<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: rogue]]></title>
    <link>http://securityratty.com/tag/rogue</link>
    <description></description>
    <pubDate>Mon, 30 Jun 2008 05:31:08 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[How to Protect Your Network from Rogue IT Employees]]></title>
      <link>http://securityratty.com/article/c2369fe5de92965e208ad191a15c2c2c</link>
      <guid>http://securityratty.com/article/c2369fe5de92965e208ad191a15c2c2c</guid>
      <description><![CDATA[Terry Childs, a network administrator for the City of San Francisco is accused of creating a super-password on the switches and routers in the city's Fibre WAN and using it to block everyone else's...]]></description>
      <content:encoded><![CDATA[Terry Childs, a network administrator for the City of San Francisco is accused of creating a super-password on the switches and routers in the city's Fibre WAN and using it to block everyone else's access to administrative functions. According to reports, Childs had been detected tampering with the network and had reacted with hostility when disciplined after a confrontation with a supervisor.]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/terry childs">terry childs</category>
      <category domain="http://securityratty.com/tag/network administrator">network administrator</category>
      <category domain="http://securityratty.com/tag/childs">childs</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/fibre wan">fibre wan</category>
      <category domain="http://securityratty.com/tag/administrative functions">administrative functions</category>
      <category domain="http://securityratty.com/tag/san francisco">san francisco</category>
      <category domain="http://securityratty.com/tag/super-password">super-password</category>
      <source url="http://www.networkworld.com/news/2008/071808-how-to-protect-your-network.html?fsrc=rss-security">How to Protect Your Network from Rogue IT Employees</source>
    </item>
    <item>
      <title><![CDATA[Obfuscating Fast-fluxed SQL Injected Domains]]></title>
      <link>http://securityratty.com/article/274149f12bf7d146a0527dd85513a6a5</link>
      <guid>http://securityratty.com/article/274149f12bf7d146a0527dd85513a6a5</guid>
      <description><![CDATA[It's all a matter of how you put it, and putting it like represents a good example of tactical warfare, namely, combining different tactics for the sake of making it harder to keep track of the impact...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_wICHhTiQmrA/SH-jQi_d3HI/AAAAAAAAB60/xkYP_cMkqC0/s1600-h/obfuscated_SQL_injection_fast_flux.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SH-jQi_d3HI/AAAAAAAAB60/heB4xfAF32k/s320-R/obfuscated_SQL_injection_fast_flux.JPG" style="border: 0pt none ;" /></a>It's all a matter of how you put it, and putting it like represents a good example of tactical warfare, namely, combining different tactics for the sake of making it harder to keep track of the impact of a particular SQL injection campaign. Consider the following examples of obfuscated domains, naturally being in a fast-flux in the time of the SQL injection that several Chinese script kiddies were taking advantage of :<br />
<br />
%6b%6b%36%2e%75%73 - <b>kk6.us</b><br />
%73%61%79%38%2E%75%73 - <b>s.see9.us </b><br />
%66%75%63%6B%75%75%2E%75%73 - <b>fuckuu.us </b><br />
%61%2E%6B%61%34%37%2E%75%73 - <b>a.ka47.us</b><br />
%61%31%38%38%2E%77%73 - <b>a188.ws</b><br />
%33%2E%74%72%6F%6A%61%6E%38%2E%63%6F%6D - <b>3.trojan8.com</b><br />
%6D%31%31%2E%33%33%32%32%2E%6F%72%67 - <b>m11.3322.org</b><br />
<br />
As always, these obfuscations are just the tip of the iceberg considering the countless number of other URL obfuscations techniques that spammers and phishers used to take advantage of on a large scale. For the time being, one of the main reasons we're not seeing massive SQL injections using such obfuscations is mostly because the feature hasn't been implemented in popular SQL injectors for copycat script kiddies to take advantage of. However, with the potential for evasion of common detection approaches, it's only a matter of personal will for someone to add this extra layer to ensure the survivability of the campaign.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="text-align: center; clear: both;"></div><a href="http://bp1.blogger.com/_wICHhTiQmrA/SH-rWx8Z7QI/AAAAAAAAB68/ELjRSL8Bobw/s1600-h/real_player_exploit.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SH-rWx8Z7QI/AAAAAAAAB68/kWffly78SVM/s200-R/real_player_exploit.JPG" style="border: 0pt none ;" /></a>The folks behind these obfuscations are naturally <a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">multitasking on several different underground fronts</a>. Take for instance <b>3.trojan8.com </b>(58.18.33.248) also responding to <b>w2.xnibi.com </b>which is also injected at several domains, <b>w2.xnibi.com/index.gif</b> to be precise.<b> </b>The fake .gif file in the spirit of <a href="http://ddanchev.blogspot.com/2008/04/fake-directory-listings-acquiring.html">fake directory listings for acquiring traffic in order to serve malware</a>, is actually attempting to exploit a RealPlayer vulnerability - JS/RealPlr.LB!exploit. The deeper you go, the uglier it gets.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-massive-sql-injection.html">Yet Another Massive SQL Injection Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/malware-domains-used-in-sql-injection.html">Malware Domains Used in the SQL Injection Attacks</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/sql-injection-through-search-engines.html">SQL Injection Through Search Engines Reconnaissance</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/google-hacking-for-vulnerabilities.html">Google Hacking for Vulnerabilities</a><br />
<a href="http://blogs.zdnet.com/security/?p=1122">Fast-Fluxing SQL injection attacks executed from the Asprox botnet</a><br />
<a href="http://blogs.zdnet.com/security/?p=1394">Sony PlayStation's site SQL injected, redirecting to rogue security software</a><br />
<a href="http://blogs.zdnet.com/security/?p=1118">Redmond Magazine Successfully SQL Injected by Chinese Hacktivists</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qerf8J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qerf8J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=M97n6J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=M97n6J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=bexghj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=bexghj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=7Q82Qj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=7Q82Qj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zZiRyJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zZiRyJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=X0fmeJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=X0fmeJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ntQNRj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ntQNRj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/338377430" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 17 Jul 2008 11:31:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sql">sql</category>
      <category domain="http://securityratty.com/tag/massive sql injections">massive sql injections</category>
      <category domain="http://securityratty.com/tag/sql injection campaign">sql injection campaign</category>
      <category domain="http://securityratty.com/tag/sql injection attacks">sql injection attacks</category>
      <category domain="http://securityratty.com/tag/popular sql injectors">popular sql injectors</category>
      <category domain="http://securityratty.com/tag/massive sql injection">massive sql injection</category>
      <category domain="http://securityratty.com/tag/site sql">site sql</category>
      <category domain="http://securityratty.com/tag/sql injection">sql injection</category>
      <category domain="http://securityratty.com/tag/campaign">campaign</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/338377430/obfuscating-fast-fluxed-sql-injected.html">Obfuscating Fast-fluxed SQL Injected Domains</source>
    </item>
    <item>
      <title><![CDATA[Monetizing Compromised Web Sites]]></title>
      <link>http://securityratty.com/article/9f7b106457f7cdcbfb11dd8b0b3dd971</link>
