Should they then not just reply with "You're on the list because of the malware payload at <URL>"?
Not saying that isn't shit or frustrating.
Being slightly more specific shouldn't be a problem.
Saying "we know you are compromised and know exactly where, but we're not going to tell" is very childish. Now, if they said for a nomial fee, we'd be happy to share the results of our work, would be another thing totally.
Are you saying that if you have this info correctly set up, these companies can verify your email domain is the same to provide assistance? What does law enforcement do with this info?
Email domains aren't always match with domains running the web-site (don't forget only ten years ago www. was still expected and people redirected you there from non-www. name).
But having access to DNS zone you can prove 'ownership' (at least technical) of the domain (even if it doesn't have the associated MX records for e-mail), precisely why LE is doing it.
> by copying&pasting whatever the original certbot
> I have no idea what they do, who can read them, when, where, why, etc
Oh my...
> Are you saying that if you have this info correctly set up, these companies can verify your email domain is the same to provide assistance?
More like "to prove you are the one responsible for tailspintoys.com - create a TXT record under that domain with 'dylan604 is admin here'".
> I have no idea what they do
TXT records are just plain text strings (in ASCII), nothing more, nothing less.
> who can read them, when, where, why
Everyone, anytime, anywhere, because it is you who placed it there in a system of Public DNS servers
The sad think is they didn't even tell that, they gave the admins no ways to be able to differentiate between:
- we don't care if we destroy your company with a false positive and
- we are sure we are right, if you didn't do it intentionally you are probably compromised
I've been in the situation where a company kinda 'ghosts' me before. And found out I was indeed the bad player (unintentionally, of course).
Those people don't have a registered business; The people contacting Microsoft do.
There are probably a bunch of excuses we can come up with that would make sense... but I think most people know the real reason, it's the same as with Google and Apple... they don't do customer support, and they don't take responsibility for any negative effects their services might have on others, at least not until someone big enough makes a fuss or lawyers get involved.
I don't think you understand how sophisticated malware distribution can be.
There's absolutely nothing stopping a "legitimate business" from distributing malware.
You're not sure which one of your virus payloads set off their screen so you open a ticket. And Microsoft is supposed to tell you exactly how to get off their list again?
Just like you shouldn't be beaten by the cops without knowing a reason for it.
If I put malware at xyz.com/mybadpage and MS starts flagging xyz.com, how on earth do I "maximize campaign life" by being told xyz.com/mybadpage has malware?
You can capitalise on this multiple ways. You can remove the first two and hope they remove the flag. You can design your next attack better so it is more like mybadpage3. Etc
(Not that I think MS should enumerate malicious URL's, unless $Site_Owner is paying for scanning service. A "we noticed malware at $URL" is generally 95% of the possible value of such disclosures.)
Mybadpage1.com
Mybadpage2.com
Mybadpage3.com
msscanninghoneypot1.com
msscanninghoneypot2.com
msscanninghoneypot3.com
You're pigeonholing a bad actor's actions into good actor behavior, it doesn't work like that...
edit: missed that multiple replies cover this
1. It's detected (because Microsoft told everyone)
2. What was detected and where it was (because they put it there)
Good Actors only know 1.
So by telling someone 2 they are giving bad actors no new information, and good actors valuable information.
2, MS only knows some information that shows the site is malicious, it cannot tell if it is a compromise or just a malicious site unless it perhaps looks at reputation but even then the site owner should be able to tell new or malicious files on their webserver withour MS telling them, if they can't even do that they have bigger problems and threat actors do abuse anti-abuse systems like this all the time and they do deploy multiple things on your site as well as use it to attack other sites and monitor the reputation of their infrastructure.
How does keeping secret (from the bad guys) where the malware is thwart the bad guys?
Or the bad guys themselves do that pretending to be the site owner. MS analysts can only inspect the normal site and the malicious URL that has now been removed in order to unblock it.
This is how abuse and IR works, I am surprised at the naivette of the responses here.
What happens is a website is blocked and the site operator has no idea why. The defense of "we can't share any information as to why you got punished as it might help bad actors avoid punishment" should not be an acceptable stance. It's the equivalent of being thrown to prison without due process and just ignoring false positives. It's a very "natural" way of acting, but that does not make it the right one.
