Norse Attack Map

http://map.norsecorp.com/

by twakefield • 11 years ago

80 46 11 years ago

map.norsecorp.com

wnevets• 11 years ago

what is norse, and why does it hate st. louis?

libraryatnight2• 11 years ago

Seems like China hates St Louis?

daveloyall4• 11 years ago

I've never posted a link to a Fox News affiliate before... Here goes!

http://fox2now.com/2015/07/08/is-st-louis-under-a-cyber-atta...

Ok, so.. Norse Corp, the ones that make the map, has offices in St. Louis.

ironchef• 11 years ago

That's because of all the defense / Intel work in St. Louis (Scott afb etc). And to the other commenter talking about Kirksville, that's where the JSS is.

twakefield• 11 years ago

LOL, I had the same initial reaction. Apparently Norse monitors global cyber attacks[1]. So the real question is not why they hate St. Louis but why does China hate St. Louis?

I found the link while reading conspiracy theories about the NYSE shut down this morning[2]. I have no idea about the quality of the data. I just thought the visualization was cool.

[1] http://norsecorp.com/. [2] http://www.zerohedge.com/news/2015-07-08/what-first-world-cy...

conpermiso• 11 years ago

There are 16 colo centers in St. Louis according to http://www.datacentermap.com/usa/missouri/st-louis/, I wonder if anyone interesting has rack space there.

d1str03• 11 years ago

Norse has offices in St. Louis and I'm sure that's where they host the majority of their honeypots. Thus, you see a lot of attacks hitting St. Louis.

d1str03• 11 years ago

Norse Corp. is a threat intelligence company. I believe one of their HQ is located in St. Louis and is where they currently host many of their honeypots. That is why you see St. Louis being attacked a lot.

jessaustin2• 11 years ago

What's even funnier is all the attacks aimed at Kirksville. What a funny little one-horse town that is.

tcas• 11 years ago

Are there any open source map platforms like this for integrating into real time data feeds (i.e. if we want to track sales by region etc...) onto a map?

I know about http://cesiumjs.org/ but it was extremely resource intensive heavy last time I tried to use it.

EDIT: it looks like they use http://leafletjs.com/ -- looks interesting

joaoqalves• 11 years ago

Hi. You can try https://map.blueliv.com/

Disclaimer: I work there.

clwg• 11 years ago

There's this https://github.com/hrbrmstr/pewpew it's as much a criticism of these sorts of security visualizations as it is a means to create them.

MayMuncher• 11 years ago

You can take a look at http://www.jsgraphs.com/ which has a list.

http://echarts.baidu.com/doc/example-en.html#map

http://echarts.baidu.com/doc/example/map9.html#-en

http://echarts.baidu.com/extension/BMap/doc/example.html#-en

http://echarts.baidu.com/doc/example/map12.html#-en

finnn• 11 years ago

You could use Logstash and Kibana to make a similar looking map from actual logs, but i don't think you'd be able to do the shooting animation, but I'm not too well versed in Kibana. Maybe with a plugin?

rza• 11 years ago

I don't know much about network security. Is there a difference between the kind of attacks that would be caught by honeypots vs targeted attacks? Do these statistics depend heavily on how they setup their honeypots, which I assume is limited by the company's logistics.

libraryatnight2• 11 years ago

Seems like China needs to go to internet time-out.

yeukhon• 11 years ago

How do they collect this data?

d1str03• 11 years ago

Honeypots

bithead• 11 years ago

That would, in my view, mean I shouldn't take the map as accurate.

daveloyall4• 11 years ago

The company that runs this attack map published a blog post about China yesterday.

http://darkmatters.norsecorp.com/2015/07/07/chinas-new-secur...

[EDIT: removed 'unflattering'.]

daveloyall4• 11 years ago

If Norse wanted to make this data useful, they'd present it as a CSV, too. How else could I determine if one entity owns all the St. Louis targets??? :)

kjs3• 11 years ago

They actually sell that sort of data feed. The map is an ad.

jackdawjack• 11 years ago

This is more of a sales pitching device (and it's a nice one) than a useful tool

kyrra• 11 years ago

I've seen maps like this discussed[0] on /r/netsec/ and other similar forums and from my understanding, they are mostly useless. It's aggregates some data to make a very pretty site, but doesn't really give you anything actionable. Normally you need to run it through real monitoring tools with various thresholds configured so you can alert the proper teams to act when something odd is going on.

[0] http://www.reddit.com/r/netsec/comments/2xuai9/pewpew_your_v...

tomphoolery2• 11 years ago

The Norse Map used to have a little "about" section that explained how the map is a general aggregation of data and designed to show at a very high level what is going on, but doesn't provide any deep insight into each attack. The famous disclaimer "for entertainment purposes only" comes to mind, but in reality I think the Norse Map is just a really neat and sort-of functional advertisement for the capabilities of Norse. If you go to http://norsecorp.com, you'll see that the company behind the map is a security firm that wants you to pay for "real-time visibility into global cyber attacks", which means either signing up for their service that alerts you of weird activity on your network, or purchasing their appliance that can help block attacks at the point of entry. I'd conclude that the map is not really meant to actually provide real threat warnings, but rather a way to see into what the Norse Intelligence Service is capable of monitoring.

meowface• 11 years ago

Norse is generally considered a joke by all the professionals I know in the infosec and threat intelligence industries, and not just for their silly map. Even moreso after their recent Iran report, done in conjunction with the political thinktank American Enterprise Institute. No bias there at all.

trhway• 11 years ago

interesting that attacks come directly from China instead of say some botnets distributed around the world.

kalleboo• 11 years ago

China probably has the most compromised PCs due to the levels of piracy there.

brock_r• 11 years ago

Thought it was a video game. Tried shooting back at China.

britknight• 11 years ago

Shall we play a game?

guiambros• 11 years ago

Nops. The only winning move is not to play.

curiousjorge• 11 years ago

How about global thermonuclear war?

tomphoolery2• 11 years ago

Plot twist, you are China.

sweis• 11 years ago

This map has much better pew pew sounds: http://threatbutt.com/map/

bognition• 11 years ago

Not sure how they are getting their attack data. Especially since they are classifying shodan as an "attacker"

leoc• 11 years ago

With a title like that, I was at first expecting to see a map of coastal attacks against northern Europe.

closetnerd• 11 years ago

I expected Russia to be active.

ldubinets• 11 years ago

Their homepage says "Norse Tracks over 200,000 tor exit nodes". Tor metrics [1] says there exist 1,000 ish Tor exit nodes. So is Norse's statement a blatant lie?

[1] https://metrics.torproject.org/relayflags.html

finnjohnsen2• 11 years ago

What about that spot mid Russia which just pulsates? attacking itself?

Norse Attack Map

Related Stories