Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/24/2017
08:55 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

China, US Top List Of Countries With Most Malicious IPs

Brazil has 20% more risky IPs than Russia, Recorded Future's analysis shows.

New research by threat intelligence firm Recorded Future has yielded some surprising insights on risky IP addresses, their distribution around their world, and how organizations can protect against them.

Recorded Future tied four million known bad IP address back to the network operators to which they belonged in order to try and understand the risk posed by each operator. Each of the IPs in the list was known to be either currently or historically risky and was associated with behavior that ranged from "unusual" to the "very malicious."

The four million IPs that Recorded Future analyzed traced back to a total of 26,581 Autonomous System Numbers (ASNs), which are unique numbers for identifying the IP subnets managed by different operators.

The company's analysis yielded some interesting results: China, for instance, had more risky or suspicious IP address than any other country. Given the country's tight control over the Internet, the high number of risky IPs suggests government awareness of malicious use, Recorded Future said.

Russia, which in recent months has been accused of a wide range of malicious activity, had a relatively low level of risky IP addresses, suggesting that bad actors there are exploiting infrastructure in other countries. Surprisingly, Brazil had 20% more risky IP addresses than Russia, while a group of Asian countries including Korea, Thailand, Vietnam, and India had two times as many bad IPs as Russia and Ukraine.

The US, which is often regarded as safer than many other countries, actually had the second highest number of bad IPs - second to China. But the IP addresses in the US were distributed across 360% more IPs in total than China.

Recorded Future's analysis revealed other interesting insight as well. The ASNs with the most number of risky IP addresses were both from China, and are currently ranked the first and fourth largest IP subnets in the world.

However, when Recorded Future ranked the ASNs by the percentage of risky IPs in them, a different picture emerged entirely. For instance, though China's Chinanet had by far the highest raw number of risk-scored IPs, that number represented a mere 0.4% of the total 100 million IP addresses managed by Chinanet overall.

In contrast, three operators — one each in Russia, Germany, and Latvia — though much smaller, appeared completely compromised with 100% of their IP addresses found risky.

Russia's ADM Service Ltd., for instance, accounted for just 511 of the 4 million IPs that Recorded Future looked at, but that number represented 100% of ADMs IP address space. Overall, Russia and Brazil topped the list of countries with network operators that had 2% or higher of their IP addresses classified as risky — a number that represents endemic risk, the analysis shows.

US Dominates

When Recorded Future looked at ASNs with the highest number of IPs associated with command and control activity, the US dominated the charts. The top three ASNs in this category were located in the US, while there were four ASNs overall in the top 10 list. The same result emerged when Recorded Future inspected IP addresses that were hardcoded into malware samples.

One explanation of why malicious activity is based in the US and countries like Canada and the UK is because threat actors want to make their traffic appear as innocent as possible, Recorded Future conjectures.

For network professionals, the key takeaway is that it is possible to proactively identify and block risky parts of the Internet by doing ASN-level risks assessments, says Bill Ladd, chief scientist at Recorded Future.

"Country-level assessments are useful for general situational awareness and ASN level assessments are useful for blocking," he says.

Instead of looking merely at the total number of bad IPs associated with an ASN it is more informative to consider the percentage riskiness of an ASN, he says. ASNs with endemic levels of risky IPs are much smaller in number and blocking them is likely to have less of a negative impact, he says.

Blocking ASNs based on their risk percentage can be effective. For example, when Recorded Future implemented rules for blocking the 10 riskiest ASNs, it preemptively also blocked over 1,720 IP addresses that later turned out to be risky. When Recorded Future tightened its rule to block all ASN's with 6% or higher of risky IPs, the company proactively blocked close to 12,000 IPs that later emerged as risky.

"High-risk ASNs can be identified and blocked," Ladd says. With almost 60,000 ASNs worldwide, it is impossible to evaluate all of them. So a risk-ordered list is needed to prioritize the most important ones to block, he notes. Organizations should review the riskiest ASNs and make blocking decisions based on both risk and business value.

"My advice to organizations is to identify and evaluate ASNs that are of highest risk. I'd also advise organizations to block any that have minimal business value," Ladd says

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36197
PUBLISHED: 2021-05-13
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This ...
CVE-2020-36198
PUBLISHED: 2021-05-13
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect: QNAP...
CVE-2021-28799
PUBLISHED: 2021-05-13
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3...
CVE-2021-22155
PUBLISHED: 2021-05-13
An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s acco...
CVE-2021-23134
PUBLISHED: 2021-05-12
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.2 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.