Russian Business Network: Shadowy Firm Seen as Conduit for Cybercrime
Brian Krebs writes in The Washington Post:
Law enforcement agencies say these kinds of Internet companies are able to thrive in countries where the rule of law is poorly established. "It is clear that organized cybercrime has taken root in countries that don't have response mechanisms, laws, infrastructure and investigative support set up to respond to the threat quickly," said Ronald K. Noble, secretary general of Interpol, an organization that facilitates transnational law enforcement cooperation. He declined to discuss the Russian Business Network specifically.
The company isn't a mainstream Internet service provider, as Comcast and Verizon are. Rather, it specializes in offering Web sites that will remain reachable on the Internet regardless of efforts to shut them down by law enforcement officials -- so-called bulletproof hosting.
Though there are thousands of Web sites that bear the Russian Business Network name on registration records, the company is unchartered and has no legal identity, computer security firms say.
Much more
here and
here and
here.
Note: Brian Krebs gets my praise for this in-depth exposé. Kudos.
- ferg
Exposing the Russian Business Network
Dancho Danchev:
It was about time someone comes up with an in-depth study summarizing all of the Russian Business Network's activities, as for me personally, 2007 is the year when bloggers demonstrated what wisdom of the crowds really means, by putting each and every piece of the puzzle to come up with the complete picture, one the whole world benefits from.
A highly recommended account into the RBN's activities courtesy of David Bizeul's "Russian Business Network study" [.pdf].
More
here.
Image source: Dancho Danchev / David Bizeul
Russian Police And Internet Registry Accused Of Aiding Cyber Crime
Via eWeek Europe.
Amsterdam-based Internet registry organisation RIPE NCC has been singled out for its involvement with notorious criminal network provider Russian Business Network (RBN) by the UK's Serious Organised Crime Agency.
The registrar took money from the well-known criminal organisation, and subsequently corruption in the Russian police allowed the network's organisers to escape SOCA's clutches according to Andy Auld, head of intelligence for the agency's e-crime department, speaking at the RSA Conference Europe security event this week in London.
RIPE NCC denies any wrong-doing and Auld explain that the registrar wasn't actually being investigated for its involvement with RBN - but as the registry body had accepted payment from the Russian criminal organisation, it could be seen by some as having been complicit in criminal activities, he said.
"An entity like Russian Business Network - a criminal ISP and recognised as such by just about every media outlet worldwide that covers these things - RBN was registered as local internet registry with RIPE, the European body allocating IP resources to industry," explained Auld.
The SOCA officer argued that any company that does business with a known cyber-criminal organisation such as RBN could itself be open to accusations of acting illegally.
More
here.
Russian Business Network: Down, But Not Out
Brian Krebs writes on Security Fix:
A major Russian Internet service provider whose client list amounted to a laundry list of organized cyber crime operations appears to have closed shop. But security experts caution that there are signs that the highly profitable network may already be building a new home for itself elsewhere on the Web.
The Russian Business Network, an ISP and Web hosting provider long based in St. Petersburg, Russia, this week relinquished most of its allocated Internet addresses after a number of its main upstream Internet providers severed ties with the group.
More
here.
More: Russian Business Network
Dancho Danchev:
In case you haven't come across it before, here's an informative blog whose objective is to track events related to the Russian Business Network (RBN) and expose its nodes in between.
What is the RBN at the bottom line? A diversified set of IP blocks located at different parts of world, who periodically appear within the deobfuscated javascipts of the sites who got IFRAME-ed and were found to serve malware by exploiting outdated browser vulnerabilities. What's more interesting to me than the "yet another popular site which got IFRAME-ed by the RBN's network" is the success of the popular malware exploitating kits using outdated and already patched vulnerabilities.
What use are patches when no one is applying them, and aren't unpatched vulnerabilities just as effective as zero day ones? Yes, they are.
More
here.
ShadowServer: RBN 'Rizing' - Abdallah Internet Hizmetleri
Via ShadowServer.org.
Russian Business Network (RBN)
In the last few months, there has been a significant amount of press coverage given to insidious cyber activity associated with the segment of the Internet known as the “Russian Business Network,” or RBN. Previous studies have suggested that the RBN has ties to nearly every area of cybercrime, including: phishing, malware, DDOS activity, pornography, botnets, and anonymization.
In November 2007, media reporting indicated that a large portion of the RBN “went dark.” Since that time, the Shadowserver Foundation has been more closely analyzing outlying networks implicated as being associated with RBN. One of these suspected outliers is AS9121, known as TurkTelekom. SecurityZone.org reported in early December 2007 that while not everything in TurkTelekom appears to be malicious, there are some ranges that are “particularly bad” and analysis of Shadowserver Foundation data agrees. Several subranges quickly stand out as being deeply involved in malicious cyber activity: 88.255.90.0/24 and 88.255.94.0/24. IP registration indicates these ranges are listed under the name “ABDALLAH INTERNET HIZMETLERI” (AIH).