      <guid>http://securityratty.com/article/9f7b106457f7cdcbfb11dd8b0b3dd971</guid>
      <description><![CDATA[Despite that pure patriotic hacktivism is still alive and kicking, compromised sites are largely getting monetized these days, starting from hosting blackhat SEO junk pages, to redirecting to live...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHsAOtYiisI/AAAAAAAAB58/CA2dvGI0DL0/s1600-h/Municipal_de_Amparo.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHsAOtYiisI/AAAAAAAAB58/k2bP_iz48tA/s200-R/Municipal_de_Amparo.png" style="border: 0pt none ;" /></a>Despite that pure patriotic hacktivism is still alive and kicking, <a href="http://ddanchev.blogspot.com/2008/06/monetizing-web-site-defacements.html">compromised sites are largely getting monetized</a> these days, starting from hosting blackhat SEO junk pages, to redirecting to live exploit URLs and fake codecs where revenue is earned through their participation in an affiliate business model.<br />
<br />
With The Africa Middle Market Fund's site monetized by web site defacers who defaced it "in between" the blackhat SEO infrastructure they were hosting internally, in this I'll comment on the currently compromised and redirection to a fake porn sites, Camara Municipal de Amparo (<b>camaraamparo.sp.gov.br/r.html</b>). Basically, it's homepage is heavily linking to the Zlob variant (<b>camaraamparo.sp.gov.br/ video.exe</b>) in between loading an IFRAME to <b>61.162.230.12/ index.php</b>. As always, upon uploading their redirector, they've build enough confidence into their new hosting provider that the link to the redirector was instantly spammed across the web. The site is so heavily linking to the internal redirector itself, that upon clicking on the majority of links the user will inevitably come across it.<br />
<br />
Speaking of fake porn sites redirecting to Zlob variants, here are the very latest additions spammed across the web through blackhat SEO practices :<br />
<br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp0.blogger.com/_wICHhTiQmrA/SHsLbgFp7NI/AAAAAAAAB6E/ZDNLECdRM1U/s1600-h/fake_porn_sites_zlob.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SHsLbgFp7NI/AAAAAAAAB6E/TIqQ0wE9bQM/s200-R/fake_porn_sites_zlob.JPG" style="border: 0pt none ;" /></a><b>just-tube .com<br />
mypornmovies .net<br />
moms-galls .net<br />
porntubefilms .com<br />
porntubedot .com<br />
hot-porntube .com<br />
landmovieblog .com<br />
sexvidtube .com<br />
freelifevideo .com<br />
getyourfreemovie .com<br />
iubat .com<br />
sweetyjoly .com<br />
hardbizarre .com<br />
freeworldvideo .net<br />
hot-porntube .net<br />
qualitymovies .net<br />
porntube1con .net<br />
video-info .net<br />
videocityblog .com<br />
fuckedolder&nbsp; .com<br />
highpro1 .com<br />
max-graf.com .pl<br />
grandsupertds .info<br />
hot-porn-tube .net<br />
hot-porntube .com<br />
terryschulz .com<br />
show-sextube .com<br />
qualitymovies .net<br />
clubvideos .net</b><br />
<br />
No matter the high profile site that's been exploited in order to participate in such malicious operations, for the time being, crunching out new domain names and using the hosting services of the well known ISPs neglecting their removal, seems to be the tactic of choice. The long tail of SQL injected sites is however, clearly replacing the plain simple blackhat SEO web spamming, so that traffic to these rogue sites is driven through redirection of the the traffic from legitimate sites.<b><br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=cEyKTJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=cEyKTJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qsdYjJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qsdYjJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BVongj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BVongj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4DJmRj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4DJmRj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=al8bCJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=al8bCJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=nrE7PJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=nrE7PJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TCjewj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TCjewj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/334911319" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 13 Jul 2008 23:26:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/rogue sites">rogue sites</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/web site defacers">web site defacers</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/profile site">profile site</category>
      <category domain="http://securityratty.com/tag/redirector">redirector</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/334911319/monetizing-compromised-web-sites.html">Monetizing Compromised Web Sites</source>
    </item>
    <item>
      <title><![CDATA[Violating OPSEC for Increasing the Probability of Malware Infection]]></title>
      <link>http://securityratty.com/article/a8772335cd8deda2e5469b0533d7c817</link>
      <guid>http://securityratty.com/article/a8772335cd8deda2e5469b0533d7c817</guid>
      <description><![CDATA[Are malware authors and the rest of the participants in fact willing to violate their OPSEC (operational security) for the sake of increasing the probability of successful malware infection by on...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp0.blogger.com/_wICHhTiQmrA/SHf46B4X8KI/AAAAAAAAB5s/bNsyTU1Vchg/s1600-h/smitfraud_PC_hijacker.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SHf46B4X8KI/AAAAAAAAB5s/ansREl9cVe0/s200-R/smitfraud_PC_hijacker.jpg" style="border: 0pt none ;" /></a>Are malware authors and the rest of the participants in fact willing to violate their OPSEC (operational security) for the sake of increasing the probability of successful malware infection by on purposely lowering down the security settings of Internet Explorer, by adding their malicious netblocks and domains into "Trusted Sites"? You bet.<br />
<br />
<div style="text-align: left;">The infamous Smitfraud or PSGuard Desktop Hijacker, has been cooperating with known malicious parties for over an year now, a cooperation which exposes interesting relatinships between the usual suspects. Starting from the basic fact that a malware infected host is infected with many other totally unrelated to one another pieces of malware, Smitfraud's "pre-infection foreplay" demonstrates that they are willing to sacrifice operational security in order to increaes the probabilty of future infections on the same host.</div>
<div class="separator" style="text-align: center; clear: both;"></div>
<br />
Rogue software added as trusted sites upon Smitfraud infection :<br />
<b>about-adult .net<br />
antivirus-scanner .com<br />
best-porncollection .com<br />
getadultaccess .com<br />
getavideonow .com<br />
ieantivirus .com<br />
malwarebell .com<br />
mega-soft-2008 .com<br />
mooncodec .com<br />
movsonline .com<br />
ruler-cash .com<br />
s-freeware .com<br />
sexysoftwaredom .com<br />
supersoft21freeware .com<br />
the-programsportal .com<br />
vwwredtube .com<br />
wetsoftwares .com<br />
youpornztube .com<br />
securewebinfo .com<br />
safetyincludes .com<br />
securemanaging .com<br />
myflydirect .com<br />
onlinevideosoftex .com<br />
scanner.malwscan .com<br />
scanner.shredderscan .com<br />
sex18tube2008 .com<br />
spywareisolator .com<br />
virus-scanner-online .com<br />
security-scanner-online .com<br />
virus-scanonline .com<br />
antivirus-scanonline .com<br />
topantivirus-scan .com<br />
topvirusscan .com<br />
virus-detection-scanner .com<br />
antivirus-scanner .com<br />
infectionscanner .com<br />
internet-security-antivirus .com&nbsp;&nbsp;&nbsp; <br />
hotvid44 .com<br />
opaadownload .com<br />
somenudefuck .com</b><br />
<br />
Rogue netblocks and IPs added as trusted IP ranges upon Smitfraud infection :<br />
<b>"69.50.*.*"<br />
"69.31.*.*"<br />
"66.235.*.*"<br />
"66.230.*.*"<br />
"216.239.*.*"<br />
"205.188.*.*"<br />
"205.177.*.*"<br />
"195.225.*.*"<br />
"216.195.*.*"<br />
"82.179.*.*"<br />
"81.95.*.*"<br />
"70.84.*.*"<br />
"195.95.*.*"<br />
"194.187.*.*"<br />
"78.129.158.*"<br />
"78.129.166.*"<br />
"89.149.226.*"<br />
"195.93.218.*"<br />
"72.21.53.*<br />
"81.9.3.*"<br />
"213.189.27.*"<br />
"88.255.74.*"<br />
