Russian Business Network study - bizeul.org

Version 1.0.1
RBN study – before and after
David Bizeul
Conclusion
RBN has succeeded in mastering the whole Internet scheme complexity: register IP addresses range with RIPE, create
a nebulous network to blur the understanding of their activities, settle agreements with legitimate ISP and impersonate
all public information about them.
Those guys are also using relationship to get help on some issues: be connected to an IXP/ISP and prevent authorities
from stopping them.
This nefarious organisation has become very convenient for hosting cybercrime activities and it may continue for a long
time. This shelter is one of the entrances of the internet hell.
Would you like your users/employee/customers to go to hell No Then why don’t you lock the hell door
Internet service providers do not want to interfere with their users but if they don’t, these users are at risk. ISPs will face
this kind of dilemma more and more in a close future and that’s why Internet regulators and countries have to enact
rules to promote ISP filtering against dangerous zones such as RBN. The world would live better without RBN IP range.
UPDATE: UK ISPs have taken a great first step forward by denying RBN IP range. This initiative should promote the
collaboration between ISPs and security sphere.
For sure, RBN will evolve in a close future to become as stealth as possible for curious people and as convenient as
possible for its customers.
Generally speaking, Internet participants should endorse minimum liabilities and regulators should punish participants if
rules are broken. This has to become real for IP address allocation, Whois registration, peering agreements and Internet
access. Law enforcement should also improve their understanding on cybercrime in order to protect legitimate actors
and to pursue new gangsters.
Acknowledgements:
- Cert-LEXSI
- An anonymous security investigator who wishes the end of Internet crime
- Other people who gave me some advices or reviews
50