Slashdot Mirror
Profile of the Russian Business Network
The Washington Post has an article detailing what is known of the workings of the Russian Business Network, a shadowy entity based in St. Petersburg that hosts a good fraction of the world's spammers, identity thieves, bot herders, and phishers. RBN is not incorporated anywhere and may not technically even be violating Russian law. It provides "bulletproof hosting" for about $600 a month to a wide range of bad guys.The author of the Post story, Brian Krebs, supplements it with two blog posts. One provides more detail and back story including a look at one ISP's security admin who decided last summer to ban all RBN traffic from his network, with outstanding results. The other post maps some of the RBN's upstream suppliers and details the extent of the RBN's involvement in recent cyber-attacks: "Nearly every major advancement in computer viruses or worms over the past two years has emanated from or sent stolen consumer data back to servers" in the RBN.
The Spamhaus project has a list of Russian Business Network addresses, for what it's worth.
I wonder if anyone has every found a remote exploit that will get past iptables -j DROP recently.
You don't need the range to be in the article. Just use zen.spamhaus.org in your rbl thingy, and that'll keep you covered. spamhaus and spamcop have been blocking these guys for a while now...
http://www.zombieapocalypse.tv/
Except most spam comes from the US via zombies. Should we block them too?
I still have more fans than freaks. WTF is wrong with you people?
RBN addresses (and assorted other nasties) are also listed in the Spamhaus DROP (Don't Route Or Peer) list. IMO, it's a useful thing to drop (pun intended) into your firewall...
Oh, no! You have walked into the slavering fangs of a lurking grue!
easy, just look at the spamhaus statistics.
Although the RBN are certainly bad guys, Slashdotters should pls resist the tendency to assume that all the bad guys are nasty, foreign types. Most of the bad guys - for example spammers - as usual, are home-grown.
Of the 133 worst spammers on the Spamhaus ROKSO list, the vast majority of the worlds worst spammers are from the USA, followed after a big gap by nasty foreigners from Israel, Ukraine, China and yes Russia too:
See: http://www.spamhaus.org/rokso/index.lasso
# Russian Buisness Network et al. As listed from spamhaus.org on 10/14/2007 81.95.144.182/32 81.95.149.171/32 58.65.239.66/31 81.95.144.3/32 81.95.149.27/32 81.95.149.181/32 81.95.149.178/32 81.95.156.0/22 193.93.235.5/32 81.95.149.110/31 81.95.148.18/32 81.95.148.130/31 81.95.148.132/31 81.95.153.243/32 81.95.147.202/31 81.95.144.0/20 195.114.16.0/23 195.64.162.0/23 84.45.90.141/32 88.201.208.0/20 195.64.140.0/23 81.94.16.0/20 85.249.23.0/24 81.95.147.182/32 217.118.119.26/32 85.133.4.138/32 213.200.79.194/32 62.154.15.154/32 213.200.78.66/32 195.66.226.151/32 213.200.80.46/32
Regarding spamhaus, there's the DROP list http://www.spamhaus.org/drop/ plus a perl script http://www.spamhaus.org/faq/answers.lasso?section=DROP%20FAQ#116 to turn that list into route commands which block those networks. If it has to be iptables for you, the script shouldn't be too hard to customize.
A little late to the thread to get modded up, but I didn't have time this morning to post my own BGP filtering route-maps to keep these malware ISPs out of my tables. AS41173 seems to be the only upstream ISP to 40989. These companies seem to be the same mysterious people, hoping to hide their identities and locations. The internet isn't that easily fooled, though.
If you look at the RIPE and whois records for all the parties involved, this is an ISP that popped up in June of last year, apparently dedicated to hosting malware sites. Look closely at addresses and dates. Fictitious Panamanian and UK addresses with an American phone number, claims of being in the Seychelles (English spelling), again with other American phone numbers.
Some nmap fingerprinting of their routing equipment shows this operation tends towards low budget. I've seen ISPs that were nothing more than a couple of university students who obtained an AS#, a prefix, found a BGP feed, and filled a rented a rack in a colo with some servers and a linux box running quagga. Seen from a looking glass, no difference from the big players. A good looking website regularly updated, proper whois and RIPE records, and it's very difficult for a potential client to know the ISP may go down during exams week.
This operation seems not much more than what a couple of kids with a little knowledge could put together. The prefixes fill various spamhaus and RBL lists. Doubtful that there are any legitimate clients on those networks. This operation is the malware gangs getting a little more hi-tech, running their own ISP by buying IP transit from companies known for never turning down business. They use C4L/NetSumo, a known no-questions-asked ISP who resell an MPLS service between London and Eastern Europe, probably Interoute's.
As for location, looking at various internal looking glasses, the prefixes seem to be hitting the internet in London then through a leased line with 70 mSec of delay, and in Prague with a sudden 20 mSec of delay. This certainly is not going through the Seychelles. My best guess would be a data centre in Russia, where bribes to local authorities gives them a certain level of immunity to lawful pursuits.
Any reasonable ISP hoping to protect their clients from this criminal malware gang would just filter those four AS#s from their main routing tables, and save themselves a world of hurt. Better yet would be to actively blackhole those prefixes. Sure, it might fly in the face of one perfect internet, but since there is no legal remedy, internet providers need to protect themselves. Good ISPs and hosting services already filter all kinds of bogus routing information, adding a known spam and malware operation to the list is just good practice.
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on