Profile of the Russian Business Network 180
The Washington Post has an article detailing what is known of the workings of the Russian Business Network, a shadowy entity based in St. Petersburg that hosts a good fraction of the world's spammers, identity thieves, bot herders, and phishers. RBN is not incorporated anywhere and may not technically even be violating Russian law. It provides "bulletproof hosting" for about $600 a month to a wide range of bad guys.The author of the Post story, Brian Krebs, supplements it with two blog posts. One provides more detail and back story including a look at one ISP's security admin who decided last summer to ban all RBN traffic from his network, with outstanding results. The other post maps some of the RBN's upstream suppliers and details the extent of the RBN's involvement in recent cyber-attacks: "Nearly every major advancement in computer viruses or worms over the past two years has emanated from or sent stolen consumer data back to servers" in the RBN.
tragedy strikes! (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Well, its not like he couldn't have used some bullet-proofing ... [slashdot.org]
Re: (Score:2)
Uh, no.
I've been away (Score:3, Insightful)
Re:I've been away (Score:5, Insightful)
Put another way, anonymity and secrecy can be used for good - anyone living in an oppressive country can attest to that. Or it can be used to send "3n1arg3 y00r p3nis" spam en masse. I think we can agree on the idea that the existence of data havens is a potential godsend, but the misuse of those havens is a huge headache.
Re:I've been away (Score:5, Insightful)
I think we can agree on the idea that the existence of data havens is a potential godsend, but the misuse of those havens is a huge headache.
I'm not sure I'd even agree with that. I am pretty much a pragmatist when it comes to on-line anonymity: I think it is, on balance, overwhelmingly a bad thing. Much the same arguments apply to data havens.
Sure, these things can theoretically protects discourse, investigative journalism, whistle-blowing and such in an undemocratic society. However, practice is a long way from theory, and on-line "anonymity" is a long way from on-line anonymity. Does anyone really believe, despite the fact that I post under an alias here, that from a technical perspective my government could not track a post back to me if it really had sufficient motivation to do so? Does anyone really believe that if I had sufficiently sensitive information and stored it on a system hosted in one of these less legally restrictive regimes that the Powers That Be could not track it down and take steps to contain it?
Meanwhile, we have spammers, phishy types such as identity thieves and credit card fraudsters, deceptive folk like inside traders and corporate PR plants, copyright infringers, and countless other people basically abusing a near-anonymous Internet identity and data centres like the one in this article to further their own interests, often at the expense of others... and getting away with it, because no-one has the resources to stop them all reliably.
For what it's worth, I don't like this position. I appreciate the value of free communications, and I'm well aware of the inhibition imposed by having to put your name to something, and the damage this can do in extreme cases. But I also appreciate the value of privacy, and of being left to mind your own business without constantly having to defend yourself from attacks. Until society grows up, learns not to trust information or offers from anonymous sources, and learns to respect sensitive information — and it has a very long way to go to reach that point — I think we'll do a lot better if people on the Internet are not effectively placed above the law and not held accountable for their actions.
Re: (Score:2, Insightful)
Re:I've been away (Score:5, Insightful)
Re:I've been away (Score:4, Interesting)
Re: (Score:2)
Exactly. More practically, as more people anonymously practice civil disobediance, larger and larger groups of people who obviously won't report another's disobediance form. Eventually it becomes large enough that people whose only interest in disobediance is practical feel safe as well since so many around them have a strong interest in not turning them in.
As the police in many cities have discovered after years of eroding community trust, effective enforcement of any law depends on citizen reports. Once
Re: (Score:2)
The Boston Tea Party [wikipedia.org] was done anonymously.
Secondly, the The Federalist Papers [wikipedia.org] were released under pseudonyms by the US constitution writers.
Re: (Score:2)
Thus he might argue that an anonymous copyright infringement might be an act of civil disobedience.
One might argue that a government that doesn't like an individual court ruling in another country should drop a tactical nuke on the courtroom as well, but it would demonstrate a remarkable lack of appreciation for when a last resort outside the normal system is justified and a complete loss of perspective on the significance of the offending action.
