11

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on.

I would like to detect CSP reports caused by malware, so I can ignore them. Ignoring *.cloudfront.net doesn't seem right, is there a way?

  • Great question! How do you know they are caused by client-side malware? – D.W. Jul 1 '14 at 16:07
  • I Googled the blocked URIs, e.g.: cdncache-a.akamaihd.net, savingsslider-a.akamaihd.net – Jackson Pauls Jul 1 '14 at 20:32
  • 1
    @MichaelGuier Ignoring everything from, say, cloudfront is easy. But the reports may also contain cloudfront URLs that aren't used by client-side malware, and I don't want to ignore those. – Jackson Pauls Jul 31 '14 at 12:03
  • 3
    Why do you want to ignore CSP reports caused by malware ? That can be dangerous; it is like ignoring the Google Safe browsing service – user45139 Aug 13 '14 at 8:17
  • 1
    @jackson - that helps - but it would help more if you put those facts in the question, rather than in the comments. – Mark C. Wallace Aug 13 '14 at 13:02
2

I highly doubt that these CSP reports where generated with client-side malware. I suspect this the behavior of a load-balancer that is leading to positives. Malware authors prefer hosting their applications using infrastructure with less oversight, where as Akamai and Cloudflare provide security services and have their own highly skilled security teams.

Without actually seeing these logs, no one can help you. The first thing I would do is download the JavaScript in the CSP report and perform an malware analysis on it.

| improve this answer | |
1

The question is mainly what you mean by "ignoring". I recommend you collect every CSP violation, but only act upon the ones that are obviously unrelated to your website. Your analysis & visualization steps should take care of that.

The cloudfront hosts are likely not malware but scripts running from browser extensions.

| improve this answer | |
0

Akamai and Cloudfront are both names associated with CDN's. In many cases CDN's are hosting collection sites for metadata associated with IP addresses for tracking purposes as well as their initially intended use of caching large files for various websites. Although these particular names may or may not be associated with legitimate traffic, your lack of concern regarding client side malware is all too prevalent in our world and suggest you remediate that belief system by doing some research regarding how malware has been one of the biggest security threats in last decade.

Malware is associated with the vast majority of compromised environments.

Owning a desktop is the first step of owning it all.

Understanding that you are probably dealing with more CSP violations than is humanly possible to investigate there is a certain amount of empathy associated with your position. Building a body of knowledge, even if you have to use a spreadsheet, about the various domains that are being listed in your CSP is the long term key to success, especially if you are apart of a small team or are a one man show. Once you understand these domains and investigate their registrations and content they may share, you can begin to look into their ToS and even capture traffic too and from these url 'strings' you are seeing (ensure this machine is isolated). Your packet captures and time investment should assist your in beginning to identify legitimate and illegitimate DNS names and will allow you to focus on more self evident risk.

It is best to keep in mind that most compromises are shown in various systems and sysops ignored them due to the vast amount of false positives they are culling through. They were alerted but they weren't alert and process driven in their culling. In short, trust nothing until you can prove it trustworthy.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.