Abdallah Internet Hizmetleri (AIH)
In one of the most thorough RBN studies to date, David Bizeul reported that AIH ranges 88.255.90.0/24 and 88.255.94.0/24 - are among the “most used network ranges used by RBN affiliates’ domain names.” The purpose of this paper is to take a deeper look at these two class C ranges of AIH based out of Rize, Turkey, available information from the Internet, and statistics collected by the Shadowserver Foundation to provide further insight into the scope and depth of the RBN.
More
here.
Read the full paper
here [.pdf].
Russian Business Network, Chinese Web Space, and Misdirection
Via RBN Exploit.
There has been recent speculation concerning the Russian Business Network (RBN) and its increasing use of Chinese web space. By way of discussing this topic it is useful to quantitatively view this aspect via a practical example. We can kill 2 birds with one stone and do this via a requested update on “iFrame Cash”.
The iFrame Cash is an active RBN enterprise we call here part of the RBN “Retail Division”. Simply the RBN pays webmasters or small web hosts a commission for planting or injecting IFrame exploits on web sites, this is done via the web site iframedollars.com and others.
Iframedollars has recently changed its IP location as it has done regularly since 2004...
Much more
here.
RBNExploit: Russian Hosting Network Running a Protection Racket
Gregg Keizer writes on ComputerWorld:
The Russian Business Network, a notorious hacker and malware hosting network, runs a protection racket that extorts as much as $2,000 a month in fees for "protective Web services" from borderline sites, a researcher alleged today.
The RBNExploit blog -- which is authored by one or more anonymous researchers -- spelled out the racket run by the group, which is thought to be headquartered in St. Petersburg, Russia, and has been pegged by security professionals as a major source of malware and cybercriminal activity.
"The business model RBN uses is quite simple and effective," said a post published today on the blog. "Its affiliates and resellers comb various niche market forums and discussion areas for Web masters using or discussing protective web services, i.e. DDoS [Distributed Denial of Service] prevention. Carry out a DDoS attack on the Web site and then provide a third-party sales approach to the Web master to 'encourage' a sign-up for their DDoS prevention services."
The price for "protection:" $2,000 per month.
More
here.
The Evil (Cyber) Empire: Inside The World of Russian Hackers
Yulia Taratuta, Igor Ivanov, Svetlana Zaitseva, and Mikhail Zygar write on Newsweek.com:
The assaults may seem to be political. In 2007, a cyberattack on Estonia, home of the popular Internet phone company Skype, paralyzed the country's entire government. Then, when the Russia-Georgia conflict flared in 2008, software suddenly became available to anyone wanting to wage their own personal cyberwar on the Georgian capital of Tbilisi. And later that year, Lithuania too became a cyber-victim when it vetoed negotiations between Russia and the European Union. Indeed, NATO takes the threat of cyber-warfare so seriously that it signed off on a special report on the topic during its parliamentary assembly last October. "Although there is no conclusive evidence that the cyberattacks in Georgia were executed or sanctioned by the Russian government," the NATO report notes, "there is no evidence that it tried to stop them, either."
Russian lawmaker Nikolai Kovalyov angrily dismisses these allegations as propaganda from the Cold-War era. "The report does not contain a single piece of evidence of the mythical Russian cyberthreat or a Russian trail from the cross-border cyberattacks," he says. Still, NATO has little doubt that—official or no—the attacks have a common Russian thread: the Russian Business Network (RBN), a shadowy cyberstructure that is reported to have sold hacking tools and software for accessing U.S. government systems. According to the NATO investigators, however, political subversion is little more than a sideline for these hackers. Their real goal: stealing money through scams, spam, and infiltrating the networks of Western banks.
More
here.
RBN: Google Search Exploits
Via RBN Exploit.
The Russian Business Network (RBN) has been busy again with a significant amount of loaded web search results which lead to malware sites as reported by Sunbelt.
The good news first is being able to precisely pin point the exploiters back to newer RBN core retail centers as previously exposed in this blog on Nov 8th 07 – i.e. iFramecash, myrdns, hostfresh, and AS 27595 i.e. Atrivo, Intercage, Inhoster. Also as reported this is the same end route as the Bank of India hack, fake anti-spywares and fake codecs.
The bad news is, as predicted and one of the probable reasons for dropping their RBnetwork IP ranges , the RBN is increasingly using botnet based fast-flux techniques (see Wikipedia) to hide the initial delivery sites behind an ever-changing network of compromised hosts i.e. "double-flux" nodes within the network registering and de-registering their addresses as part of the DNS SOA (start of authority) record list for the DNS (domain name server). This provides an additional layer of redundancy and survivability within the malware network as seen in the case of the fake codecs.
