Slashdot Log In
Profile of the Russian Business Network
Posted by
kdawson
on Sat Oct 13, 2007 09:09 PM
from the where-the-bad-guys-are dept.
from the where-the-bad-guys-are dept.
The Washington Post has an article detailing what is known of the workings of the Russian Business Network, a shadowy entity based in St. Petersburg that hosts a good fraction of the world's spammers, identity thieves, bot herders, and phishers. RBN is not incorporated anywhere and may not technically even be violating Russian law. It provides "bulletproof hosting" for about $600 a month to a wide range of bad guys.The author of the Post story, Brian Krebs, supplements it with two blog posts. One provides more detail and back story including a look at one ISP's security admin who decided last summer to ban all RBN traffic from his network, with outstanding results. The other post maps some of the RBN's upstream suppliers and details the extent of the RBN's involvement in recent cyber-attacks: "Nearly every major advancement in computer viruses or worms over the past two years has emanated from or sent stolen consumer data back to servers" in the RBN.
Related Stories
[+]
Russian Hacker Gang Vanishes Again 64 comments
Arashtamere writes "The shadowy hacker and malware hosting network that only recently fled Russia to set up operations in China has now pulled the plug there and vanished yet again. An analyst at VeriSign's iDefense Labs unit said iDefense had tracked RBN's migration earlier in the week from servers based in Russia to ones running in China, after obtaining at least seven net blocks of Chinese IP addresses. As of Wednesday, RBN controlled 5,120 IP addresses assigned to Chinese service providers; known RBN clients were even seen using those addresses that day. But with its China move putting the spotlights of the media and the security community on the organization, RBN suddenly went offline on Thursday. 'They severed connections to six of the seven net blocks on November 8,' the analyst said. RBN as a single organization may be dead and gone; it may even now be breaking up into smaller pieces farmed out to multiple countries' Internet infrastructures."
[+]
Entertainment: EULAs For Malware 105 comments
I Don't Believe in Imaginary Property writes "The authors of the Zeus malware have added an end-user license agreement to their product. The buyer is, of course, permitted to infect as many computers with Zeus as they please, but they have no right to distribute it for 'any business or commercial purpose not connected with this sale,' and they can't examine the source, use it to control non-Zeus botnets, or send it to anti-virus companies. Oh, and they commit to paying for future upgrades, too — wouldn't Microsoft love to be able to add that term to their EULA. While it seems silly to imagine Zeus's authors going to the authorities for violations of this EULA, if they're anything like the Russian Business Network, they probably have an extra-judicial means of contract enforcement named Ivan. That said, this is by no means the first
EULA-encrusted malware."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
tragedy strikes! (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Well, its not like he couldn't have used some bullet-proofing ... [slashdot.org]
I've been away (Score:3, Insightful)
Re:I've been away (Score:5, Insightful)
Put another way, anonymity and secrecy can be used for good - anyone living in an oppressive country can attest to that. Or it can be used to send "3n1arg3 y00r p3nis" spam en masse. I think we can agree on the idea that the existence of data havens is a potential godsend, but the misuse of those havens is a huge headache.
Parent
Re:I've been away (Score:5, Insightful)
I think we can agree on the idea that the existence of data havens is a potential godsend, but the misuse of those havens is a huge headache.
I'm not sure I'd even agree with that. I am pretty much a pragmatist when it comes to on-line anonymity: I think it is, on balance, overwhelmingly a bad thing. Much the same arguments apply to data havens.
Sure, these things can theoretically protects discourse, investigative journalism, whistle-blowing and such in an undemocratic society. However, practice is a long way from theory, and on-line "anonymity" is a long way from on-line anonymity. Does anyone really believe, despite the fact that I post under an alias here, that from a technical perspective my government could not track a post back to me if it really had sufficient motivation to do so? Does anyone really believe that if I had sufficiently sensitive information and stored it on a system hosted in one of these less legally restrictive regimes that the Powers That Be could not track it down and take steps to contain it?
Meanwhile, we have spammers, phishy types such as identity thieves and credit card fraudsters, deceptive folk like inside traders and corporate PR plants, copyright infringers, and countless other people basically abusing a near-anonymous Internet identity and data centres like the one in this article to further their own interests, often at the expense of others... and getting away with it, because no-one has the resources to stop them all reliably.
