ThreatSTOP - Active Internet Security - What are users asking? FAQ

Partners

What are users asking? FAQ

Do I have to make ThreatSTOP my primary DNS?
No, that is simply the easiest configuration. As long as your devices resolve the domain threatstop.local and its subdomains using our servers, the service will work.

One of the easiest ways to use ThreatSTOP is to make our DNS servers a forwarder for the zone threatstop.local on your DNS servers, and leave everything else in your nameservers the same. Just make sure that you register whatever IP address your DNS queries come from as your device.

Alternative methods include doing a subdelegation from whatever nameserver you are using, or making our servers forwarders. All these methods will require that you configure the IP address of your nameservers (or whatever they are NATed to) as the "device" in our service.
Can I have my nameservers query yours?
Yes, as long as the IP address your queries come from is configured as the device in your account.
What format should I send my logs in?
We are constantly working on parsing new formats, for which we need example logs. DShield format is obviously preferred, but it's more important that we get the logs, than the format they are in.
How often do you update the feeds?
Every two hours. If your firewall doesn't automatically redo a lookup on expiration of TTL, then you will need to tell it, either in configuration or by using a cron job, to fetch the updated lists.
IP v.x.y.z is in the feed, but I want to talk to it!
That's what white lists are for. If you are an SMB or Enterprise customer, add the IP/range to your custom allow list. If you are a basic subscriber, create a rule that has higher priority than our block list that allows the traffic. You can also contact the data provider, either DShield or TQM, to request that the IP be removed.
My firewall isn't listed, can I use ThreatSTOP?
In most cases, yes. As long as your firewall, or it's management station, or any computer you can run a script that can configure your firewall from, has a DNS resolver that works, you can use ThreatSTOP. If you would like your firewall officially supported, contact us and leave your e- mail, and we will test and document firewalls based on user demand.
How is ThreatSTOP different from OpenDNS?
ThreatSTOP does not change what real names on the Internet resolve to, which is how OpenDNS works. We propagate private (local) names that express the reputation that the data provider assigns to the IP address. This has several advantages over OpenDNS:

1: OpenDNS is a one-size-fits-all system. If a URL is redirected by OpenDNS, it is redirected for everyone. ThreatSTOP allows the user to decide what to do with a given IP address list, and for our SMB and Enterprise customers, allows the user to decide which lists of IPs to use.

2: ThreatSTOP can be used for inbound, as well as outbound, connection blocking as well as other traffic routing decisions.

3: ThreatSTOP doesn't require that all your clients resolve all their names through our service. It doesn't even require that your firewalls do, as long as they resolve threatstop.local through it. As a result, it changes the configuration of less devices.
4: ThreatSTOP is not subject to the problem of the system with statically configured nameservers totally bypassing the protection. Even systems using alternate DNS providers are subject to the rules, if their traffic goes through your firewall.

5: OpenDNS is focused on phishing. Currently, ThreatSTOP is not providing a phishing feed, although we have reason to believe that phishing sites do show up on the DShield or TQM lists from time to time. We are researching this, but have not settled on one. We may well seek to partner with the backer of OpenDNS, Phishtank, to propagate the currently active phishing IP lists.

6: ThreatSTOP can protect you against connections to numeric IP addresses in phishing, OpenDNS can't.
Suse Linux is freaking out!
Suse has a bug with resolving addresses in the local TLD. This affects interoperability with Windows SBS, OSX, and others that use the convention of the local tld for internal DNS. There is a fix discussed here: http://www.novell.com/coolsolutions/tip/15248.html
So, what's this going to cost me in the long run?
We plan on keeping the current feeds free, as in beer.

The idea is to get people to sign up, use it, and contribute their logs. For free accounts there will be ads on the reports, and the reports and configuration options will be limited.

We plan to charge for enhanced services like:
- Customized and enhanced feeds.
- Personalized allow and deny lists.
- Management of multiple firewalls and firewall groups.
- Long term non-repudiable log archiving.
- Compliance/forensic quality reporting without ads.
- Other enhanced services as we come up with them.
If you have other services you'd like to see, please tell us.
Will adding your nameservers to my list of resolvers be enough to make it work?
No, if you aren't specifically telling your firewalls to use us a primary DNS or authoritative for threatstop.local, your lookups will fail. There are no NS records in the public Internet for .local, and there never will be. This is by design.
I have an IDS and use its alerts to put blocks in my firewall, why do I need ThreatSTOP?
ThreatSTOP isn't a replacement for your IDS, but a service that helps protect against unknown attacks, which are frequently first detected by DShield/Internet Storm Center, and the worst current SPAM sources as detected by TQMCube. ThreatSTOP offloads your IDS and SPAM filters by lettting you block the worst bots and spammers early, so that you don't waste time and CPU with more expensive (in terms of CPU, bandwidth, etc) defenses, like signature matching and RBL @ the MTA.

Taking IDS alerts and using the sources in block lists can be a great tool, as long as you are very wary of false positives. However, an IDS can only protect you against known attacks, for which there are signatures, or attacks that are similar in nature. And IDSes do nothing about SPAM.
I don't have any servers on my network, is ThreatSTOP any use to me?
If you aren't allowing any inbound connections to your network, then any tool that blocks connections from attackers, like an IDS or ThreatSTOP, can seem like it's not much use. The difference is that ThreatSTOP can block OUTBOUND connections to the systems on lists. The systems listed are, in general, pretty bad actors, and not sites you want to visit. In some cases, especially systems that can show up on the DShield lists, they can be malware seed sites, or bot masters. As a result, you will still probably get some measure of additional protection from using ThreatSTOP. When ThreatSTOP adds phishing and P2P supernode feeds, these will be very useful to all users, and will be as useful to outbound only firewall users as users who allow inbound connections.
How do I get delisted from your feeds?
ThreatSTOP does not generate feeds. We take in information from other sources, and make it available in a format that can be used to make a routing decision. Since we represent to our users that our feeds come from the particular providers, and contain what is in those specific lists, ThreatSTOP does not in any way alter the actual content we receive.
If you believe that an IP is in the feeds incorrectly, you can contact us , and we can tell you which feed it is in. You should then contact the data provider to have them correct any errors.
How do I contact you?
You can use our web form . Our support PGP key is listed there, and is also on the PGP keyservers.
I don't want anyone messing with my firewall!
ThreatSTOP doesn't mess with anything. All the changes are made by you, you control what lists you use, when you update them, and what you do with traffic identified by the lists. You aslo control the timing, method, and content of any submitted logs.
ThreatSTOP is a pull, not a push, service.
We pull in lists of bad actors published by others, currently DShield and TQMCube, and make them available as DNS forward lookups using a private, secured DNS. Your devices query those lists.
To submit logs to us, you either e-mail them to us, or upload them to a web form. You initiate all communications to our servers, we never initiate communication to yours.
My firewall can't resolve the lists!
The two most common causes of this problem are that you aren't allowing TCP name resolution, or that you have put the wrong IP address in your device configuration.

Because the lists are so long, we have to use TCP to propagate them. You need to allow port 53 TCP queries from your nameservers and/or firewall. There is no need to allow them INBOUND, only TO our servers.

Our system uses a private, secure, DNS. If the source IP of your query is not in our ACL, you will be denied. Make sure that the devices configured in our UI match the IP addresses your queries come from.

[ Back ]

Main Menu