RIPE77 Anti Abuse WG · 2018-10-18 · fgpxmvlsxpsp.me.uk= hsjnkhqxqiox.com Botnet Crimeware...

Criminal(Abuse(in(RIPE(IP(space

October(18th,(2018,(Amsterdam Anti>Abuse(WG

Dhia Mahjoub,(PhD.,(Head(of(Security(R&D,(Cisco(Umbrella

*#####@DhiaLite

*#####Head#of#Security#R&D#at#Cisco#Umbrella

*#####15+#years#experience#in#network#security,#network#traffic#analysis

*#####PhD#in#graph#algorithms#applied#on#sensor#networks#problems

*#####Regular#speaker#at#Black#Hat,#Defcon,#Flocon,#Virus#Bulletin,#NCSC#One#Conference,#FIRST,#TFOCSIRT

*#####Collaboration#with#LEAs

Who#am#I#?

● 30$data$centers$worldwide,$11$in$Europe

● ~150$billion$queries$a$day

● Translates$to$around$24$TB$a$day

● Valuable$client$query$information

Worldwide$DNS$data

Data%center%locations

Threat(detection(at(scale

IP BGP

SSL WHOIS

HASH WEB

Umbrella

Investigate

DOMAIN

LexicalLive(DGA(prediction

Anomaly(detectionNewly(seen(domains

Spike(rank(model

Predictive(IPPredictive(IP(space(monitoring

GraphBbasedCoBoccurrence(model

fgpxmvlsxpsp.me.uk=hsjnkhqxqiox.com

Botnet

Crimeware

Exploit(Kit

Phishing

Ransomware

Trojan

Cryptojacking

MetaBdata(pattern(analysis(at(scale

Toxic&hosted&content

● Malware)C2● Ransomware● Phishing● Cybercrime)forums● Stolen)credentials)marketplaces● Criminal)exchange)services● Criminal)jabber)servers

Rogue&outgoing&traffic

● SSH/wordpress bruteDforcing● Mass)scans● DDoS)attacks● Spam)sending

IP&space

CyberDcrime)attacks

Cybercrime

Products GoodsServices

• Malware)– RATs,)banking)trojans,)ransomware,)etc.

• Brute)force)tools)and)account)checkers

• Vulnerabilities)and)Exploits

• Bulletproof)Hosting

• DDOS)services

• Ransomware)as)a)service

• Installs)and)traffic

• Exploit)Kit

• Cash)out)and)exchangers

• Credit)card)dumps

• Fullz information)and)PII

• Database)dumps

Cybercrime)Ecosystem

Cybercrime

Bulletproof6hosting

Bulletproof+Hosting

Bulletproof,hosting,provider,(BPH)

A,criminal,hosting,provider,who,shields,their,customers,from,abuse,complaints,and,take,down,action.,

Good Abused Bulletproof

Spectrum3of3Hosting3Providers

A$Taxonomy$of$BulletProof Hosting

Cybercrime

Bulletproof6hosting

Botnet:based Host:based

Dedicated LeasedHybrid

BPH6classification

Bulletproof,Hosting,business,model,

Dedicated*hoster recipe

Low$barrier$of$entry$(Approx <$2K)1.*Register*business*offshore

2.*Register*own*ASN*and*lease*IP*space

3.*Setup*website(s)*or*stay*underground

4.*Drive*customers*– forums*(open,*closed),*social*media

5.*Generate*revenue*through*hosting*or*sending*traffic

7.*Handle*abuse

8.*Shut*down,*move*elsewhere,*repeat

Dedicated*BPH*technical*features*

Leaf%ASN%

Offshore*business*registration*

Anonymous*payment*methods

Small*IP*range*

Toxic*hosted*content*or*outgoing*traffic

• Have(only(upstream(peers,(no(downstream• Frequent(pattern(for(questionable/bulletproof(hosters

