Cyber Intel Pros and Hobbyists Can Now Report Threats Anonymously – Source: www.infosecurity-magazine.com

Imagine a world in which any cybersecurity professional, or even a cyber hobbyist or whistleblower, could report a new cluster of malicious cyber activity anonymously, without having to go through lengthy and formal cyber reporting disclosure processes.

This is the mission that a group of European-based cybersecurity practitioners is trying to achieve with Draugnet, a new anonymous threat reporting platform built on Malware Information Sharing Platform (MISP), an open-source cyber threat intelligence (CTI) sharing platform.

Trey Darley, a security researcher based in Belgium, and Alexandre Dulaunoy, the head of the Computer Incident Response Center Luxembourg (CIRCL), will launch and demonstrate Draugnet during FIRSTCON in Copenhagen on June 24.

Initially called ‘Abracadabra,’ to convey how simple it is to use, Draugnet allows anyone to report a piece of threat intelligence – from a few indicators of compromise to a vulnerability report or a comprehensive threat intelligence report – without registering an account or logging in, and submit it for anyone to use in a simple machine-readable JSON format.

Democratizing Cyber Threat Intelligence Reporting

According to its mission statement, Draugnet is “for quiet defenders, rotating trust groups, and anyone caught between responsible stewardship and unmanageable risk.”

Speaking to Infosecurity before the official launch, Darley explained: “Let’s say that I want to collect vulnerability reports on my connected coffee maker products. Draugnet will allow me to present a simple web form that researchers can submit vulnerabilities to. It passes the anonymized vulnerability report through to my MISP environment for my analysts to triage, and provides the submitter with a follow-up token.”

This token,  a string of random characters, is saved in the local browser cache, allowing users to reuse it to continue or share it with someone else to update their vulnerability report.

He added that the back and front end of Draugnet are decoupled, suggesting that anyone who has access to the back end cannot trace it back to the reporting individual.

The idea behind Draugnet is to democratize cyber threat intelligence reporting and make it accessible not only to professional cybersecurity practitioners, but also “to people outside of the security ecosystem, for instance a quality assurance professional who just listens to the Darknet Diaries podcast while they go jogging and want to contribute without necessarily getting involved further.”

“Additionally, while vulnerability reporting is rapidly increasing, we don’t seem to be moving in the direction of an open society, but to one where we share less and less,” regretted Darley.

Draugnet’s mission is to facilitate more sharing by making cyber threat reporting less cumbersome and process-heavy.

Draugnet’s Challenges and Potential Use Cases

Despite his ambition for the project, Darley acknowledged that there will be limitations to achieving Draugnet’s mission.

First, warranting complete anonymity on the internet is a tall order, he said. “Nothing is perfectly anonymous online, as any two things that touch (e.g. a user and a system) leave a trace,” he said.

Second, he admitted that there is currently no way of guaranteeing against false or malicious reporting within Draugnet.

However, he sees Draugnet as just another Lego block in the cyber defenders’ toolbox and suggests that any organization could use it in a trusted environment.

“You might not want to open this up to the entire Internet, but instead use it in a constrained access environment, such as an information sharing and analysis center (ISAC) or another trust group. You might also want to host it using Intel Software Guard Extensions (SGX), to ensure confidentiality for the in-memory lookup table that says which token allows access to which event,” he said.

“For instance, if I’m a national cybersecurity agency, I might have a rough idea of the top few hundreds of cybersecurity researchers in my country, a sort of ‘friends and family’ list. I can give them access to a Draugnet-enabled reporting platform hosted on a confidential compute environment, and allow them to contribute to cyber threat intelligence in a simple and paperwork-less way.”