3.1.0_6 UPDATE

JMV43 0

@bbcan177 Changing subject, "Thousands of GitHub repositories deliver fake PoC exploits with malware" found this on Bleeping Computer, some of the pfBlocker feeds are named in this article.

JMV

lohphat

@jmv43-0 ??? I'm not aware of any IP or DNSBL list downloads from pfBlocker feeds which contain executable scripts. They're just lists of IPs, CIDRs, FQNDs to build lookup tables.

Do you have an example feed which contains a script?

BBcan177

@jmv43-0

https://twitter.com/BleepinComputer/status/1584202031044374528?t=0XBrpP3vz_7XvkMFnW4PcQ&s=19

"By looking closer into some of those cases, the researchers found a plethora of different malware and harmful scripts, ranging from remote access trojans to Cobalt Strike."

"IP address analysis: comparing the PoC's publisher IP to public blocklists"

So basically there are scripts and executables that were found in several Github repositories.

The researchers found that some of those malware IPs were matched in the public IP blocklists.

The best blocklists being hpHosts and Stop Forum Spam.

Tho hpHosts has been closed but I have been trying to get it back some what:

https://twitter.com/BBcan177/status/1582913688058855426?t=abL5y3qyGMikWZgRn7mbnw&s=19

BBcan177

And another reason why I resisted to automatically unblock any IPs of any feeds.

DefenderLLC

@bbcan177 Good idea. Making the same change now...

JMV43 0

@lohphat Looking for a short and concise answer. Are they dangerous or not? I'm not a professional at this like some of you are.

JMV

JMV43 0

@bbcan177 Thank you. I just needed to make sure it didn't somehow affect pfBlocker's feeds..

JMV

pfsjap

@bbcan177 said in 3.1.0_6 UPDATE:

And another reason why I resisted to automatically unblock any IPs of any feeds.

I don't get it, how would you automatically unblock IPs of some feed?

Gertjan

@pfsjap said in 3.1.0_6 UPDATE:

how would you automatically unblock IPs of some feed?

By using a build in list called 'auto unblock' ;)

Now the question goes to 'why' - right ?

pfsjap

@gertjan I don't want to unblock IPs in a blocklist, I just can't see how that would even be possible.
I guess I could change the rule action from Reject to Pass, but 'Auto unblock'?

DefenderLLC

@pfsjap I was wondering this myself. Got confused with Suricata where this feature is an option.