50673SERVERIUS

21100ITLDCLUA

62088SINARO

200429HOSTSLIM

62454ZYZTM(,(NL

204196Abelohost,(NL

201628Fiber01LAS,(NL

9002RETN,(UA 60144

3WLInfra,(NL

6461Telia,(SE

1299Zayo,(US

Leaf((Stub)(ASN(or(leaf(ASNs(chain

1#hosting#provider#spreading#footprint#on#multiple#ASNs

Example:#King%Servers: Serverius ; Alfa#Telecom#; Hosting#Solutions

RIPE%768%IPs%(3%prefixes)% ARIN%2048%IPs%(2%prefixes)

50673,#NL 44546,#CZ

50245,#CZ

Others

3356,#US 6939,#US

31.148.219.0/2431.148.220.0/2493.170.13.0/24

14576,#US

6939,#US27257,#US39906,#CZ

Others

104.193.252.0/22162.244.32.0/22

Broken#into#/24,#/25,#/26,#/27,#etc

Resellers:)1)ASN)used)by)multiple)hosting)providers

Worldstream

Dedicated*BPH*technical*features*

Leaf*ASN*

Offshore(business(registration(

Anonymous*payment*methods

Small*IP*range*

Toxic*hosted*content*or*outgoing*traffic

Belize AnguillaBritish/Virgin/Islands

DominicaPanama

Seychelles

United/Arab/Emirates

Register*Business*in*Offshore*Jurisdictions

Hong/Kong

ServersRIPE,(ARIN(space

OperatorsUkraine,(Russia

BusinessBelize,(Panama,(Seychelles

Multiple(Layers(of(Resistance

Example)BPH)operations

Cybercrime

Bulletproof6hosting

Botnet:based Host:based

BPH6classification

Botnet(based-BPH

Actor(s)+grow+and+maintain+FF+network*FF+service+offered+in+underground+forumsVictim

Crimeware consumer

Researcher

Zbot Fast+Flux+Proxy+Networkaka+Fluxxy,+Darkcloud

Botnet+comprised+at+its+peaks+of+30K40K+compromised+residential+

IPs,+mainly+in+UA,+RU

40K50++bot+IPs+provisioned+per+domain

Toxic+content+deliveredShort+lifetime:+malware,(ransomwareMedium+lifetime:+phishingLong+lifetime:+carding,(cybercrime(forums

Criminal+customer’ssite+origin+IP

Covered+at+Black+Hat+2014,Botconf 2014,+Defcon 2017ZBot Fast+Flux+BPH+Operation

Threats*delivered*by*ZBot Fast*Flux*proxy*network

Cybercrime

Bulletproof6hosting

Botnet:based Host'based

BPH6classification

Host'based,BPH

Abuse(in(Swiss(space

AS51852Private/Layer,/CH

AS9002RETN,/UA

AS42624Simple/Carrier,/CH

AS6939Hurricane/Electric,/US

Layershift.ruPaylicense.com,4BelizeVERATON/PROJECTS/LTD

AS59493VERATON/PROJECTS/LTD,/RU

AS201630Qhoster,/BG

Qhoster.comBelizeEKs,/malware,/CP,/fake/SW,/dump/shops,/botnet/C2/

DE/ASNs UK/

US/ASNs

CH/ASN

Offshorededicated.netOffshoreservers.bzOffshorehosting.nameOffshorededi.com

AS42632Filanco,/RU

AS42632MNOGOBYTE,/

AS43350NFORCE,/

AS48031XSERVER,4

AS/52288Private/Layer,/PA

Almashosting.comIranSSH/bruteforcingPetya dropperSpam/sending

Panama1

● Offers)anonymous)offshore)hosting)on)shared)hosting,)VPS)and)dedicated)servers

● IP)space)split)between)hosting)companies)operating)from)Panama,)Switzerland,)Belize,)Russia,)Iran

