RBN Attacks Labour Organization

Russian Business Network hackers have targeted the computers of visitors to WomensLabour.org, a website devoted to women and the labour market in Central and Eastern Europe.

The website is designed to provide Non Governmental Organizations (NGOs) and particularly gender focused NGOs with up to date information about the economic position of women from the Central and Eastern Europe (CEE). It places particular emphasis on the link between the EU enlargement process and the position of CEE women in the labour market.

The RBN is well known for its direct involvement in the sexual exploitation of women and children. The Russian Business Network's efforts to spy on Eastern European labour organizations should be noted by law enforcement.

MalwareDomainList.com first listed WomensLabour.org as compromised on June 30th. Google's Safe Browsing application reports that visitors to the site were targeted by malicious software ("resulted in malicious software being downloaded and installed without user consent") originating at martuz.cn, betbigwager.cn, and cutlot.cn. Cutlot.cn and betbigwager.cn are operated by well known cyber criminal Raymond Keaton (keaton@cybernauttech.com). Chen Poon, who also acts in tandem with Russian cyber criminals, owns martuz.cn. The RBN's malicious software included, but was not limited to, "7 scripting exploits".

- James McQuaid

DNS Super Black Hole

DNS Black Hole technology has been used in various settings for some years. "The first DNSBL was the Real-time Blackhole List (RBL), created in 1997 by Paul Vixie as part of his Mail Abuse Prevention System (MAPS)" (note: http://en.wikipedia.org/wiki/DNSBL).

Some years later, David Glosser's open source security project at EmergingThreats.net formalized the use of the technique as a means of blocking malware (note http://www.malwaredomains.com/bhdns.html). His site includes a nice hyperlink list of the various hosts blocking web sites at http://www.malwaredomains.com/bhdns.html#Resources.

Over the past two years, having faced an onslaught of hundreds of new malware domains per week created by the RBN and their affiliates, those of us engaged in mitigation and recovery operations began creating Super Black Holes in Linux DNS servers as a matter of necessity. Initially, there was some skepticism as to whether the concept was practicable, but it has proven sound when used with internal DNS servers.

The great advantage for home users is that a DNS Super Black Hole provides the opportunity to effectively block a *very* large number of malicious web sites with minimum resources. For example, to filter by IP address the 247,268 evil sites (provided in the DNS Super Black Hole files that I am posting) requires 6 GB of RAM deployed across two inline firewall servers. Such hardware is unavailable to most home users. In contrast, using one older PC bearing only 512 MB of RAM, the home user can block the same 247,268 bad actor web sites using a DNS Super Black Hole (deployed on a free, open source software platform such as Smoothwall). Windows users can edit the files by using free, open source software such as Notepad++ (http://sourceforge.net/projects/notepad-plus/) and WinSCP (http://sourceforge.net/projects/winscp/). This provides parents with a means to filter racist, criminal and pornographic web sites.

In the struggle against cyber criminals, I have often observed instances where viruses are used to drive up the traffic statistics of a web site owned by the criminal. This enables cyber criminals to auction the domain at a greater price. In order to discourage this practice, my DNS Super Black Hole files include many of these domains.

Few individuals visit malicious web sites on purpose. In most cases, the user visits a legitimate site which has been hacked or which includes a malicious banner ad (a fairly common occurence at Yahoo and Google). The end result is that a hidden window or I-Frame is invoked by JavaScript which installs malware on the PC. DNS Super Black Hole prevents this by diverting the DNS (domain name server) query to the Black Hole. The files include Internet bad actors as well as, most of the known malware domains as of May 27, 2009.

Smoothwall is a stable platform which provides excellent installation instructions and documentation (http://www.smoothwall.org/) and user community support (http://community.smoothwall.org/forum/). As such, it is ideal for home users.

You can download the DNS Super Black Hole files for Smoothwall at Emerging Threats from: http://doc.emergingthreats.net/bin/view/Main/HoneywallSamples):

* config-hosts (http://doc.emergingthreats.net/pub/Main/HoneywallSamples/config-hosts): 247,268 organized crime, RBN affiliates, malware hosts and bad actors blacklisted for Smoothwall 3. Leave last line blank. Place in /var/smoothwall/hosts/, then rename config-hosts to config. Update 5-27-2009: 3,526 cybercrime and malware domains discovered since May 3rd.

