Slashdot Mirror
Pawn Storm Group Makes Trend Micro IP Address a C&C Server
An anonymous reader writes: Following Trend Micro's disclosure of Russian hacking group Pawn Storm's 7-year campaign against military-industrial targets in and related to the United States, the security company has today announced that one of the IP addresses it owns has been 'designated' by the hackers as a C&C server for their spear-phishing scenario. The intent of the DNS record redirection, according to the company, is likely to be to convince others that it has been hacked (which it hasn't), or else to push one of its IP addresses into administrative blacklists.
https://www.youtube.com/watch?v=LaTGrV58wec
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
on YouTube as well
"C&C"
I always read that as "coffee and cats."
Pawn Storm Group Makes Trend Micro IP Address a Coffee and Cats Server
YMMV.
--
BMO
I thought they were hosting a game server for a minute.
Command and control isn't as exciting.
So the Pawn Store is dealing with old RTS game servers?
What?
See subject: Via hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
* :)
E.G. -> Thru my program & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites) @ the TOP of your custom hosts file works!
It works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS)
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
ONLINE!
---
Yes - this is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically in fact!
(Since they filter out online threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home (I never could use them as my DNS with ActiveDirectory networks 'on the job', though)).
This also LIGHTENS REMOTE DNS SERVER LOADS too (which DNS admins ought to love actually), & also increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
Thus, DNS & hosts COMPLIMENT ONE ANOTHER for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which are verified as correct via REVERSE DNS PINGS in my program noted above...)
APK
P.S.=> It's great stuff using hosts & OpenDNS in combination for BOTH added in memory cached speed + reliability too... apk
See subject: Via hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
* :)
E.G. -> Thru my program & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites) @ the TOP of your custom hosts file works!
It works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS)
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
ONLINE!
---
Yes - this is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically in fact!
(Since they filter out online threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home (I never could use them as my DNS with ActiveDirectory networks 'on the job', though)).
This also LIGHTENS REMOTE DNS SERVER LOADS too (which DNS admins ought to love actually), & also increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
Thus, DNS & hosts COMPLIMENT ONE ANOTHER for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which are verified as correct via REVERSE DNS PINGS in my program noted above...)
APK
P.S.=> It's great stuff using hosts & OpenDNS in combination for BOTH added in memory cached speed + reliability & security too... apk
Here's the narrative:
- Trend Micro documented a 0-day Java exploit, leading to it's patching http://blog.trendmicro.com/tre...
- The hacking org Operation Pawn Storm that was using the exploit got all pissy, and redirected a domain that computers infected with their malware contact, pointed it to an IP address in Trend Micro.
The domain names contacted for command and control instructions are usually randomly encoded and encrypted, and rotate on a regular basis. The crackers know what the next domain name to be used is, but they are hard to deduce from the binary. Infected systems will likely move on to contacting the next domain/ip looking for remote control instructions in hours/days.
I though I should share this blog with you all as this has amazing tips for health and fitness. http://keepfithealth.blogspot....
See subject: Via hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
* :)
E.G. -> Thru my program & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites) @ the TOP of your custom hosts file works!
It works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS)
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
ONLINE!
---
Yes - this is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically in fact!
(Since they filter out online threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home (I never could use them as my DNS with ActiveDirectory networks 'on the job', though)).
This also LIGHTENS REMOTE DNS SERVER LOADS too (which DNS admins ought to love actually), & also increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
Thus, DNS & hosts COMPLIMENT ONE ANOTHER for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which are verified as correct via REVERSE DNS PINGS in my program noted above...)
APK
P.S.=> It's great stuff using hosts & OpenDNS in combination for BOTH added in memory cached speed + reliability & security too... apk
Why wouldn't they also add Kaspersky, McAfee, Norton, AVG, Avira, etc to their next batch.
Fuck, why not add 74.125.21.* and 207.46.163.* to thei C&C list. I wonder if the Google Air Force, or Microsoft have any atomic bombs to drop on Spamhaus?
birds of a feather
If trend micro really has not been hacked, how can they know that their ISP or an upstream provider has not been hacked in such a way that the attacker can use Trend Micro's IP address as a C&C server?
