GetLinkInfo and Sucuri Issues

[RyanGallant]

GetLinkInfo and Sucuri seem to be having issues. Specifically, GetLinkInfo appears to be completely broken (unable to connect to any sites at all) and Sucuri has moved to a "v3" version of their service and have changed their formatting. Sucuri also seems to be either much more aggressive, is consulting more services, or a few significant sites were compromised over the holidays and my organization is seeing more false positives popping up. Any thoughts?

[Jt3kt]

Hey Ryan, I disabled GetLinkInfo all together. It hasn't proven to be a good source for information through my use. I intend to revisit it at some point to see if it can be helped.

Sucuri has been good; and you're right they did roll an update on their side. I've Sucuri working well on my 3.0 branch, but there is a good number of changes between the LogRhythm-Labs/PIE and my base.

https://github.com/Jtekt/PIE/tree/3.0

[RyanGallant]

GetLinkInfo is back up and running, but much of the same checks it runs are now being done by Sucuri, so I'm retiring it as well. After a lot of tweaking, Sucuri has become more stable for me, but I'm curious about the changes you've made to your own PIE deployment. However, your github does not appear to include your tweaks to Sucuri, as the scripts in there are from before changes were made. Would you mind committing your changes?

[Jt3kt]

Did you change over to view the 3.0 branch? I intend to put in a merge request once I'm done testing, check the change notes for a summary of what all is different. There's three sites, self included, I know running that branch and I've been rolling in changes noted from their use.

[RyanGallant]

I have indeed. You'll have to excuse me for not being particularly comfortable with Github, but I'm seeing your most recent changes as being from a month ago on branch 3.0. There is a message that reads:

This branch is 11 commits ahead, 1 commit behind LogRhythm-Labs:master.

But I haven't been able to find "LogRhythm-Labs:master" or any of the changes to the Sucuri module.

[Jt3kt]

Looks like my memory is off; I committed the Sucuri changes to the LogRhythm repo back in August. The only update on the 3.0 is the updated catch on the skip-lines for picking up the JSON return from Sucuri. It was found depending the browser agent used to query Sucuri, the number of empty lines returned from Sucuri was not always set to the same value, so that change should make it a little more tolerant of different local configurations.

I'll have to investigate Sucuri v3, we're still pulling from the v2 API.

[Jt3kt]

I've converted over my PIE:Sucuri to the new V3 API, I'll post that up after a few days of running it through its paces. The updated plugin will present you with more in-depth info in the console, with links that go direct to source to help analysts investigating.

Stay tuned!

[Jt3kt]

3.0 repo is updated on my fork. Both Sucuri and VirusTotal received quite a bit of love, note you'll need the 3.0 branches method of handling links for it to work without re-writing the plugin calls.