ThreatCrowd is a free online threat intelligence platform that allows users to search for indicators related to cyber threats like domains, IPs, files and malware samples. It provides context on these indicators from various data sources including blacklists and antivirus detections. The platform uses technologies like Cytoscape.js and SQL with pivoting capabilities. It has been in development since 2014 and sees a variety of users in threat intelligence, security operations, bug bounties and pen testing. There is discussion of transitioning the platform to be more community owned and focused on reducing the security industry echo chamber through tools that allow quick testing of intelligence.

1. ThreatCrowd.org
@chrisdoman, Vectra Networks
bsidesbelfast.org September 2016

2. What is ThreatCrowd?
threatcrowd.org

3. Use-case: ThreatIntel & Triaging Detections
baddomain.com

4. Use Case: Bug-Bounties & Pen-Tests

5. Search

6. Infrastructure

7. Pivot

8. Pivot
Automatically identify sinkholes and parking
ranges, and avoid pivoting
MD5
Domain
E-mail
IP Address
SSL Certificate
Server Build Hash
Nameserver
Anti-Virus detection
Filename

9. Browse

10. Blacklists
google.com?

11. RSS

12. Maltego

13. API
https://www.threatcrowd.org/searchApi/v2/email/report/?email=william19770319@yahoo.com

14. What is it built on?
via boundary.com

15. No magic here
+ cytoscape.js
You can access graph data easily with:
SQL + pivot(indicator)

16. Datasources are internal &
thanks!

17. Why should you build a free platform?
- You get to see Belfast
- You get to use it

18. ~2014
+ some more

19. ~2016
+ loads more

20. A couple of tricks…

21. Who is using ThreatCrowd?
Stats
OPSEC?

22. Dridex
Locky

23. antivirus.*(.sofacy|sofacy.)

24. Issues
WHY IS MY WEBSITE ON YOUR WEBSITE??

25. Where is ThreatCrowd going?
- Lots of change since ThreatCrowd was built in 2014
- Use case #1 - ThreatIntel – has changed

26. 2013 - Tracking Hangover
Via Nii Consulting and Norman Shark
D:ProjectsElanceAppInSecurityGroup
FtpBackupReleaseBackup.pdb

27. 2016 – Still Hangover?
Via Cymmetria

28. Some things are getting harder to track
https://mpars0ns.github.io/bsidescharm-2016slides/

29. Are there still attackers worth tracking?
Via @daveaitel and @fireeye. * correlation != causation

30. Marketing doesn’t show a drop in
attackers worth tracking…
Via @APTNotes

31. … not that you can trust all the marketing

32. Still lots of activity worth tracking
Via Bloomberg, FIRST, Guardian

33. Already some great resources for crimeware

34. Where is ThreatCrowd going?
We don’t need another commercial platform
Lots of hosting offers from the community - thanks!
May hand over to the community
What do you think?

35. Coming Soon - ThreatBox(?)
Reduce the infosec echo chamber - try tools quickly
Integrate the free intel with tools to apply it
SIFT & Remnux are awesome but different
Want to beta test?

36. Questions?
@chrisdoman / threatcrowd.org
vectranetworks.com