More
here.
Image source: RBN Exploit
Criminal Network to Trade Botnets and Malware Uncovered
Dan Kaplan writes on SC Magazine US:
Researchers at a web security firm have discovered what they term the latest milestone in the evolving cybercriminal underground: a one-stop-shop for hackers.
Called Golden Cash, the network enables cybercrooks to buy and sell control of compromised computers, as well as trade tools for creating malware and controlling and collecting data from botnets. Also, the platform contains about 100,000 stolen FTP credentials for sale.
The discovery of the Russian-based platform, believed to be run by individuals related to the Russian Business Network (RBN), was noted in the second issue of Finjan's 2009 Cybercrime Intelligence Report.
More
here.
Russian Hosting Firm Denies Criminal Ties, Says It May Sue Blacklister
Ryan Singel writes on Wired News:
Speaking to the Western press for the first time, a Russia-based web-hosting firm pilloried by security companies as a free zone for online crime insists that it's really just misunderstood.
"We can't understand on which basis these organizations have such an opinion about our company," Tim Jaret of the Russian Business Network says in an e-mail interview. "We can say that this is subjective opinion based on these organizations' guesswork." Jaret's e-mail signature identifies him as working in RBN's abuse department.
Security researchers and anti-spam groups say the St. Petersburg-based RBN caters to the worst of the internet's scammers, renting them servers used for phishing and malware attacks, all the while enjoying the protection of Russian government officials. A report by VeriSign called the business "entirely illegal."
"They just figured out that in Russia no one will prosecute them, or if they do, they can pay them off," says Johannes Ullrich, chief technology officer of the SANS Internet Storm Center. Ullrich says RBN maintains a veneer of legitimacy by paying lip service to abuse complaints, but nothing more.
More
here.
Russia Now 3 and 0 in Cyber Warfare
Kevin Coleman writes on Defense Tech:
In January of 2009 the world witnessed the third successful cyber attack against a country. The target was the small country of Kyrgyzstan. The country is only about 77,000 square miles in size with a population of just over 5 million. The attackers focused on the three of the four Internet service providers. They launched a distributed denial of service attack traffic and quickly overwhelmed the three and disrupting all Internet communications.
The IP traffic was traced back to Russian-based servers primarily known for cyber crime activity. Multiple sources have blamed the cyber attack on the Russian cyber militia and/or the Russian Business Network (RBN). RBN is thought to control the world's largest botnet with between 150 and 180 million nodes. These reports go on to say that Russian Officials hired the technically capable group to do this.
It is widely believed that this group also played a substantial role in the Estonia Attack in 2007 and the attack on Georgia in 2008. The mechanism of attack was a fairly large botnet with nodes distributed in countries around the world. One significant difference in the Kyrgyzstan attack is that most of the DDoS traffic was generated in Russia.
More
here.
Geopolitical Climate Makes Going After Cyber Criminals Almost Impossible
Brian Krebs writes on Security Fix:
Dmitri Alperovitch, director of intelligence analysis and hosted security for San Jose, Calif.-based Secure Computing, said federal law enforcement officials who need to know have already learned the identities of those responsible for running the Storm worm network, but that U.S. authorities have thus far been prevented from bringing those responsible to justice due to a lack of cooperation from officials in St. Petersburg, Russia, where the Storm worm authors are thought to reside.
In a recent investigative series on cyber crime featured on washingtonpost.com, St. Petersburg was fingered as the host city for one of the Internet's most profligate and cyber-crime enabling operation -- the Russian Business Network.
Alperovitch blames the government of Russian President Vladimir Putin and the political influence of operatives within the Federal Security Service (the former Soviet KGB) for the protection he says is apparently afforded to cybercrime outfits such as RBN and the Storm worm gang.
More
here.
Update: Russian Hacker Gang Vanishes Day After Moving to China
Gregg Keizer writes on ComputerWorld:
The shadowy hacker and malware hosting network that only recently fled Russia to set up operations in China has now pulled the plug there and vanished yet again, researchers said late Friday.
The latest disappearing act of the Russian Business Network (RBN) has left researchers scratching their heads. "Where have they gone, that's the question," said an analyst with VeriSign's iDefense Labs, who wanted to remain anonymous, leery of retribution from the gang. "What's really interesting is how fast they shut everything down."
More
here.
Note: Oh, they're still out there -- just a little more difficult to track.
-ferg
RBN Goes Dark to Relocate; May Be Moving to China
Gregg Keizer writes on ComputerWorld:
The Russian Business Network (RBN), a notorious hacker and malware hosting organization that operates out of St. Petersburg, Russia, has gone off the air, security researchers said today.
