Hacker News new | ask | show | jobs
by bell-cot 1400 days ago
Actual bad guys, hosting $Evil on purpose, are extremely unlikely to need any "change the URL" hints.
1 comments

They don't need one but having one maximizes campaign life.
How on earth does it do that?

If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?

Imagine that you have put malware in xyz.com/mybadpage1, xyz.com/mybadpage2, and xyz.com/mybadpage3 pages. MS flags you, and you query MS. They tell you they see malware on the first two urls. Now you gained information about their blindspots.

You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc

Disagree: $Evil_Site_Owner can easily test MS's blind spots by putting malware on numerous web sites, then seeing which of those sites are flagged. And if MS is not systematically scanning all the URLs...well, "MS failed to notice malware at $URL, which my web server logs say MS has not visited" is pretty useless information.

(Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)

A bad actor can do the same thing by putting together

Mybadpage1.com

Mybadpage2.com

Mybadpage3.com

Except if you're a malicious actor you can also do:

msscanninghoneypot1.com

msscanninghoneypot2.com

msscanninghoneypot3.com

You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that...

edit: missed that multiple replies cover this

You move it to xyz.com/anotherbadpage and tell MS it has been cleaned up. They do this all the time. Speaking from first hand experience. This is a very simple topic, why are there so many people not understanding this?!
Bad actors know

1. It's detected (because Microsoft told everyone)

2. What was detected and where it was (because they put it there)

Good Actors only know 1.

So by telling someone 2 they are giving bad actors no new information, and good actors valuable information.

1 is for domain only.

2, MS only knows some information that shows the site is malicious, it cannot tell if it is a compromise or just a malicious site unless it perhaps looks at reputation but even then the site owner should be able to tell new or malicious files on their webserver withour MS telling them, if they can't even do that they have bigger problems and threat actors do abuse anti-abuse systems like this all the time and they do deploy multiple things on your site as well as use it to attack other sites and monitor the reputation of their infrastructure.

This assumes the bad actor only put one thing there. If they put multiple things there they don't know what was detected unless told.
But if a bad actor wants to know what's detectable they can just put each malware on separate domains.