Barracuda Labs launches Threatglass to share and research malicious websites

Barracuda Networks, Inc. has announced the launch of Threatglass (http://www.threatglass.com), an online tool for sharing, browsing and analysing web-based malware. Threatglass allows users to graphically browse website infections by viewing screenshots of the stages of infection, as well as by analysing network characteristics such as host relationships and packet captures.

“‘Good sites gone bad’ is a daily problem for popular websites targeted by attackers and used to serve malware to their unsuspecting visitors,” said Dr. Paul Judge, chief research officer and VP, Barracuda. “Threatglass was designed for both casual users and the research community to provide a way to document and better understand this ongoing problem.”

Threatglass was built as a frontend for a large-scale, automated system that leverages heavyweight virtualisation to detect web-based malware in a vulnerability and exploit-independent manner. The platform analyses millions of websites each week. Websites for inspection are sourced from multiple data feeds including the Alexa top 25,000 websites, social feeds and suspicious websites from Barracuda’s customer network, consisting of more than 150,000 organisations worldwide. In addition to screen captures of the infections, Threatglass displays various representations of network traffic including DNS, HTTP, and netflow in both graphical and textual formats. The system has cataloged approximately 10,000 live web-based malware attacks and adds new ones each day.

Barracuda Labs’ malware detection engines have discovered numerous infections in high-profile websites. In the last few months, Barracuda Labs published those findings for Cracked.com, Php.net and Hasbro.com. Those examples and thousands of other infected websites now are visible through Threatglass.
Key features Threatglass users can explore include:

Visualisation
· Casually browse website infections in a Pinterest-like graphical representation
· View charting and trending data of historical malware volumes
· Examine relationships between various components of an attacker ring

Community
· Share data among other researchers
· Review easily-parsed breakout data as well as source data
· Submit websites for inspection and analysis