"79.143.178.*"<br />
"202.71.102.*"<br />
"64.202.189.170"<br />
"217.170.77.150"</b><br />
<br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
The second hardcoded trusted IP is also responding to :<br />
<a href="http://bp0.blogger.com/_wICHhTiQmrA/SHf8FAKzs7I/AAAAAAAAB50/ZR2egkY7iLY/s1600-h/ie7_trusted_sites.png" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SHf8FAKzs7I/AAAAAAAAB50/6CEouhwdlio/s200-R/ie7_trusted_sites.png" style="border: 0pt none ;" /></a><b>virusisolator .com<br />
virus-isolator .org<br />
virus-isolator .net<br />
soft-collections .com<br />
viruswebprotect .com<br />
virus-isolator .us<br />
codecvideo2008-18 .com<br />
sextubecodec55 .com<br />
sextubecodec67 .com<br />
soft-archives .com<br />
soft-collections .com<br />
codecreviews .com<br />
codecvideo2008-18 .com</b><br />
<br />
Such practices leave a great deal of malicious creativity, for instance, once rented a botnet's already infected malware PCs could start trusting the majority of sites in their scammy ecosystem. What's great is that by doing this they expose their affiliations with these affiliate based rogue security software programs, next to their infrastructure on which they may be that easily claiming ownership.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sBfhZJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sBfhZJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sLbEyJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sLbEyJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4lt2Sj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4lt2Sj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ds4Mej"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ds4Mej" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=pPLe4J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=pPLe4J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=hYS1aJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=hYS1aJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MqymEj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MqymEj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/333145852" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 15:39:32 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware authors">malware authors</category>
      <category domain="http://securityratty.com/tag/smitfraud">smitfraud</category>
      <category domain="http://securityratty.com/tag/smitfraud infection">smitfraud infection</category>
      <category domain="http://securityratty.com/tag/successful malware infection">successful malware infection</category>
      <category domain="http://securityratty.com/tag/sacrifice operational security">sacrifice operational security</category>
      <category domain="http://securityratty.com/tag/operational security">operational security</category>
      <category domain="http://securityratty.com/tag/malware pcs">malware pcs</category>
      <category domain="http://securityratty.com/tag/infamous smitfraud">infamous smitfraud</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/333145852/violating-opsec-for-increasing.html">Violating OPSEC for Increasing the Probability of Malware Infection</source>
    </item>
    <item>
      <title><![CDATA[The Template-ization of Malware Serving Sites]]></title>
      <link>http://securityratty.com/article/ae9fa7925137e6a71a690ef3b705294d</link>
      <guid>http://securityratty.com/article/ae9fa7925137e6a71a690ef3b705294d</guid>
      <description><![CDATA[Just like web malware exploitation kits and phishing pages turned into a commodity underground good , allowing easy localization to different languages , and of course, the natural lowering of entry...]]></description>
      <content:encoded><![CDATA[<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHZZ6zTOnOI/AAAAAAAAB5c/3Sqe37mACns/s1600-h/fake_video_codec_template.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHZZ6zTOnOI/AAAAAAAAB5c/Rsu1-EiUFlY/s200-R/fake_video_codec_template.JPG" style="border: 0pt none ;" /></a>Just like web <a href="http://ddanchev.blogspot.com/2007/10/mpack-and-icepack-localized-to-chinese.html">malware</a> <a href="http://ddanchev.blogspot.com/2008/05/icepack-exploitation-kit-localized-to.html">exploitation</a> <a href="http://ddanchev.blogspot.com/2008/05/firepack-exploitation-kit-localized-to.html">kits</a> and <a href="http://ddanchev.blogspot.com/2008/03/phishing-pages-for-every-bank-are.html">phishing pages turned into a commodity underground good</a>, allowing easy <a href="http://ddanchev.blogspot.com/2008/02/localizing-cybercrime-cultural.html">localization to different languages</a>, and of course, the natural lowering of entry barriers into web malware and phishing in general, the very same thing is happening with fake ActiveX templates like the ones used on <a href="http://ddanchev.blogspot.com/2008/07/fake-porn-sites-serving-malware-part.html">the majority of fake porn and celebrity sites I've been assessing recently</a>.<br />
<br />
The increase of these bogus ActiveX templates is due to the fact that despite they are currently available for sale, buyers appear to be leaking them for everyone to use so that they can continue maintaining their current business models, namely, the services they offer with the ActiveX templates. Unethical competitive practices among cybercriminals and scammers are only to starting to take place with one another trying to ruin or extend the lifecycle of their services.<br />
<br />
Talking about prevalence, the <b>TonsOfPorn ActiveX</b> remains the most widely used rogue ActiveX in the majority of fake codec campaigns for the last couple of months. The ActiveX is largely abused by using another <b>fake porn site template for PornTube</b>, which in combination result in nothing more than huge domain portfolios with no content at all if we exclude the Zlob variants.<br />
<br />
And while template-tization means more efficient malware campaigns, it also results in a common pattern for generic detection of such sites. For instance, the folks at <a href="http://www.finjan.com/MCRCblog.aspx?EntryId=1993">Finjan did an experiment by verifying the signature based detection of the common javascript file</a> that was used in the ongoing waves of SQL injection attacks. Their conclusion :<br />
<br />
"<i>Can it be that Anti-virus products are now holding more signatures for domains and URLs rather than trying to identify a malicious code they never inspected before? As my research found, just by changing the domain names, some AVs did not find this code as malicious...... surprisingly enough.</i>"<br />
<br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp0.blogger.com/_wICHhTiQmrA/SHaFBlIm7bI/AAAAAAAAB5k/lXlcCbD2H78/s1600-h/inthecloud3.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp0.blogger.com/_wICHhTiQmrA/SHaFBlIm7bI/AAAAAAAAB5k/wABNqH2-Sz0/s200-R/inthecloud3.jpg" style="border: 0pt none ;" /></a>When assessing malware campaigns in general, I usually do the same for the record. Storm Worm's use of <b>ind.php</b> for executing its set of exploits has the same detection rate - <b>scanners result: 10/33 (30.30%)</b> and is detected as JS.Zhelatin.zb.<br />
<br />
Getting back to the <b>TonsOfPorn ActiveX</b>, it's structure is more static than a Red Army statue in Estonia, making it easy to proactively protect against, no matter the domain, no matter the exploits served. It's detection rate is close to the javascript from the SQL injection attacks - <b>Scanners Result: 9/33 (27.28%) </b>and is detected as <b>Trojan.HTML.Zlob.L</b>.<br />
<br />
From my personal experience, blocking an IP address where a couple of hundred malicious domains remain parked, is just as useful as blocking a single domain acting as the main redirector behind a huge domains portfolio of malicious domains. However, the most beneficial approach on a large scale remains the practice of taking care of the most obvious patterns that still remain faily easy to detect, at least for the time being, due to the efficiency the people behind them aim to achieve, making them easily susceptible to generic detection approaches.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=60LvHJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=60LvHJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TvxsiJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TvxsiJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=UeK86j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=UeK86j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AHP63j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AHP63j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ci9jvJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ci9jvJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=mQuV1J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=mQuV1J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=FGm2Yj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=FGm2Yj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/332106839" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 12:59:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malicious domains remain">malicious domains remain</category>