Re: (Score:2)
Re: (Score:2)
Civil disobedience is generally an acceptable form of behavior in a civil society and as such does not deserve to be compared to military action.
I disagree. There is a direct parallel between civil disobedience and military action. Obviously the consequences are different, and usually more serious in one case than the other, but nevertheless the same underlying principle applies: you are placing yourself above the normal rules that everyone else follows, and essentially adopting a might-is-right policy because you believe you can get away with it/history will be on your side/whatever. You write "civil society" a lot. I suggest to you that a civil
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This isn't personal, but needs to be trotted out every now and then.
Fuck you and the horse you rode in on. Our gift economy will destroy your way of life.
So a certain type of person keeps saying. Do drop by and let us know when it actually happens. Meanwhile, personally I think the millions of people in the world who work to produce non-physical products should be compensated fairly for their efforts and allowed to pay their rent too, without others taking advantage of them.
Re: (Score:2)
personally I think the millions of people in the world who work to produce non-physical products should be compensated fairly for their efforts and allowed to pay their rent too, without others taking advantage of them.
The problem with it is that deciding on what is fairly here is impossible through market-place forces. The only reason their right to compensation exists is because it is sanctioned by the government (which is owned by all people). So it is the establishment's policy together with the market forces (but neither the policy nor the market forces alone) that decide their level of "fair" compensation.
The very concept of "ownership" breaks down when talking about exchange of tangibles for something that t
Re: (Score:2)
The problem with it is that deciding on what is fairly here is impossible through market-place forces.
Of course it's not. The default is that something you can't control afterwards (the no copyright case) is worth whatever a single patron is prepared to pay for it, as indeed happened for hundreds of years. If you introduce an alternative economic mechanism through which the costs can be shared, then the product is worth whatever the sum of the individual contributions would be. In either case, if the value of the work at market rates is less than what the work costs to do, allowing for a profit the artist
Re: (Score:3, Insightful)
Of course it's not. The default is that something you can't control afterwards (the no copyright case) is worth whatever a single patron is prepared to pay for it, as indeed happened for hundreds of years. If you introduce an alternative economic mechanism through which the costs can be shared, then the product is worth whatever the sum of the individual contributions would be. In either case, if the value of the work at market rates is less than what the work costs to do, allowing for a profit the artist is prepared to accept, then the work won't get done.
Naturally, this is wrong. Since it doesn't even explore the current economic model in which the government guarantees producers of content near-perpetual ownership of distribution rights. A system in which "the costs can be shared" as you put it is the one that exists for some blank media in the US but it is certainly not the prevailing system of compensating content producers. But my point was that there are gradations to how much compensation the content producers would be able to achieve through the
Re: (Score:3, Insightful)
Naturally, this is wrong. Since it doesn't even explore the current economic model in which the government guarantees producers of content near-perpetual ownership of distribution rights. A system in which "the costs can be shared" as you put it is the one that exists for some blank media in the US but it is certainly not the prevailing system of compensating content producers.
On the contrary. I think one of the main advantages of the copyright idea, perhaps even the most important one, is precisely that it makes it commercially viable for an artist to produce a work that takes a lot of time, wouldn't be worth enough for any single patron to commission it, but is worth a small amount to many people. You can argue, very reasonably, that if copyright is an economic instrument and the value it is generating for the artist is far greater than what would be necessary for them to pro
Re: (Score:2)
"FTA ....and [RBN] may not technically even be violating Russian law."
