Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
Summary
Abstract: .........................................................................................................................................................2
Summary.........................................................................................................................................................3
Overview .........................................................................................................................................................4
1. Russian cybercrime......................................................................................................................................4
2. RBN at a glance ...........................................................................................................................................5
RBN activities / Web focus............................................................................................................................6
1. Malware diffusion .........................................................................................................................................6
2. Phishing......................................................................................................................................................10
3. Other malicious activities............................................................................................................................10
RBN organization / Network data ...............................................................................................................11
1. Overview on BGP and Internet...................................................................................................................11
2. Internetworking and AS peering .................................................................................................................11
3. ISP and IXP................................................................................................................................................11
4. AS Path ......................................................................................................................................................12
5. The RBN IP path ........................................................................................................................................12
6. The RBN Networks virtually........................................................................................................................13
7. The RBN Networks logically.......................................................................................................................18
8. The RBN Networks physically ....................................................................................................................19
9. The RBN Networks in the Internet..............................................................................................................20
10. Affiliates presentation through networks................................................................................................21
Too Coin Software .........................................................................................................................................21
SBT................................................................................................................................................................21
RBN ...............................................................................................................................................................21
AkiMon...........................................................................................................................................................21
Nevacon.........................................................................................................................................................22
Silvernet.........................................................................................................................................................22
Linkey ............................................................................................................................................................22
Eltel2..............................................................................................................................................................22
Luglink ...........................................................................................................................................................22
Eltel................................................................................................................................................................22
Other affiliates................................................................................................................................................23
RBN customers / Real stats ........................................................................................................................24
1. Running services on entities.......................................................................................................................24
2. Hosted web pages......................................................................................................................................25
Investigation and analysis ..........................................................................................................................27
1. Lookup, IP history, NS history and, registrar history...................................................................................27
2. Network Whois ...........................................................................................................................................28
3. Reverse IP and reverse NS analysis..........................................................................................................31
4. Simple DNS analysis..................................................................................................................................31
5. Whois history..............................................................................................................................................32
6. Information correlation and assumptions....................................................................................................35
A nefarious social network .........................................................................................................................36
1. Deliberately complex and false...................................................................................................................36
2. Behind the curtains.....................................................................................................................................38
RBN evolution ..............................................................................................................................................43
1. Changes in hosted domain names .............................................................................................................43
2. Changes in locations ..................................................................................................................................43
3. Evolution.....................................................................................................................................................44
Mitigation strategies ....................................................................................................................................45
4. Think big to understand the threat impact and to predict evolution ............................................................45
5. Act small.....................................................................................................................................................46
Conclusion ...................................................................................................................................................50
Annexes........................................................................................................................................................51
1. Tools and services used for this study .......................................................................................................51
2. RBN content ...............................................................................................................................................52
3