Slashdot Mirror
Legitimate ISP a Cover-up For a Cybercrime Network
ezabi writes "TrendWatch, the malware research arm of TrendMicro, has posted a white paper titled 'A Cybercrime Hub' (PDF, summary here) describing the activities of an Estonian ISP acting as a cover-up for a large cybercrime network. It's involved with malware distribution and DNS hijacking, which leads to credit card fraud. The story's interesting, and a typical internet user would be exposed in such a situation. What security measures should be taken to prevent normal users from falling victim to such malicious bodies? Note that they are represented legitimately and are offering real services like any other internet company."
The summary is hugely incorrect. This is not a malware or cybercrime network, but "normal" adware. Yes adware is bad too, but its legal and calling adware companies cybercriminals is going to bring some lawsuits.
It's involved with malware distribution and DNS hijacking, which leads to credit card fraud.
I did find it funny that they say this; just because it's *possible* doesn't mean they'd do such. Surprisingly Comcast and other ISP's have been starting to do dns hijacking, so does it mean they are doing credit card fraud?
If you read the actual white paper you see it's just usual not-so-scary adware. It replaces ads you see with their own. Thats of course allowed and legal when the user gives consent to it.
I hate adware as much as everyone else here, but instead of going for huge headlines and dramatic stories, just tell the real facts and dont make assumptions. In this case this is a legal (adware) company with 50+ workers that follows Estonian laws. Maybe the summary writer would even like to read the actual white paper too, theres no mention of credit card fraud.
If you want to fight adware, do it properly, not with assumptions or lies.
Look up the mafia and trash collection.
"As God is my witness, I thought turkeys could fly." A. Carlson
DNSSEC so they can't do anything to your DNS queries (not even by directing you to an evil resolver), and SSL or similar for everything else so your connections can't be edited or sniffed. Then there's not really much the can do, besides just dropping all your connections.
Use common sense!
Here i was thinking that this article would be about comcast, but then i remembered that comcast is just the regular kind of fraud. Over-promising and under-delivering...
Anywho, this is kind of scary, but not in an internet-scary kind of way, but instead in a crime can be all around you kind of way. Imagine if a restaurant was a front for a crime hub, i.e. skimming credit card and checking info, they would have access to people's financials, but in a much more limited sense. Although it would be interesting if the ISP didn't skim from it's own customers, but instead used them to poison dns stuff and the like. "Install our connection software! Welcome to our botnet, live long and prosper!"
Man in the middle attacks have a classic solution: Encryption and non-repudiation in the authentication protocols. Encrypt everything between the client and server (as IPv6 allows for) and the amount of damage a rogue ISP can do (or any peer point) is greatly reduced.
#fuckbeta #iamslashdot #dicemustdie
From a US perspective: without network neutrality, this is all legal.
Page 8 of the PDF shows CNN.COM with an advertisement replaced. What stops them from replacing the content of the articles? Page 10 shows how they hacked Google results. What keeps them from changing those results to filter articles on politics, religion, gender issues, laws...
I though "legitimate business" and "front for crime syndicate" were mutually exclusive.
First: I'm estonian and maybe not objective. But, in my opinion, this "research" are little bit inflammatory. I don't count, but if every third word is "Estonian" or "Estonia" or "Tartu", then this looks like "oww, look those foreign, maybe russian, cybercriminals!". Anyway, this is old and dead horse, what gets beaten, this infamous estdomains a.k.a Rove Digital (if anybody want proof, look Figure 1 in pdf and compare rovedigital.com). This article tries make impression, how in estonia this ISP is legal or somewhat "known and normal" business. In fact, i never heard about those guys before first scandals and court case, i afraid they don't have much business (legal or other kind) in Estonia.
I for one welcome our new Cybercriminal Tartu Overlords ...
(Especially since they have to within a 3 mile radius from me, being in Tartu as well)
I'd tell you the chances of this story being a dupe, but you wouldn't like it.
This is a perfect example of what kind of great "innovations" happen when you have Big Gubment stand aside and let the Free Market do whatever it wants.
What security measures should be taken to prevent normal users from falling victim to such malicious bodies?
I think a massive DOS attack will teach these Estonian bastards! Oh wait..
http://www.rovedigital.com/
This all resolves to a complete lack of accountability. The IANA requires that site owners respond to abuse e-mails but then who checks the ISP? Or what if the ISP doesn't care because they are makign revenue of the hackers? Much less this case where the ISP is the hacker! The IANA needs a protocol for revoking the IP ranges of any ISP that allows abuse OR does not respond to abuse. Currently, there is no reasonable method an abuser if their ISP is unwilling to act and no method for forcing the ISP to act. All a malicious user has to do is stand behind a non-responsive ISP...