So is this supposed to be a DDOS attack on Trend Micro? Or are they planning on hacking Trend Micro and using their servers as actual C&C?
See subject: Via hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
* :)
E.G. -> Thru my program & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites) @ the TOP of your custom hosts file works!
It works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS)
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
ONLINE!
---
Yes - this is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically in fact!
(Since they filter out online threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home (I never could use them as my DNS with ActiveDirectory networks 'on the job', though)).
This also LIGHTENS REMOTE DNS SERVER LOADS too (which DNS admins ought to love actually), & also increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
APK
P.S.=> Thus, DNS & hosts COMPLIMENT ONE ANOTHER for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which are verified as correct via REVERSE DNS PINGS in my program noted above...)... apk
See subject: By hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
* :)
E.G. -> Thru my program & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites that are VERIFIED AS VALID via REVERSE DNS PINGS) @ the TOP of your custom hosts file!
Doing that works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS) - beyond adblocking hosts do as well.
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
ONLINE!
---
Yes - this is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically in fact!
(Since they filter out online threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home (I never could use them as my DNS with ActiveDirectory networks 'on the job', though)).
This also LIGHTENS REMOTE DNS SERVER LOADS too (which DNS admins ought to love actually), & also increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
APK
P.S.=> Thus, DNS & hosts COMPLIMENT ONE ANOTHER for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which is what MOST folks do (nobody "hits the entire internet everyday" in other words))... apk
See subject: I post it again & you'll run dry of 'em. I win as always (no limits ac poster here)!
* To quote one of my FAV. films lately on that note?
"No scenario? I see every scenario. I see 50 scenarios. THAT'S WHAT IT DOES, KARL - it puts me 50 MOVES AHEAD OF YOU..." - Eddie Morra from LIMITLESS from -> https://www.youtube.com/watch?...
APK
P.S.=> So your single effete useless 'weapon' = moot (just like you, YOU limited weasel, lol)... apk
See subject: I post it again & you'll run dry of 'em. I win as always (no limits ac poster here)!
* To quote one of my FAV. films lately on that note?
"No scenario? I see every scenario. I see 50 scenarios. THAT'S WHAT IT DOES, KARL - it puts me 50 MOVES AHEAD OF YOU..." - Eddie Morra from LIMITLESS from -> https://www.youtube.com/watch?...
APK
P.S.=> So your single effete useless 'weapon' = moot (just like you, YOU limited weasel, lol)... apk
See subject: I post it again, you run dry of 'em - I win (no limits ac poster here)!
* To quote one of my FAV. films lately on that note?
"No scenario? I see every scenario. I see 50 scenarios. THAT'S WHAT IT DOES, KARL - it puts me 50 MOVES AHEAD OF YOU..." - Eddie Morra from LIMITLESS from -> https://www.youtube.com/watch?...
APK
P.S.=> So your single effete useless 'weapon' = moot (just like you, YOU limited weasel, lol) - I'm actually offering a decent solution vs. DNS redirect poisoning, unlike a SCUMBAG like the one downmodding my posts (which is fine - I always outsmart the dolt doing it anyhow as noted above)... apk
See subject: I post it again, you run dry of 'em - I win (no limits ac poster here)!
* To quote one of my FAV. films lately on that note?
"No scenario? I see every scenario. I see 50 scenarios. THAT'S WHAT IT DOES, KARL - it puts me 50 MOVES AHEAD OF YOU..." - Eddie Morra from LIMITLESS from -> https://www.youtube.com/watch?...
APK
P.S.=> So your single effete useless 'weapon' = moot (just like you, YOU limited weasel, lol) - I'm actually offering a decent solution vs. DNS redirect poisoning, unlike a SCUMBAG like the one downmodding my posts (which is fine - I always outsmart the dolt doing it anyhow as noted above)... apk
See subject: By hardcoded fav. sites in hosts via APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
* :)
E.G. -> Thru my program & inputs YOU give it for those favorite sites you use MOST online where you spend most of your time online in hosts (favorite sites that are VERIFIED AS VALID via REVERSE DNS PINGS) @ the TOP of your custom hosts file!
Doing that works for:
---
1.) MORE SPEED (hosts are cached into LOCAL memory + operate in kernelmode, NOT slower usermode OR some remote slower facility like DNS) - beyond adblocking hosts do as well.