* hosts (http://doc.emergingthreats.net/pub/Main/HoneywallSamples/hosts): Protect your home from 247,268 bad domains for Smoothwall 3; placed in /var/smoothwall/hosts/. Note: with this many objects in BlackHole, you must use local loopback. Updated 5-27-2009.

Many of the web sites listed in these files are extraordinarily dangerous, so do not visit them!

RBN Registers Racist Domains Using Go Daddy

Russian Business Network malware distributors have registered numerous racist domain names using domain registrar Go Daddy. The domains, and subsequently created subdomain names, provide insight into the RBN's misanthropic perspective.

Over the past year, Go Daddy has been criticized by anti-fraud watchdog groups for refusing to take down web sites engaged in the sale of illegal steroids. (note: http://www.darkreading.com/security/management/showArticle.jhtml?articleID=211201188)

As of March 26th, the malicious sites were hosted at XS4ALL Networking (cistron) in Amsterdam at IP address 83.68.16.6 (which XS4ALL classifies as "ADSL IP numbers"). One of the domains present on the IP address (and registered through Go Daddy), ntkrnlpa.info, has been involved in several RBN criminal campaigns. Note Dancho Danchev's excellent blog post of March 25th, "Embassy of Portugal in India Serving Malware", at http://ddanchev.blogspot.com/2009/03/embassy-of-portugal-in-india-serving.html

Go Daddy should act in a socially responsible manner and reveal information regarding the registrant(s), take down the domains, and apologize for taking profits from providing registration services for racists and criminals.

83.68.16.6:
4thelulz.info
a.good.time.at.yomammashouse.info
a.shitonjesus.com
am.t3h.n00b-pwner.com
am.your-god.com
and.i.will.be.postingyour.info
and.shitonwomensrights.info
anxau.com
are.jews.on.tha-inter.net
are.no.girls.on.tha-inter.net
at.niggertrading.com
at.yomammashouse.info
be.postingyour.info
bitches.and.shitonwomensrights.info
blows.me.i.say.fuckyeahnigga.com
buy.your.nigger.at.niggertrading.com
call.me.the.n00b-pwner.com
cause.im.the.n00b-pwner.com
dont.worry.ill.soon.be.postingyour.info
exploiterzone.org
fuck.with.me.and.i.will.be.postingyour.info
fuck.your-god.com
fuckyeahnigga.com
get.pwnt.cause.im.the.n00b-pwner.com
getpwnt.info
girl.blows.me.i.say.fuckyeahnigga.com
girls.on.tha-inter.net
good.time.at.yomammashouse.info
hacked.your.site.4thelulz.info
had.a.good.time.at.yomammashouse.info
here.4thelulz.info
ho.rubato.ad.una.fiat.uno.td.le.borchie.biz
i.am.t3h.n00b-pwner.com
i.am.your-god.com
i.say.fuckyeahnigga.com
i.take.a.shitonjesus.com
i.will.be.postingyour.info
ill.soon.be.postingyour.info
im.just.here.4thelulz.info
im.the.n00b-pwner.com
in.the.n00b-pwner.com
its.time.to.call.in.the.n00b-pwner.com
jews.on.tha-inter.net
just.here.4thelulz.info
master.of.tha-inter.net
mazzolin.di.borchie.biz
me.and.i.will.be.postingyour.info
me.i.say.fuckyeahnigga.com
me.the.n00b-pwner.com
metal.borchie.biz
n00b-pwner.com
n00bs.get.pwnt.cause.im.the.n00b-pwner.com
nigger.at.niggertrading.com
niggersgonewild.info
niggertrading.com
no.girls.on.tha-inter.net
ntkrnlpa.info
of.tha-inter.net
oh.fuckyeahnigga.com
on.tha-inter.net
on.your-god.com
out.there.are.jews.on.tha-inter.net
postingyour.info
pwning.tha-inter.net
pwnt.cause.im.the.n00b-pwner.com
quel.mazzolin.di.borchie.biz
rubato.ad.una.fiat.uno.td.le.borchie.biz
satan.says.shitonjesus.com
say.fuckyeahnigga.com
says.shitonjesus.com
shit.on.your-god.com
shitonjesus.com
shitonwomensrights.info
site.4thelulz.info
slapping.bitches.and.shitonwomensrights.info
t3h.n00b-pwner.com
take.a.shitonjesus.com
tatuaggi.e.borchie.biz
tha-inter.net
the.n00b-pwner.com
there.are.jews.on.tha-inter.net
there.are.no.girls.on.tha-inter.net
they.call.me.the.n00b-pwner.com
ti.picchio.con.le.borchie.biz
time.at.yomammashouse.info
time.to.call.in.the.n00b-pwner.com
to.call.in.the.n00b-pwner.com
users.getpwnt.info
watch.out.there.are.jews.on.tha-inter.net
when.your.girl.blows.me.i.say.fuckyeahnigga.com
will.be.postingyour.info
windows.users.getpwnt.info
with.me.and.i.will.be.postingyour.info
worry.ill.soon.be.postingyour.info
yomammashouse.info
your-god.com
your.girl.blows.me.i.say.fuckyeahnigga.com
your.mom.4thelulz.info
your.nigger.at.niggertrading.com
your.site.4thelulz.info
yourseekerz.com

