Nota Bene

A few days ago Microsoft announced a large scale raid on the dynamic DNS service No-IP, as a result of which 22 of its domains were seized. The guys in Redmond said there were very good reasons for this: No-IP hosts all kinds of unpleasant malware; No-IP is a breeding ground of cybercriminals; No-IP is an epicenter for targeted attacks; and No-IP never agrees to working with anyone else on trying to root out all the badness.

Like in most conflicts, the sides have exchanged the contradictory volleys of announcements in the eternal tradition of ‘it’s his fault – no she started it’.

In particular, No-IP has said it’s a real goody-two-shoes and always willing to cooperate in eliminating sources of cyberattacks, while its clients are most displeased with the raid and consider it an illegal attack on legal business – since it’s possible to find malware practically anywhere, so interrupting services through a court is simply not on.

Is it legal to shut down a service because of #malware found?… When it can be found everywhere?…Tweet

In the meantime, the result of the raid has been rather far-reaching: more than four million sites were pulled, including both malicious and harmless ones – affecting 1.8 million users. Microsoft is trying to sieve the wheat from the chaff and get the clean sites back up and running; however, many users are still complaining about ongoing disruption.

To work out who’s to blame is a thankless and probably hopeless task. I’ll leave the journalistic investigations to… the journalists. Instead, here let me give you some food for thought: dry, raw facts and figures – so maybe/hopefully you’ll be able to come to your own conclusions about the legality and ethicality of MS’s actions, based on those facts and figures…

1)      Shutting down 22 No-IP domains affected the operations of around 25% of the targeted attacks that we keep track of here at KL. That’s thousands of spy and cybercriminal operations ongoing for the last three years. Approximately a quarter of those have at least one command and control center (C&C) with this host. For example, hacker groups like the Syrian Electronic Army and Gaza Team use only No-IP, while Turla uses it for 90% of its hosts.

2)      We can confirm that out of all large providers the No-IP dynamic DNS was the most unwilling to cooperate. For example, they ignored all our emails about a botnet sinkhole.

3)      Our analysis of current malware shows that No-IP is often used by the cyberswine for botnet control centers. A simple search via the Virustotal scanning engine confirms this fact with a cold hard figure: a total of 4.5 million unique malware samples sprout from No-IP.

4)      However, the latest numbers from our security cloud (KSN) show something not quite so cut and dry. Here’s a table showing detections of cyberattacks from dozens of the largest dynamic DNS services:

So – No-IP isn’t leading in the number of detections, even though they’re still really high compared to most.

Here’s some more info for comparison: the % of malware hosts in the .com zone makes up 0.03% of the total; in the .ru zone – 0.39%; but in No-IP the figure’s 27.5%!

And now for other figures that add a bit of a different perspective: in one week, malware domains on No-IP generated around 30,000 detections, while in the same week on one of the most malicious domains in the .com zone, the figure was 429,000 – almost 14 times higher. Also: the tenth most infected domain in the .ru zone generated 146,000 detections – that is, about the same as the first ten providers of dynamic DNS mentioned above put together!

To summarize…

On the one hand, blocking popular services that are used by thousands – if not millions – of typical users: it ain’t right. On the other hand, closing spawning grounds for malware is right – and noble.

The takedown of No-IP domains. Was it right or wrong? Ambiguity with a big ATweet

But then mathematics takes on the role of devil’s advocate, and proves:

Quantitatively, closing all the domains of No-IP is no more effective in combatting the distribution of malware than closing one single top malware domain in one of the popular zones, i.e., .com, .net, or even .ru. Simpler put, even if you were to shut down all providers of dynamic DNS – the Internet still wouldn’t become ‘cleaner’ enough to notice the difference.

So there you have it – ambiguity with a big A. 

It leaves anyone in their right and honest-with-themselves mind to admit things are far from black and white here, and as regards the right and wrong, or good and bad, or Nietzsche’s thing – who can tell?

Still, another thought comes to mind at some point while reflecting on all this…

It’s further evidence that as soon as the quantity of piracy or degree of criminality gets above a certain threshold, the ‘powers that be’ get involved all of a sudden and start closing services, ignoring any notions of Internet freedom or freedom to do business. It’s just the way things are, a rule of life of human society: If it stinks, sooner or later it’ll get cleaned up.

The list of blocked services is already rather long: Napster, KaZaA, eMule, Pirate Bay and so on. Now No-IP‘s been added to the list.

Who’s next?

// Bitcoin? It’s already begun.

According to various sites on the Internet, Bergen is the wettest, rainiest city of the European continent. Don’t believe a word of it! Me and some pals were in the city just recently and in all the three days there not a single drop of rain fell on any of us. In its absence was a preponderance of sun – so much so that our cheeks became redder than the king prawns on offer in the Bergen fish market (see pic further below).

And probably up to 200 kilometers away there was nothing but clear sunny skies too, save for a few fluffy clouds. Only on the horizon did there sometimes appear something reminiscent of light rain. The locals were also fairly amazed too – they’ve never known such rain-free summery days here ever!