This has nothing to do with resources or having sufficient desire to act. RBN possibly hasn't broken the law in Russia, therefore neither the Russian government nor any other country has the right to punish them for what they are doing. OK, perhaps Russian law needs changing but, until then, they are not criminals (unless of course they have previous convictions. :-) Those using RBN's network to carry out crime are criminals but if no-one is raising a complaint then the police are unable to act against
Re: (Score:2)
I am not a country, nor do I define my rights in terms of what any country says is legal or not. My life is negatively impacted by the quantity of spam I get, both directly, and because it impedes other people I know or work with as well. I have every right to respond to d
Re: (Score:2)
I get even more disturbed when I hear individuals defining what is right or wrong based on their own whims. When you take the law into your own hands, you become a vigilante. That is also against the law in many countries, including probably your own. You have become no better than those you wish to punish. Don't dress it up by explaining how you think that you are justified, or by claiming that it requires some l33t hacker to come and save the world on your behalf. You are thinking, and wanting to act,
Re: (Score:2)
Re: (Score:2)
The point is that I don't believe that Internet anonymity does do much to protect freedoms in practice. If you like, I don't regard it as what Franklin famously called "essential liberty". If it were actually effective in this regard, I would be far less willing to sacrifice it, but as I said, on this issue, I'm a pragmatist.
Re: (Score:2)
Why not practise what you preach ?
Especially from someone claiming to be brave.
Re: (Score:2)
Why not practise what you preach ?
If you mean why don't I post here under my real name, then it's for the same reasons that I noted in my final paragraph. But there is a distinction between letting the legal authorities in a country track down those who are committing crimes and using the Internet as a shield to avoid being held accountable, and putting all my comments out in the open for anyone to see in a world where data mining, personal profiling, lawsuits based on the fact that you breathe air, and anything-in-the-name-of-profit corp
Re: (Score:2)
Re: (Score:2)
Yeah. Anonymity sucks when it comes to spam and trolls.
But when you are being beat and/or shot for things you said by the powers that be, you're going to be missing it badly.
All one has to do is turn on the TV [bbc.co.uk] and see why we must have the ability to publish anonymously at all times.
Remember, then they have come [wikipedia.org] for everyone who has already spoken out publicly, the only people left to spea
Re: (Score:2)
A joke, but raises a serious point.
A "haven" is a safe place to put things (eg private data you want limited access to, or controversial data you want to make available). Not a safe place to launch attacks (DDOS, spam, etc) from.
This is the kind of slide -- equating those who want privacy with spammers/terrorists/pedophiles/vegetarians/Muslims -- that authoritarians use to justify violating said privacy.
This article is useless without IP addresses (Score:5, Informative)
I wonder if anyone has every found a remote exploit that will get past iptables -j DROP recently.
Re: (Score:2, Informative)
Spamhaus DROP list FTW! (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
http://robotterror.com/site/wiki/aggressive_spam_and_zombie_blocking_via_spamhaus_org_drop_and_iptables [robotterror.com]
Re:This article is useless without IP addresses (Score:5, Informative)
Re:This article is useless without IP addresses (Score:5, Informative)
Networks - 81.95.144.0/22, 81.95.148.0/22, 81.95.154.0/24, 81.95.155.0/24.
First upstream ISP - 41173 which is a provider in the Seichelles (so they either run a VPN tunnel to there or have a SAT link). So the article may be actually full of shit. I somehow suspect that they are not hopping back to Russia and the servers are outside Russian jurisdiction in the first place.
Primary upstream transit ISP is 3257 which is Tiscali. Now this does not surprise me in the slightest. No further comment.
Other transit ISPs are : 25577 - C4L (???), 8928 Interoute (again, this one is no surprise).
1. It does not look like Russian hosting to me. The Russians are laughing their arse off at the inept article (and other similar musings). The servers may actually be in Europe (or on an the Seyshelles where you can do diddly squat about them).
2. The hosting is truly bulletproof. Applause. They have most likely bought wholesale all relevant officials in a small nation telecoms operator. So all requests regarding their business activities will go straight to
Re: (Score:2)
The Seychelles? What can you do about them?
You can encourage global warming and sea level rise. They better hope they have watertight server rooms...
Fight spam; warm the world!
Re: AS#s: 40989, 41173, 28866 and 25577 (Score:5, Informative)
If you look at the RIPE and whois records for all the parties involved, this is an ISP that popped up in June of last year, apparently dedicated to hosting malware sites. Look closely at addresses and dates. Fictitious Panamanian and UK addresses with an American phone number, claims of being in the Seychelles (English spelling), again with other American phone numbers.
