Russian Business Network (RBN) servers to add to your HOSTS file to block them
As regards the "Russian Business Network" (RBN) who has been @ the heart of MANY online attacks (or, things like Zlob trojan & IDTheft related attacks, etc. et al)? Use this information to protect yourselves, from them.
FIRST OF ALL - Note, I use "0.0.0.0" vs. "127.0.0.1"
(That is simply because iirc, the zero's based one leads to a NULL port type of request, rather than your "loopback adapter" (i.e.-> YOUR OWN MACHINE fielding requests) for a couple of reasons (which it took me some time to come up w/ & testing as to which is "better" to use)).
SECONDLY, 0.0.0.0 is SMALLER than 127.0.0.1, & thus, parses + loads FAR faster, & is smaller on disk is why - AND, in RAM once loaded: THUS, I am logically concluding that 0.0.0.0 is better to use period for HOSTS file blocks - same function, & @ LESSER cost, nearly all the way around (less diskspace, faster loadspeed, less memory occupancy, & etc. et al). A MORE EFFICIENT STRUCTURE!
ADD THIS LIST TO YOUR CUSTOM HOSTS FILE (usually located in %windir%\system32\drivers\etc subfolder-subdirectory):
"A single entity is likely to be behind this attack, since the malicious code on all these pages came from the same server in China."
(AND, the "RBN" is KNOWN to 'hop between' China & Russia regularly, as needed, & I suspect they are the ones behind this, but the article offers NO discrete IP Address ranges or IP's so, we have to wait on the specifics, but it is a GOOD guess based on their prior track record w/ Zlob, which I see nearly every day @ times on the job)...
Last edited by APK; 04-07-2008 at 03:57 PM.
Reason: To warn users who have ActiveDirectory/AD LAN-WAN setups to NOT use external DNS servers!
And, the salient portion that notes that my suspicion was correct:
"if you look at the IPs used in the IFRAMEs, these are the front-end to rogue anti virus and anti spyware tools that were using RBN's infrastructure before it went dark, and continue using some of the new netblocks acquired by the RBN"
So, with that said? Here are those URL's from the list above, albeit altered to 0.0.0.0 equations, for your CUSTOM HOSTS FILE, that shuts out RBN (these appear to be their newly acquired domains list) & the servers they use:
START OF LIST TO ADD TO YOUR CUSTOM HOSTS FILE FOR BLOCKING OUT BAD SITEs/ADBANNERS THAT MAY BE INFECTED ETC.:
0.0.0.0 requestedlinks.com END OF LIST TO ADD TO YOUR CUSTOM HOSTS FILE FOR BLOCKING OUT BAD SITEs/ADBANNERS THAT MAY BE INFECTED ETC.:
FOR THOSE INTERESTED (or, those that need actual IP addresses to add to firewall rules tables OR IE restricted zones etc.), here are the actual IP addresses of the bogus servers:
More updates on RBN attacks & servers to block in a HOSTS file (or other means)
The "RBN"'s still @ it (per earlier in this guide/last page)
Gaining more servers to attack folks with online!
(Per my earlier posts on how to add to a HOSTS file & their IP addresses above - this gent is whom I got this info. from & he's a fairly noted security researcher + ontop of them & their activities online it seems, use him for a resource, excellent so far (proved me right in my guess above too, albeit far later than I guessed it was they, lol (pretty obvious if you follow security trends & news though to be honest)):
He has more servers there (updated list is why) vs. my own above... if you're into your online security? Refer to it & add his lists to your HOSTS file too (or, email me for mine to save time if you wish, many have).
For users of Adobe Acrobat Reader (of any version or patch level today - safety hint):
Well, update to the latest/greatest version... HOWEVER, if you don't trust that, as I do not, FULLY?
(I say this, & simply because browser makers have been trying that left & right since "time immemorial" online, & more of those types of attacks pop up of differing nature that evades new patches vs. it, keep popping up regardless of the patches!)
Plus, like I had stated earlier in this guide?
Try this FOR ADOBE ACROBAT READER ALSO:
Use Adobe Acrobat's EDIT menu
Imo @ least, but, one based on the data in this guide (plus that from security websites I noted above)?
Well, because most times, if a site needs it???
I mean, hey: Even adbanners have been abused this way & proofs of that abound in this guide no less.
In fact, when I noted this over @ slashdot?
So, evidence as to WHY one should do this to Adobe Acrobat Reader (until it's patched vs. this type of thing):
Last edited by APK; 11-06-2008 at 09:59 PM.
Reason: I needed "consciousness-fuel" (coffee) this a.m. (I had put the IPAddress-To-URL equation in the WRONG ORDER originally, for HOSTS file entries - sorry!)
Know your installed applications base (Add/Remove Programs in CONTROL PANEL!)
USE YOUR "ADD-REMOVE" CONTROL PANEL APPLET!
This is important - as MANY 'malware/trojans' actually DO use since they realize folks do NOT regularly check this area.
IF you don't recognize a ware?
