Slashdot Mirror
Uncooperative Russian ISP Prevents Cisco From Shutting Down Cybercriminal Gang
An anonymous reader writes: Cisco's Talos research team has managed to identify and partially shut down a cyber-criminal group that is using the RIG exploit kit to infect users with spambots via a malvertising campaign. Their investigation led them back to Russian ISP Eurobyte, who didn't bother answering critical emails and allowed the campaign to go on even today. In October 2015, Cisco's researchers also thwarted the activity of another group of cyber-criminals that made around $30 million from distributing ransomware.
I'm pretty sure I would never even notice, and the internet would be a safer place.
cisco is not responsible for policing the net, nor is it legally able to interpret law, and has no power whatsoever to enforce it. this seems to be pure vigilantism at best , and no different from actions of a criminal gang at worst.
let legitimate law enforcement do their job following due process. if they are behind the times that a function of freedom and speed of progress.
should any one trust cisco? same that allows and cooperates with the illegal surveillance by nsa etc?
Remember this when I leave your website or refuse to turn off my ad blockers.
You won't find any Russian business that would respond to inquiries this week (with the exception of employees working from home even though they shouldn't). Reason: all Russians have official holidays that started on January 1 and will end on January 11.
I tell everyone I know to use them.
Advertisers either fix your shit or loose out? If you can't regulate yourselves in regards to 3rd party networks and ethical ads then you will be out of business.
Fact of the matter is it is too dangerous to run without one. That should go right up there with browsing the net as administrator or root and using IE 6 these days.
Also for those who say they are safe as long as they don't click or run anything, all I can say is told you so! Open a page with flash and your 0wned. Simple
http://saveie6.com/
Russia needs the money. Even the president can't afford a shirt.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Bet a hundred quatloos that this so-called "ISP" are the malware peddlers themselves. Either that, or they know fully well who their customers are, and they interpret Cisco's communications as nothing more than a request to shut down a well paying customer.
This is not a unique phenomenon. This is a fairly common reaction to abuse and spam complaints. You want us to shut down a paying customer? Why would we want to do that?
The key to effectively deal with network abuse is to make the responsible party understand that it's in their best interest to do that. Otherwise they stand to lose more than they are profiting from network abuse. As long as effective public email blacklist exist, network providers will have to reluctantly terminate their spambags, else their entire network gets blacklisted and they lose more, as their other, non-spamming pissed off customers flee to other providers, in order to be able to send mail.
The same thing here. Presuming that this is a bone-fide provider, and not a sock puppet for the malware peddlers, the appropriate step of action is to escalate to their upstream, and attempt to get their cooperation, and have them agree to terminate the circuit to their rogue downstream provider, unless they get rid of the spamware peddlers. And keep escalating upstream, as far as necessary. Now, we're talking Cisco here, right? Well, it shouldn't take long before Cisco ends up talking to someone that uses their hardware in their core business. At this point, it's now going to be up to Cisco to put up and shut up, and inform their customer that unless this is dealt with, they will respectfully decline to renew their own customer's support contracts.
Could this sequence of events actually come to fruition? Extremely unlikely, but this is the only way to effectively deal with network abuse.
What did Canada do to end up on that list?
The only thing I can see in common in those three is that they consistently whoop the US's ass in ice hockey.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If you cannot contact an ISP, you can contact Roskomnadzor. If you cannot contact Roskomnadzor you always can contact a FSB (KGB) because it's FSB that ultimately manages our information security and is basically somehow immune to bribes. Especially if you are Cisco.
It does not matter what does it host, be it CP, Mein Kampf or just a botnet. It either cooperates with Roskomnadzor, FSB and Department R (Or maybe K, I cannot remember) in catching or at least suppression of criminals, or loses it's license.
who didn't bother answering critical emails
I don't answer critical emails either. However, if you send me nice ones, or polite ones I might even read them.
You'd think that if this was something SERIOUS for Cisco, they'd at least bother to pick up the phone - maybe even go to the effort of finding someone who spoke russian. As it is, this outfit, like everyone else on the planet probably gets spammed senseless. Especially through public email addresses. Who can blame someone for ignoring emails from unsolicited sources?
To sum up, this sounds like the lazy excuse of an indolent individual: Why haven't you done X? asks the boss. "Well I sent them an email, but they never replied" whines the guy who just wants to get back to playing Facebook.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
It's heartwarming to see that Russia and the US share some traits at least.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Cisco would be better suing the ISP for the sites details, and then suing the site owners in the court.
In Russian courts. Good luck with that. The hackers are probably protected and/or financed by the Russian mafia, which means they are effectively protected by the Russian government.
They are better off convincing US or EU organizations the ISP is refusing to shut down known criminals, and getting the ISP blocked from Western countries/ISPs. Like most things of this nature, morality and politics are useless, it's only going to be fixed when it affects their wallet...
Eurobyte operate a fairly big block rented from Webazilla, which is 46.30.40.0/21.. and I recommend that you block traffic to that entire lot. But a lot of Webazilla's other customer are pretty shitty too. I don't think you miss much if you blocked traffic to the entire AS35415.
Never email donotemail@WeAreSpammers.com
and nothing new. You pay a little premium not to be disconnected as soon as somebody sends a legal request. Not reacting to something like that is what their customer pays for.