Read on: fish appetizer, fish main dish and a desert …

Stock market hacks for microsecond delays.

Cyber-swindling gets everywhere. Even the stock market. First, a bit of history…

The profession of stockbroker was once not only respected and honorable, but also extremely tough. Dealers in stocks and shares once toiled away on the packed floors of stock exchanges and worked silly hours a week, stressed to the limit by relentless high pressure decisions all day (and night). They bought and sold securities, stocks, bonds, derivatives, or whatever they’re called, always needing to do so at just the right moment while riding the waves of exchange rates and prices, all the while edging nearer and nearer to serious heart conditions or some other burn-out caused illness. Other times they simply jumped out of windows to bring a swift end to it all. In short – hardly the world’s best job.

Anyway, all that was long ago. All that hard manual labor has been replaced by automation. Now thinking hard, stressing and sweating aren’t needed: a large proportion of the work today is carried out by robots – special programs that automatically determine the very best moments to buy or sell. In other words, the profession of stockbroker has in large part been boiled down to the training of bots. And to these bots reaction times – to the microsecond – are vital to take advantage of this or that market swing. So speed literally depends on the quality of an Internet connection to the electronic stock exchange. That is, the nearer a robot is physically located to the exchange, the higher its chances of being the first with a bid. And vice versa – robots on the periphery will always be outsiders, just as will those not using the very latest progressive algorithms.

These critical reaction times were recently tampered with by unknown cyber-assailants. A hedge fund’s system was infected with malware to delay trading ability by a few hundred microseconds – which can – and probably did – make all the difference between clinching deals and losing them.

Read on: Your password for a Twix?…

Privyet everyone!

There are fascinating, beautiful sights to behold in the furthest corners of the globe, quite a few of which I tend to mention on this here blog from time to time. But sometimes spellbinding beauty can be found right on your doorstep…

Just the other day for example, towards evening the most amazing assortment of clouds appeared over the reservoir next to our Moscow HQ office. First there were pure white fluffy clouds basking in the bright sun, and then a thick thatch of dark and angry low cloud came along as if pushing the fluffy cumulus out of the way. Alas, by the time I’d fetched my camera most of the particularly unusual dark cloud had passed, but I did still manage to snap some of the proceedings…

Read on: Little Fluffy Clouds…

Patent trolls – continued.

Here, alas, passions are still running high, with the occasional fit of… passion. Indeed, the issues related to patent parasites haven’t gone away; it’s just that only the most interesting – ‘loudest’ – cases ever get heard about. But if you dig deeper, you eventually hit upon stuff that is interesting, just not paid attention to. Which is what we did – and found quite a bit on patent trolls worthy of the title of this blogpost. So, he we go…

The irony’s all too much.

For this item I didn’t have to dig all that deep actually – I just checked Ars Technica. There I found some rather familiar glorification of the patent aggregator RPX – made out to be a sweet and innocent protector of orphans, the poor, and princesses (from dragons). I just couldn’t believe what I was reading: “RPX works by selling memberships to companies that feel harangued by patent trolls, including Apple and many other tech companies. RPX basically buys up patents it believes will be used by trolls. By uniting the buying power of many companies, it can get the patents for a bargain price.”  Well, maybe I could believe it… I was just so rattled at being reminded of the hypocrisy.

WHAT? RPX is some kinda anti-troll? And trolls may fly…

Source

We first came across this so-called anti-troll in the year of its creation, and were one of the first to bite it back – successfully.

Read on: a simple arrangement…

Now, for any Moscow drivers who were held up one recent sunny afternoon by an army of retro-mobiles slowly edging along Leningradsky Shosse and Prospect – SORRY! It was us, KL, putting on some old-school Ritz for our highly valued partners from all over Western Europe.

The smiles are contagious…

‘State Duma’ [Parliament]

On June 15, 2004, at precisely 19:17 Moscow time something happened that started a new era in computer security. We discovered the first malware created for smartphones.

It was Cabir, which was infecting Symbian-powered Nokia devices by spreading via unsecured Bluetooth connections. With its discovery the world learned that there was now malware not just for computers – which everyone already knew too well about (save for the odd hermit or monk) – but also for smartphones. Yes, many were scratching their heads at first – “viruses infecting my phone? Yeah, pull the other leg” – but the simple truth of the matter did finally sink in sooner (= months) or later (= years a decade!) for most people (some still aren’t aware). Meantime, our analysts made it into the history books!

Why did we christen this malware Cabir? Why was a special screened secure room created at our Moscow HQ? And how did Cabir end up in the pocket of an F-Secure employee? These and other questions were recently put to Aleks Gostev, our chief security expert, in a interview for our Intranet, which I thought I’d share with you here; might as well have it from the horse’s woodpecker’s mouth…

Incidentally, the story started really running when we used these two devices to analyze the malware:

…but more about those below…

Read on: An unusual file n the inbox…

Back towards the end of the 1990s was when a KLer first had a child. My toast at the baby’s head-wetting went something like this: “At last we’ve assimilated viruses ourselves – and started to multiply!”