Some nmap fingerprinting of their routing equipment shows this operation tends towards low budget. I've seen ISPs that were nothing more than a couple of university students who obtained an AS#, a prefix, found a BGP feed, and filled a rented a rack in a colo with some servers and a linux box running quagga. Seen from a looking glass, no difference from the big players. A good looking website regularly updated, proper whois and RIPE records, and it's very difficult for a potential client to know the ISP may go down during exams week.
This operation seems not much more than what a couple of kids with a little knowledge could put together. The prefixes fill various spamhaus and RBL lists. Doubtful that there are any legitimate clients on those networks. This operation is the malware gangs getting a little more hi-tech, running their own ISP by buying IP transit from companies known for never turning down business. They use C4L/NetSumo, a known no-questions-asked ISP who resell an MPLS service between London and Eastern Europe, probably Interoute's.
As for location, looking at various internal looking glasses, the prefixes seem to be hitting the internet in London then through a leased line with 70 mSec of delay, and in Prague with a sudden 20 mSec of delay. This certainly is not going through the Seychelles. My best guess would be a data centre in Russia, where bribes to local authorities gives them a certain level of immunity to lawful pursuits.
Any reasonable ISP hoping to protect their clients from this criminal malware gang would just filter those four AS#s from their main routing tables, and save themselves a world of hurt. Better yet would be to actively blackhole those prefixes. Sure, it might fly in the face of one perfect internet, but since there is no legal remedy, internet providers need to protect themselves. Good ISPs and hosting services already filter all kinds of bogus routing information, adding a known spam and malware operation to the list is just good practice.
the AC
Re: (Score:2)
I want to combine that with iptables log analyzer. How should I log that?
I found a couple of references but it seemed like it was logging everything even though it was not important.
Post some ranges (Score:3, Interesting)
Although I have to say over the last ~2 weeks it's been down quite a bit.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Service provides "shy away" from blocking nets... (Score:5, Interesting)
Danny McPherson, chief research officer at Arbor Networks, a Lexington, Mass.-based company that provides network security services to some of the world's largest Internet providers, said most providers shy away from blocking whole networks. Instead, they choose to temporarily block specific problem sites.
"Who decides what the acceptable threshold is for stopping connectivity to an entire network? Also, if you're an AT&T or Verizon and you block access to a sizable portion of the Internet, it's very likely that some consumer rights advocacy group is going to come after you."
First... who's saying anything about blocking "a sizable portion of the Internet"? We're talking about being able to identify bad-actors and doing something about it for a change. From some recent articles I've read, AT&T doesn't seem to have any problems blocking their users from accessing the Internet when they don't like what they're doing... they'll just drop you if they don't like you. Why do they have issues blocking real criminals from doing real criminal activities. Can anyone honestly say that these networks are hosting content that anyone legitimate would want to get to?
If there are legit companies doing business with these guys, and maybe if the networks were blocked, or the providers refused to carry routes to those networks, they would "shy away from" doing business with the RBN. Or is that too much of a free-market approach to the problem... block the criminals, and if you're associated with them, you can't do business either. Hmmm...
Second, as to who decides... the market decides! This is pretty cut-and-dry. If there's a company somewhere that specializes in hosting this crap, then shut it down! It will only benefit legitimate business. This is so easy... there isn't a free-speech or access issue here... nothing for anyone to get upset about. The cancer has been identified... cut it out of the body.
The time for reactive measures is over. The article got one thing right... this problem has been allowed to grow and fester beyond the point where half-measures are going to work. $150 million is real money and it's time to take the ability for these goons to do this away from them.
Re:Service provides "shy away" from blocking nets. (Score:4, Insightful)
Re: (Score:2)
The moment a large ISP like AT&T starts blocking theior IP ranges, they'lll move them. They have control of millions of bots throughout the world, they could use totally dynamic, ever-changing IPS if necessary. And the IPs blocking would just create enormous collateral damage.
