. Make sure the remaining plugins, like Flash, are updated. If you're really serious, consider installing a protective extension, like NoScript. If you do that, you should be in pretty decent shape for everyday web browsing.

share|improve this answer
add comment

I think you should have a look at the following site. Seems like it does what are looking for.

http://honeynet.org.au/?q=node/63

share|improve this answer
add comment

Automated Web Patrol with Strider HoneyMonkeys from Microsoft Research. They had lots of virtual machines, browsing the web, and then later they compared the diffs of the machine (previous and after). They found many 0day that way

share|improve this answer
    
This is interesting and relevant research - thanks. But according to en.wikipedia.org/wiki/Client_honeypot, HoneyMonkey is not available for download. And I don't see that they provide a database of results for specific pages. So it seems that this doesn't answer the question. –  nealmcb Mar 25 '11 at 4:55
add comment

One method for cunducting some manual analysis of a site with additional safety is to run a testing vm which you can simply return to a snapshot image afterwards. Obviously this isn't completely foolproof as methods do exist to attack the host, but in a safety/convenience trade-off it's often a good way to go.

share|improve this answer
add comment

For ones which are flagged up as malicious that you really want to go and check, your best bet is to use a standalone machine on its own network which will be torn down and rebuilt afterwards.

As this can be time intensive, the solution I use is a virtual machine running under vmware or virtualbox, which I just reset back to initial values after I'm done.

It does depend on what you want to do though - in en enterprise environment you may have very different needs to a research environment.

share|improve this answer
add comment

What kind of context are we talking about? Small business? Corporate network? Top-secret government facility?

Generically, if you're interested in maintaining security: Block first, ask questions later.

share|improve this answer
    
Not really talking about a specific industry. No matter what, I completely agree that block first and ask questions later is the best solution. You can also say that if you see any trojan or bot activity from a host that you should reimage it immediately since there is no guarantee that AV will completely clean it. I'm just looking for people's personal opinion on how they would go about verifying the legitimacy of a website and/or pulling the website in a safe manner and truly seeing what your getting when you go to the site. –  user1841 Mar 24 '11 at 14:38
add comment

For a quick check, I'll usually visit the site with Firefox/NoScript and look for anything suspicious. Ultimately I just choose to trust the warning for the most part. I don't have the time, nor is it really ever a site our company needs to visit, so beyond that cursory check, I choose to trust the warnings and stay away if Chrome/Firefox/IE warn me.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.