      <category domain="http://securityratty.com/tag/malicious domains">malicious domains</category>
      <category domain="http://securityratty.com/tag/tonsofporn activex remains">tonsofporn activex remains</category>
      <category domain="http://securityratty.com/tag/tonsofporn activex">tonsofporn activex</category>
      <category domain="http://securityratty.com/tag/domains">domains</category>
      <category domain="http://securityratty.com/tag/generic detection approaches">generic detection approaches</category>
      <category domain="http://securityratty.com/tag/generic detection">generic detection</category>
      <category domain="http://securityratty.com/tag/activex">activex</category>
      <category domain="http://securityratty.com/tag/fake activex">fake activex</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/332106839/template-ization-of-malware-serving.html">The Template-ization of Malware Serving Sites</source>
    </item>
    <item>
      <title><![CDATA[Fake Porn Sites Serving Malware - Part Two]]></title>
      <link>http://securityratty.com/article/86e13cf5a3ac03ff0da9f40355440a24</link>
      <guid>http://securityratty.com/article/86e13cf5a3ac03ff0da9f40355440a24</guid>
      <description><![CDATA[What we've go here is the same malware gang using the very same malicious ISP among the ones you rarely see in any report , continuing to crunch out domain redirectors using the same templates for...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp3.blogger.com/_wICHhTiQmrA/SHHrzCPIfDI/AAAAAAAAB4E/7qxOVh8ZjQQ/s1600-h/fake_porn_malware_domains_farm.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SHHrzCPIfDI/AAAAAAAAB4E/JTiTcBU_mq4/s200-R/fake_porn_malware_domains_farm.JPG" style="border: 0pt none ;" /></a>What we've go here is the same malware gang using the very same <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">malicious ISP among the ones you rarely see in any report</a>, continuing to crunch out domain redirectors using the same templates for fake porn sites. And since some of the fake sites are actual redirectors, periodically revisting them leads to more fake codecs and even more actionable intelligence into the nature of their practices, and which are the ISPs proving them with hosting services for several consecutive years.<br />
<br />
The main redirector in this campaign <b>popular-adult.com</b> is also responding to :<br />
<br />
<div style="text-align: left;"><b>basic-adult .com<br />
business-adult .com<br />
center-adult .com<br />
comp-adult .com<br />
compadult .com<br />
controladult .com<br />
cruiseporn .com<br />
drive-adult .com<br />
ebony-adult-video .com</b></div>
<div style="text-align: left;"><b>ebony-pornmovie .com</b></div>
<a href="http://bp3.blogger.com/_wICHhTiQmrA/SHICb9Bw1GI/AAAAAAAAB4U/vHROBrIH6vM/s1600-h/popular_adult_CERNEL_ATRIVO.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SHICb9Bw1GI/AAAAAAAAB4U/jIZzb-nymvc/s200-R/popular_adult_CERNEL_ATRIVO.JPG" style="border: 0pt none ;" /></a><b>ebony-video-xxx .com<br />
engine-adult .com<br />
fat-</b>a<b>dult-video .com<br />
fat-pornmovie .com<br />
fat-video-xxx .com<br />
global-adult .com<br />
inc-adult .com<br />
name-adult .com<br />
nameadult .com<br />
other-adult .com<br />
partadult .com<br />
pleasureadult .com<br />
porn-abc .com<br />
porn-contact .com<br />
porn-global .net<br />
porn-go .net<br />
porn-group .net<br />
porn-party .net<br />
porn-play .net<br />
porn-plus .net<br />
porn-power .net<br />
porn-room .net<br />
pornabout .com<br />
porndrive .net<br />
pornhelp .net<br />
pornname .net<br />
pornstar-adult-video .com<br />
pornstar-pornmovie .com<br />
pornstar-video-xxx .com<br />
room-adult .com<br />
scan-adult .com<br />
seek-adult .com<br />
u-adult .com</b><br />
<br />
The secondary redirectors going out of popular-adult.com :<br />
<br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHIFY0buIsI/AAAAAAAAB4k/NE0nt-J_MWg/s1600-h/fake_porn_redirectors.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHIFY0buIsI/AAAAAAAAB4k/55mFJcgdujQ/s200-R/fake_porn_redirectors.JPG" style="border: 0pt none ;" /></a><b>pornname .net/ted/382634557/1/<br />
porn-abc .com/ike/1666520193/1/<br />
pornhelp .net/dense/876421348/1/<br />
porn-play .net/cristina/1970565499/1/<br />
porn-global .net/percival/330780624/1/<br />
porn-contact .com/cisse/854714304/1/<br />
porn-play .net/honora/888715608/1/<br />
pornname .net/deidre/1964468519/1/<br />
pornhelp .net/pip/1977382266/1/<br />
porndrive .net/shelton/767217618/1/<br />
pornhelp .net/mat/354381578/1/<br />
pornabout .com/tobe/1436617289/1/<br />
porn-go .net/samson/7633197/1/<br />
porn-contact .com/teresa/409084583/1/<br />
porn-party .net/basil/1305549820/1/<br />
porn-contact .com/ed/1067772053/1/<br />
porn-contact .com/frish/1287341391/1/<br />
pornname .net/mariah/53967973/1/<br />
pornname .net/jacobus/291129748/1/<br />
porn-plus .net/beverly/2122167311/1/<br />
porn-party .net/lulu/917088357/1/<br />
pornabout .com/boetius/1991451664/1/<br />
cruiseporn .com/padde/1296397392/1/<br />
porn-power .net/arch/334137732/1/<br />
cruiseporn .com/meta/377489795/1/<br />
porn-room .net/lynette/1518855371/1/<br />
porn-play .net/link/1975737157/1/<br />
hporn-global .net/vin/1241430020/1/<br />
porndrive .net/dunk/1245242641/1/<br />
porn-go .net/louisa/1685718172/1/<br />
pornhelp .net/dunk/1859215260/1/<br />
porn-contact .com/celia/1805798677/1/<br />
porn-play .net/anabelle/987641695/1/<br />
porn-room .net/rille/815076192/1/<br />
pornabout.com/hodge/1040019816/1/<br />
porn-abc .com/claes/1130748100/1/<br />
pornabout .com/frederick/1987458246/1/<br />
porn-go .net/fredde/1153431432/1/<br />
porn-party .net/felicity/705720374/1/<br />
porndrive .net/ginne/1183690031/1/<br />
porn-group .net/kimberle/706468800/1/<br />
porn-room .net/helen/565953612/1/<br />
porn-party .net/arche/1387111363/1/<br />
porn-contact .com/kingston/232354071/1/<br />
pornhelp .net/mima/1024064014/1/<br />
porn-power .net/gretchen/152347961/1/<br />
porn-contact .com/ophelia/840853119/1/<br />
porn-play .net/eleanor/88926029/1/<br />
porn-power .net/bella/1712681771/1/<br />
porn-global .net/melchizedek/1823498218/1/<br />
pornabout .com/gabbe/1478560492/1/<br />
porn-party .net/obedience/1540587230/1/<br />
porndrive .net/rod/1177331120/1/<br />
porn-play .net/gee/1314369182/1/<br />
pornname .net/phineas/975226015/1/<br />
porn-global .net/reynold/131075998/1/<br />
porndrive .net/bat/1542809624/1/<br />
porn-global .net/hans/400396810/1/<br />
porn-contact .com/mock/1738069316/1/<br />
porn-plus .net/tryphosia/354085313/1/<br />
porn-room .net/bazaleel/1417267786/1/<br />
porn-contact .com/joyce/353938308/1/<br />
porn-power .net/laine/780004499/1/<br />
pornhelp .net/mille/988856007/1/<br />
cruiseporn .com/dare/258399427/1/<br />
porn-global .net/nat/2039108680/1/<br />
pornname .net/eudora/2132399934/1/<br />
porn-go .net/ana/277211595/1/<br />
pornhelp .net/auge/1990287956/1/<br />
porn-contact .com/danial/1195423348/1/<br />
porn-abc .com/teresa/1787982397/1/<br />
porn-go .net/lawrence/1575543567/1/<br />
porn-go .net/sherre/1066718744/1/<br />
porn-contact .com/jack/657185819/1/<br />
porn-abc .com/manda/216390544/1/<br />
porn-party .net/chuck/1533427157/1/<br />
porndrive .net/lucille/215841052/1/<br />
cruiseporn .com/rodney/1024994863/1/<br />
pornname .net/sheldon/669324635/1/<br />
porn-global .net/janet/1677642355/1/<br />
porn-global .net/basil/635902337/1/<br />
porn-party .net/adela/980553444/1/<br />
cruiseporn .com/charles/2038221862/1/<br />
pornabout .com/sid/644600064/1/<br />