"I find the use of a good filtered DNS service that blacklists malware URL's upon discovery goes a long way towards limiting my exposure to this. Open DNS or Scrub IT works well. The only down side is they are often the target of DOS attacks, so their uptimes are limited. Be prepared to switch DNS settings when the "Internet" goes down. Most of my frequent sites, I keep in my local hosts file, so even if DNS goes down or DNS is hijacked, the link to my banking is still valid. Ruining as a normal user I can't be tricked into editing my hosts file. I don't have the privileges. Links; Open DNS http://www.opendns.com/ ScrubIT http://www.scrubit.com/ " - by Technician (215283) on Wednesday August 26, @01:53PM (#29204855)
See my subject-line, & this URL (especially points #'s 2 thru 5, because they cover a great deal of exactly what you state works, because, those points DO):
----
HOW TO SECURE Windows 2000/XP/Server 2003, & even VISTA, + make it "fun-to-do", via CIS Tool Guidance (&, beyond):
http://www.tcmagazine.com/forums/index.php?s=555c0485c3ad66d4020d3aa92778a1b2&showtopic=2662&st=0&start=0
----
IT WORKS...
How well? Ok, a testimonial, from -> http://www.xtremepccentral.com/forums/showthread.php?s=79253c5b286c472a012ff2ef7e7f2230&t=28430&page=3
----
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it worked and I am sure her wallet is appreciated too now that it works. Speaking of which, I need to call her to see if I can get some leads. APK - I will say it again, the guide is FANTASTIC! Its made my PC experience much easier. Sandboxing was great. Getting my host file updated, setting services to system service, rather than system local." THRONKA, user @ xtremepccentral.com
----
That's 'how well'... For going on 2++ yrs. now for Thronka & his paying clients, & for myself? Since 1997-1998 or so, through many machines since those days, to the present today, same results here!
APK
P.S.=> AND, what is a MAJOR portion of that guide (as far as "the beyond" part, above CIS Tool Guidance)? HOSTS FILES, & OpenDNS or ScrubIT DNS... & you think just like I do, & it does work, for all that you noted, plus more - think about THIS one:
Like IPSecurity Policies (also covered in my guide, acting as "layered security")? HOSTS files can LIMIT what even an already "taken in" malware can do online - because, IF/WHEN you block KNOWN "bogus servers" or bad adbanners (or even malicious websites)??
Well, if YOU cannot get to them, guess what? NEITHER CAN THE MALWARE... sure, some of you might say "but the malware could just use a static IP address vs. using HOST names or URL's to communicate back to 'home base/the mothership'" but, they can't do that, because ISP/BSP's "take down" KNOWN bad servers fairly quickly once they're discovered... & thus, using an IP address would be, self-defeating - where using URLs or DOMAIN NAMES allows malware makers/botnet masters etc. et al the ability to QUICKLY re-register said domain name once more, albeit, on a diff. server next rou
Authentication protocols like PKI that use encryption would make many sources of malware unambiguous. The pretty much leaves email and discs as the only malware carriers that are hard to track.
I totally came in here expecting this to be about Comcast. I feel like I'm being robbed every month when I pay my bill.
"Are you being treated for some condition that we should know about?" - by Anonymous Coward on Wednesday August 26, @04:03PM (#29207137)
No - but, do see my subject-line, & by the way: Care to show us your PHD in Psychiatry, or Medicine, etc. et al with your name on it?
(I say that, simply because w/out it (and a license to practice, as well as performing a formal examination of myself), you rather childishly transparent & stupid "insinuations/inneundos" mean, squat...)
Get it?
(Have a nice day)
APK
P.S.=> You're OFF TOPIC as well, by the way - So, go away now, little troll... apk
i run a p3 700mhz,512mb ram box with dnsmasq and a proper hosts file on said server. I have a comcast connection, but i believe comcast isn't filtering nx records in florida yet?
DNSSEC so they can't do anything to your DNS queries (not even by directing you to an evil resolver), and SSL or similar for everything else so your connections can't be edited or sniffed.
Actually, once the bad guys have installed malware on your PC, it's pretty much game over. DNSSEC won't help you, and SSL won't help you: they are designed to thwart man-in-the-middle attacks, not man-in-the-endpoint attacks. If your PC is compromised, the DLL that performs DNSSEC or SSL verification can also be compromised. We don't really have a security model to deal with man-in-the-endpoint attacks, other than things like two-factor (or n-factor) authentication which work because one of the two (or n) communications channels isn't compromised by the bad guys.
proof, n. A demonstration that a conclusion is implied by certain premises and axioms.
We're the USA. Why don't we just bomb Estonia?
We've bombed a lot of countries for a heck of a lot less.
For those interrested check out some info about the RBN (Russian Business Network) which was organized around an ISP in St. Petersburg, this was a really big operation.
This report lacks some detailled information about the ISP, eg which AS are involved, etc, so one can just react and put them into a DROP List or do an AS-Path finltering. If its an ISP with known AS, you (your ISP) can react.
I was just wondering in Figure 6 of the PDF where is step 5?