RUSSIAN BUSINESS NETWORK DEPLOYS IN THE IP SPACE OF THE ISLAMIC REPUBLIC

A Russian organized crime group involved in pornography, drug smuggling, and the distribution of malware has initiated operations from the IP address space of the Islamic Republic of Iran. It is unknown if this activity was launched with state approval.

The Russian Business Network affiliate involved has established a front company, autonomous system AS48669 NTCOLO-AS NTCOLO, and has been allocated 510 unique IP addresses. AS48669 consists of 105 malware domains, 19 domain name servers, 8 mail servers and 3 fraudulent payment processors. The affiliate's contact email address is staff@ntcolo.com.ua.

The domain to IP address assignments are modified several times per week, as the RBN seeks to evade IP blocking by network administrators. As of Sunday 22 March 2009, the domain to IP address assignments were as follows:


194.165.4.0/23 = 192.165.4.1 through 192.165.5.255 AS48669 NTCOLO-AS NTCOLO

194.165.4.7
advancedprotectionscanner.com (fake antivirus application)
bestantimalwarescanner.com (fake antivirus application)
fullantispywareonlinescane.com (fake antivirus application)
newsworldinteger.cn
webgreenpeace.cn
worldwidesphere.cn

194.165.4.14
*.ykoohky.com
ns.ykoohky.com
ns.zdorcaf.com (name server for malware redirector)

194.165.4.15
ns1.ykoohky.com
ns1.zdorcaf.com (name server for malware redirector)

194.165.4.16
mail.quicksecurityskim.com (mail server for malware domain)
mail.webprotectionswipe.com (mail server for malware domain)
quicksecurityskim.com (fake antivirus application)

194.165.4.20
mail.onlinestabilityexamine.com (mail server for malware domain)
ns1.onlinestabilityexamine.com (name server for malware domain)
onlinestabilityexamine.com (Downloader.MisleadApp, WinFixer trojan)
www.onlinestabilityexamine.com (Downloader.MisleadApp, WinFixer trojan)

194.165.4.21
ns2.onlinestabilityexamine.com (name server for malware domain)

194.165.4.39
piratas-numericos.info (Ransom trojan, New Malware.j trojan, Generic.d)

