The Age of Collaborative Security: What Tens of Thousands of Machines Witness

Disclaimer: This article is meant to give insight into cyber
threats as seen by the community of users of CrowdSec.

What can tens of thousands of machines tell us about illegal
hacker activities?

Do you remember that scene in Batman – The Dark Knight, where
Batman uses a system that aggregates active sound data from
countless mobile phones to create a meta sonar feed of what is
going on at any given place?

It is an interesting analogy with what we do at CrowdSec. By
aggregating intrusion signals from our community, we can offer a
clear picture of what is going on in terms of illegal hacking in
the world.

After 2 years of activity and analyzing 1 million intrusion
signals daily from tens of thousands of users in 160 countries, we
start having an accurate “Batman sonar” global feed of cyber
threats. And there are some interesting takeaways to outline.

A cyber threat with many faces

First of all, the global cyber threat is highly versatile. What
do we see when looking at the types of attacks reported, their
origin, and the Autonomous Systems (AS) behind the malicious IP
addresses?

Scanners and Brute force attempts are still the most popular
intrusion vectors our community sees and rank #1. Pretty logic, as
surveillance is the first step to a more advanced intrusion. The
scanning activities seen by our community are mostly port scans or
HTTP-based probings.

Amongst the different intrusion types used by hackers, brute
force attempts on sensitive services (SSH, email, admin URLs, etc.)
is #2. Not breakthrough information, but when studies show that
brute force attacks are accounted for 6% of
cyber attacks^[1]
in the world, it is not surprising to see it as dominant,
especially since it is still one of the easiest and cheapest ones
to automate and deploy (hello script kiddies). Because it is pretty
easy to counter, one would think it rarely works, but hey, 6%!

Log4J is still not yet a done deal

Amongst the most popular exploit attempts our community sees, we
have Log4j. You indeed enjoyed last year’s storm on how a simple
open-source logging utility for Apache with a vulnerability took
over the cybersecurity world and caused endless headaches to
cybersecurity experts. And, of course, the criminal world was more
than happy to exploit it with automated scanning bots looking for
vulnerable services.

Well, our community has witnessed the storm. Once the December
peak following the disclosure passed, things calmed down a little
bit, but scanning activities for Log4j started again, although at a
lower but constant level, fueled by bots.

The key message is that if you think you are protected because
the “marketing” storm passed, think twice.

There is still a very aggressive activity looking to use the
vulnerability.

For instance, a couple of weeks ago, a large spectrum of our
community was scanned as the IP address 13.89.48.118 was reported
by more than 500 users in less than 12 hours. It joined 20000+
other IP addresses on the community blocklist for remediation.

IP addresses: cyber criminals’ core
resource

IP addresses are rarely malevolent forever and their reputation
can change from one day to another. With the community constantly
sharing information on them, any update can be instantaneously
transferred to users. In the long run, it provides invaluable data
on the aggressiveness duration of IP addresses.

This is a snapshot of the number of IP addresses that landed in
the CrowdSec data lakes (flagged as malicious). What is interesting
to note is that cybercriminals are indeed changing the IPs they are
using to commit their attacks:

* only 2,79% of these are permanent members of our database

* 12,63% of all collected IPs change every single week

* The daily renewal rate sits at 1.8%

**Autonomous systems have different approaches to mitigating
compromised IPs**

Each IP is part of a pool of addresses managed by an AS
(Autonomous System). An AS is an extensive network or group of
networks that have a unified routing policy. Every computer or
device that connects to the Internet is connected to an AS.
Typically, each AS is operated by a single large organization, such
as an Internet service provider (ISP), a large enterprise
technology company, a university, or a government agency, and is,
as such, responsible for the IP addresses.

Each aggressive IP shared by the CrowdSec community is enriched
by its AS. This, combined with the data on aggressiveness duration,
can provide a clear picture of how AS manage compromised IPs.

While looking simply at the number of compromised assets might
be an angle, it wouldn’t be necessarily fair. Not all operators are
equal in size, and some are hosting “riskier” services (hello
outdated PHP CMS) than others.

The average malevolent duration of all the IPs in the same AS
indicates the operator’s due diligence in identifying and dealing
with compromised assets. The distribution of the average duration
is shown with arrows pointing to the position of the most reported
AS for the leading cloud providers. For instance, at AWS,
compromised addresses remain compromised for an average of 3 days.
Azure 9 days. At the end of the chart, AS from China or Russia
(surprise…) “are less quick” to act upon compromised IPs.

This article is meant to give an overview of the threat activity
and intelligence CrowdSec users see daily. Please consult the full version of the report here
if you want more details.^[2]