AS9002RETN,/UA

AS201630Qhoster,/BG

DE/ASNs UK/

US/ASNs

CH/ASN

AS42632Filanco,/RU

AS42632MNOGOBYTE,/

AS43350NFORCE,/

AS48031XSERVER,4

Panama1

AS51852Private0Layer,0CH

AS9002RETN,0UA

AS42624Simple0Carrier,0CH

AS6939Hurricane0Electric,0US

Layershift.ruPaylicense.com,4BelizeVERATON0PROJECTS0LTD

AS59493VERATON0PROJECTS0LTD,0RU

AS201630Qhoster,0BG

Qhoster.comBelizeEKs,0malware,0CP,0fake0SW,0dump0shops,0botnet0C20

DE0ASNs UK0

US0ASNs

CH0ASN

AS42632Filanco,0RU

AS42632MNOGOBYTE,0

AS43350NFORCE,0

AS48031XSERVER,4

AS052288Private0Layer,0PA

Almashosting.comIranSSH0bruteforcingPetya dropperSpam0sending

Panama1

AS9002RETN,0UA

AS201630Qhoster,0BG

DE0ASNs UK0

US0ASNs

CH0ASN

AS42632Filanco,0RU

AS42632MNOGOBYTE,0

AS43350NFORCE,0

AS48031XSERVER,4

Panama1

AS9002RETN,0UA

AS201630Qhoster,0BG

DE0ASNs UK0

US0ASNs

CH0ASN

AS42632Filanco,0RU

AS42632MNOGOBYTE,0

AS43350NFORCE,0

AS48031XSERVER,4

Panama1

AS9002RETN,/UA

AS201630Qhoster,/BG

DE/ASNs UK/

US/ASNs

CH/ASN

AS42632Filanco,/RU

AS42632MNOGOBYTE,/

AS43350NFORCE,/

AS48031XSERVER,4

Panama1

AS8493URBANET-UPC-Schweiz,-CH

AS57470VLADPOLITEX,-RU

AS3216SOVAM,-RU

AS12389ROSTELECOM,-RU

A-single-/23Phishing,-dump-shops,-money-mule-recruiting,-Android-trojans

AS197988

SOLARCOM,/CH

AS33891

COREBACKBONE,/

AS13030

INIT7,/CH

Illegal/video/streaming,

pharma,/fake/merchandise,

exchange/services/(PMObitcoin),

bitcoin/mining,

bitcoin/based/gambling,

freedom/of/speech:/free/snowden,/

justice/for/assange,/wikileaks

Abuse(in(Dutch(space

Bulgarian+hoster with+UK+business+registration5+address+used+by+officers+featured+in+the+Panama+papers/offshore+leaks

Suite&1&78&Montgomery&Street,&Edinburgh,&Scotland,&EH7&5JA

Hostzealot A Fortunix

AS201525,*BGHZ#Hosting#Ltd

AS6939,*USHE*Inc.

AS5580,*NLHibernia

AS60144,*NL3W*Infra

AS59711,*GBHZ#Hosting#Ltd

AS61046,*GBHZ#Hosting#Ltd

AS3356,*USLevel*3

Phishing,*porn,*pharma,*scam*sites,*dating*sites,*

malware

Spam,*scam*sitesFake/rogue*software,*pharma

Hostzealot infrastructure

AS50673Serverius,/NL

AS9002RETN,/UA

AS42708Portlane,/SE

AS51430ALTUSHOST,/NL

AS5577Root,/LU

AS199968IWSNET,/SEHostplay.com

AS201630Qhoster,/BG

AS60778Felicity,/NL

AS60567DATACLUB,/SE

Dump/shops

Armenia,/UAEPorn,/torrents,/pirated/movies

BelizeEKs,/malware,/CP,/fake/SW,/dump/shops,/botnet/C2/

PanamaPorn,/pirated/movies

Latvia,/BelizeDump/shops

DE/ASNs

UK/ASNs

US/ASNs+ CH/

Kings(serversHosting(Solutions

AS32338,7AS202951Hostiserver

202920

203557

60567Dataclub.biz

Ecatel

445961457650673197812

EK,7malware,7porn,7pharma,7fake7sw

Adult7and7child7porn

Upstream17450673 6939

Ferazko7Holding.ru

MPAA7(movie)7piracy

1657credit7card7dump7shops

203339

movie7piracy,child7porn,7etc

Brute(forcing,phishing3(Airbnb,3Amex,3etc.)

