[nsp-sec] AS 4134 injection site hosted on 221.12.88.52

[Smith, Donald]

They have added ip.js to their injection and that is live. I understand if we can't get the bad guy this is going to be a wack a mole game. I still think there is benefit in getting the malware distribution sites down since that requires them to reinject. The tool they are using is only semi automated so they have to have a windows system with remote gui if they are not on the box. But vnc or other similar app can be used.
 
 
 
donald.smith at qwest.com giac

________________________________

From: Gong, Yiming [mailto:yiming.gong at xo.com]
Sent: Fri 5/9/2008 1:25 PM
To: Smith, Donald; nsp-security at puck.nether.net
Subject: RE: [nsp-sec] AS 4134 injection site hosted on 221.12.88.52



Apparently the culprit found something wrong with the old box and made
the dns change today (see 2008050902 )

stlmsd1.Yiming>dig ririwow.cn

;; AUTHORITY SECTION:
ririwow.cn.             3H IN SOA       dns23.hichina.com.
hostmaster.hichina.com. (
                                        2008050902      ; serial
<---here
                                        6H              ; refresh  
                                        1H              ; retry
                                        2w6d            ; expiry
                                        3H )            ; minimum

This IP belongs to China Netcom, another ISP in China, not AS 4134. I
will see if I can get luck on their side.

AND this is really what I have been worrying about, as long as the guy
behind is at large, we are playing "catch me if you can" game, and
without the good help from ISP and low enforcement, this looks like a
never-ending game.


Regards,

Yiming


> -----Original Message-----
> From: Smith, Donald [mailto:Donald.Smith at qwest.com]
> Sent: Friday, May 09, 2008 1:55 PM
> To: Gong, Yiming; nsp-security at puck.nether.net
> Subject: RE: [nsp-sec] AS 4134 injection site hosted on 221.12.88.52
>
> wwwDOTririwowDOTcn/jp.js is now on 221.12.88.52.
> jp.js appears to have been removed as I get a 404 not found.
> It is probably still worth having them investigate it.
> 
> 
> donald.smith at qwest.com giac
>
> ________________________________
>
> From: Gong, Yiming [mailto:yiming.gong at xo.com]
> Sent: Thu 5/8/2008 4:28 PM
> To: Smith, Donald; nsp-security at puck.nether.net
> Subject: RE: [nsp-sec] AS 4134 injection site hosted on 60.191.239.219
>
>
>
> Now this IP is having a blackhole treatment on Chinatelecom backbone.
>
> Next step will be trying to work with CT and see if they can
> clean this
> box in the next few days.
>
> Cheers,
>
> Yiming
>
>
> > -----Original Message-----
> > From: nsp-security-bounces at puck.nether.net
> > [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of
> > Smith, Donald
> > Sent: Thursday, May 08, 2008 5:09 PM
> > To: nsp-security at puck.nether.net
> > Subject: [nsp-sec] AS 4134 injection site hosted on 60.191.239.219
> >
> > ----------- nsp-security Confidential --------
> >
> > The handlers have been covering a set of host names that all lead to
> > 60.191.239.219.
> > The FWDN being injected are
> > wwwDOTririwow.cn, wwwDOTbluellDOTcn, bbsDOTjueduizuanDOTcom, and
> > wwwDOTfiexin.org
> >
> > Details about those sites and how it is being used as the malware
> > delivery target in a MASSIVE SQL injection attack are
> > available here in
> > this diary.
> >
> > http://isc.sans.org/diary.html?storyid=4393
> >
> > $ whois -h whois.cymru.com 60.191.239.219
> > AS      | IP               | AS Name
> > 4134    | 60.191.239.219   | CHINANET-BACKBONE No.31,Jin-rong Street
> >
> > $ whois -h upstream-whois.cymru.com 60.191.239.219
> > PEER_AS | IP               | AS Name
> > 174     | 60.191.239.219   | COGENT Cogent/PSI
> > 703     | 60.191.239.219   | UUNET - MCI Communications
> Services, Inc.
> > d/
> > izon Business
> > 1239    | 60.191.239.219   | SPRINTLINK - Sprint
> > 2828    | 60.191.239.219   | XO-AS15 - XO Communications
> > 2914    | 60.191.239.219   | NTT-COMMUNICATIONS-2914 - NTT
> > America, Inc.
> > 3257    | 60.191.239.219   | TISCALI-BACKBONE Tiscali Intl
> Network BV
> > 3320    | 60.191.239.219   | DTAG Deutsche Telekom AG
> > 3549    | 60.191.239.219   | GBLX Global Crossing Ltd.
> > 3561    | 60.191.239.219   | SAVVIS - Savvis
> > 11164   | 60.191.239.219   | TRANSITRAIL - National LambdaRail, LLC
> > 17888   | 60.191.239.219   | SINGTEL-HK SingTel Hong Kong Limited
> >
> > Any help getting this taken down would be appreciated by all:)
> >
> >
> > H8Hz
> > Donald.Smith at qwest.com giac
> >
> >
> > This communication is the property of Qwest and may contain
> > confidential or
> > privileged information. Unauthorized use of this
> > communication is strictly
> > prohibited and may be unlawful.  If you have received this
> > communication
> > in error, please immediately notify the sender by reply
> > e-mail and destroy
> > all copies of the communication and any attachments.
> >
> >
> > _______________________________________________
> > nsp-security mailing list
> > nsp-security at puck.nether.net
> > https://puck.nether.net/mailman/listinfo/nsp-security
> >
> > Please do not Forward, CC, or BCC this E-mail outside of the
> > nsp-security
> > community. Confidentiality is essential for effective
> > Internet security counter-measures.
> > _______________________________________________
> >
>
>
>