porn-abc .com/eloise/1882289515/1/<br />
porndrive .net/bryant/724023427/1/<br />
porn-party .net/bonne/305120344/1/<br />
porn-play .net/susan/826151266/1/<br />
porn-room .net/sheila/439221958/1/<br />
porn-go .net/valere/1498454342/1/<br />
porn-contact .com/asenath/1036530205/1/<br />
porn-plus .net/marcus/51947065/1/<br />
porn-party .net/bridgit/518065759/1/<br />
porn-plus.net/shawn/1427002427/1/<br />
cruiseporn.com/alicia/1252994155/1/<br />
porn-abc.com/arminda/975985679/1/<br />
porn-party.net/lionel/929052416/1/<br />
porn-contact .com/ande/1755833202/1/<br />
porn-power .net/cyrus/732691977/1/<br />
aboutadultsex .com/heloise/1008109638/1/<br />
adultzoneworld .com/barne/506956701/1/<br />
superporncity .com/roberta/1239682918/1/<br />
pornhelp .net/eurydice/1944564451/1/<br />
theadultpost .com/volodia/543769984/1/<br />
porn-play .net/bird/760635633/1/<br />
coolbestporn .com/bradford/578099145/1/<br />
porn-plus .net/delilah/465854735/1/<br />
porn-power .net/pheney/698426424/1/<br />
porn-party .net/cristina/940229631/1/<br />
porn-party .net/justin/1913395886/1/<br />
porn-contact .com/lotte/1794233444/1/<br />
porn-party .net/nowell/850070721/1/<br />
worldbestadult .com/parthenia/1858633626/1/<br />
funpornsite .com/patience/188018581/1/<br />
adultsexpro .com/isse/1981168802/1/<br />
adultsexpro .com/isabelle/683364151/1/<br />
porndrive .net/erne/906935790/1/<br />
porn-power .net/delpha/178727494/1/<br />
porn-plus .net/chesley/1261676752/1/<br />
porn-plus .net/selina/11889629/1/<br />
porntimeguide .com/arnold/1555784224/1/<br />
aboutadultsex .com/doug/1975246767/1/<br />
porn-global .net/clum/1615653087/1/<br />
funxxxporn .com/kym/739810260/1/<br />
porn-plus .net/roxane/2022633909/1/<br />
worldbestadult .com/vicke/955775101/1/<br />
porn-play .net/jane/1396714471/1/<br />
pornname .net/nicole/1695768032/1/<br />
adultvideodot .com/bela/96070992/1/<br />
porn-room .net/carre/1310194786/1/<br />
adultsexpro .com/azubah/141802741/1/<br />
theadulteye .com/pheney/1077328499/1/<br />
porn-party .net/chick/1522449297/1/<br />
aboutadultsex .com/elbert/1300176621/1/<br />
findadultsex .com/lorre/2057361400/1/<br />
teenporntop .com/aristotle/901956477/1/<br />
coolbestporn .com/bartel/94175118/1/<br />
porn-plus .net/deanne/70540201/1/<br />
coolbestporn .com/appe/1679745028/1/<br />
findadultsex .com/asaph/1439353641/1/<br />
pornxxxfilm .com/tone/904077420/1/<br />
funxxxporn .com/india/476477713/1/<br />
adultvideodot .com/ed/879863981/1/<br />
bestpriceporn .com/babbe/1457040435/1/<br />
superliveporn .com/russell/56570486/1/</b><br />
<br />
More fake porn video sites using similar site templates, and using the same redirection infrastructure :<br />
<br />
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHIFIM-11XI/AAAAAAAAB4c/TWE3MI4BkNk/s1600-h/best-codec_crawled.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHIFIM-11XI/AAAAAAAAB4c/tmD1w9q0Ct0/s200-R/best-codec_crawled.JPG" style="border: 0pt none ;" /></a><b>porntubev20 .com<br />
clearpornurlssite .com<br />
mypornmovies .net<br />
getyourfreemovie .com<br />
tubescollection .com<br />
free-best-porn .com/videos/<br />
pornmovieshare .com<br />
clipslab .com<br />
mybestvideosite .com<br />
avwav .com</b><b> </b><br />
<br />
The fake codecs download locations in this campaign :<b>&nbsp;</b><br />
<br />
<b>aviutility .com<br />
18x-adult2008 .com<br />
2008x-adult-2008 .com<br />
best-codec .com<br />
hq-codec .net<br />
mpegsystem .com<br />
bestsoft-ware08 .com</b><br />
<br />
<b>The registrant and hosting provider :</b><br />
<br />
Cernel Inc, Legal Department&nbsp; (support@cernel.net)<br />
23404 W. Lyons Ave #223, Santa Clarita, Ca,91321<br />
US, Tel. +1.6613470577<br />
<br />
Historically, the same gang has been using the same hosting provider for many other fake codecs, which remain parked on the same netblock in a standby mode :<br />
<br />
<b>Fire-ticket .com</b> - 64.28.184.162<br />
<b>Fire-codec .com</b> - 64.28.184.163<br />
<b>Light-ticket .com</b> - 64.28.184.163<br />
<b>Braketicket .com</b> -&nbsp; 64.28.184.164<br />
<b>Mooncodec .net </b>- 64.28.184.164<br />
<b>Light-codec .com</b> - 64.28.184.165<br />
<b>Turbo-ticket .com</b> - 64.28.184.165<br />
<b>Space-codec .com</b> - 64.28.184.166<br />
<b>Ultra-ticket .com</b> - 64.28.184.166<br />
<b>Brakecodec .com</b> - 64.28.184.167<br />
<b>Demo-ticket .com</b> - 64.28.184.167<br />
<b>Demoticket .net</b> - 64.28.184.168<br />
<b>Hq-ticket .com</b> - 64.28.184.168<br />
<b>Turbo-codec .com</b> - 64.28.184.168<br />
<b>Hqticket .com</b> - 64.28.184.169<br />
<b>End-ticket .com</b> - 64.28.184.169<br />
<b>Nitro-codec .com</b> - 64.28.184.169<br />
<b>Hqticket .net</b> - 64.28.184.170<br />
<b>Clean-ticket .com</b> - 64.28.184.170<br />
<b>Red-codec .com</b> - 64.28.184.170<br />
<b>Black-codec .com</b> - 64.28.184.171<br />
<b>Viva-ticket .com</b> - 64.28.184.171<br />
<b>Niceticket .net</b> - 64.28.184.171<br />
<b>Endticket .com</b> - 64.28.184.172<br />
<b>Ultra-codec .com</b> - 64.28.184.172<br />
<b>Wot-ticket .com</b> - 64.28.184.172<br />
<b>Mega-codec .net</b> - 64.28.184.173<br />
<b>Storm-ticket .com</b> - 64.28.184.173<br />
<b>Megaz-ticket .com</b> - 64.28.184.174<br />
<b>Vipcodec .net</b> - 64.28.184.174<br />
<b>Democodec .net</b> - 64.28.184.175<br />
<b>Giga-ticket .com</b> - 64.28.184.175<br />
<b>Demo-codec .net</b> - 64.28.184.176<br />
<b>Uin-ticket .com</b> - 64.28.184.176<br />
<b>Hopeticket .com</b> - 64.28.184.177<br />
<b>Hq-codec .net</b> - 64.28.184.177<br />
<b>Best-codec .com</b> - 64.28.184.178<br />
<b>Hope-ticket .com</b> - 64.28.184.178<br />
<b>Endcodec .net</b> - 64.28.184.179<br />
<b>Zero-ticket .com</b> - 64.28.184.179<br />
<b>End-codec .net</b> - 64.28.184.180<br />
<b>Pop-ticket .com</b> - 64.28.184.180<br />
<b>Cleancodec .net</b> - 64.28.184.181<br />
<b>Yupticket .com</b> - 64.28.184.181<br />
<br />
The deeper you go the more interesting it gets, malware command and controls located on the same network, fake banks, money mule recruitment sites, pharmaceutical scams and spam hosting - they or their customers if they are to forward the responsibility are definitely multitasking.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">Malicious Doorways Redirecting to Malware</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/portfolio-of-fake-video-codecs.html">A Portfolio of Fake Video Codecs</a> <br />
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TrZhTJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TrZhTJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=WEgFzJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=WEgFzJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=feuAKj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=feuAKj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sTFsEj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sTFsEj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=yitXlJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=yitXlJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Zk1jsJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Zk1jsJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=qQDKaj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=qQDKaj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/329627841" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 23:24:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/net">net</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/porn-party">porn-party</category>
      <category domain="http://securityratty.com/tag/porn-contact">porn-contact</category>
      <category domain="http://securityratty.com/tag/fake porn sites">fake porn sites</category>
      <category domain="http://securityratty.com/tag/porn-play">porn-play</category>
      <category domain="http://securityratty.com/tag/porn-plus">porn-plus</category>
      <category domain="http://securityratty.com/tag/porndrive">porndrive</category>
      <category domain="http://securityratty.com/tag/pornhelp">pornhelp</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/329627841/fake-porn-sites-serving-malware-part.html">Fake Porn Sites Serving Malware - Part Two</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[Fast Track to Botnet Central]]></title>
      <link>http://securityratty.com/article/d62636e855a8a6846b44ec6cafe10519</link>