AS29073QUASINETWORKS,3

AS56611REBACOM,3NL

AS64484DMZHOST,3NL

AS204655NOVOGARA,3NL

JUPITER253LIMITED

AS206703OKSERVERS,3

Brute(forcing,porn,3pharma,3fake3merchandise

!Created(Nov(14,(2016!Last(visible(Sep(8,(2018

okservers.net

dmzhost.co

!Site(is(down(since(March(2018

AS56611REBACOM,3NL

AS64484DMZHOST,3NL

JUPITER253LIMITED

AS206703OKSERVERS,3

okservers.net

dmzhost.co

AS56611REBACOM,3NL

AS64484DMZHOST,3NL

JUPITER253LIMITED

AS206703OKSERVERS,3

okservers.net

dmzhost.co

Brute'forcing,phishing2(Airbnb,2Amex,2etc.)

AS56611REBACOM,2NL

AS64484DMZHOST,2NL

JUPITER252LIMITED

AS206703OKSERVERS,2

Brute'forcing,porn,2pharma,2fake2merchandise

Last%visible%Sep%8,%2018 okservers.net

dmzhost.co

Top&carding&and&cybercrime&forums

Top&carding&site:&Joker’s&stash

●All&Joker’s&stash&domains&have&been&on&RIPE&IP&space&+&some&Iranian&hosters

●190.115.27.130:&Banner&on&port&443/tcp on&190.115.27.130:&[ssl]&cipher:0xc013&,&jstash03.link,&jstashNbazar.link,&jstashNbazar.store,&jstash03.link,&jstashbazar.link,&www.jstashNbazar.link,&www.jstashNbazar.store,&www.jstash03.link,&www.jstashbazar.link

●190.115.27.130&is&on&AS262254,&Dancom LTD,&registered&in&Belize,&but&part&of&the&DDOSNGUARD,&RU&operation

Top&carding&site:&Joker’s&stash

Black&Hat&2016

Other(hosters used(by(Joker’s(stash(domains:

●INFIUM,(UA((AS50297)

●DOTSI,(PT((AS49349)(a.k.a BlazingFast

●SINARO,(NL((AS62088),(a.k.a Morehost

All(three(have(regularly(been(involved(in(hosting(toxic(content:(abused(or(complicit(??

Top(carding(site:(Joker’s(stash

Top&cybercrime&forum:maza

●Maza domains-used-RIPE-IP-space-+-currently-on-Iranian-BPH-hoster

●Current-IP-has-also-hosted-Joker’s-stash-domains-and-their-jabber-server

Top-cybercrime-forum:maza

AS59580BATTERFLYAIMEDIA,-

AbdAllah (aka-Mykhailo Rytikov,-Webhost,-Whost

Black-Hat-2016

Operational-Recommendations

1. Understand-and-expose-TTPs-of-rogue/gray-hosting-providers

2. Share-intel-with-security-community/LE,-monitor-and-take-early-action

3. Ask-registries-to-scrutinize-ASN-and-IP-space-requests-more-closely?

4. Work-on-whois policies-with-RIPE

5. Datacenters-scrutinize-peering-or-coQlocation-requests?

Some'related'Work

▪ Hack'in'the'Box,'Amsterdam'2018'https://conference.hitb.org/hitbsecconf2018ams/sessions/commsecEprivacyEandE

protectionEforEcriminalsEbehaviorsEandEpatternsEofErogueEhostingEproviders/

▪ SANS'CTI'Summit'2018'https://www.youtube.com/watch?v=gHewB06Bnrk

▪ FIRST/OASIS'Borderless'Cyber'Conference'and'Technical'Symposium'2017'https://www.oasisE

open.org/events/sites/oasisEopen.org.events/files/Borderless_Cyber_2017%20final_Dec7_2017.pdf

