mardi 7 octobre 2008

Atrivo, botnet, spam ...

On m'a *un peu* reproché de favoriser l'anglais sur ce blog, sachant que j'avais annoncé au départ que la proportion d'articles FR/EN serait à peu près respectée... Est-ce ma faute si je dispose majoritairement de flux RSS en anglais, et que les seules mailing-lists que je trouve intéressantes le sont également ? :-)

Bref, ce post n'est pas là pour blablater sur cet aspect linguistique, mais bien pour faire un peu le point sur le cas Atrivo/Intercage.

Pour rappel, cet hébergeur localisé aux US sur lequel j'ai déjà bloggé ici et hébergeait apparemment 100% de données illicites telles que de la pédopornographie, des consoles d'administration de malware, du phishing, des faux sites, j'en passe et des meilleures...

Suite à l'étude de Jart Armin (lien dans mon premier post sur Atrivo, *flemme*) et au mouvement d'ensemble de la communauté de lutte contre la cybercriminalité, Atrivo se retrouvait sans connexion, après quelques épisodes de changement de peer etc.

Un nouvel article, cette fois-ci d'Ars Technica, apporte de l'eau au moulin. L'article nous indique ainsi que selon Messagelabs, qui est entre autre je le rappelle un *énorme* gestionnaire de trafic e-mail, l'activité globale des botnets s'est vue baisser de façon significative à la fermeture d'Atrivo :

L'impact a été de courte durée, puisqu'Atrivo est revenu online après sa première fermeture du 21 septembre 2008, et que certains de leurs clients ont probablement commencé à migrer rapidement toutes leurs données illicites et leurs command&control vers d'autres hébergeurs bulletproof.

Le spam quant à lui, malgré le fait que d'autres facteurs soient à prendre en compte, a baissé de 8,1% pour septembre 2008.

La fermeture d'Atrivo depuis le 21 septembre a fait couler beaucoup d'encre, et la communauté des professionnels de la sécurité informatique et de la lutte contre la cybercriminalité semble actuellement sur un mode de réflexion un peu plus mature que simplement vouloir fermer de nouveaux hébergeurs bulletproof, et dieu sait qu'il y en a encore un bon paquet. Les réflexions sur une meilleure collaboration avec les services judiciaires font partie intégrante de cette réflexion, de laquelle il émergera peut-être de nouvelles méthodes de lutte contre ce type d'hébergeurs. Time will tell.

mercredi 24 septembre 2008

Cernel Panic

This is just a quick update on my post concerning Atrivo/Intercage.

A lot has been happening during the last few days. Atrivo lost all its upstreams providers, then came back, finding one provider, UnitedLayer, as can be seen on cidr-report. Anyway, while this was happening, some of the malware having its c&c servers hosted by Atrivo suddenly moved to another hosting company, namely CERNEL (.net).

It is interesting to see that Cernel.net has been registered through EstDomains.

Update (2008-09-25) : Cernel.net is unreachable at the moment. The domain is pointing to...an Intercage IP address. Need I say more ? :-)

vendredi 29 août 2008

Atrivo bulletproof host thrown under the spots

A new article from the excellent Brian Krebs has been published today on the Washington Post.

The article is spreading Jart Armin's whitepaper about ATRIVO, a famous hosting company ... Well when I say "famous" I should say famous to fraudsters and computer security researchers.

The case is quite similar to the RBN case at the end of last year : a bulletproof hosting company, acting for years, suddenly gets in the spotlights. Several things have been said concerning RBN. Having studied the organisation for a while, I have to say some releases about RBN have been upsetting me. According to almost the whole security community, RBN had disappeared...Only to be spotted and mentionned everywhere for any fraudulent action taking place in the malware/phishing/fraud world. RBN has spread all worldwide malware, has done every phishing case, has hosted all illegal content worldwide, and has attacked Georgia... Crap.

It just seems that most researchers have simply forgotten one thing: RBN had customers. When RBN "died", I heard shouts that they had gone to "AbdAllah" host for example. I think that's totally untrue ; people noticed fraudulent domains had moved from ex-RBN to AbdAllah, and claimed it was a RBN move, which wasn't, in my opinion.
Instead, it was only a move from customers, from one bulletproof hoster to another.

Now Atrivo is "following" the RBN case, being shown as an evil host. Emil K, its founder, is declaring just like Tim Jaret did for RBN, that he is responding to the abuse requests. But he doesn't. He's quite following the same politic of communication than Jaret.

As for Jart's paper, I don't agree totally with him, thought I respect his work. I won't say more, and let you read his paper. What will Atrivo's future be, now that all eyes are on them ? Will they vanish just like RBN did ? Time will tell...

Edit: (2008-09-01) It seems that some people are reacting fast (speaking of GLBX). Read this excellent article from Jose Nazario.
Edit: (2008-09-05) An excellent investigation from Knujon about Directi can be read here. Excellent work.
Edit: (2008-09-08) It seems that everyone is running away from Atrivo :
http://sunbeltblog.blogspot.com/2008/09/more-interesting-atrivointercageestdoma.html
http://voices.washingtonpost.com/securityfix/2008/09/scam-heavy_us_isp_grows_more_i.html
Edit: (2008-09-09) Another striking article from Brian about EstDomains this time. Brian is very active recently against cybercrime hosting companies and registrar, and it seems to work fine. This shows us all the power of the press... But it shouldn't go too far, since it could ruin some LE investigations. I hope it will not be the case.

Update: (2008-09-15): EstDomains declares global war against malware... Can you really believe it ? Article here.

Update (2008-09-15): Thanks to Communautech for a nice french article here.

Update (2008-09-17): Gary Warner has done a great work, showing us a huge amount of domain names pointing to Intercage. Here is the result.
Update (2008-09-22): Atrivo seems to be down for the moment. link here and here.
Update (2008-09-22): Atrivo is back tonight. Some new peering appeared, as can be seen here:

Report for AS27595
Name
INTERCAGE - InterCage, Inc.
AS Adjancency Report
In the context of this report "Upstream" indicates that there is an adjacent AS that lines between the BGP table collection point (in this case at AS2.0) and the specified AS. Similarly, "Downstream" refers to an adjacent AS that lies beyond the specified AS. This upstream / downstream categorisation is strictly a description relative topology, and should not be confused with provider / customer / peer inter-AS relationships.
27595 INTERCAGE - InterCage, Inc.
Adjacency: 1 Upstream: 1 Downstream: 0
Upstream Adjacent AS list
AS23342 UNITEDLAYER - Unitedlayer, Inc.

Thanks to cidr-report.org as usual for the info :-)