      <guid>http://securityratty.com/article/d62636e855a8a6846b44ec6cafe10519</guid>
      <description><![CDATA[Its true, you too can finally get into the botnet you always wanted. Finally the ability to be a zombie computer under some losers control is yours

Seriously though, becoming a victim to a hacker's...]]></description>
      <content:encoded><![CDATA[
        Its true, you too can finally get into the botnet you always wanted.&nbsp; Finally the ability to be a zombie computer under some losers control is yours!<br /><br />Seriously though, becoming a victim to a hacker's botnet is incredibly easy.&nbsp; These attacks are not typical to other forms of destruction found on the internet.&nbsp; There true intent is usually to remain hidden from view until called upon.&nbsp; In the case of <a href="http://www.spywareguide.com/spydet_31297_fasttrackbot.html">FastTrackBot</a> however there is a new objective.&nbsp; <a href="http://www.spywareguide.com/spydet_31297_fasttrackbot.html">FastTrackBot</a> downloads several executable files that keep your computer clicking on the attacker's affiliate links.&nbsp; These executable files keep the webpages in hidden iexplore.exe windows in order to hide the application from suspicious eyes.&nbsp; If you're using X-cleaner, I suggest you take a look at the Expert Tab.&nbsp; The Show All Hidden Windows function is great for showing you exactly what is open at the time.<br /><br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/fasttrack/replace%20ad.html" onclick="window.open('http://blog.spywareguide.com/fasttrack/replace%20ad.html','popup','width=488,height=332,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/fasttrack/replace%20ad-thumb-488x332.png" alt="replace ad.png" class="mt-image-center" style="margin: 0pt auto 20px; text-align: center; display: block;" width="488" height="332" /></a></span>FastTrackBot phones home to several of these sites in order to keep the user clicks through affiliate links.<br /><br />Aside from creating invisible windows to hog your bandwidth up, it also attempts to install a rogue anti-spyware application.&nbsp; This is a popular technique when attempting to fraud the victim into leaking credit card information when actually attempting to purchase the fake product.&nbsp; FastTrackBot inserts a fake security center that appears identical to the one found in Windows XP.<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/fasttrack/securitycenter.html" onclick="window.open('http://blog.spywareguide.com/fasttrack/securitycenter.html','popup','width=786,height=576,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/fasttrack/securitycenter-thumb-500x366.png" alt="securitycenter.png" class="mt-image-center" style="margin: 0pt auto 20px; text-align: center; display: block;" width="500" height="366" /></a></span>As you can see in the address bar, this is not the actual security center.&nbsp; Clicking anywhere on this window means almost certain doom in the worst way possible...a never ending stream of fake "YOU ARE INFECTED!!!!" alerts.<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/fasttrack/infect.html" onclick="window.open('http://blog.spywareguide.com/fasttrack/infect.html','popup','width=764,height=523,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/fasttrack/infect-thumb-500x342.png" alt="infect.png" class="mt-image-center" style="margin: 0pt auto 20px; text-align: center; display: block;" width="500" height="342" /></a></span><br />In order to kill the actual application, you have to remove it from memory first, then remove its autostart which is found in 5 different locations - or simply remove with our free <a href="http://www.spywareguide.com/onlinescan.php">Microscanner</a>.<br />
        
    ]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 05:41:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fasttrackbot">fasttrackbot</category>
      <category domain="http://securityratty.com/tag/fasttrackbot inserts">fasttrackbot inserts</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/invisible windows">invisible windows</category>
      <category domain="http://securityratty.com/tag/fake">fake</category>
      <category domain="http://securityratty.com/tag/actual application">actual application</category>
      <category domain="http://securityratty.com/tag/fake security center">fake security center</category>
      <category domain="http://securityratty.com/tag/fasttrackbot phones home">fasttrackbot phones home</category>
      <category domain="http://securityratty.com/tag/application">application</category>
      <source url="http://blog.spywareguide.com/2008/07/fast-track-to-botnet-central.html">Fast Track to Botnet Central</source>
    </item>
    <item>
      <title><![CDATA[Summarizing June's Threatscape]]></title>
      <link>http://securityratty.com/article/520325188c71fdacd3f86834feb1cdc5</link>
      <guid>http://securityratty.com/article/520325188c71fdacd3f86834feb1cdc5</guid>
      <description><![CDATA[June's threatscape that I'll summarize in this post based on all the research conducted during the month, was a very vibrant one. With the return of GPcode, a remotely exploitable flaw in the Zeus...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"><a href="http://bp3.blogger.com/_wICHhTiQmrA/SGoHvxfg0WI/AAAAAAAAB3M/6CMFS1Q1zGQ/s1600-h/ddanchev.jpg" imageanchor="1" style="clear: left; border-right: 0pt; border-top: 0pt; float: left; margin-bottom: 1em; border-left: 0pt; margin-right: 1em; border-bottom: 0pt; background-color: transparent;"><img src="http://bp3.blogger.com/_wICHhTiQmrA/SGoHvxfg0WI/AAAAAAAAB3M/WskmE9LDFvE/s200-R/ddanchev.jpg" style="border-right: 0pt; border-top: 0pt; border-left: 0pt; border-bottom: 0pt;" /></a>June's threatscape that I'll summarize in this post based on all the research conducted during the month, was a very vibrant one. With the return of GPcode, a remotely exploitable flaw in the Zeus crimeware kit allowing both, researchers and malicious parties to assess the severity of a particular banker malware campaign, the increasing use of malicious doorways next to ICANN and IANA's DNS hijacking, all speak for themselves and how diverse the threats and, of course, the abilities to maintain a decent situatiational awareness about what's going on have become.</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>01.</b>&nbsp; <a href="http://ddanchev.blogspot.com/2008/06/uks-crime-reduction-portal-hosting.html">U.K's Crime Reduction Portal Hosting Phishing Pages</a> - nothing new here since vulnerable sites are to be "remotely file included" and SQL injected to locally host anything on behalf of a malicious party. Risk and responsibility forwarding is one thing, but having a crime reduction portal hosting phishing pages is entirely another. The phishing pages was shut down in less than 12 hours upon notification</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>02.</b> <a href="http://ddanchev.blogspot.com/2008/06/price-discrimination-in-market-for.html">Price Discrimination in the Market for Stolen Credit Cards</a> - Tracking down "yet another stolen credit cards for sale" service in the wild, the price discremination that they applied greatly reflects the current lack of transpararency for a potential buyer of stolen credit cards, and how higher profit margins are driving the entire business model. With script kiddies running their own botnets and undermining the sophisticated botnet master's high profit margin business model by undercutting their prices, stolen credit cards are not what they used to be - an exclussive good. Nowadays, they are a commodity good and often a bargain</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>03.</b> <a href="http://ddanchev.blogspot.com/2008/06/blackhat-seo-redirects-to-malware-and.html">Blackhat SEO Redirects to Malware and Rogue Software</a> - Sampling an active blackhat SEO campaign out of the hundreds of thousands currently active online, releaved a large portfolio of domains serving Zlob variants by pitching them as fake codecs that the end user should download if they are to view the non existent adult content at the sites. Where's the OSINT mean? It's in the fact that the codecs and the fake security software phone back to UkrTeleGroup Ltd's network</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>04.