You should secure your site better and have someone who knows what they are doing (there are paid WAF and web security vendors) monitor and respond to security incidents. You are not being punished, MS is protecting its customers. You should blame the hacker not MS for the impact of the hack. It's like someone messed with your car tank and tires and the police stop you from driving it because it is unsafe to other drivers, they are not punishing you but protecting other people from being hurt by your property.
The police says why they stopped you though! Which implies what you have to change in order to be able to drive again. They will not say "you have to figure it out on your own or the guys who messed with your car would have it more easy."
This is a pretty weak position to fall back to.
MS is disparaging their business and is trying to make themselves unaccountable. And they aren't customers so they have nothing to walk away from.
A non-malicious actor doesn't know, so telling them the exact URL at least tells them where the compromised asset might be.
A non-malicious actor who needs the URL isn't monitoring or responding to the incident properly. Threat actors do take advantage of this and simulate a fake cleanup. Actually they exclude certain ips and asns on phishing kits so that visiting the url gives you a 404 or a webhosts "cleanup" page.
With that said, there is an epidemic of muppet thinking right now. It's not just the intertubes. Suppose a credit card company pulls your credit report because they say you applied for credit with them. No funds are stolen. You demand they show proof. They say nope, because TTPs. So: how do I know it's a one-off, and not data theft by fraud at scale? Off goes a letter to the FTC...
Do you think like a muppet? Here is satirical example (http://athena.m3047.net/temporizing.html):
TEMPORIZING FOUND NOT TO BE A FORM OF LYING
"Temporizing", which is speculating from what we know now as to the
motives of actors in the past and presenting that as historical fact,
has been found not to be a form of lying. "Social proof demonstrates
that temporizing is not lying" said a social commentator.
The news was greeted optimistically as a good day for humanists and
levels the playing field because "now the standards of proof we need
to meet for the existence of society are the same as for religion".
"People must have known about this in the past because it seems
like they should have" said a man in the street. "Everybody who
believes in science trusts society" said another.Imagine if I just suddenly started spreading around rumors of your malfeasance and shadyness, and untrustworthyness.
It's a big deal.
Leave it to HN to get me to defend even MS lol.
Alex Pinto's classic research into the (lack of) overlap among threat indicator feeds should be a shot across the bow; I worked with threat indicators for a decade. To fend off muppet thinking I would like to remind everybody that they're selling threat indicator feeds; nobody that I know of sells not-a-threat feeds. A false positive means a site was falsely reported as a threat [sp]; a false negative does not mean that it is good, it simply means it is omitted from the list of threats.
In my experience vendors are a lot more worred about false positives than dropping something which is a threat on the floor (false negatives in context). However, moral hazard pushes them to publish things which turn out to be false positives anyway, because at the end of the day they're selling FUD.
My network, my rules. Something doesn't have to be a threat for it to be blocked from a private network in my opinion; there are lots of reasons for that, including minimizing potential threats. Something could be hosted on stinky infrastructure, but it's unknown or hasn't been demonstrated to be a threat. Profiles for operational security vary, and so does the appetite for proactively blocking (and whitelisting necessary resources): just because it's legal doesn't mean it doesn't put me at a competitive disadvantage if people know what I'm doing. I have no problem with people sharing and discussing such indicators, but there has to be attribution to the sharer: they have a reputation to be considered with equal concern as that of the indicators they publish.
If you're going to do something public with such information, you can't point fingers at "AI" and indicators you found in a paper bag on the bus: you do that, then you own it. Saying the victim deserves it is something you'd better be prepared to defend in court.
Example: Viral video shows police pulling unarmed (and allegedly innocent) suspect out of a parked car that sparks outrage. It's later found out that the victim was previously evading police pursuit just minutes before, and was trying to blend in with the other cars in a lot.
Is that really something to worry about so strongly that we screw over legitimate websites?
A malicious actor can already know exactly what's detected if they run one malware at a time per site.
We can not expect companies to give free security advice. Secondly, providing such info without consent might result in legal actions from not so smart companies.
Likely they already store this info somewhere so that the next time anyone reviews the domain, the reviewer cannot overlook it. In that case, the system could be completely automated, sending the info to the hostmaster or tech-c of the domain or something.
If you launch a product that targets other businesses and has the capability of destroying them, you better take responsibility for that.