For what it's worth, I don't like this position. I appreciate the value of free communications, and I'm well aware of the inhibition imposed by having to put your name to something, and the damage this can do in extreme cases. But I also appreciate the value of privacy, and of being left to mind your own business without constantly having to defend yourself from attacks. Until society grows up, learns not to trust information or offers from anonymous sources, and learns to respect sensitive information — and it has a very long way to go to reach that point — I think we'll do a lot better if people on the Internet are not effectively placed above the law and not held accountable for their actions.
Parent
Re: (Score:2, Insightful)
Re:I've been away (Score:5, Insightful)
Parent
Re:I've been away (Score:4, Interesting)
Parent
Re: (Score:3, Insightful)
Of course it's not. The default is that something you can't control afterwards (the no copyright case) is worth whatever a single patron is prepared to pay for it, as indeed happened for hundreds of years. If you introduce an alternative economic mechanism through which the costs can be shared, then the product is worth whatever the sum of the individual contributions would be. In either case, if the value of the work at market rates is less than what the work costs to do, allowing for a profit the artist is prepared to accept, then the work won't get done.
Naturally, this is wrong. Since it doesn't even explore the current economic model in which the government guarantees producers of content near-perpetual ownership of distribution rights. A system in which "the costs can be shared" as you put it is the one that exists for some blank media in the US but it is certainly not the prevailing system of compensating content producers. But my point was that there are gradations to how much compensation the content producers would be able to achieve through the
Re: (Score:3, Insightful)
Naturally, this is wrong. Since it doesn't even explore the current economic model in which the government guarantees producers of content near-perpetual ownership of distribution rights. A system in which "the costs can be shared" as you put it is the one that exists for some blank media in the US but it is certainly not the prevailing system of compensating content producers.
On the contrary. I think one of the main advantages of the copyright idea, perhaps even the most important one, is precisely that it makes it commercially viable for an artist to produce a work that takes a lot of time, wouldn't be worth enough for any single patron to commission it, but is worth a small amount to many people. You can argue, very reasonably, that if copyright is an economic instrument and the value it is generating for the artist is far greater than what would be necessary for them to pro
Re: (Score:2)
This article is useless without IP addresses (Score:5, Informative)
I wonder if anyone has every found a remote exploit that will get past iptables -j DROP recently.
Re: (Score:2, Informative)
Spamhaus DROP list FTW! (Score:4, Informative)
Parent
Re:This article is useless without IP addresses (Score:5, Informative)
Parent
Re:This article is useless without IP addresses (Score:5, Informative)
Networks - 81.95.144.0/22, 81.95.148.0/22, 81.95.154.0/24, 81.95.155.0/24.
First upstream ISP - 41173 which is a provider in the Seichelles (so they either run a VPN tunnel to there or have a SAT link). So the article may be actually full of shit. I somehow suspect that they are not hopping back to Russia and the servers are outside Russian jurisdiction in the first place.
Primary upstream transit ISP is 3257 which is Tiscali. Now this does not surprise me in the slightest. No further comment.
Other transit ISPs are : 25577 - C4L (???), 8928 Interoute (again, this one is no surprise).
1. It does not look like Russian hosting to me. The Russians are laughing their arse off at the inept article (and other similar musings). The servers may actually be in Europe (or on an the Seyshelles where you can do diddly squat about them).
2. The hosting is truly bulletproof. Applause. They have most likely bought wholesale all relevant officials in a small nation telecoms operator. So all requests regarding their business activities will go straight to
Parent
Re: AS#s: 40989, 41173, 28866 and 25577 (Score:5, Informative)
If you look at the RIPE and whois records for all the parties involved, this is an ISP that popped up in June of last year, apparently dedicated to hosting malware sites. Look closely at addresses and dates. Fictitious Panamanian and UK addresses with an American phone number, claims of being in the Seychelles (English spelling), again with other American phone numbers.
Some nmap fingerprinting of their routing equipment shows this operation tends towards low budget. I've seen ISPs that were nothing more than a couple of university students who obtained an AS#, a prefix, found a BGP feed, and filled a rented a rack in a colo with some servers and a linux box running quagga. Seen from a looking glass, no difference from the big players. A good looking website regularly updated, proper whois and RIPE records, and it's very difficult for a potential client to know the ISP may go down during exams week.
