Dell builds sinkhole data-sharing platform

Dell malware researchers are building information sharing efforts to help the industry better identify victims and new attacks.

Dell SecureWorks counter threat unit malware research director Joe Stewart said his team had built open-source sinkhole data-sharing tools which it will share with the industry.

He said the tools will help avoid researchers mistaking a sinkhole server as an attacker domain, and improve the speed of identifying new attacks and victims.

Sinkholing gives researchers a unique perspective on past, present and future attacks as it allows infected systems that have been inactive for months to be reanimated.

“[The tools] can provide a daily report and show the top infectors," Stewart said at the RSA 2013 conference.

All sharing data helps us win. We want to get to the people who are infected and know about it to get themselves secure.

“Often with sinkholing you know what you are looking for, so don't do in-depth data analysis.”

He said some malware families can be very difficult to track.

“They use the tools to download other malware, so on one hand you had targeted victims and on the other, you have hundreds of individual victims.”