Maltrail is a malicious traffic detection system, utilizing publicly
available (black)lists containing malicious and/or generally suspicious
trails, along with static trails compiled from various AV reports and
custom user defined lists, where trail can be anything from domain name
(e.g. zvpprsensinaix.com for Banjori malware),
URL (e.g. http://109.162.38.120/harsh02.exe for known malicious executable),
IP address (e.g. 185.130.5.231 for known attacker) or HTTP User-Agent header
value (e.g. sqlmap for automatic SQL injection and database takeover tool).
Also, it uses (optional) advanced heuristic mechanisms that can help in
discovery of unknown threats (e.g. new malware).
security/maltrail: Update to 0.53
ChangeLog: https://github.com/stamparm/maltrail/blob/master/CHANGELOG
* Defunct 360-netlab feeds were deleted
* "potential data leakage" heur is improved
* Multiple updates and optimizations for regular static trails and the
whitelist
* "potential iot-malware download" heur is improved
* Multiple updates and optimizations for regular static trails and the
whitelist
* New Wiki pages are added
* Fixed deadlock of Docker output to stdout
* Definition of network interfaces is improved
* Fixed regex for /360bigviktor.py feed
* Fixed syscalls handling
* "potential remote code execution" heuristic is improved
* Multiple updates and optimizations for regular static trails and the
whitelist
* "potential remote code execution" heurfor CVE-2022-30190 is updated
* "Maltrail detection nuances" wiki-page is updated
* "Trail classes" wiki-page is updated
* Multiple updates and optimizations for regular static trails and the
whitelist
* Fixed row rendering in UI
* Multiple updates and optimizations for regular static trails and the
whitelist
PR: 268704
Reported by: m.muenz@gmail.com (maintainer)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security/maltrail:
- Update to 0.12
- Fix portlint warnings in pkg-descr while here
PR: 236531
Submitted by: Michael Muenz <m.muenz@gmail.com> (maintainer)
Maltrail is a malicious traffic detection system, utilizing publicly
available (black)lists containing malicious and/or generally suspicious
trails, along with static trails compiled from various AV reports and
custom user defined lists, where trail can be anything from domain name
(e.g. zvpprsensinaix.com for Banjori malware),
URL (e.g. http://109.162.38.120/harsh02.exe for known malicious executable),
IP address (e.g. 185.130.5.231 for known attacker) or HTTP User-Agent header
value (e.g. sqlmap for automatic SQL injection and database takeover tool).
Also, it uses (optional) advanced heuristic mechanisms that can help in
discovery of unknown threats (e.g. new malware).
WWW: https://github.com/stamparm/maltrail
PR: 233074
Submitted by: Michael Muenz <m.muenz@gmail.com>