This operation seems not much more than what a couple of kids with a little knowledge could put together. The prefixes fill various spamhaus and RBL lists. Doubtful that there are any legitimate clients on those networks. This operation is the malware gangs getting a little more hi-tech, running their own ISP by buying IP transit from companies known for never turning down business. They use C4L/NetSumo, a known no-questions-asked ISP who resell an MPLS service between London and Eastern Europe, probably Interoute's.
As for location, looking at various internal looking glasses, the prefixes seem to be hitting the internet in London then through a leased line with 70 mSec of delay, and in Prague with a sudden 20 mSec of delay. This certainly is not going through the Seychelles. My best guess would be a data centre in Russia, where bribes to local authorities gives them a certain level of immunity to lawful pursuits.
Any reasonable ISP hoping to protect their clients from this criminal malware gang would just filter those four AS#s from their main routing tables, and save themselves a world of hurt. Better yet would be to actively blackhole those prefixes. Sure, it might fly in the face of one perfect internet, but since there is no legal remedy, internet providers need to protect themselves. Good ISPs and hosting services already filter all kinds of bogus routing information, adding a known spam and malware operation to the list is just good practice.
the AC
Parent
Post some ranges (Score:3, Interesting)
Although I have to say over the last ~2 weeks it's been down quite a bit.
Re: (Score:3, Informative)
Re: (Score:2)
Service provides "shy away" from blocking nets... (Score:5, Interesting)
Danny McPherson, chief research officer at Arbor Networks, a Lexington, Mass.-based company that provides network security services to some of the world's largest Internet providers, said most providers shy away from blocking whole networks. Instead, they choose to temporarily block specific problem sites.
"Who decides what the acceptable threshold is for stopping connectivity to an entire network? Also, if you're an AT&T or Verizon and you block access to a sizable portion of the Internet, it's very likely that some consumer rights advocacy group is going to come after you."
First... who's saying anything about blocking "a sizable portion of the Internet"? We're talking about being able to identify bad-actors and doing something about it for a change. From some recent articles I've read, AT&T doesn't seem to have any problems blocking their users from accessing the Internet when they don't like what they're doing... they'll just drop you if they don't like you. Why do they have issues blocking real criminals from doing real criminal activities. Can anyone honestly say that these networks are hosting content that anyone legitimate would want to get to?
If there are legit companies doing business with these guys, and maybe if the networks were blocked, or the providers refused to carry routes to those networks, they would "shy away from" doing business with the RBN. Or is that too much of a free-market approach to the problem... block the criminals, and if you're associated with them, you can't do business either. Hmmm...
Second, as to who decides... the market decides! This is pretty cut-and-dry. If there's a company somewhere that specializes in hosting this crap, then shut it down! It will only benefit legitimate business. This is so easy... there isn't a free-speech or access issue here... nothing for anyone to get upset about. The cancer has been identified... cut it out of the body.
The time for reactive measures is over. The article got one thing right... this problem has been allowed to grow and fester beyond the point where half-measures are going to work. $150 million is real money and it's time to take the ability for these goons to do this away from them.
Re:Service provides "shy away" from blocking nets. (Score:4, Insightful)
Parent
As I see it... (Score:4, Insightful)
Parent
RBL-XBL (Score:5, Insightful)
Re: (Score:2)
It makes a lot of sense to use the Spamhaus RBL to block things in a firewall. If a site is black listed for sending spam, then I don't want any traffic from that site, not email, not web traffic, anything. However, I am not aware of a system that ties an iptables DROP rule to an RBL.
why don't you write one....isn't that the whole point of OSS?
from the 30 seconds that on spamhaus.org, it looks like they let you download the entire list for a fee.....so...just grab the list and write yourself a perl script to generate iptables rules...
all in all it should take you about 5 minutes to build a "system" do to this.
Giving it a nice web GUI should take about 15.
The arrticle won't name names, so here it is ... (Score:2)
His name's Doe. John Doe. He's easy enough to find. (Or at least that's what his toe tag will say once RBN is finished with him)
Part of the problem is that their activities bring in hard currency. Also, the local authorities p
riiiiiiiiiight (Score:2)
One provides more detail and back story including a look at one ISP's security admin who decided last summer to ban all RBN traffic from his network, with outstanding results.