194.165.4.41 (fake antivirus applications and WinFixer trojans)
*.bestscan4.com
*.bestscan6.com
*.easy4scan.com
*.fast4scan.com
*.fastscan4.com
*.just4scan.com
*.lead4scan.com
*.live6scan.com
*.livescan4.com
*.livescan6.com
*.new6scan.com
*.plus4scan.com
*.plus6scan.com
*.plusscan4.com
*.scan4easy.com
*.scan4ever.com (fake antivirus application)
*.scan4fast.com
*.scan4now.com
*.scan6best.com
*.scanbest4.com
*.scaneasy4.com
*.scanfast4.com
*.scanlive4.com
*.scannew4.com
*.scanplus4.com
bestscan4.com
bestscan6.com
easy4scan.com
fast4scan.com
fastscan4.com
gobestscan.com
just4scan.com
lead4scan.com
live6scan.com
livescan4.com
livescan6.com
newscan6.com
ns1.inspred.com (name server for malware domain)
ns1.new4scan.com (name server for malware domain)
ns1.scan4new.com (name server for malware domain)
ns1.scan4plus.com (name server for malware domain)
plus4scan.com
plus6scan.com
scan4easy.com
scan4ever.com
scan4fast.com
scan4now.com
scan6best.com
scan6live.com
scanbest4.com
scaneasy4.com
scanfast4.com
scanlive4.com
scannew4.com
scanplus4.com
www.bestscan4.com
www.bestscan6.com
www.easy4scan.com
www.fast4scan.com
www.fastscan4.com
www.just4scan.com
www.lead4scan.com
www.live6scan.com
www.livescan4.com
www.livescan6.com
www.new6scan.com
www.plus4scan.com
www.plus6scan.com
www.plusscan4.com
www.scan4easy.com
www.scan4ever.com
www.scan4fast.com
www.scan4now.com
www.scan6best.com
www.scanbest4.com
www.scaneasy4.com
www.scanfast4.com
www.scanlive4.com
www.scannew4.com
www.scanplus4.com

194.165.4.140 (fake antivirus applications and WinFixer trojans)
*.avpayments.com (fraudulent payment processor)
*.easy6scan.com
*.fast6scan.com (fake antivirus application)
*.ia-pro.com (WinFixer trojan)
*.internetantiviruspro.com (WinFixer trojan)
avpayments.com (fraudulent payment processor)
easy6scan.com
fast6scan.com
general-antivirus.com
generalantivirus.com
internetantiviruspro.com
mail.new4scan.com (mail server for malware domain)
mail.scan4new.com (mail server for malware domain)
mail.scan4plus.com (mail server for malware domain)
mail.scan5best.com (mail server for malware domain)
scan4plus.com
www.avpayments.com (fraudulent payment processor)
www.easy6scan.com
www.fast6scan.com (fake antivirus application)
www.ia-pro.com (WinFixer trojan)
www.internetantiviruspro.com (WinFixer trojan)
www.live4scan.com
www.new4scan.com

194.165.4.224
ns1.scan5best.com (JS.Downloader, Packed.Generic.200, fake antivirus application)
personal-antivirus.com (Downloader.MisleadApp, WinFixer trojan)

194.165.5.20
google-analitecs.com ("intermediary for the infection of 123 sites" - Google)
mail.google-analitecs.com (mail server for hacking domain)
ns1.google-analitecs.com (name server for hacking domain)
ns2.google-analitecs.com (name server for hacking domain)
ns2.inspred.com

194.165.5.54
ns2.new4scan.com (name server for phishing domain)
ns2.scan4best.com (name server for malware domain)
ns2.scan4new.com (name server for malware domain)
ns2.scan4plus.com (name server for malware domain)
ns2.scan5best.com (name server for malware domain)

United States Agency for International Development hacked by Georgia attacker

Russian intelligence enlists RBN to boost Lavrov

With the arrival of Russian Foreign Minister Sergei Lavrov to Azerbaijan, the corresponding U.S.A.I.D. site was hacked by the Russian Business Network. Those who visited the site have had the information on their computers taken:

"The Azerbaijan section at the United States Agency for International Development (azerbaijan.usaid.gov) has been compromised and is embedded with malware and exploits serving scripts approximately around the 1st of March." - Dancho Danchev (http://blogs.zdnet.com/security/?p=2817)

The domain which is collecting data from the computers infected when they visited the U.S.A.I.D. Azerbaijani web site, fileuploader.cn, was registered by Sergey Astakhov.



Those familiar with this blog will note that Mr. Astakhov led the cyber "first strike" against Georgia preceeding the war between Georgia and Russia (http://securehomenetwork.blogspot.com/2008/09/rbn-operatives-part-ii.html).

