Cloud

8/24/2017
08:55 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China, US Top List Of Countries With Most Malicious IPs

Brazil has 20% more risky IPs than Russia, Recorded Future's analysis shows.

New research by threat intelligence firm Recorded Future has yielded some surprising insights on risky IP addresses, their distribution around their world, and how organizations can protect against them.

Recorded Future tied four million known bad IP address back to the network operators to which they belonged in order to try and understand the risk posed by each operator. Each of the IPs in the list was known to be either currently or historically risky and was associated with behavior that ranged from "unusual" to the "very malicious."

The four million IPs that Recorded Future analyzed traced back to a total of 26,581 Autonomous System Numbers (ASNs), which are unique numbers for identifying the IP subnets managed by different operators.

The company's analysis yielded some interesting results: China, for instance, had more risky or suspicious IP address than any other country. Given the country's tight control over the Internet, the high number of risky IPs suggests government awareness of malicious use, Recorded Future said.

Russia, which in recent months has been accused of a wide range of malicious activity, had a relatively low level of risky IP addresses, suggesting that bad actors there are exploiting infrastructure in other countries. Surprisingly, Brazil had 20% more risky IP addresses than Russia, while a group of Asian countries including Korea, Thailand, Vietnam, and India had two times as many bad IPs as Russia and Ukraine.

The US, which is often regarded as safer than many other countries, actually had the second highest number of bad IPs - second to China. But the IP addresses in the US were distributed across 360% more IPs in total than China.

Recorded Future's analysis revealed other interesting insight as well. The ASNs with the most number of risky IP addresses were both from China, and are currently ranked the first and fourth largest IP subnets in the world.

However, when Recorded Future ranked the ASNs by the percentage of risky IPs in them, a different picture emerged entirely. For instance, though China's Chinanet had by far the highest raw number of risk-scored IPs, that number represented a mere 0.4% of the total 100 million IP addresses managed by Chinanet overall.

In contrast, three operators — one each in Russia, Germany, and Latvia — though much smaller, appeared completely compromised with 100% of their IP addresses found risky.

Russia's ADM Service Ltd., for instance, accounted for just 511 of the 4 million IPs that Recorded Future looked at, but that number represented 100% of ADMs IP address space. Overall, Russia and Brazil topped the list of countries with network operators that had 2% or higher of their IP addresses classified as risky — a number that represents endemic risk, the analysis shows.

US Dominates

When Recorded Future looked at ASNs with the highest number of IPs associated with command and control activity, the US dominated the charts. The top three ASNs in this category were located in the US, while there were four ASNs overall in the top 10 list. The same result emerged when Recorded Future inspected IP addresses that were hardcoded into malware samples.

One explanation of why malicious activity is based in the US and countries like Canada and the UK is because threat actors want to make their traffic appear as innocent as possible, Recorded Future conjectures.

For network professionals, the key takeaway is that it is possible to proactively identify and block risky parts of the Internet by doing ASN-level risks assessments, says Bill Ladd, chief scientist at Recorded Future.

"Country-level assessments are useful for general situational awareness and ASN level assessments are useful for blocking," he says.

Instead of looking merely at the total number of bad IPs associated with an ASN it is more informative to consider the percentage riskiness of an ASN, he says. ASNs with endemic levels of risky IPs are much smaller in number and blocking them is likely to have less of a negative impact, he says.

Blocking ASNs based on their risk percentage can be effective. For example, when Recorded Future implemented rules for blocking the 10 riskiest ASNs, it preemptively also blocked over 1,720 IP addresses that later turned out to be risky. When Recorded Future tightened its rule to block all ASN's with 6% or higher of risky IPs, the company proactively blocked close to 12,000 IPs that later emerged as risky.

"High-risk ASNs can be identified and blocked," Ladd says. With almost 60,000 ASNs worldwide, it is impossible to evaluate all of them. So a risk-ordered list is needed to prioritize the most important ones to block, he notes. Organizations should review the riskiest ASNs and make blocking decisions based on both risk and business value.

"My advice to organizations is to identify and evaluate ASNs that are of highest risk. I'd also advise organizations to block any that have minimal business value," Ladd says

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19990
PUBLISHED: 2018-07-23
October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable v...
CVE-2018-19990
PUBLISHED: 2018-07-23
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend pat...
CVE-2018-19990
PUBLISHED: 2018-07-23
FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in attackers accessing out of bound data. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fix...
CVE-2018-19990
PUBLISHED: 2018-07-23
FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-overflow that may result in remote code execution. This attack appears to be exploitable via specially crafted ASF file that has to be provide...
CVE-2018-19990
PUBLISHED: 2018-07-23
FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulnerability that allows attackers to consume excessive amount of resources like CPU and RAM. This attack appear to be exploitable via specially c...