Since then we’ve been motivating employees in various ways to have more children! The more the merrier, I say. Yes, we’re quite family-friendly here at KL – kid-friendly even more so. It’s quite funny how the KL-kiddie situation has evolved: At first, every time a KL-cub entered this world we would all get together and not just wet, but fairly drench the poor little thing’s head :). A few years later, as the frequency went up dramatically we’d just chip in for a nice prezzie for the happy new mom and dad. Then, when the new-baby frequency moved from Hz to kHz, we’d simply get to hear the news at the water cooler. Seems a shame, but what can you do? We’ve a world to save too!

I don’t know how many KL-juniors we’ve got here now, but it’ll be a lot. With this in mind, as well as international child protection day in Russia (and many other countries) coming in early June, we organized a big children’s party at the office! Around 200 kids of our employees came to work with their mamas and papas to finally find out about the place one of their parents disappears to every week day, and to play, paint, eat, trampoline, and lots more besides.

Read on: chess, ice cream and viruses…

Summer. A bit of free time – more than usual. So here you are, something for the weekend, sirs and madams…

1. My book recommendation

I’m always hearing funny – not ha-ha – comments about modern-day China, including those related to the incredibly strong rise of its economy, or about how many bowls of rice the worker of modern China is prepared to work for. But Wikipedia is good on China, as are plenty of textbooks, plus this, this and this are interesting too (on per capita GDP China comes 121^st in the world – between Tunisia and the Dominican Republic).

But for those REALLY interested in China, I REALLY recommend reading this fat book on China by none other than Henry Kissinger.

In it you’ll learn all sorts of new-to-you knowledge and curiosities about the country’s ancient history, its economy and more. There’s the estimation that the GDP of medieaval China was something like a third of world GDP, there’s all the treachery of the opium wars, there’s the communist past, and the country’s renaissance. As I say, I strongly recommend it. But here’s a warning: there’s a TON of detail in there. Some pages I just scanned. All the same, on the 25^th anniversary of Tiananmen Square, it feels like the right time to give it a read.

2. My film recommendation

Check it out if you haven’t already, or watch it again: You Only Live Twice – Sean strutting his stuff as Bond, James Bond; shaken, not stirred.

Turns out GoPro appeared 47 years ago (see the pic below)!! You see, I’m going through the whole series of Bond films – from Dr. No to Skyfall. I’ve got them all in my laptop which I watch while on the treadmill in the gym. Amazing how enjoyable running on the spot can be :).

3. My music recommendation

No words needed. It’s music. To be heard and felt, not talked about. Enjoy!

That’s all folks. Hope you’re enjoying your summer. Godspeed!…

True to my word, herewith, the second installment of my new weekly (or so) series, ‘dark news from the cyber-side’, or something like that…

Today the main topic will be about the security of critical infrastructure; in particular, about the problems and dangers to be on the watch for regarding it. Things like attacks on manufacturing & nuclear installations, transportation, power grid and other industrial control systems (ICS).

Actually, it’s not quite ‘news’ here, just kinda news – from last week: fortunately critical infrastructure security issues don’t crop up on a weekly basis – at least, not the really juicy bits worthy of a mention. But then, the reason for that is that probably that most issues are kept secret (understandable, but worrying all the same) or simply no one is aware of them (attacks can be carried out on the quiet – even more worrying).

So, below, a collection of curious facts to demonstrate the current situation and trends as regards critical infrastructure security issues, and pointers to what needs to be done in face of the corresponding threats.

Turns out there are plenty of reasons to be bowled over by critical infrastructure issues…

The motto of engineers who make and install ICS  is ‘ensure stable, constant operation, and leave the heck alone!’ So if a vulnerability in the controller is found through which a hacker can seize control of the system, or the system is connected to the Internet, or the password is actually, really, seriously… 12345678 – they don’t care! They only care about the system still running constantly and smoothly and at the same temperature!

After all, patching or some other interference can and does cause systems to stop working for a time, and this is just anathema to ICS engineers. Yep, that’s still today just the way it is with critical infrastructure – no seeing the gray between the black and the white. Or is it having heads firmly stuck in the sand?

In September last year we set up a honeypot, which we connected to the Internet and pretended was an industrial system on duty. The result? In one month it was successfully breached 422 times, and several times the cyber-baddies got as far as the Programmable Logical Controllers (PLC) inside, with one bright spark even reprogramming them (like Stuxnet). What our honeypot experiment showed was that if ICS is connected to the Internet, that comes with an almost 100% guarantee of its being hacked on the first day. And what can be done with hacked ICS… yes, it’s fairly OMG. Like a Hollywood action movie script. And ICS comes in many different shapes and sizes. For example, the following:

Nuclear malware

Source

Read on: absence of light will only be the result of burned out bulbs and nothing else…