Who Else Was Hit by the RSA Attackers?

94 thoughts on “Who Else Was Hit by the RSA Attackers?”

1. brucerealtor October 24, 2011

   Brian

   Thank you very much for your diligent work and reporting of this list to us today.
2. AKL October 24, 2011

   Something wrong with your chart because i see more than one russian C2 in the list
   1. BrianKrebs Post authorOctober 24, 2011

      AKL – The chart and the list look at two different aspects of this attack. The list is a list of organizations that owned the Internet addresses that were seen calling home to the command and control (C&C) networks used by the attackers. The chart just shows the geographic breakdown of those C&C networks.
      1. Uzzi October 26, 2011

         Dear Brian, thanks for the fun so far, but this needs clarification because some folks can’t estimate the impact:

         “The list is a list of _networks belonging to_ organisations that owned the IP addresses that were seen calling home to the command and control (C&C) networks used by attackers.”

         For example we find MICROSOFT-CORP—MSN-AS-BLOCK on the list, which AS8075 belongs to. And let’s assume if there were bots on this network chances are they still have infections…

         A quick check for AS8074 on UCEPROTECT shows that at least 9 of their IPs were seen spamming last week:

         65.52.145.245 6 Spamtrap-hit/s
         65.52.146.226 1 Spamtrap-hit/s
         65.52.153.209 8 Spamtrap-hit/s
         65.52.154.69 8 Spamtrap-hit/s
         70.37.65.32 65 Spamtrap-hit/s
         157.55.160.108 1 Spamtrap-hit/s
         157.55.161.209 1 Spamtrap-hit/s
         157.55.178.53 1 Spamtrap-hit/s
         157.55.193.31 2 Spamtrap-hit/s

         Let’s have a look at http://cbl.abuseat.org:

         65.52.145.245 listed / infected with trojan or proxy
         65.52.146.226 listed / infected with trojan or proxy
         65.52.153.209 listed / infected with trojan or proxy
         65.52.154.69 listed / infected with trojan or proxy
         70.37.65.32 not listed
         157.55.160.108 not listed
         157.55.161.209 not listed
         157.55.178.53 listed / infected with trojan or proxy
         157.55.193.31 not listed

         Seems like there are still some infected machines spooking around at some microsoft facility. But without an inside view and without knowing their security policies we can’t tell if those machines are of any risk for the company – even if those machines have high chinese traffic. 😉

         Let’s check for another example: VOLKSWAGEN. – If you know how to use Senderbase.org you come to find that 194.114.76.23’s reputation is ‘Poor’ = A problematic level of threat activity has been observed…

         …but as 194.114.76.23 is part of Volkswagen’s Autostadt (“an amazing mixture of amusement park, museum and inner city relaxation area”) it’s likely people take their notebooks around. Any risk for the company? – Most likely not… even if a notebook belongs to a chinese visitor.

         Yes, every company should have their software, policies and admins up to date – and we all should bother Microsoft until they update all their windows installations worldwide free of charge – but a list of most of the internet networks because they’ve had some C&C traffic does just mean that. Cybercrime and is a threat to all of us. Chinese or not. 😉
3. Christian October 24, 2011

   looks like the great chinese Firewall is only wirking in one direction 😉
4. Matt October 24, 2011

   Hi Brian,

   Good article. Please could you provide me with source of this data.

   Thanks

   Matt
5. Curious October 24, 2011

   I’m with Matt: How -did- this data come about? The way you worded it, you implied it was searched for historically. That is, using what we knew in… January or so, we searched backwards in time to the prior November, to see who was communicating with what IP Addresses.

   How did that happen? I’d really like a congressman to inquire.

   One theory would be as part of the ‘Warrant-less Wiretapping’ program, the government could have a pen register on all the transatlantic cables. I’d like to think that isn’t the case… but it wouldn’t surprise me.
6. Alibert October 24, 2011

   Yes, Source please. Without source its just a bunch of senseless words.

   Furhtermore: Where all the connections C&C connections or may there be legit connections, i.e. the servers serving banners.

   I still doubt the APT in this attack, see here for a writeup: http://jeffreycarr.blogspot.com/2011/06/18-days-from-0day-to-8k-rsa-attack.html (not mine, just the first hit)
7. Mentor October 24, 2011

   Kind of a douchebag move without the the proper context isn’t it? I’m all for more information like this coming out, but this is steaming pile of FUD.