</b> <a href="http://ddanchev.blogspot.com/2008/06/using-market-forces-to-disrupt-botnets.html">Using Market Forces to Disrupt Botnets</a> - With the current oversupply of malware infected hosts, and botnet masters embracing the services model for anything malicious, in this post I discussed the radical security approach of puchasing already infected malware hosts on a per country basis, disinfecting them and forcing them to update all the software on the infected PCs. Of course, on an opt-in basis. The possibility to directly provide incentives for botnet hunters to shut down whatever they come across to on a daily basis, and that's a lot of botnets, is also there</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>05.</b> <a href="http://ddanchev.blogspot.com/2008/06/whos-behind-gpcode-ransomware.html">Who's Behind the GPcode Ransomware?</a> - The title speaks for itself, the research with enough actionable intelligence gathered in the shortest timeframe possible is already proving accurate and highly valuable. How come? Stay tuned for more developments</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>06.</b> <a href="http://ddanchev.blogspot.com/2008/06/imageshack-typosquatted-to-serve.html">ImageShack Typosquatted to Serve Malware</a> - In a rare instance of a creative attack combining typosquatting in order to impersonate ImageShack and serve malware by redirecting users to an image file that is actually forwarding to the binary, I was recently tipped by the folks at TrendMicro who are also following this that the site is up and running again. Not for long</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>07.</b> <a href="http://ddanchev.blogspot.com/2008/06/fake-youtube-site-serving-flash.html">Fake YouTube Site Serving Flash Exploits</a> - Next to using the usual set of exploits courtesy of a commodity web malware exploitation kit, this campaign was also using flash exploits. Even more interesting is the fact that the password stealer obtained was attempting to phone back to a misconfigured malware command and control interface, basically allowing you to assess the campaign from the eyes of the "campaigner"</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>08.</b> <a href="http://ddanchev.blogspot.com/2008/06/monetizing-web-site-defacements.html">Monetizing Web Site Defacements</a> - Web site defacements are getting monetized just like SQL injections are in order to locally host a blackhat search engine optimization campaign on a vulnerable site with a high page rank. In this post I've assessed such monetization courtesy of a web site defacer at The Africa Middle Market Fund</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>09.</b> <a href="http://ddanchev.blogspot.com/2008/06/malicious-doorways-redirecting-to.html">Malicious Doorways Redirecting to Malware</a> - Yet another large domains portfolio exposed though a malicious doorway redirecting to fake porn and video sites serving Zlob variants, tracking down the initial spamming of the malicious doorways across multiple vulnerable forums and guestbooks </div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>10.</b> <a href="http://ddanchev.blogspot.com/2008/06/zeus-crimeware-kit-vulnerable-to.html">The Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw</a> - When cyber criminals get advised to patch their vulnerable versons of the Zeus Crimeware Kit, you know there's a monoculture in the crimeware market. This flaw released publicly in May, 2008, not just allows others to hijack someone's ebanking botnet, but also, vendors and researchers to better assess a vulnerable Zeus command and control location</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>11.</b> <a href="http://ddanchev.blogspot.com/2008/06/fake-celebrity-video-sites-serving.html">Fake Celebrity Video Sites Serving Malware</a> - When templates for fake video and adult sites are just as available as they are now, anyone can take advantage of this cheap social engineering track that seems to work just fine. Compared to relying on blackhat search optimization to acquire traffic, some of the campaigns were SQL injected at vulnerable sites in order to drive traffic to them, next to several other tactics which when combined can result in a lot of people unknowingly visiting the sites </div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>12.</b> <a href="http://ddanchev.blogspot.com/2008/06/phishing-campaign-spreading-across.html">Phishing Campaign Spreading Across Facebook</a> - An internal phishing campaign was circulating across Facebook, which got taken care of thanks to coordinated efforts with Facebook's security folks. There's also an indicating tha they are currently typosquatting other social networking sites like Hi5 for instance</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>13.</b> <a href="http://ddanchev.blogspot.com/2008/06/underground-multitasking-in-action.html">Underground Multitasking in Action</a> - As a firm believed in taking a random sample for a particular threat segment, this was once of these cases confirming the confidence I've built into anticipating upcoming tactics and strategies to be used </div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<div style="text-align: left;"><b>14.</b> <a href="http://ddanchev.blogspot.com/2008/06/update-to-photobuckets-dns-hijacking.html">An Update to Photobucket's DNS Hijacking</a> - Despite that Photobucket didn't oficially acknowledge the DNS hijacking, the hosting provider the NetDevilz hacking team used issued a statement. Ironically, the Turkish hacking group used the same provider weeks later to redirect ICANN and IANA's domains to Atspace.com</div>
<div style="text-align: left;"><b>15.</b> <a href="http://ddanchev.blogspot.com/2008/06/fake-porn-sites-serving-malware.html">Fake Porn Sites Serving Malware</a> - Among the largest domains portfolio of malware serving porn sites I've exposed in a while, all of them naturally remain active since they are hosted on a partition of RBN's diverse network. Visualizing a malicious doorway or the entire ecosystem provides a better understanding at how structured the ecosystems are</div>
<div style="text-align: left;"></div>
<div style="text-align: left;"></div>
<b>16.</b> <a href="http://ddanchev.blogspot.com/2008/06/backdoording-cyber-jihadist-ebooks-for.html">Backdoording Cyber Jihadist Ebooks for Surveillance Purposes</a> - Despite that in this case we have a cyber jihadist backdoording his own released books, the international intelligence community next to law enforcement are known to have expressed interest in backdooring suspect's PCs, so why not SQL inject the cyber jihadist forums themselves?<br />
<b>17.</b> <a href="http://ddanchev.blogspot.com/2008/06/right-wing-israeli-hackers-deface.html">Right Wing Israeli Hackers Deface Hamas's Site</a> - When you read that Hamas's site is hacked, you ask yourself the following, do they even have a web site that's up the running? The answer to which would be the fact that even Hezbollah has been maintaining an Internet infrastructure since 1998 <br />
<b>18.</b> <a href="http://ddanchev.blogspot.com/2008/06/icann-and-ianas-domain-names-hijacked.html">ICANN and IANA's Domain Names Hijacked by the NetDevilz Hacking Group</a> - A fact is a fact, no comment here, go through all the technical details of the hijacking, including some actionable intelligence on who's behind the hijacking<br />
<b>19.</b> <a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs You Rarely See in Any Report</a> - Who's tolerating malicious activities on their network, and how is the RBN related to all this? Well, when combined, the tiny parts of these ISPs represent a tiny part of the Russian Business Network itself<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Arx0SJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Arx0SJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5olcEJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5olcEJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=a2BAsj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=a2BAsj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=H5lz4j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=H5lz4j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=MYqzVJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=MYqzVJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1PoM3J"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1PoM3J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=d9Ilyj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=d9Ilyj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/323996877" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 03:05:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/fake youtube site">fake youtube site</category>
