Subject: [mile] IODEF Future Use Cases

From: Trevor Freeman <[email-masked]>
Date: Fri, 21 Mar 2014 20:44:12 +0000

Hi Panos,

Kathleen said you were considering adding future use cases for MILE to the guidance document.

Here are some suggestions for such use cases.

Fake Hosting Companies

See http://blog.dynamoo.com/2014/02/on-trail-of-3nt-solutions-llc.html

Seems that it pays for criminals to set up foreign hosting companies to front their activates - maybe not a real surprise. The WHOS statement cannot be acceptable in today's environment. Service providers should be required to be proactive not reactive to cybersecurity issues. Given the modern monitoring tool set it is pretty trivial to identify bad content for yourself. You just have to look. Since we have independent data on servers hosting malware, national CERTS could monitor how effective the service provider are at policing their customers. MILE\IODEF could be used to notify a national CERT when ISP identifies and takes action to clean up an incident as well as CERTS notifying ISP when they are aware of incidents. This would help identify bad ISPs i.e. those who deliberately or consistently do a bad job detecting and addressing malware on server they host (cos they are the ones hosting the malware)

Suspicious Certificates
A third party may become aware of some suspicious\questionable uses for a certificate. The third party may be a web crawler or an isp or network appliance. Yes they could perform the revocation check on the certificate themselves but that is not definitive. A better check would be to forward an IODEF message to the CA with the full context of bot the certificate and its use. That exchange can be automated i.e. the IODEF message has the full context and allows the CA to confirmed if they did indeed issue the certificate. If that checked out a IODEF message could be sent to the subject, in case the certificate was legitimately issued but the keys stolen.

Phishing\Spearfishing attacks

Spearfishing attacks in particular are a great attack vector and their existence are of great interest to cybersecurity analysts. When an email inspection has its suspicion raised about a message, generating an IODEF message to the subjects organization and or an ISAC about the incident would help alert the analysts.  Again some of the response could be automated e.g. if the message requires visiting a site with malware, the tolls could check out any URLs in the message to establish if malware is preset. The site could be up for a short duration so may not have been identified or has tools to shield it from unintended browsing.

Hope this helps

Trevor

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 24 Mar 2014 13:46:24 +0000

Thank you Trevor. I will make sure I will incorporate these in the doc.
Panos

From: Trevor Freeman [mailto:[email-masked]]
Sent: Friday, March 21, 2014 4:44 PM
To: Panos Kampanakis (pkampana)
Cc: [email-masked]
Subject: IODEF Future Use Cases

Hi Panos,

Fake Hosting Companies

Suspicious Certificates

Hope this helps

Trevor