   This must have been all the information anyone was willing to give you, couldn’t you talk anyone into finishing the work for you?

   Good luck with the book!
8. Andrew October 24, 2011

   At least a couple of those “victims” probably aren’t.
   Traffic from WebSense and OpenDNS could as easily have been proxied on the their customers behalf.
   1. BrianKrebs Post authorOctober 24, 2011

      If I could be more specific about the source of the data, I would, but I’m not at liberty to do so. I wouldn’t have posted this information if I didn’t think it was reliable data.

      Your points were addressed in this paragraph, from the story above:

      “A few caveats are in order here. First, many of the network owners listed are Internet service providers, and are likely included because some of their subscribers were hit. Second, it is not clear how many systems in each of these companies or networks were compromised, for how long those intrusions persisted, or whether the attackers successfully stole sensitive information from all of the victims. Finally, some of these organizations (there are several antivirus firms mentioned below) may be represented because they intentionally compromised internal systems in an effort to reverse engineer malware used in these attacks.”
      1. Alfred Huger October 24, 2011

         I doubt the AV firms mentioned are running ‘honeypot’ systems on their own publicly noted address space. Typically this is done through shell companies or address blocks so as not to have your honeypot’s cover blown to early.
         1. JCitizen October 25, 2011

            I’m not an AV company, but I can attest that from 2006 to 2008 my perimeter gateway UTM pie charts looked similar to these offered in the story. Since then the Chinese have become a little less brazen, and the IPs started originating from “University ” addresses; but now are more obfuscated, and my ISP is gaining ground as well.

            After I supplied data to my ISP, they not only reduced this traffic, but the local back ground radiation as well. I really have to give them a lot of credit to this effort. I also believe attempts, that fail externally, are dropped when no success is reached in a certain amount of time. These charlatans can now rely more on success by interior infections, direct physical espionage, and social engineering attacks.
9. anna October 24, 2011

   Maybe interesting for you, to read a bit about root cause structural problems & Solution in the IT-Sec arena?

   quick start:
   http://www.qcic.nl/item.jsp%3Fnews=85.html
   http://www.qcic.nl/item.jsp%3Fnews=61.html
   1. hhhobbit October 25, 2011

      Thanks for posting these links at qcic.nl. The NL police need to point people with problems in the Netherlands towards them. The first link truly indicates why the list above exists.
      1. anna October 31, 2011

         Its a shame that most people prefer negative [Its Bad!] ‘news’,
         and can’t be bothered to learn about why those things became ‘bad’ and even more interesting how to actually Fix such common bad habits.

         Anyone knows why this is?
10. Doug October 24, 2011

    Brian;

    I too am interested in what you are using as the basis for your list. Not who gave you the data, but what that data was based on. Was it based on nodes/hosts that were infected by malicious excel files using the same flash 0-day that infected RSA, or was it based on nodes/hosts that had the RAT beaconing out? If it is the later, then I think the information is suspect since the Poison Ivy RAT isn’t unique to this particular hack.
    1. futurelux October 24, 2011

       ……….the latter… the later. a Q. of grammer
11. CW October 24, 2011

    You get an “F” on this homework assignment! You’ve listed every Internet Service Provider where this bot crossed their network. At a minimum, you could have called RSA and verified that these companies are even RSA customers. There are companies on this list that I know are NOT RSA customers.
    1. RT October 24, 2011

       You get an “F” for reading comprehension.
       “Security experts have said that RSA wasn’t the only corporation victimized in the attack, and that dozens of other multinational companies were infiltrated using many of the same tools and Internet infrastructure.”
       1. hhhobbit October 25, 2011

          Kudos RT. You have given the best summary of the problem I have observed. The detractors are saying they want where the data came from (which can not be revealed) and won’t believe it until it is revealed. They remind me of the proverbial Ostrich sticking their heads in the sand. They seem to argue thace since there is no disclosure of the source data that there is no problem. I suspect the problem is even larger than what Brian is showing. There are probably even more Fortune 500 companies affected than what he shows. Some of them would even claim they were still not infected even if they were informed by who it was that gave Brian the data that they had a problem. There is a growing anti-security stance which is gripping the entire world right now. Why do I say this? You known it is bad when the US Air Force doesn’t want to eradicate some malware in their drone systems. Ten years ago the Air Force wouldn’t have even tolerated it.
12. abadidea October 24, 2011

    The mystery of “NO_NAME” is going to keep me awake at night.

