(Ed: Please pardon me for the wall of text, but that last entry annoyed the heck out of me.)
You know how in your teenage and college fantasy where you played Dustin Hoffman in All The Presidents Men? Remember when you dreamed of getting that one little lead and following breadcrumbs from point A to Pulitzer Prize? Yeah, network security and audits are a lot like that. Your problem is that you’ve had eight years of getting used to reading gov’t reports and taking for granted that they tell the story. Stenographers ‘R Us, in a nutshell.
When you talk about IT or whether to ‘believe’ intelligence reports about it, do better than read a 13pp PDF directed to network admins. You should really look at the data supplied too.
This page released by CERT (that’s important) is the Joint Analysis Report released by the FBI and DHS. At the bottom is the link to the 13 page PDF that they released. What the author of the Rolling Stone article linked to in the last entry failed to do is look at the other file on that page. It’s available in a handy CSV file format if you don’t grok STIX XML. The CSV is utterly redundant. CERT only needs to distribute the STIX format as that’s what admins will use to harden their networks. The CSV is there for reporters.
Back to CERT, which is one of the most trusted of information disseminating entities in the world of IT. For the most part, they send out weekly bulletins about security related patches for firmware, OS’s, services, and applications. Occasionally they’ll send out flashes of things, but that is rare and a big deal when they do.
To say yesterdays publication via CERT is unprecedented may be accurate, but to question the make up of a document that is light on ‘facts’ misreads the purpose of the document. It was aimed at security and network professionals on the front-lines. It wasn’t written for reporters. If every administrator of machines and networks followed the recommended security setups and procedures in that document no one would ever be talking about hacking.
Now, rather than write an article complaining how not enough data was spoon-fed to you, you could look at the actual data files, contact some of the owners of the IP addresses and maybe figure out why the intelligence services are confident in their claim.
Email spam is already well-known. Targeted email is a different beast. If the target is a hunter then the crafted email they get looks like an email from Cabela’s. The hit ratio goes way up. Most people would just think that google sold their search info instead of them being the target of a malicious attack. In actuality the website the email links to goes to one of the domains below and hosts a malicious website made to look like Cabela’s site. It has javascript in it that infects your computer. Even worse, the link in the email is a shortened form link. ‘bty.com/276dfgr, ‘tco.com/erfgh’ or ‘ln.com/badlink’ so the target can’t verify the end point by looking at it. Anyone can make these.
These domains were used in targeted email spoofs.
www.cderlearn.com – 209.236.67.159 – WestHost, Inc. – Providence UT, USA
ritsoperrol.ru – dead domain name
littjohnwilhap.ru – dead domain name
wilcarobbe.com – dead domain name
one2shoppee.com – dead domain name
insta.reduct.ru – 146.185.161.126 – Digital Ocean, Inc., New York, NY
editprod.waterfilter.in.ua – 176.114.0.120 – FOP Sedinkin Olexandr Valeriyovuch – Boyarka, Ukraine
mymodule.waterfilter.in.ua – dead domain name
efax.pfdregistry.net – dead domain name
Of the 249 identified IP addresses, these are Canadian: (Any CDN reporters wanna call McGill? For kicks, maybe?)
167.114.35.70 – OVH Hosting – Montreal – McGill College
198.50.177.202 – OVH Hosting – Montreal – McGill College
142.10.38.212 – Ontario Hydro
69.70.199.50 – Videotron Ltee – Montreal
207.176.226.8 – Rigstar Communications Inc – Calgary
66.158.142.2 – MORGAN SCHAFFER INC. – Lasalle, Quebec
See below the fold for a numerical count of IP’s by country.
Continue reading →
