Detecting Log4J on a global scale using collaborative security

The talk introduces CrowdSec, a free and open-source agent that uses rule-based scenarios to detect attacks on a server and sends the offending IPs to a central consensus engine. The engine publishes a shared blocklist back to every participating agent. The speaker explains how the network resists poisoning through trust ranks that grow over months, per-network voting that limits any one actor's influence, and comparison against the project's own honeypots. A whitelist of common services such as search engine crawlers and CDNs guards against false positives. Privacy is kept narrow: only the source IP, a timestamp and the scenario name are shared.

The main case study is Log4j. CrowdSec published a detection scenario within a day of the December 2021 disclosure and revised it several times as attackers obfuscated their payloads, eventually reaching 34 matching patterns and Unicode support. Community signals quickly identified around a thousand actively exploiting IPs. One scanner turned out to be a German research institute, and the team chose not to block it. Later spikes were less clear, though one was loosely linked to a US government warning about a VMware Horizon flaw. In a controlled experiment with two identical servers, 92 percent of hostile traffic to the protected server was blocked using community reputation alone.

The talk also covered SSH and SIP brute forcing, a layer 7 denial-of-service wave, and how quickly hosting providers cleaned up compromised machines, with averages differing widely between providers. The practical takeaway is that no single control should be relied on, and shared reputation data can close the gap before a local detector sees an attack.