    Actually, this whole list is. At least my employer is not on it 😀
    1. timeless October 25, 2011

       The output appears to be AS [1] entries. You could review the complete list [2] to confirm.

       You can see a graph of AS entries [3] which lists NO_NAME. This is well outside my area, but my guess is it means some tool was mapping ip addresses to ASs and whenever an ip address *didn’t* map to an AS, it rendered “NO_NAME”. However, I really don’t understand how that would work, one possibility is things like 10.0.0.0 specified in RFC 1918 [4] would count as NO_NAME, see sample output from ultratools [5] for a case with similar text but a “pretty error”. More information could probably be found from ARIN [6]. If they aren’t RFC reserved entries, it’s possibly they’re bogons [7], I’m not really sure which would be scarier.

       [1] http://en.wikipedia.org/wiki/Autonomous_system_%28Internet%29
       [2] http://bgp.potaroo.net/cidr/autnums.html
       [3] http://www.robtex.com/as/as8426.html
       [4] http://tools.ietf.org/html/rfc1918
       [5] https://www.ultratools.com/tools/asnInfoResult?domainName=10.0.0.0
       [6] https://www.arin.net/
       [7] http://web.archive.org/web/20080430130611/http://www.completewhois.com/bogons/

       @Brian: sorry for the link bits, you’ll have to approve it :).
13. Tee October 24, 2011

    I see that Google, Microsft, and Yahoo are on the list. Could the above RSA-related compromises account for the continuing conscription of contacts in Yahoo and Live (Google?) accounts that result in the spewing of SPAM to said contacts? Seems somewhat far-fetched, but I thought I’d pose the question, anyway.

    Such a mail account compromise happened to me in early July. I found that my account was accessed by a node in some foreign island nation (forget which). My contacts must have been obtained at that point. Then SPAM sent on my behalf, but not through my account (I was able to examine the headers of one of the messages). My password was (is) not easily guessable. Yahoo groups to which I subscribe appear to still be under such attacks, daily. My machine was not compromised. I inspected the registry, the logs, and running programs. I removed the hard drive, mounted it on an external USB interface, and scanned it from a safe machine with multiple AV programs. Worst thing found was a spyware cookie. I use FF+NoScript. Never any behavioral indications that it was ever compromised. I can document most of this.

    Just last week, one of my users reported receiving similar SPAM from his brother, who uses a Live account. After examining his machine for most of the day, I concluded that FF+NoScript had blocked his PC from being infected when he clicked the SPAM link and visited the target website.
    1. JCitizen October 25, 2011

       I have a client who is a Microsoft partner whose account has been compromised for months, and Microsoft doesn’t seem interested in doing diddly about fixing the problem. This client suspects it is an inside job; but I reserve judgment until I can train this person in basic local machine policy and security in general.
14. sprawlxy October 24, 2011

    If you can’t divulge the source, can you divulge the raw data that gives timeframes and explanations of the traffic that was seen?

    Without this information your article is irresponsible alarmism that damages the listed companies. The traffic could have just been a handful of packets before an IPS kicked in (i.e. normal controls are working), someone checking their own controls by contacting known C&C servers, or an actual infection. We will never know without the raw data.
15. RR October 24, 2011

    At this point it’s safe to assume that every company that competes with, buys from, or sells to China has been compromised and fully rooted.
16. J October 24, 2011

    Maybe you can’t tell the source (who gave you the info) but what data is this based on? Actual connections from a backdoor or is this based on DNS lookups? I can make any company with an open DNS server look like they’ve been infected…
17. ChesterCheetah October 24, 2011

    Appreciate the info. I’ll ask the ? that affected organization’s are asking – does a mechanism exist for companies on this list to find out how / why they showed up on this list?

    Normally in situations like this there is a way for affected orgs to get an additional bit of insight in order to take remediation / incident response steps.

    Another question: the article states that the devices were calling home to some of the same phone home control infrastructure, is this infrastructure assessed to be sole purpose or there indications that it may have been used for or is affilated with other botnets, malware purveyors.