According to a pair of Trend Micro Inc. researchers, RBN went dark around 10 p.m. EST Tuesday. "The routing information for their IP addresses has been withdrawn," said Paul Ferguson, a network architect at Trend Micro. "That's significant because while RBN has had connectivity issues in the past, then the routing [to its IP addresses] was still being advertised. This time, they've been voluntarily withdrawn."
"This is not the result of someone, such as their ISP, blackholing their traffic," Ferguson continued. "This was done voluntarily." Another report, however, on The Washington Post's Web site, claimed that while RBN has severed links to the Internet, its upstream connectivity providers had begun to refuse to route RBN traffic as early as mid-October.
More
here.
Hackers Jack Monster.com, Infect Job Hunters
Gregg Keizer writes on ComputerWorld:
Monster.com took a portion of its Web site offline Monday as researchers reported that it had been compromised by an IFrame attack and was being used to infect visitors with a multi-exploit attack kit.
According to Internet records, the Russian Business Network (RBN) hacker network may be involved.
Parts of the Monster Company Boulevard, which lets job hunters search for positions by company, were unavailable Monday; by evening, the entire section was dark. Most major American companies are represented on the site -- Google Inc.'s cache of the page that shows only those firms that begin with the letter B, for example, included Banana Republic, Bank of America, Black & Decker, Boeing, Broadcom and Budget Car Rental.
More
here.
RBN: New and Improved Storm Botnet for 2008
Via RBN Exploit.
Obviously the Russian Business Network (RBN) is working overtime during the Christmas and New Year holiday, no doubt planning for many in the ISP security and anti-spam arena to be on skeleton staff.
Many will now have already seen reports of the Storm Botnet outbreak which started on December 24th “MerryChristmasDude” with good write up at ComputerWorld and for technical details at ISC Sans or HolisticInfoSec (links on footer). This picture is changing rapidly and by December 26th there were new web sites “Uhavepostcard” , “HappyCards2008” and no doubt more to come over the next few days.
Three of the key web sites have the following registrant information, all registered via “ANO REGIONAL NETWORK INFORMATION CENTER DBA RU (Russia)” in chronological order:
- Domain Name: MERRYCHRISTMASDUDE.COM - Creation Date: Nov 27 2007
- Domain Name: UHAVEPOSTCARD.COM - Creation Date: Dec 23 2007
- Domain Name: HAPPYCARDS2008.COM - Creation Date: Dec 26 2007
More
here.
Security Fix: Report Slams U.S. Host as Major Source of Badware
Brian Krebs writes on Security Fix:
Last week, I examined a series of Web services that make profiting from cyber crime a point-and-click exercise that even the most novice hackers can master. Today, I'd like to highlight the activities of Atrivo, a Concord, Calif., based network provider that hosts some of these services.
Several noted security researchers are releasing a report today that stems from many months of investigating malicious activity emanating from Atrivo's customers. Security experts say that Atrivo, also known as "Intercage," has long been a major source of spyware, adware, viruses and fake anti-virus products.
The report is an exhaustive and well-researched analysis of Atrivo and its operations. Some of the statistics on active exploits cited in that report come from data sets I commissioned during my own investigation of Atrivo and later shared with Jart Armin, the principal author of the report and curator of the blog hostexploit.com.
Looking back several years, Atrivo's various networks were used heavily by the Russian Business Network, an ISP formerly based in St. Petersburg, Russia. RBN had gained notoriety for providing Web hosting services catering exclusively to cyber criminals. But after increased media attention, RBN dispersed its operations to other, less conspicuous corners of the Internet.
More
here.
Russia's Chechen Model for its Georgia Cyber Attack
Via IntelFusion.
Cyber warfare as a military strategy is still in its infancy, and Western conceptions of just what cyber warfare is are in sharp contrast to that of Russia and China. In fact, just last year, General James Cartwright called the U.S. cyber warfare effort “dysfunctional“. And today, 18 months later, the USAF top leadership pulled the plug on its own 8th Air Force Cyber Command (h/t Danger Room), which is very interesting timing in light of Russia’s recent cyber and military attack against Georgia.
Unlike the U.S. effort, which is hugely complex, costly, and confusing, Russia has opted for a more efficient, low cost model that outsources the work to hacker groups like the Russian Business Network or the Eurasian Union of the Youth (ESM) who were responsible for last year’s cyber attack against the Ukrainian Security Service’s Web site.
While there isn’t unanimous consent among computer security firms and consultants that Russian hackers are working on behalf of the Federal Security Service (FSB), there is ample evidence to suggest that very thing.
More
here.
