AIL Project v6.0.1 - Improved usability in social network monitoring and many bugs fixed

Jan 23, 2025 • Team CIRCL

AIL Framework v6.0.1 Release Notes

Release Date: 2025-01-23

This release includes several new features, improvements, and bug fixes. We recommend users to upgrade to the latest version.

Screenshot from 2025-01-23 15-12-20 Screenshot from 2025-01-23 15-13-31

New Features and Improvements

  • User Management:
    • User login is now case-insensitive.
    • User updates now include v6.0.1 specific changes.
  • Chat Explorer:
    • Added the ability to show messages and open them in their respective chat/subchannel/thread.
    • Chat tags are now displayed.
    • Basic chat card improved, includes a chat participants button and improved button styling.
  • Chat Viewer:
    • Added messages heatmap by year for user-account viewer.
    • Added heatmap messages and year selector for chat viewer.
    • Added chat messages by current year heatmap feature.
  • Message Description:
    • Chat name and username are now included in the message description.
  • Retro Hunt:
    • OCR retro hunt added.
  • Crawling:
    • Improved queued error log.
    • Improved title extraction, resolving issues with signal.alarm and sleep.
  • Cryptocurrency:
    • Added ripple address subtype and correlation.
  • Taxonomies and Galaxy:
    • MISP taxonomies and galaxy have been bumped to the latest versions.
  • Image Handling:
    • Implemented blurring of unsafe images with violence and pornography-illicit-or-illegal tags with a warning message.
  • Domain Search:
    • Domain name sanitization added to search by name and displays domain.
  • Updater:
    • Now uses tag subversion (e.g., v6.0.1).
  • Tracker:
    • Filter result by object type.
  • Flask:
    • Update Flask_config.py.
    • Set proxy using ProxyFix.
  • Other:
    • README updated with a new dashboard image.

Bug Fixes

  • AIL Updater:
    • Removed updates between tags.
    • Fixed upper tags list and is_fork issues.
  • Domain Display:
    • Unblurred default image if domain is down.
  • Module Extractor:
    • Invalid object meta logging added and fixed.
    • Fixed onion extraction and prevents onion extraction from crawled items.
  • Retro Hunt:
    • Fixed object to resume functionality.
    • Fixed item iterator issues.
    • Force pause state before deleting a retro hunt.
    • Fixed retro hunt resume.
  • Crawler:
    • Increased timeout for queued captures.
    • Fixed issues related to signal timeouts during title extraction.
    • Debugged signal timeout issues.
    • Addressed issues with crawler queued capture loop and debugged related errors.
    • Avoid crawler loop if a capture end up in an invalid state.
    • Fixed reload_crawlers_stats queues stats.
  • Chat Messages:
    • Fixed subchannel nb_max issue for chat messages by year.
    • Fixed get years date range for chat forum.
  • Chat Explorer:
    • Fixed protocols name list order.
  • Exifs Module:
    • Handled Mp4 UnidentifiedImageError.
  • Investigation:
    • Addressed issue with adding objects with spaces in their IDs to an investigation.

Other Changes

  • Merged several pull requests:
    • Merged branch ‘master’ of github.com:ail-project/ail-framework.
    • Merged pull request #253 from eltociear/patch-1 (chg: [flask] update Flask_config.py).
    • Merged pull request #250 from FafnerKeyZee/patch-1 (Update Tracker.py).
    • Merged pull request #251 from FafnerKeyZee/patch-2 (Update abstract_chat_object.py). *Fixed an issue where stat was only performed on subchannels for a forum.
    • Merged pull request #249 from vncloudsco/master (Update Install silent and Dockerfile update).
    • Improved tracker level validation preventing a crash when the level field is None.
    • Updated Dockerfile and install scripts.

Funding

MISP-LEA, a collaborative endeavor between Shadowserver and CIRCL, is a 24-month initiative funded by the European Union. The project’s central aim is to establish operational and enduring MISP and AIL instances dedicated specifically to law enforcement agencies. This setup will facilitate a smoother exchange of evidence between law enforcement agencies and improve the onset of collaborative investigations. For this purpose, the system will ingest data from Shadowserver’s ransomware and C2 infrastructure tracking.

Law enforcement agencies willing to discover and leverage the MISP-LEA platform can apply on the misp-lea.org website.