    Thanks …
18. bt October 24, 2011

    “Source!” “Burn the source!” “Kreeeebs, give us your source!” “SOURRRRRRCEEEE. MUST BURN THE SOURCE.”

    Jeez guys would you quit it with the obvious fishing expeditions?
    1. bt October 24, 2011

       To put it in a more eloquent way, there are many situations where you don’t expect or anticipate learning the source of some info.

       For instance you don’t go prodding someone who you buy drugs off of for their supplier. It’s called knowing your place. In this case ‘your place’ would be the reader. While having every bit of info cited is nice that’s just not how life works.

       For now be happy you are getting tidbits of info without paying a monthly subscription to some uber leet super secret forum of doom where people hash out their plans for world domination. Kthx.
       1. g October 24, 2011

          Yeah, sorry, these aren’t juicy tidbits. These are assertions that various companies have been compromised — possibly libelous, even — with no backing.

          You’re not selling me drugs, you’re forcing drugs down my throat and then telling me not to question the supplier.
          1. BJ October 25, 2011

             G,

             Unless you were subjected to a “Clockwork Orange” type treatment, nobody forced this down your throat.

             If you want to discount this information because Brian will not reveal his sources, that’s your prerogative.
       2. Alfred Huger October 24, 2011

          I really admire your work Brian but I tend to agree with some of the folks who are a little critical of this data being posted without any context. How this data was gathered and how it was judged is critical to actual give it any veracity.

          That it was shared with the Government does not lend it anymore credibility to me than if it was shared with any random party. In fact people sharing stuff w/ Congress nearly always have an agenda. Especially if they are a security vendor or service provider of any description.

          I am indifferent to who the source is but a better understanding of their data, your caveats notwithstanding, I think is sorely needed here.

          al
19. dp October 24, 2011

    Brian, you know better. This is extremely reckless journalism on your part. This looks like it’s probably DNS related, and if so, ANY DNS lookup would cause a hit on your list. That means anyone doing a dig to see IP information, pinging to see if the site is still up, trying to hit it with a browser, etc. Unless you have solid visibility on the C2 itself there is no way to determine that these sites where “other places the RSA attackers hit” as your article title states.

    You should probably take this down. If you don’t provide enough detail for independent verification, this is just FUD.
    1. timeless October 25, 2011

       It’s DNS related to the extent that DNS is a low level of the Internet and AS are also a low level of the Internet. As it happens, I think it’s fairly safe to say that AS is a much *lower* level.

       What you’re probably looking at is:

       1. {victim} sends pattern of packets to {C&C}
       2. either someone hacks the {C&C} or someone observes the packets going to it.
       3. Let’s assume someone observes {C&C} (hacking {C&C} is boring, it obviously could have a log of whom sent it valid chatter)
       4. {observer} can easily only record instances where a proper stream of packets (understood to be “well formed chatter”) are sent by {victim} to {C&C}
       5. What should {observer} report?

       Choices:
       a. IP Addresses
       – problems: Dynamic ip addresses, too many ip addresses = totally useless
       b. DNS entries
       – problems: Dynamic, chaotic, meaningless, not necessarily round trippable, too many names (potentially nearly as many as ip addresses) = totally useless
       c. AS entries
       – problems: Not every company has an AS assigned, some companies have a couple
       – value: Big companies (and organizations) *do* have them, and at most only a couple, there are only a handful of AS Numbers out there (well, ok, maybe a couple thousand, but really it’s *much* better than IP addresses or dns entries)

       AS entries don’t solve every problem, obviously if an ISP hosts others then those it hosts will appear in an AS assigned to the ISP. However because ISPs are responsible for traffic from their ASN, it’s in an ISP’s best interest to make sure it can do something with ASN info, and general best practices say that you should give one ASN to yourself and one to what you host so that when someone yells at you, you can say “oh, that’s a customer, we’ll get on it”, instead of having someone say “oh, that ISP is evil/clueless/hacked, let’s block it”.

       It isn’t uncommon for “ASN” [1] to come up as a possible target of an Internet Death Penalty [2].

