One of the main products we develop at Lastline is the Malscape Threat Intelligence Feed, which provides continuously updated intelligence about malicious activity on the Internet. Specifically, we provide information about malicious servers on the Internet based on the various analysis techniques we have developed. Regularly, we find that legitimate services on the Internet are abused by attackers and we need to make sure that such domains or IP addresses are specifically marked by our heuristics: we typically do not want to blacklist these domains/IP addresses since this could cause unwanted side effects. A prime example of this kind of benign services are cloud storage solutions such as for example Dropbox. These services are often abused by attackers to host their malicious content (e.g., malware binaries, exploits, or helper files) in an attempt to evade common attack detection techniques.
As an example of malicious content hosted on a cloud storage, we can take a look at a recent Wepawet report. The attacker uses Dropbox to host a JavaScript file that includes an iframe to another site, which then attempts to perform drive-by download attacks based on the Help Center URL Validation vulnerability (CVE-2010-1885).
Obviously, we do not want to blacklist the domain dl.dropbox.com since it belongs to a service that is used by many people in legitimate use cases. However, to protect people on the Internet from this kind of attacks, we want to make sure that malicious content hosted on benign services is removed as quickly as possible. To reach this goal, we have established good relationships to various services and regularly send them reports about malware hosted at their site. The malicious JavaScript file from the above example was reported to Dropbox shortly after our analysis systems detected that it is malicious and within less than 30 minutes it was removed from Dropbox. Furthermore, the user and all of his/her links were banned as well, mitigating this threat efficiently.
