RBN Never 'Went Away' - They Just Flew Lower Under The Radar
This is also the opinion that I have had since the withdrawal of RBN routes originated by AS40989.
Dancho Danchev:
There's indeed a connection between the RBN, Storm Worm and the The New Media malware gang. The malware gang is either a customer of the RBN, partners with the RBN sharing know-how in exchange for infrastructure on behalf of the RBN, or RBN's actual operational department.
Piece by piece and an ugly puzzle picture appears thanks to everyone monitoring the RBN that is still 100% operational.
More
here.
RBN Goes Dark to Relocate; May Be Moving to China
Gregg Keizer writes on ComputerWorld:
The Russian Business Network (RBN), a notorious hacker and malware hosting organization that operates out of St. Petersburg, Russia, has gone off the air, security researchers said today.
According to a pair of Trend Micro Inc. researchers, RBN went dark around 10 p.m. EST Tuesday. "The routing information for their IP addresses has been withdrawn," said Paul Ferguson, a network architect at Trend Micro. "That's significant because while RBN has had connectivity issues in the past, then the routing [to its IP addresses] was still being advertised. This time, they've been voluntarily withdrawn."
"This is not the result of someone, such as their ISP, blackholing their traffic," Ferguson continued. "This was done voluntarily." Another report, however, on The Washington Post's Web site, claimed that while RBN has severed links to the Internet, its upstream connectivity providers had begun to refuse to route RBN traffic as early as mid-October.
More
here.
RBN: 'I See Alive IFRAMEs Everywhere' - UPDATE
Dancho Danchev:
During the weekend, the entire Newsland.ru which is among the most popular Russian news portals, was marked as as "this site may harm your computer" by StopBadware.org due to an IFRAME embedded link pointing to where else if not to the RBN.
Considering that each and every embedded malware attack during 2007 that I assessed in previous posts, had something to do with the RBN in the form of a single RBN IP which was used in numerous malicious activities all at once, different sites get embedded with it, blackhat SEO postings at different forums etc. in this one the parties behind the attack dedicated a special IP with what looks like as a clean IP reputation.
More
here.
Note: Oddly enough, IP prefixes from RBN
strangely disappeared from the global routing system today... stay tuned.
- ferg
RBN and Bulletproof Hosting
Fraser Howard writes on the Sophos Blog:
Several previous blog entries have described various forms of web-based attacks. In most cases, the attack involves compromising a large number of web servers in order that the sites they host are turned into drive-by download sites. When victims browse these compromised sites, additional malicious content is silently loaded from some remote server (the attack site).
Whilst looking through some of the data collected from the web threat analysis system in the lab over the last few weeks, I noticed that a number of the remote attack sites were in the same address range. Digging further, it quickly became apparent that the attack sites were using hosting services provided by the Russian Business Network (RBN). The RBN provide web hosting and other services much like any other ISP. Unlike other ISPs however, the RBN is reported to be used almost solely by cybercriminals for illegal purposes. Illegal activities such as phishing, botnet C&C, spam, DoS attacks and malware hosting have all been traced to RBN-hosted servers.
More
here.
RBN: The Top 20, Fake Anti-Spyware and Anti-Malware Tools
Via The RBN Exploit Blog.
In a continuation of the discovery of the RBN’s “Retail Division” one of the most important exploit delivery methods is the fake; anti-spyware and anti-malware for PC hijacking and personal ID theft, this is a source of revenue for the RBN also from a direct sale.
For example, MalwareAlarm is a dangerous fake anti-spyware software and it is an update version of Malware Wiper. MalwareAlarm is stealth based malware, according to McAfee’s Site Advisor they tested 279 “bad” downloads. The methodology is to get the user to use a “free download”, MalwareAlarm then displays a warning message to purchase the paid version of MalwareAlarm, and of course the damage is done with the initial action.
The purpose of this article is to demonstrate the multiplicity of nodes, connections and delivery routes. However, it is a prompt for the community of the need for real-time CYBERINT based blocking and shield services. As is shown below, many are either or both SBL and XBL blacklisted, but this is only the core IP address and not the multiplicity of other mirrored hosts and servers.
More
here.
Rogue RBN Software Pushed Through Blackhat SEO
Dancho Danchev:
This is yet another example of the KISS strategy uncovering another huge IFRAME campaign, again taking advantage of locally cached pages generated upon searching for a particular word, and the IFRAME itself. In the previous example for instance, we had an second ongoing IFRAME campaign with just 4 pages injected with 89.149.243.201, however, what Keep it Simple Stupid really means in this case is that the next IP in their netblock 89.149.243.202 is currently getting injected at many other sites as well.
The difference between the previous campaign and this one, is that the previous one was targeting just two high page rank-ed sites, while in the second one, the malicious parties pushing RBN's rogue XP AntiVirus are relying on a much more diverse set of domains loading the IFRAME. One factor remains the same, both campaigns continue pushing the rogue XP AntiVirus.
More
here.
Note: Okay, the time has come to start naming names, apparently.
netdirekt e.K. - a hosting provider based in Frankfurt, Germany - has long been a (perhaps unwittingly) hosting provider for RBN activities for well over a year. So has
Layered Technologies, Inc. (based in Plano, Texas),
InterCage, Inc. (Concord, California), and
SoftLayer Technologies, Inc. (Dallas, Texas). Each of these have long been known to be operational deployment platforms for RBN-related activities.
And yes, each of them have been contact through formal channels to inform them of these activities, to no avail.
Isn't it time for these companies to be called to task for continuing to turn a blind eye to criminal activities hosted in their networks?
-ferg
