Malicious Websites

Question

Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as "malicious". While a lot of time, this is truly bad, there are other times that websites share the same IP with a lot of others, therefore it gets flagged because of the host. A lot of this is occurring for in the cloud stuff as well. So with that being said, how do you truly determine if a site is bad or not? I currently use various website such as:

Robtex, ISC, Ipvoid, Urlvoid, MyWOT, McAfee Site Advisor, Virustotal, Anubis, various malware domain lists, etc.

But even then, data is sometimes questionable and inconsistent. Are there any additional websites and/or tools you all would recommend for further analysis. Maybe Cuckoo or some type of hardened Linux box where you can actually go to the website and search for redirects or be able to pull the various files from the site that your "infected machine" is trying to get. Any information would be appreciated!

Answer 1

For ones which are flagged up as malicious that you really want to go and check, your best bet is to use a standalone machine on its own network which will be torn down and rebuilt afterwards.

As this can be time intensive, the solution I use is a virtual machine running under vmware or virtualbox, which I just reset back to initial values after I'm done.

It does depend on what you want to do though - in en enterprise environment you may have very different needs to a research environment.

Answer 2

One method for cunducting some manual analysis of a site with additional safety is to run a testing vm which you can simply return to a snapshot image afterwards. Obviously this isn't completely foolproof as methods do exist to attack the host, but in a safety/convenience trade-off it's often a good way to go.

Answer 3

Automated Web Patrol with Strider HoneyMonkeys from Microsoft Research. They had lots of virtual machines, browsing the web, and then later they compared the diffs of the machine (previous and after). They found many 0day that way

Answer 4

I think you should have a look at the following site. Seems like it does what are looking for.

http://honeynet.org.au/?q=node/63

Answer 5

How do I tell which sites are malicious? I don't. I don't try. There's no good, reliable way to detect that a site is malicious. It's not a good use of your time. Life is too short to mess with that.

Instead, it's a better use of your time to make sure your software is set up so that if a site is malicious, it can't do any harm. Turn on automatic updates. Use a browser that has a good security track record (Chrome has been taking a real leadership role in security lately). Uninstall plugins you don't need, like Java and Silverlight. Make sure the remaining plugins, like Flash, are updated. If you're really serious, consider installing a protective extension, like NoScript. If you do that, you should be in pretty decent shape for everyday web browsing.

Answer 6

For a quick check, I'll usually visit the site with Firefox/NoScript and look for anything suspicious. Ultimately I just choose to trust the warning for the most part. I don't have the time, nor is it really ever a site our company needs to visit, so beyond that cursory check, I choose to trust the warnings and stay away if Chrome/Firefox/IE warn me.

Answer 7

What kind of context are we talking about? Small business? Corporate network? Top-secret government facility?

Generically, if you're interested in maintaining security: Block first, ask questions later.