Cloud

8/24/2017
08:55 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China, US Top List Of Countries With Most Malicious IPs

Brazil has 20% more risky IPs than Russia, Recorded Future's analysis shows.

New research by threat intelligence firm Recorded Future has yielded some surprising insights on risky IP addresses, their distribution around their world, and how organizations can protect against them.

Recorded Future tied four million known bad IP address back to the network operators to which they belonged in order to try and understand the risk posed by each operator. Each of the IPs in the list was known to be either currently or historically risky and was associated with behavior that ranged from "unusual" to the "very malicious."

The four million IPs that Recorded Future analyzed traced back to a total of 26,581 Autonomous System Numbers (ASNs), which are unique numbers for identifying the IP subnets managed by different operators.

The company's analysis yielded some interesting results: China, for instance, had more risky or suspicious IP address than any other country. Given the country's tight control over the Internet, the high number of risky IPs suggests government awareness of malicious use, Recorded Future said.

Russia, which in recent months has been accused of a wide range of malicious activity, had a relatively low level of risky IP addresses, suggesting that bad actors there are exploiting infrastructure in other countries. Surprisingly, Brazil had 20% more risky IP addresses than Russia, while a group of Asian countries including Korea, Thailand, Vietnam, and India had two times as many bad IPs as Russia and Ukraine.

The US, which is often regarded as safer than many other countries, actually had the second highest number of bad IPs - second to China. But the IP addresses in the US were distributed across 360% more IPs in total than China.

Recorded Future's analysis revealed other interesting insight as well. The ASNs with the most number of risky IP addresses were both from China, and are currently ranked the first and fourth largest IP subnets in the world.

However, when Recorded Future ranked the ASNs by the percentage of risky IPs in them, a different picture emerged entirely. For instance, though China's Chinanet had by far the highest raw number of risk-scored IPs, that number represented a mere 0.4% of the total 100 million IP addresses managed by Chinanet overall.

In contrast, three operators — one each in Russia, Germany, and Latvia — though much smaller, appeared completely compromised with 100% of their IP addresses found risky.

Russia's ADM Service Ltd., for instance, accounted for just 511 of the 4 million IPs that Recorded Future looked at, but that number represented 100% of ADMs IP address space. Overall, Russia and Brazil topped the list of countries with network operators that had 2% or higher of their IP addresses classified as risky — a number that represents endemic risk, the analysis shows.

US Dominates

When Recorded Future looked at ASNs with the highest number of IPs associated with command and control activity, the US dominated the charts. The top three ASNs in this category were located in the US, while there were four ASNs overall in the top 10 list. The same result emerged when Recorded Future inspected IP addresses that were hardcoded into malware samples.

One explanation of why malicious activity is based in the US and countries like Canada and the UK is because threat actors want to make their traffic appear as innocent as possible, Recorded Future conjectures.

For network professionals, the key takeaway is that it is possible to proactively identify and block risky parts of the Internet by doing ASN-level risks assessments, says Bill Ladd, chief scientist at Recorded Future.

"Country-level assessments are useful for general situational awareness and ASN level assessments are useful for blocking," he says.

Instead of looking merely at the total number of bad IPs associated with an ASN it is more informative to consider the percentage riskiness of an ASN, he says. ASNs with endemic levels of risky IPs are much smaller in number and blocking them is likely to have less of a negative impact, he says.

Blocking ASNs based on their risk percentage can be effective. For example, when Recorded Future implemented rules for blocking the 10 riskiest ASNs, it preemptively also blocked over 1,720 IP addresses that later turned out to be risky. When Recorded Future tightened its rule to block all ASN's with 6% or higher of risky IPs, the company proactively blocked close to 12,000 IPs that later emerged as risky.

"High-risk ASNs can be identified and blocked," Ladd says. With almost 60,000 ASNs worldwide, it is impossible to evaluate all of them. So a risk-ordered list is needed to prioritize the most important ones to block, he notes. Organizations should review the riskiest ASNs and make blocking decisions based on both risk and business value.

"My advice to organizations is to identify and evaluate ASNs that are of highest risk. I'd also advise organizations to block any that have minimal business value," Ladd says

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
Good Times in Security Come When You Least Expect Them
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  10/23/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.