Though on a small scale it can work, blocking is ultimately futile. It's like trying to prevent someone telephoning you by blocking the
Re: (Score:2)
Not so fast with the doom and gloom "we can't win" attitude. Yes we CAN if we decide we WANT to. Almost every scam on the Internet depends on a 'bulletproof' host somewhere. Yes they hijack Windows PCs, yes they now use P2P for C2 but eventually most of these scammers are driving somebody to a website or they have to collect the stolen keystrokes. Bulletproof hosting is real and it is a real problem. If we pu
Re: (Score:2)
Then they'd Joe Job opponents, rivals, or just random ISPs to make them look guilty. This ISP is sleazy, but many others could be used unwittingly.
Re: (Score:2)
Second of all, at the first threat of armed resp
As I see it... (Score:4, Insightful)
Self clearing rules - less maintenance (Score:2)
Re: (Score:2)
Suppose:
1 mail = 10 kB
100 mails = 1 mB
100.000 mails = 1 gB
Not thát massive...
Flatfee accounts should only be possible for "good behaviour" customers, the notorious zombie-owners should pay per gB.
Just a suggestion.
RBL-XBL (Score:5, Insightful)
Re: (Score:2)
It makes a lot of sense to use the Spamhaus RBL to block things in a firewall. If a site is black listed for sending spam, then I don't want any traffic from that site, not email, not web traffic, anything. However, I am not aware of a system that ties an iptables DROP rule to an RBL.
why don't you write one....isn't that the whole point of OSS?
from the 30 seconds that on spamhaus.org, it looks like they let you download the entire list for a fee.....so...just grab the list and write yourself a perl script to generate iptables rules...
all in all it should take you about 5 minutes to build a "system" do to this.
Giving it a nice web GUI should take about 15.
Re: (Score:2, Informative)
The arrticle won't name names, so here it is ... (Score:2)
His name's Doe. John Doe. He's easy enough to find. (Or at least that's what his toe tag will say once RBN is finished with him)
Part of the problem is that their activities bring in hard currency. Also, the local authorities p
riiiiiiiiiight (Score:2)
One provides more detail and back story including a look at one ISP's security admin who decided last summer to ban all RBN traffic from his network, with outstanding results.
If this was not a network in Russia, but oh, say AOL, the fact that lots of its hosts were bots for the bad guys would not change the fact that banning the whole network is censorship. But, of course, all Russian businessmen are mobsters, right? So it's Ok to do this to a network in Russia. Right! How is this article missing a censorship tag?
Yeah, yeah, let's get funny with all the "in soviet blah, blah, blah." If you don't think you are being suckered into the new xenophobia based on old world para
Re: (Score:2)
1. The advertisement is unsolicited.
2. The recipient is forced to expend his/her bandwidth on the ad.
3. Dealing with the advertisement (deleting it, blocking it, clicking through it if it's an interstitial)
Re: (Score:2)
Re: (Score:2)
I have seen the future. (Score:5, Insightful)
There is a good line in Dune -- "You control a mentat by controlling his information." The religious crowd is easily aroused by "think of the children." Apparently, the slashdot crowd needs to hear "think of the spam." This is how the world network for all-to-free an exchange of information will be fractured. You just need to find a hot-button issue for every crowd and they'll scream for the separation along national borders on their own (thinking it's their own idea).
A good number of the posts so far propose blocking Russia altogether. Because there is no "business" done with Russia. Aha. But that means no Russian news. No access to chats with Americans for Russians. Hell, the new Russian order couldn't dream of a better situation. Not only do they get not to have their citizens interact with Americans freely, but they also don't have to be the bad guys in it. The Jefferson quote states that giving up freedom for a little bit of security will cause one to lose both. But why go that far? "little bit of security" is not even necessary as the price. Apparently a little bit of expediency is enough.
It's censorship and xenophobia even if you can make a Yakov Smirnoff joke of it. Sorry, but this time, the boogie man is you!
Re: (Score:2)
Most spammers are still from the USA though (Score:3, Informative)
Although the RBN are certainly bad guys, Slashdotters should pls resist the tendency to assume that all the bad guys are nasty, foreign types. Most of the bad guys - for example spammers - as usual, are home-grown.