      <category domain="http://securityratty.com/tag/web site defacements">web site defacements</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware hosts">malware hosts</category>
      <category domain="http://securityratty.com/tag/web site defacer">web site defacer</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/vulnerable sites">vulnerable sites</category>
      <category domain="http://securityratty.com/tag/malicious">malicious</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/323996877/summarizing-junes-threatscape.html">Summarizing June's Threatscape</source>
    </item>
    <item>
      <title><![CDATA[The Malicious ISPs You Rarely See in Any Report]]></title>
      <link>http://securityratty.com/article/698e36c7aa4d5f39635cf50fa8e91834</link>
      <guid>http://securityratty.com/article/698e36c7aa4d5f39635cf50fa8e91834</guid>
      <description><![CDATA[The recently released badware report entitled May 2008 Badware Websites Report &quot; lists several Chinese netblocks tolerating malicious sites on their networks. As always, these are just the tip of the...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp2.blogger.com/_wICHhTiQmrA/SGjb89L1eNI/AAAAAAAAB3E/O9YPRKZ-UkM/s1600-h/chinese_netblocks_malware_sites.JPG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp2.blogger.com/_wICHhTiQmrA/SGjb89L1eNI/AAAAAAAAB3E/wO68nyXNhP8/s200-R/chinese_netblocks_malware_sites.JPG" style="border: 0pt none ;" /></a>The <a href="http://blogs.zdnet.com/security/?p=1339">recently released</a> badware report entitled “<a href="http://www.stopbadware.org/pdfs/StopBadware_Infected_Sites_Report_062408.pdf">May 2008 Badware Websites Report</a>" lists several Chinese netblocks tolerating malicious sites on their networks. As always, these are just the tip of the iceberg out of a relatively good sample that the folks at Stopbadware.org used for the purposes of their report. In the long term however, with the increasing prelevance of fast-fluxing, a country's malicious rating could become a variable based on the degree of dynamic fast-fluxing abusing its infrastructure in a particular moment in time. Moreover, forwarding the risk and the malicious infrastructure to malware infected hosts, and exploited web servers, creates a "twisted reality" where the countries with the most disperse infrastructure act as a front end to the countries abusing it, ones that make it in any report, since they are the abusers.<br />
<br />
The report lists the following malicious netblocks, a great update to a previous post on "<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocating Malicious ISPs</a>" :<br />
<br />
- CHINANET-BACKBONE No.31,Jin-rong Street<br />
- CHINA169-BACKBONE CNCGROUP China169 <br />
- CHINANET-SH-AP China Telecom (Group)<br />
- CNCNET-CN China Netcom Corp.<br />
- GOOGLE - Google Inc.<br />
- DXTNET Beijing Dian-Xin-Tong Network Technologies Co., Ltd.<br />
- SOFTLAYER - SoftLayer Technologies Inc.<br />
- THEPLANET-AS - ThePlanet.com Internet Services, Inc.<br />
- INETWORK-AS IEUROP AS<br />
- CHINANET-IDC-BJ-AP IDC, China<br />
<br />
With some minor exceptions though, in the face of the following ISPs you rarely see in any report - <b>InterCage, Inc., Softlayer Technologies, Layered Technologies, Inc., Ukrtelegroup Ltd, Turkey Abdallah Internet Hizmetleri, and Hostfresh</b>. Ignoring for a second the fact that the "the whole is greater than the sum of it's parts", in this case, the parts represent RBN's split network. Since it's becoming increasingly common for any of these ISPs to provide standard abuse replies and make it look like there's a shutdown in process, the average time it takes to shut down a malware command and control, or a malicious domain used in a high-profile web malware attack is enough for the campaign to achieve its objective. The evasive tactics applied by the malicious parties in order to make it harder to assess and prove there's anything malicious going on, unless of course you have access to multiple sources of information in cases when OSINT isn't enough, are getting even more sophisticated these days. For instance, the Russian Business Network has always been taking advantage of "<a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">fake account suspended notices</a>" on the front indexes of its domains, whereas the live exploit URLs and the malware command and controls remained active.<br />
<br />
And while misconfigured web malware exploitation kits and malicious doorways continue supplying good samples of malicious activity, we will inevitable start witnessing more evasive practices applied in the very short term.<br />
<br />
<b>Related posts:</b> <br />
<a href="http://ddanchev.blogspot.com/2008/02/new-media-malware-gang-part-three.html">The New Media Malware Gang - Part Three</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/new-media-malware-gang-part-two.html">The New Media Malware Gang - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/new-media-malware-gang.html">The New Media Malware Gang</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/hacked-by-rbn.html">HACKED BY THE RBN!</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">Rogue RBN Software Pushed Through Blackhat SEO</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">RBN's Phishing Activities</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-malware-puppets-need-their-master.html">RBN's Puppets Need Their Master</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/go-to-sleep-go-to-sleep-my-little-rbn.html">Go to Sleep, Go to Sleep my Little RBN</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/exposing-russian-business-network.html">Exposing the Russian Business Network</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/detecting-and-blocking-russian-business.html">Detecting the Blocking the Russian Business Network</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/over-100-malwares-hosted-on-single-rbn.html">Over 100 Malwares Hosted on a Single RBN IP</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/russian-business-network.html">The Russian Business Network</a><b>&nbsp;</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Is5xDI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Is5xDI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=OkYeyI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=OkYeyI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=zJULTi"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=zJULTi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NNv1Ri"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NNv1Ri" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=K7P0HI"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=K7P0HI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=jsNS2I"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=jsNS2I" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Y3tJ6i"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Y3tJ6i" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/323281769" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 30 Jun 2008 05:31:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/malicious">malicious</category>
      <category domain="http://securityratty.com/tag/malicious isps">malicious isps</category>
      <category domain="http://securityratty.com/tag/isps">isps</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/malicious doorways continue">malicious doorways continue</category>
      <category domain="http://securityratty.com/tag/infrastructure">infrastructure</category>
      <category domain="http://securityratty.com/tag/malicious infrastructure">malicious infrastructure</category>
      <category domain="http://securityratty.com/tag/malicious domain">malicious domain</category>
      <category domain="http://securityratty.com/tag/malware command">malware command</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/323281769/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs You Rarely See in Any Report</source>
    </item>
  </channel>
</rss>