2.) MORE SECURITY (vs. redirect poisonings)
3.) MORE RELIABILITY (vs. redirects & downed DNS too)
ONLINE!
---
Yes - this is IN COMBINATION with DNS mind you!
(Albeit DNS is only secondary for rare times you may miss a lookup & the data for said site's NOT one of your favorites).
I'd suggest OpenDNS specifically in fact!
(Since they filter out online threats as I do in my hosts file & they are patched vs. the Kaminsky redirect poisoning flaw here @ home (I never could use them as my DNS with ActiveDirectory networks 'on the job', though)).
This also LIGHTENS REMOTE DNS SERVER LOADS too (which DNS admins ought to love actually), & also increases RELIABILITY online vs. redirect poisoned DNS servers (of which 99.999% of ISP dns servers are NOT PATCHED AGAINST mind you), OR vs. "downed" dns servers too!
APK
P.S.=> Thus, DNS & hosts COMPLIMENT ONE ANOTHER for more speed, security, & reliability online!
(I use DNS for rare sub 4% of the time lookups I have to do, the other 95++% of my time online is spent @ favorite sites in my hosts file, which is what MOST folks do (nobody "hits the entire internet everyday" in other words))... apk
See subject: I post it again, you run dry of 'em - I win (no limits ac poster here)!
* To quote one of my FAV. films lately on that note?
"No scenario? I see every scenario. I see 50 scenarios. THAT'S WHAT IT DOES, KARL - it puts me 50 MOVES AHEAD OF YOU..." - Eddie Morra from LIMITLESS from -> https://www.youtube.com/watch?...
APK
P.S.=> So your single effete useless 'weapon' = moot (just like you, YOU limited weasel, lol):
Unbelievable - I'm actually offering a decent solution vs. DNS redirect poisoning, unlike a SCUMBAG like the one downmodding my posts (which is fine - I always outsmart the dolt doing it anyhow as noted above)... apk
See subject - 1st enter trend's proper hostname to ip address resolution ala
216.104.20.189 trendmicro.com
THEN, block the redirect poisoned DNS entry of:
0.0.0.0 ausameetings.com
* It works to defeat this on BOTH fronts, easily...
(Utterly NULLIFYING this threat, to resolve properly here vs. this threat, per data from the source article -> http://thestack.com/pawn-storm... )
---
How to build the BEST hosts file possible with data from 10 reputable sources in the security community vs. threats of this nature + for more speed, reliability, & anonymity as well as security online?
Hey, you know (by "yours truly", of course):
APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. browser addons & locally installed DNS servers @ home + fixes DNS' redirect security issues - obtaining its data vs. online threats & adbanner blocking from 10 reputable sites in the security community!
* :)
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
---
"The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"...
APK
P.S.=> By "yours truly" - "The Lord of Hosts" so-to-speak:
PERTINENT QUOTE/EXCERPT:
"The image this title brings to mind is of a mighty military commander, one who can at a mere word summon rank upon rank of protective power" from https://answers.yahoo.com/ques... & THAT WORD = hosts!
(Accept NO substitutes!)
...apk
See subject - 1st enter trend's proper hostname to ip address resolution ala
216.104.20.189 trendmicro.com
THEN, block the redirect poisoned DNS entry of:
0.0.0.0 ausameetings.com
* It works to defeat this on BOTH fronts, easily...
(Utterly NULLIFYING this threat, to resolve properly here vs. this threat, per data from the source article -> http://thestack.com/pawn-storm... )
---
How to build the BEST hosts file possible with data from 10 reputable sources in the security community vs. threats of this nature + for more speed, reliability, & anonymity as well as security online?
APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. browser addons & locally installed DNS servers @ home + fixes DNS' redirect security issues - obtaining its data vs. online threats & adbanner blocking from 10 reputable sites in the security community!
* :)
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
---
"The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"...
APK
P.S.=> By "yours truly" - "The Lord of Hosts" so-to-speak:
PERTINENT QUOTE/EXCERPT:
"The image this title brings to mind is of a mighty military commander, one who can at a mere word summon rank upon rank of protective power" from https://answers.yahoo.com/ques... & THAT WORD = hosts!
(Accept NO substitutes!)
...apk