Of the 133 worst spammers on the Spamhaus ROKSO list, the vast majority of the worlds worst spammers are from the USA, followed after a big gap by nasty foreigners from Israel, Ukraine, China and yes Russia too:
See: http://www.spamhaus.org/rokso/index.lasso [spamhaus.org]
Spamhaus Drop List (Score:2)
I am going to set up the log analyzer and see how effective it is.
I still have some issues with getting it to log properly.
By default everything is accepted, except the drop list.
RBN's Netblocks (Score:3, Informative)
Has Anyone Seen the FBI? (Score:2)
But the FBI, even though part of its job is to protect Americans from the Russian mob(s) [google.com], doesn't seem interested in that sitting duck den of thieves. They're pretty industrious over at FBI, but they aren't protecting Americans from some of the most common crimes that rob people's life
RBN not just for spammers (Score:3, Insightful)
Re:Just block Russia (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Australia on the other hand is relatively clean.
Re: (Score:3, Interesting)
Re: (Score:2)
Funny. I have been doing this for years, but more inclusively by firewalling the entire world other than North America for the very reasons you cite. (A very effective strategy, by the way. It reduces spam by 98 percent.) But every time I have mentioned/advocated it on
M
Why block more than you need to? (Score:2)
Re: (Score:2)
Re:Just block Russia (Score:5, Insightful)
I started blocking Russian, Nigerian, and other addresses from one of the forums I run [thehaif.com]. It's just a community forum for people in Houston, Texas. In a matter of hours I started getting complaints from regular users who I didn't realize were expat oil execs and workers in Russia, Nigeria, etc... who used my forum to keep up on things going on at home.
The lesson I learned is that even if I can't imagine why someone would want something doesn't mean it isn't something someone would want.
Re: (Score:2)
Besides, the whole premise is broken. So some USA industries manage countless millions of foreign slaves in China, India, etc for a cheap workforce, but that's perfectly good capitalism? Using legal communication channels for data mining and advertising, same as every single noteworthy company in the world does, becomes demonised as soon as somebody labels it as mass spamming and fishing based on an u
Flamebait? Heh. I must've pissed off a spammer (Score:2)
The only conclusion I can see is that some spammer is smart enough to realize that this approach might indeed affect business, that they don't have any defenses currently in placce against it, and doesn't want the word to get out.
Obligatory (Score:2)
Re: (Score:2)
Re: (Score:2)
I'm surprised I didnt think of that myself.
-- From a Aussie
Re: (Score:2)
The other problems are all rooted in culture and government. The US is what it is because it's been ruled by corporate interests and a corrupt government. It's not something that can ever be fixed, but it can be cleaned up with a series of good administrati
Re:One Nuke (Score:4, Insightful)
Re: (Score:3, Insightful)
In the meantime you'd have a bunch of half-a
Re: (Score:2)
Re:One Nuke (Score:5, Insightful)
That's a variant on the broken window fallacy. The idea that breaking somebody's windows is a good thing because it creates work for the glazier, the police, etc. It only works from an internal viewpoint that is based on the relative distribution of wealth. Taking a broad overview of society as a whole, it's pretty plain to see that the total wealth has gone down. It's the same sort of protectionism as farm subsidies. It may keep people in work but its at the cost of having an inefficient, bloated economy. Far better than to create jobs through needless destruction and inefficiency, is to create jobs by aiming higher and achieving more as a society.
MS one of biggest obstacles to aiming higher (Score:2)
While I generally agree with this sentiment, and understand your reference to the broken window fallacy [wikipedia.org], I also find myself wondering if we might not still see a net gain should the Redmond campus suddenly fall off the map, given how active Microsoft has been in deliberately obstructing efforts to "aim higher and achieve more as a society" -- and not just for th
Re: (Score:2)
Send us ONE nuke today, and get TEN nukes by the end of the day for FREE!
FREE delivery guaranteed. Local taxes may apply.
Re: (Score:2)
Give a man a nuke (Score:2)
Teach a man to build his own nukes and you lose your monopoly on global terror.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)