Look it up on GOOGLE (or altavista/yahoo, etc.) to find out if it is MALWARE or not, &/or IF you need it @ all (if you don't? It's "dead weight" & taking up space on your disks & slowing you down only).
Last edited by APK; 04-07-2008 at 04:08 PM.
Reason: NOTING REVISION OF MY LAST POST ABOVE
-> Run: telnet.exe
--> Type (and press enter): unset ntlm
He also has more on things like "EFS" (encrypting filesystem) which I omitted, & both Mr. J.'s site & the GOVERNMENT ones I note, also cover it too (or, supplement points I made with more alternatives etc.).
P.S.=> I list MORE security techniques for securing telnet, here (did this years ago circa 1997-2002, & it's cited in 2001 here @ Neowin, by searching TELNET on that page) to supplement this technique:
APK "A to Z" Internet Speedup & Security Text!
It had its "dim early beginnings" back in 1997-1998, as the VERY FIRST security guide for Windows NT-based Operating Systems (2000/XP/Server 2003 currently) @ NTCompatible.com (albeit for Windows NT, & 2000 there only) as their "Article #1" here http://web.archive.org/web/200202050...article1.shtml (it started out on how to speed up a Windows NT based PC, & grew into a "SPEED & SECURITY GUIDE" there over the next few years 1998-2002 or so).
Which goes into that point on TELNET & many others (including more speed tuneups, services cutoffs for speed + security in DETAIL & far more also to supplement this post here)... apk
Last edited by APK; 04-13-2010 at 09:05 PM.
Reason: Editing in points of interest into it now... apk
"Checks & Balances" (accuracy check of this article by "pros" (still, test for yourselves, because a simple certification doesn't a security-pro make)), Part 1
I also "took the liberty" of contacting a "security-pro" (in Don Parker of "SecurityFocus.com" fame)!
This is in regards to my outline/article/guide here, & here were HIS thoughts/opinions on its content @ this point:
I don't see any real downsides to what you posted. The only thing is that
you need to remember the audience that it is you are trying to reach. If
your goal was to hit the newbies as it were then you may have missed the
mark a bit. Beyond that, it looks fine to me.
That's so you guys all reading here have SOME idea this stuff is SOLID, & works, & 'passes muster' with the "top geeks" (lol, no offense intended, but lacking a better expression here is all - because mere certifications do NOT an 'expert make', as in the fellow I note above, because iirc, that is ALL he has going for him afaik & to myself @ least? THIS IS NOT ENOUGH, certs are not the same as full degrees, & not by a LONG shot in this field) in the arena of computer security!
So, test for yourselves, via CIS Tool - to be sure...
Also - Do please check this page out, for even more security points:
Especially the downloadable guide for security there to supplement this one's points, it is named -> SP800-69.pdf
The PDF file guide above from NIST (in association w/ the U.S. Gov't. on securing PC's no less), like my guide here also?
That also lists a "6.32 Removing Malware" section as well!
So, that is in response to 'my naysayers' from various forums that cricized me for listing such a guide here!
(In fact, many of them were MS-MVP mods too no less, but many on many forums would NOT cite "why" or yield specifics I asked for as to WHY I SHOULD NOT LIST SUCH A GUIDE in this article's content... well, experts in this area appear to agree with myself, as it IS part of "securing a computer" in knowing HOW TO REMOVE INFESTATIONS, as I do, like THEY do as well!)
Anyhow/anyways - The .pdf guide from NIST either tend to reinforce my own, OR, go beyond in some cases!
Securing wireless networks
Securing MS-Office apps better
Script file extensions associations with notepad.exe for instance (for safety vs. scripted attacks)
More on email & webbrowser security
The SIGVERIFY utility (file signature checker)
Disabling unneeded accounts
That's for some things I did not cover well imo, here (OR RATHER, well enough earlier), & to supplement my guide (both have good ideas & they both work).
That's an example of where your score (for users on Windows XP SP #2 no less fully hotfix patched as of this date) can be @ scoring-wise, on the CIS Tool benchmark test gauge of Windows Security, after following its suggestions for security-hardening your systems.
A 90.112 score... & that was AlexStarFire's score from the 3dguru.com forums, once he applied it to his home system ("stand-alone", non-HOME or WORK-LAN system, online on the public internet), which is way, Way, WAY up from its initial default score of 46.xxx/100...
* Here is an example of a user named Thronka, who employed it to security-harden the endpoints on his LAN/WAN setup @ work, who is also enjoying it successfully as well, albeit this time, in a BUSINESS environs (as I have it as well, for both HOME standalone machine online today, & also on the job):
P.S.=> I hope you guys also employ it thus as well - it starts with reaching just 1 person, & then, by example? Others start to apply it also, & then things start to change "for the better", because by securing yourself, & maybe even setting up your pals & families machines' this way? You lessen the possibility of "spreading the diseases" out there online today... apk
Last edited by APK; 04-07-2008 at 04:12 PM.
Reason: FORUMS HERE has character-per-post limits... apk