Security vendors present fake maps of real-time cyber attacks. How can we trust their products?

Google for cyber threat map, open page and look in the source code for a “random”. You would be suprised.

BitDefender without any obfuscation of JS uses function generateAttacksRandomly. Random is a pair of cities and issue type (infection, attack or spam).

FireEye maintains an static list of attacks with source, destination and type.

From this list a random visualization is created. Math.random() returns a real number from the range [0,1). When multiplied by the list size and rounded down we get an index of the “current” attack.

Map of attacks created by Kaspersky is static, but the visualization is dynamic like from Hollywood. Too bad that it’s fake. You see a lot of action, but no real-time network traffic.

Check Point uses an event steaming to feed the world attack map.

Fortinet feeds threat map using WebSocket messages.