The domain, fileuploader.cn, has been used for criminal purposes in the past. "It gets even more interesting when the phone back location of the malware fileuploader.cn/check/check.php is revealed. The domain in question was exclusively used by Russian Business Network/customers of the RBN in January, 2008 part of the cybercrime powerhouse’s attempt to throw sand in the eyes of the community by
issuing fake account suspended notices whereas the malware campaigns remained active." (http://blogs.zdnet.com/security/?p=2817)

As Danchev observes, "Is there such a thing as a coincidence, especially when it comes to three malware embedded attacks in a week affecting Azerbaijan's USAID.gov section, and now their Pakistani (azembassy.com.pk) and Hungarian (azerembassy.hu) embassies?" (http://ddanchev.blogspot.com/2009/03/azerbaijanian-embassies-in-pakistan-and.html)

It should be noted that Mr. Astakhov is a commercial purveyor of potentially illegal sexual material (deinglaube.com) as well as, malware. Such is the less than exemplary state of Russia's intelligence services. It is unfortunate that Russia's Foreign Ministry draws upon criminal assets.

James

RBN Takes Another Hit

Ukrainian web hosting provider UkrTeleGroup Ltd., a long time hub of Russian cybercrime operations, has been taken offline. The take down came after reports by McAfee and other security organizations, and a formal complaint by Brian Krebs of The Washington Post. This action sends a clear message to other web hosting providers that providing service to organized cyber crime imposes risks to the host. The overall effect will be to drive up the cost to cyber criminals of doing business. Last year, cybercrime cost the world economy as much as $1 trillion.

You can read more at Brian Krebs' Security Fix column at The Washington Post:
http://voices.washingtonpost.com/securityfix/2009/01/troubled_ukrainian_host_sideli.html

Risk Impact High

Symantec yesterday (11-26-2008) identified a new strain of adware bearing a risk impact of high. Adware.OneStep targets the Firefox browser (http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-112613-5052-99&tabid=2). It embeds search results from onestepsearch.net with hidden advertisements that use size zero iframe tags.

An examination of onestepsearch.net reveals additional cause for concern. The proprietor of onestepsearch.net is Navigation Catalyst Systems, Inc.; the firm was sued by Verizon on April 15th. In that lawsuit,

"Verizon California Inc., Verizon Trademark Services LLC and Verizon Licensing Company alleged that Defendants Navigation Catalyst Systems Inc. and Basic Fusion Inc. have used an automated process to register and use over three million domain names, many of which are confusingly similar to famous or distinctive trademarks owned by others."(http://news.justia.com/cases/featured/california/cacdce/2:2008cv02463/413394/)

The mass registration of typosquatting domains is a tactic often practiced by the Russian Business Network.

McAfee's Site Advisor service ties navigationcatalyst.com to qsrch.com ("When we visited this site, we found that it appears to have a business relationship with New.net, a known provider of adware, spyware or other potentially unwanted programs."). Indeed, onestepsearch.net shares both its IP address and name server with qsrch.com. Other domains at IP address 208.87.149.250 include a variety of sociopathic porn sites (teenagefucksluts.com, has.seen.godscock.net, etc.), hacker redirect sites (justgotpwned.com), typosquatter domains (blogpspot.com), disreputable medical products and unsafe download sites (01computersoftwar.biz, etc.). Waria.vg is also present; waria is a trojan egg dropper which targets Linux and Unix systems. Also, corrupt DNS entries are deliberately employed by onestepsearch.net; the reverse DNS entry for onestepsearch.net, 250.f.com, is not whoisable, and no f.com exists.

It is adviseable that you block the IP addresses as well as, the domain names associated with onestepsearch.net. DNS blocking is useful as malware domains often change IP addresses, as their owners seek to avoid IP blocking.

onestepsearch.net  - 208.87.149.250
ns1.onestepsearch.net - 209.128.80.137
ns2.onestepsearch.net - 209.128.80.138
ns3.onestepsearch.net - 209.128.76.101
ns4.onestepsearch.net - 209.128.76.102
mail01.quadzemail.com - 208.87.148.231

onestepsearch.net and quadzemail.com lurk within AS40634, and you may be able to block this entire route (208.87.148.0/23), which appears to be rife with the worst malice.