Has anyone created an RBL, much like (possibly) the BGN list which
includes the IP addresses of hosts which seem to be "infected" and are
attempting to brute-force SSH/HTTP, etc?
It would be fairly easy to setup a dozen or more honeypots and examine
the logs in order to create an initial list.
Anyone know of anything like this?
-Drew

Thu, 15 Feb 2007 11:30:34 EST, Drew Weaver said:

Has anyone created an RBL, much like (possibly) the BGN list which
includes the IP addresses of hosts which seem to be "infected" and are
attempting to brute-force SSH/HTTP, etc?

It would be fairly easy to setup a dozen or more honeypots and examine
the logs in order to create an initial list.

A large percentage of those bots are in DHCP'ed cable/dsl blocks. As such,
there's 2 questions:

1) How important is it that you not false-positive an IP that's listed because
some *previous* owner of the address was pwned?

2) How important is it that you even accept connections from *anywhere* in
that DHCP block?

(Note that there *are* fairly good RBL's of DHCP/dsl/cable blocks out there.
So it really *is* a question of why those aren't suitable for use in your
application)

PGP SIGNATURE
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

xerdRXfh6Qs6VvsDmLzdeK4=
=5HAi
PGP SIGNATURE

Thu, 15 Feb 2007, Drew Weaver wrote:
Has anyone created an RBL, much like (possibly) the BGN list which
includes the IP addresses of hosts which seem to be "infected" and are
attempting to brute-force SSH/HTTP, etc?

Bots are rarely single purpose engines. If they have been detected doing
bad things, they will probably appear in multiple RBLs for multiple
reasons. If something is in multiple RBLs, even if it hasn't done the
particular badness you are looking for, its probably just a matter of
time.

Perhaps not surprising, some of the porn site vendors appear to have
the most sophisticated systems for detecting brute force/password sharing
attacks.

Valdis.Kletnieks (AT) vt (DOT) edu wrote:
Thu, 15 Feb 2007 11:30:34 EST, Drew Weaver said:

>Has anyone created an RBL, much like (possibly) the BGN list which
>includes the IP addresses of hosts which seem to be "infected" and are
>attempting to brute-force SSH/HTTP, etc?

>It would be fairly easy to setup a dozen or more honeypots and examine
>the logs in order to create an initial list.

A large percentage of those bots are in DHCP'ed cable/dsl blocks. As such,
there's 2 questions:

1) How important is it that you not false-positive an IP that's listed because
some *previous* owner of the address was pwned?

2) How important is it that you even accept connections from *anywhere* in
that DHCP block?

That depends

Do you sell "Internet service" to you customers or something else. If
the former then they're actually paying to receive connections from
anywhere

(Note that there *are* fairly good RBL's of DHCP/dsl/cable blocks out there.
So it really *is* a question of why those aren't suitable for use in your
application)

Thu, 15 Feb 2007 09:16:27 PST, Joel Jaeggli said:
Valdis.Kletnieks (AT) vt (DOT) edu wrote:
2) How important is it that you even accept connections from *anywhere* in
that DHCP block?

That depends

Do you sell "Internet service" to you customers or something else. If
the former then they're actually paying to receive connections from
anywhere

Then the RBL is irrelevant, as "anywhere" isn't the same as "anywhere that
isn't in an RBL". :)

(And anyhow, I'd *hope* that any use of an RBL to filter things on behalf of
a customer was spelled out in the contract, at least in the fine print that
most Joe Sixpacks never bother reading, specifically to cover that issue)

PGP SIGNATURE
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

f850/VR8Q4wS/qWYHD6YlpY=
=DyX
PGP SIGNATURE

Drew Weaver wrote:
Has anyone created an RBL, much like (possibly) the BGN list
which includes the IP addresses of hosts which seem to be "infected"
and are attempting to brute-force SSH/HTTP, etc?

It would be fairly easy to setup a dozen or more honeypots and examine
the logs in order to create an initial list.

Anyone know of anything like this?

web.dnsbl.sorbs.net has hosts that do this as well as korgo infected
machines, and a whole host of other types of vulnerabilities, trojans
and bots.

Do be careful about how you use the data, we don't distinguish between
the types for very good reason.

Regards,

Mat