If this was not a network in Russia, but oh, say AOL, the fact that lots of its hosts were bots for the bad guys would not change the fact that banning the whole network is censorship. But, of course, all Russian businessmen are mobsters, right? So it's Ok to do this to a network in Russia. Right! How is this article missing a censorship tag?
Yeah, yeah, let's get funny with all the "in soviet blah, blah, blah." If you don't think you are being suckered into the new xenophobia based on old world para
Re: (Score:2)
1. The advertisement is unsolicited.
2. The recipient is forced to expend his/her bandwidth on the ad.
3. Dealing with the advertisement (deleting it, blocking it, clicking through it if it's an interstitial)
Re: (Score:2)
Re: (Score:2)
I have seen the future. (Score:5, Insightful)
There is a good line in Dune -- "You control a mentat by controlling his information." The religious crowd is easily aroused by "think of the children." Apparently, the slashdot crowd needs to hear "think of the spam." This is how the world network for all-to-free an exchange of information will be fractured. You just need to find a hot-button issue for every crowd and they'll scream for the separation along national borders on their own (thinking it's their own idea).
A good number of the posts so far propose blocking Russia altogether. Because there is no "business" done with Russia. Aha. But that means no Russian news. No access to chats with Americans for Russians. Hell, the new Russian order couldn't dream of a better situation. Not only do they get not to have their citizens interact with Americans freely, but they also don't have to be the bad guys in it. The Jefferson quote states that giving up freedom for a little bit of security will cause one to lose both. But why go that far? "little bit of security" is not even necessary as the price. Apparently a little bit of expediency is enough.
It's censorship and xenophobia even if you can make a Yakov Smirnoff joke of it. Sorry, but this time, the boogie man is you!
Most spammers are still from the USA though (Score:3, Informative)
Although the RBN are certainly bad guys, Slashdotters should pls resist the tendency to assume that all the bad guys are nasty, foreign types. Most of the bad guys - for example spammers - as usual, are home-grown.
Of the 133 worst spammers on the Spamhaus ROKSO list, the vast majority of the worlds worst spammers are from the USA, followed after a big gap by nasty foreigners from Israel, Ukraine, China and yes Russia too:
See: http://www.spamhaus.org/rokso/index.lasso [spamhaus.org]
RBN's Netblocks (Score:3, Informative)
RBN not just for spammers (Score:3, Insightful)
Re:Just block Russia (Score:5, Informative)
Parent
Re: (Score:2)
Re: (Score:2)
Australia on the other hand is relatively clean.
Re: (Score:3, Interesting)
Re:Just block Russia (Score:5, Insightful)
I started blocking Russian, Nigerian, and other addresses from one of the forums I run [thehaif.com]. It's just a community forum for people in Houston, Texas. In a matter of hours I started getting complaints from regular users who I didn't realize were expat oil execs and workers in Russia, Nigeria, etc... who used my forum to keep up on things going on at home.
The lesson I learned is that even if I can't imagine why someone would want something doesn't mean it isn't something someone would want.
Parent
Re: (Score:2)
Besides, the whole premise is broken. So some USA industries manage countless millions of foreign slaves in China, India, etc for a cheap workforce, but that's perfectly good capitalism? Using legal communication channels for data mining and advertising, same as every single noteworthy company in the world does, becomes demonised as soon as somebody labels it as mass spamming and fishing based on an u
Obligatory (Score:2)
Re: (Score:2)
Re: (Score:2)
I'm surprised I didnt think of that myself.
-- From a Aussie
Re: (Score:2)
The other problems are all rooted in culture and government. The US is what it is because it's been ruled by corporate interests and a corrupt government. It's not something that can ever be fixed, but it can be cleaned up with a series of good administrati
Re:One Nuke (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
In the meantime you'd have a bunch of half-a
Re:One Nuke (Score:5, Insightful)
That's a variant on the broken window fallacy. The idea that breaking somebody's windows is a good thing because it creates work for the glazier, the police, etc. It only works from an internal viewpoint that is based on the relative distribution of wealth. Taking a broad overview of society as a whole, it's pretty plain to see that the total wealth has gone down. It's the same sort of protectionism as farm subsidies. It may keep people in work but its at the cost of having an inefficient, bloated economy. Far better than to create jobs through needless destruction and inefficiency, is to create jobs by aiming higher and achieving more as a society.
Parent
Re: (Score:2)
Re: (Score:3, Insightful)