       [1] http://www.mail-archive.com/vox-tech@lists.lugod.org/msg08765.html
       [2] http://catb.org/jargon/html/I/Internet-Death-Penalty.html
20. brucerealtor October 24, 2011

    Sometimes information of a partial nature aims at precipitating further conduct from one’s adversaries.

    As in Sun Tzu’s Art of War, or even the 38 Stratagems of Ancient China.

    As regards issues of ‘defamation,’ the 3 caveats repeatedly noted would make such a claim ‘challenging.’
21. rsc October 24, 2011

    This appears to be a list of AS (Autonomous System) network names. Look some of them up at “www.arin.net”.

    Back when Merit Network, Inc. ran the internet (with MCI and IBM – I was with Merit in the dialup business then), Merit was able to do network by network traffic statistics matrices – i.e.: how much traffic of what kind – DNS, FTP, UUCP, SMTP – went from one network to another network. This was back when the Internet was MUCH smaller – and even then, scaling of the network routing tables were a problem. This was about the time BGP and autonomous system numbers were invented to simplify the network routing problem of 255 class-A networks + 16535 class-B networks + 16777216 class-C networks.

    All I can think is that the Department of Homeland Security has it’s tentacles in enough ISPs that they can collect a cross-matrix of AS to AS traffic statistics on a historical basis (which is still probably gigabytes of data per. day – depending on how deeply they inspect the packets.) I think this is reasonable speculation of MINIMAL capabilities of the DHS/NSA – based on what’s already been revealed about the AT&T’s relationship with the US Federal government.

    Brian – not citing where the data comes from is fear mongering, plain and simple.
22. L. Carlson October 24, 2011

    Doesen’t anybody at these hacked companies check their *multilayered* outbound router logs 1/2 hourly for suspicious outbound traffic to strange IP addresses, or would that be too easy?
    1. Infosec Geek October 25, 2011

       actually I suspect it would be too hard. at least not without a good toolset, and folks having a good toolset are less likely to be on that list. A big enterprise network will have so much traffic you won’t be able to tell what’s funky without some automated help, and that requires custom rulesets tuned for your network.

       To get your mind around the problem, consider this. Last week I heard an assetion that a typical browser these days can open hundreds of simultaneous connections for one simple view (last time I sniffed a session it was just a couple of dozen for a simple page load but that was awhile ago). So think about the noise from that with ads, google results prefetches, etc.

       These are not your home hobbyist or SOHO networks.
23. Anderson October 24, 2011

    Krebs has it backwards and this list actually communicates quite the opposite conclusion:

    Not appearing in this list implies that a given company’s security team did not investigate the RSA breach on their own network. Otherwise they would have generated investigative traffic to it and appeared as a FP in the above list. This is much easier to do than running malware in a sandbox, as Brian suggests.

    Brian – you may have accurate data – but you have come to an entirely inaccurate conclusion from it
    1. timeless October 25, 2011

       I’m pretty sure that the data is based on observations of the C&C destinations (roughly inbound) and not based on origin (roughly outbound). Brian noted that there are around 300 destinations, which makes observing them or doing data gathering at that side *much* simpler than trying to do data gathering at all possible sources.
    2. TK October 25, 2011

       Krebs conslusion is flawed. Anderson is right — there is as much evidence that Bluecoat and others *were* intentionally investigating these servers as there is that the others *weren’t* looking into them as well.

       Just because we aren’t infosec companies, doesn’t mean we don’t know what we are doing.
24. Arion69 October 25, 2011

    Why is everybody crying after source? It is irrelevant. The breaches happen more often and too easily. It has become clear that everyone can be victimized so why bother thinking who has been hit or not. Focus on fixing these problems before it is too late.
25. ASG October 25, 2011

    Sorry if I missed that, but does anyone know the IP adresses of the C&C Servers? I would like to know them to do a search in our SIEM System…
26. Secfl October 25, 2011

    I think it’s interesting that Websense made the list. With there latest and greatest URL database and real-time threat scanning, one would think they would block or detect this type of threat unless they were reverse-engineering the attack.
    1. Matt October 25, 2011

       Not sure why anyone is surprised or upset about being on the list. Also, why wouldn’t you expect security companies to be on the list (e.g. Websense)? They have security ignorant (couldn’t think of a more kind word) folks who work in accounts payable, accounts receivable, etc, etc just like the rest of us. Furthermore, none of those gateway security products do an adequate job of preventing these attacks. We have best of breed enterprise web gateway anti-x and best of breed client anti-x and best of breed mail gateway anti-x and stuff sails past it all on a daily basis.
27. Terry Ritter October 25, 2011

    Somewhat Off Topic, but almost the last chance: The US government has issued a Request For Information (RFI) on malware and bots, see:

    http://www.federalregister.gov/articles/2011/09/21/2011-24180/models-to-advance-voluntary-corporate-notification-to-consumers-regarding-the-illicit-use-of#p-27

    The comment period ends 2011-11-04.