▪ Virus'Bulletin'2017'https://www.virusbulletin.com/blog/2017/11/vb2017EpaperEbeyondElexicalEandEpdnsEusingEsignalsE

graphsEuncoverEonlineEthreatsEscale/

▪Defcon'2017'https://www.youtube.com/watch?v=AbJCOVLQbjs

▪Black'Hat'2017'https://www.youtube.com/watch?v=PGTTRN6VsEY&feature=youtu.be

▪NCSC'One'Conference'2017

▪Black'Hat'2016 https://www.youtube.com/watch?v=m9yqnwuqdSk

▪RSA'2016 https://www.rsaconference.com/events/us16/agenda/sessions/2336/usingElargeEscaleEdataEtoEprovideE

attacker

▪BruCon 2015 https://www.youtube.com/watch?v=8edBgoHXnwg

▪Virus'Bulletin'2014 https://www.virusbtn.com/conference/vb2014/abstracts/Mahjoub.xml

▪Black'Hat'2014 https://www.youtube.com/watch?v=UG4ZUaWDXS

Thank&you

Dhia Mahjoub,&dmahjoub@cisco.com,&@DhiaLite

Thanks

Atheana AltayyarIntel471Sarah&Brown

RIPE77 Anti Abuse WG · 2018-10-18 · fgpxmvlsxpsp.me.uk= hsjnkhqxqiox.com Botnet Crimeware...

Documents

Sameer Ratolikar - Crimeware Attacks & Defenses - Interop Mumbai 2009

BLACKENERGY & QUEDAGH - F-Secure · PDF file2 BLACKENERGY & QUEDAGH The convergence of crimeware and APT attacks INTRODUCTION BlackEnergy is a popular crimeware (that

Jabber Walk Latin

Cisco Jabber for Windows 10.6 Release Notesjabberupdate.harman.com/img/cisco-jabber-for... · Cisco Jabber for Windows 10.6 Release Notes ReleaseNotes2 Introduction2 Requirements5

Cisco Jabber for Windows 10.6 User Guidejabberupdate.harman.com/...cisco-jabber-windows-106... · Cisco Jabber for Windows 10.6 User Guide UserGuide4 Availability4 CreateCustomTabs15

Koobface: Inside a Crimeware Network

Deploying Jabber Desktop Clientsd2zmdbbm9feqrf.cloudfront.net/2015/eur/pdf/BRKUCC-2345.pdf · Deploying Jabber Desktop Clients BRKUCC-2345 Shane Long, ... [User@XMPP Domain] Jabber

The New Reality of Stealth Crimeware - IntelThe New Reality of Stealth Crimeware 3 Take the stealth, creativity, and patience of Stuxnet. Add the commercialism, wide distribution,

Troubleshooting Cisco Jabber Clients - alcatron.net Live 2014 Melbourne/Cisco Live...Troubleshooting Cisco Jabber Clients ... Jabber for Windows CUCM CUPS Unity Connection Cisco WebEx

Jabber vs Lync

Cisco Jabber 12

VPN Jabber Android

Jabber Test

Using the Jabber SoftPhone...Jabber Softphone User Reference 1 Updated 02/25/2020 by UC Support . Using the Jabber SoftPhone ****Please note, the jabber softphone is not intended to

Fighting Crimeware: An Architecture for Split-Trust Web

JANUARY-JULY 2018 CRIMEWARE TRENDS: A Sampling of

Frequently Asked Questions: Cisco Jabber 9.1(1) for …ncs.fnal.gov/nvs/documents/voip/Jabber-iPhone-FAQ.pdf · Frequently Asked Questions Frequently Asked Questions: Cisco Jabber

Cisco Jabber IM v11.8 Mac Reference Guide ABOUT CISCO JABBER Cisco Jabber IM is an instant messaging client that works seamlessly with your UWW Cisco VoIP phone. Use Cisco Jabber to

JABBER JOURNAL

JABBER: INSTANT MESSENGER · What is Jabber? Jeremie Miller: Creator of Jabber. Open Source Jabber Community: A friendly community of end users and developers who value freedom of