    A copy of my response is on my site at:

    http://www.ciphersbyritter.com/COMPSEC/ADVISING.HTM
    1. hhhobbit October 25, 2011

       Terry, I read your comments very carefully. The only difference between you and me is you are more optimistic than I am. So I will let your comments stand. But a discussion of bots and this are really the same thing. It boils down to one question – are there concrete things we can do to reduce the size of this problem (infected computers) to something manageable? I gave some of them which are more appropriate for this than the bots here (but they apply to both and at the same time also battle phish):

       http://securemecca.blogspot.com/2011/04/advanced-persisten-threat.html

       The problem comes in on that third bulleted item. At present there really isn’t a good STABLE, INEXPENSIVE replacement for Microsoft Windows.
       There could be if the Linux people could just stop thrashing around and make their changes far less revolutionary and more evolutionary. Example? Why did Ubuntu replace gnomeshell with a new GUI that creates hundreds of files on the desktop of my neighbors machine when he moves his mouse too fast? What was so deficient in gnomeshell that it had to be replaced? I know people that are still using VTWM (Virtual Tom’s Window Manager) because they got used to it and don’t want to change their GUI every 2-3 years. Fortunately they don’t have to manage right to left languages like Arabic or Perso-Arabic which some people need. I can only hope that Apple finally made it so you have to type a pass-phrase to install software into the privileged file system space. If they haven’t done it yet they have basically taken the Unix file system protection and thrown it out the door (probably permanently).

       http://securemecca.com/public/ChmodTable.txt

       Also, no matter who argues to the contrary, Macintosh is probably more expensive than Microsoft. It definitely is with up front and hardware costs. Any time you have a monopoly on where the hardware can come from the prices go up along with assurance of compatibility.

       I can’t even update my Ubuntu LTS system to use the latest flash player. Adobe does their best but with libraries that are too old (the OS has only been in place for slightly over one year) the new version of flash won’t work properly. Linux people need to stop thrashing around and make an OS with at least a three year life-span. You are NEVER going to get that with Linux. Expecting people to replace their OS every 3-6 months or even every year just isn’t practical. This is especially true when they take the GUI you got used to and throw it out the door. There better be a very good reason to take something that was working, throw it away, and replace it with something else. I for one am getting tired of change just for changes sake.

       I have had my web-site blocked not just once but twice because my ISP’s anti-bot service isn’t anywhere near good enough and neither are the people taking care of it to distinguish a FP from from the real thing. I can assure them my Linux machines are not bots. I even blow away my ~/.mozilla and ~/.opera folders at even the hint of a JavaScript infection and create fresh new ones. In fact I do it every three months whether they need it or not. This is your number one source for infections of desktop Linux systems. Servers have other problems. I also highly recommend NoScript for Firefox but everybody I know removes it.

       I don’t think there are easy answers and expecting Senators and Representatives, much less secretaries who are fearful of computers to be the biggest contributors to giving us more security is too much to expect. As Matt said, even with the best stuff they still have packets heading out the door. If you ask me, this particular problem – companies infected just like RSA, is probably even larger than what Brian shows.
28. D October 25, 2011

    Brian:

    You need to provide a method for companies listed on this list to find the IP addresses that correspond to this data.
    1. timeless October 25, 2011

       https://www.ultratools.com/tools/asnInfo

       Would let anyone on the list find out the range of ip addresses which could contain the sources.

       However, the data was clearly lossily compressed such that a company would have to do some work to figure out which computers on their network are affected.

       Given that in general ASs pair with other ASs at relatively well understood borders, any network admin would understand where to go to add (hopefully check) logging of their AS domain. Given that the vast majority of the C&Cs are in China, I’d bet one could merely have one’s AS exits look for traffic headed to Chinese ASs (again, countably few).

       However, people have noted that the precise method of identifying bad traffic wasn’t provided in Brian’s article (which doesn’t bother me), so I’m not quite sure what one should look for in Chinese bound traffic once one identifies it (to distinguish C&C traffic from valid traffic). Although one could take the simplistic approach of “if you’re talking to China, you go into a penalty box until you complain”. With that system, if you’re lucky, you get only a handful of complaints, and you can slowly inspect each system and then let it out…. — I really don’t want to be that Admin, I like working on Web Browsers, it’s a much more relaxed job (and yes, we have Firedrills too, and they can affect more people than any single poor admin, but still, we didn’t try to clean up all of our customers, just send out a fixed software package).
       1. D October 26, 2011

          [quote]
          https://www.ultratools.com/tools/asnInfo – Would let anyone on the list find out the range of ip addresses which could contain the sources.

          However, the data was clearly lossily compressed such that a company would have to do some work to figure out which computers on their network are affected.
          [/quote]

          There are quite a few companies on this list that have multiple large aggregate blocks (off the top of my head I see down to /8’s in there) and multiple large backbone connections. Not having more specific information makes the name dropping useless.

          It would be nice to be able to do a lookup, based on ASN to identify infected IP addresses.
          1. timeless October 28, 2011

             the reality is that the only people who could do something truly useful with ip addresses are IT admins *within* their given organization. Further, only people who are not clueless will be able to do necessary cleaning and forensic analysis. Also, some of these companies will be using NAT, so an ip address won’t correspond to a single computer, merely a point of presence.

             Giving out a list of actual ip addresses really doesn’t benefit the general public. And if the people who collected IP addresses happened to miss a C&C point and thus miss other infected addresses, we don’t want a company to say: “we’re clean, we checked all of those IPs”.

             Cleanup / Analysis involves much more than simply looking at exit points, someone has to determine what data was stolen and whose credentials were compromised. The public facing ip list won’t get you there at all. It’s *better* to just know if your systems as a class were affected. That’s what the AS says. And for the ISPs in the list, hopefully they have a team which is savy enough to determine which of their customers were affected and notify them (in case those customers don’t have proactive IT).
29. n3kt0n October 25, 2011

    The detractors to this post are frankly clueless, but what do you expect when they do not have all the facts? Brian posted callback domains for the perpetrator C2 systems months ago. Organizations that were identified as affected need only go back to their DNS logs at the time window of the hacks (assuming they have DNS logs, right?) and look for beaconing to the following URL’s posted by Brian back in March. Or they can use one of the passive DNS databases for the IP records that are available to the good guy community. Some of those 2nd level domains are active right now for current exploitation. If they are only looking now for something that happened back in March, won’t help much. Look for active exploitation, NOW.

    http://krebsonsecurity.com/wp-content/uploads/2011/03/unclassrsa.jpg
    1. hhhobbit October 26, 2011

       To humor myself I just ran them through DNS. Many are now mapped to MS localhost (0.0.0.0) with one to 127.0.0.2. www(dot)cz88(dot)net is an alias to a numbered host at myisp(dot)cn. hopto(dot)org is a DNSWCD – DNS WildCard Domain. Whether or not that host goes to anything (most likely it doesn’t) is immaterial to me. I finally blocked the hopto(dot)org domain in my PAC filter because of all the malware it redirects to. hopto(dot)org’s IP address is constantly changing. But all redirectors and URL minimizers have an inherent risk unless you can see in advance where you are headed.
30. Disgruntled RSA customer October 25, 2011

    When will RSA customers take this seriously – RSA got hacked, RSA pretended it didn’t matter then finally ‘fessed up that it was a major breach endangering their entire customer base. RSA customers get hacked – is there a point where the customers question RSA about all of this or are they just going to carry on drone like eating the BS story that they are told – oh great we get free replacement tokens that means we are ok…..c’mon people wise up the whole integrity of RSA is broken and here’s a bunch of paying organisations who are paying the price.
    1. hhhobbit October 25, 2011

       Many of the US DoD and NASA contractors dropped RSA and are using other company’s products. RSA is suffering permanent big time losses over their break in.
       1. TJ October 25, 2011

          Why does this come back to RSA? If you believe those listed in this article you obviously don’t have any understanding of information security. This atricle only points out the fact that other organizations had machines that beaconed out to the same C2 servers as those that were used in the RSA attack. Have you heard any of these other organizations come forward?? You should take a few to really think what the adversary was after when they breached RSA and why they replaced tokens. With your wits, I am sure your organization is probably already owned.

          As far as people replacing tokens…you shoul probably check your facts abut the DoD and federal agencies walking away from RSA. As a consultant in the beltway, I can attest that not one of my customers has stopped using SecurID in both the classified and non-class environments. As someone else mentioned above, the federal governemtn and DIB (Defense Industrial Base) as long been impacted by these types of adversaries and have often fallen victim.

          I realize the desire to blame RSA, but all RSA has done as put the threat in the limelight and let people know it can happen to them.

          TJ
          1. hhhobbit October 26, 2011

             One of the editors at SANS said that cutomers did abandon RSA and that was over five months ago. Names of companies were of course not mentioned. So search the SANS digests and take your beef up with the SANS editor if you disagree with his statement. He knows some of the people at those companies personally. If you want to reply to Disgruntled RSA Customer for him bringing the subject up in the first place then do so. But reply to him rather than making this a personal attack against me. You basically called me stupid and I resent it. I suggest my real world experience of analyzing over 5,000 malware over the past six years with much of it being the the 3-4 hosts in sequence where the last one or two hosts go into DNS and drop out of DNS eight hours or less later only to be replaced by new hosts with updates of the malware used to steal you financial information has educated me far beyond my degrees in Psychology, Mathematics and Computer Science.

             Besides the problem is NOT just RSA. Don’t you think I know that? ALL companies should know by now that they may be attacked. What I am getting from some people here is that it isn’t even happerning at all. I even got the same email message that took Google down. It looked positively amateurish to me. But I wasn’t using Outlook on Windows. I was using Thunderbird on Linux. So even a nobody blocker can get attacked.
          2. Disgruntled RSA customer October 26, 2011

             Did you read what I read before posting this? RSA were breached they are to blame, it was unforgivable they didn’t tell us the truth about what happened so we could do something about it. Thanks for pointing out the obvious in your other comments that was profound.

             This is simple we paid them a fortune to protect us they failed – who else is there to blame?

             “I realize the desire to blame RSA, but all RSA has done as put the threat in the limelight and let people know it can happen to them.”
    2. TK October 25, 2011

       This should have been turned into a class-action, like Sony, months ago…
    3. Clive Robinson October 26, 2011

       @ Disgruntled,

       You are conflating two issues,

       1, being hacked.
       2, losing confidential data.

       All companies with an Internet connection get a “knock on the door” several times a day.

       Some of those knocks find unlocked doors some don’t.

       The chance of a knock finding an open door depends on how well known it is. By definition a zero day attack is unknown on first use, and depending on what it does and how much it is used it eventually becomes known.

       So any company can be hit by malware, even with the best detection systems.

       Infact there is an old truism that “if you don’t occasionaly have malware then you need to replace your security team”.

       What RSA and many other companies have done is for business reasons assume that malware cann’t harm them (fail #1). Then implement systems that contain sensitive information without the necessary checks and preventative measures (fail #2).

       The problem with such measures is that they are nearly all obtrusive in use and thus have high costs associated with them.

       Somebody at RSA decided to take a gamble that it would not happen, or that if it did they could hide the problem, thus they could save money (fail #3).

       As it is RSA has taken a “reputational hit” with some immediate financial implications. However over time other of their customers will leave them depending on what the cost is.

       RSA may even repair their reputation and thus prosper by getting sufficient new customers, or atracting back customers they have lost, but this may take years to do.

       Another asspect to such problems is actually knowing what is and what is not sensitive data and where it is actually used within your organisation and how.

       One significant problem is the non revocation of access as people get different jobs or promotion within an organisation.

       Sometimes you will find some secretary or accountant who has worked in many parts of an organisation has access to just about every source of data within the organisation, without currently having the requirment to have access.

       There are two issues with this,

       1, the employee might go rouge.
       2, The employees account might be used by others.

       Either way the company has a problem, especialy when “used by others” is done via malware, which you (should) know you are going to get hit by at some point.

Comments are closed.