
Read the answer offered by Kelly Spors of The Wall Street Journal here.
Bank of India IT staff are mopping up the mess left by attackers who rigged the firm's website to feed malware to customers trying to access online services.
The bank managed to pry loose the rogue iframe responsible for the malware sometime early Friday morning California time. At time of writing, though, Bank of India's website was effectively cordoned off, bearing a terse notification saying: "This site is under temporary maintenance and will be available after 09:00 IST on 1.09.07."
The shuttering came a day after employees for security provider Sunbelt Software discovered someone had planted an iframe in the site that caused unpatched Windows machines to be infected with some of the most destructive pieces of malware currently in circulation. Sunbelt counted 31 separate pieces in all, including Pinch, a powerful and easy-to-use Trojan that siphons personal information from a user's PC. Other malware included Trojan.Netview, Trojan-Spy.Win32.Agent.ql, various rootkits and several spam bots.
Executives and IT administrators at US offices of Bank of India who were contacted Friday morning by IDG were initially unaware of the attack. A spokesman later told the news service that officials were aware of the problem and were working to correct it, but had no information concerning its severity or duration.
Some of the servers used to install the malware belonged to the notorious Russian Business Network, a group Spamhaus says is involved in child porn, phishing and other misdeeds. According to Verisign's iDefense unit, the RBN also played a hand in bringing us MPack, a powerful Trojan downloader that infected more than 10,000 websites in just three days.
In this case, the attackers appeared to use an exploit kit dubbed n404, according to this post by Dancho Danchev. It relies on a technique known as Fast Flux domain name service, which is proving to be resilient against bot hunters because there is no single point of weakness to take down.
Roger Thompson, a researcher with Exploit Prevention Labs, said he spotted one piece of code that exploited a vulnerability patched by last year's Microsoft Security Bulletin MS06-042."It's pretty much a cut-and-paste of the original proof-of-concept that was put out on Metasploit last July," Thompson said of the code.
MICRONNET-NET: 195.114.16.0 - 195.114.17.255
etname: MICRONNET-NET; descr: Micronnet LTD network; country: RU
Address: Reshetnikova str. HSE 9, 197119 St. Petersburg , Russia
E-mail: info@micronnet.net
Just so you know your enemy, our good friends the RBN (Russian Business Network) - now widening their buisiness to "bullet proof" hosting of MPack (diy exploiters) - if you try and complain to Nevacon, do not expect a reply ;-) - I keep wondering why the international community cannot do something about this? - WE seem more inclined to blame China or Russia as countries. Just so we now 4/5 times more spam & exploits are from USA hostings then China:
Add all below to your IP banned list on your hosts / servers, another 300+ RBN IPs to go with these :-(
YEKTCNT.INFO
IP Address: 194.146.207.222
IP Location Panama (just domains) - Panama - Nevacon Ltd, new hosting out of The Seychelles.
Blacklist Status:
Yet another part of Russian Business Network / iframe cash gang. (see; Spamhaus Org - Rosko) Endless malware and PC hijacking.
gretabc.com [194.146.207.21]
tesla4.net [194.146.207.11]
intostec.com [194.146.207.11]
dedust2.net [194.146.207.11]
mayconcern.com [194.146.207.11]
mayconcern.net [194.146.207.11]
inetnum: 194.146.204.0 - 194.146.207.255
netname: NEVSKCC-NET
descr: NEVACON LTD
country: RU
194.146.207.222 [reverse DNS - ip-207-222.nevacon.net]
1. Adencnt.info
2. Dinacnt.info
3. Empacnt.info
4. Gifecnt.com
5. Grigcnt.info
6. Hasicnt.info
7. Hoicnt.info
8. Juidacnt.info
9. Lipocnt.com
10. Mircnt.net
11. Nisocnt.net
12. Rikocnt.info
13. Sogcnt.info
14. Tipocnt.com
15. Wetricnt.info
16. Xifcnt.com
17. Yektcnt.info
Domain ID:D18788623-LRMS
Domain Name:YEKTCNT.INFO
Created On:30-Jun-2007 17:17:14 UTC
Last Updated On:04-Sep-2007 18:01:41 UTC
Expiration Date:30-Jun-2008 17:17:14 UTC
Registrant ID:DI_6786675
Registrant Name:Wedrov Kirill
Registrant Organization:N/A
Registrant Street1:Lesi Ukraynki 15/7
Registrant Street2:
Registrant Street3:
Registrant City:Lviv
Registrant State/Province:Lviv Oblast
Registrant Postal Code:48751
Registrant Country:UA
Registrant Phone:+093.4584442
81.95.144.182/32 | rbnnetwork.com | SBL58402 | 2007-09-04 02:44:54 |
81.95.149.171/32 | rbnnetwork.com | SBL58369 | 2007-09-03 02:09:43 |
81.95.144.3/32 | rbnnetwork.com | SBL58287 | 2007-08-31 03:12:22 |
81.95.149.27/32 | rbnnetwork.com | SBL58284 | 2007-08-31 03:01:04 |
81.95.149.181/32 | rbnnetwork.com | SBL58009 | 2007-08-21 00:35:36 |
81.95.149.178/32 | rbnnetwork.com | SBL58008 | 2007-08-21 00:35:08 |
193.93.235.5/32 | rbnnetwork.com | SBL57580 | 2007-08-10 03:38:22 |
81.95.149.110/31 | rbnnetwork.com | SBL57575 | 2007-08-10 02:19:56 |
81.95.148.18/32 | rbnnetwork.com | SBL57411 | 2007-08-05 12:08:37 |
81.95.148.130/31 | rbnnetwork.com | SBL57122 | 2007-07-30 02:17:40 |
81.95.148.132/31 | rbnnetwork.com | SBL57123 | 2007-07-30 02:17:54 |
81.95.153.243/32 | rbnnetwork.com | SBL57112 | 2007-07-30 00:48:36 |
81.95.147.202/31 | rbnnetwork.com | SBL57085 | 2007-07-29 09:56:50 |
81.95.147.182/32 | rbnnetwork.com | SBL55191 | 2007-06-02 06:48:43 |
ACCORDING to VeriSign, one of the world's largest internet security companies, RBN, an internet company based in Russia's second city, St Petersburg, is "the baddest of the bad". In a report seen by The Economist, VeriSign's investigators unpick an extraordinary story of blatant cybercrime that implies high-level political backing.
In one sense, RBN (Russian Business Network) does not exist. It has no legal identity; it is not registered as a company; its senior figures are anonymous, known only by their nicknames. Its web sites are registered at anonymous addresses with dummy e-mails. It does not advertise for customers. Those who want to use its services contact it via internet messaging services and pay with anonymous electronic cash.
But the menace it poses certainly exists. "RBN is a for-hire service catering to large-scale criminal operations," says the report. It hosts cybercriminals, ranging from spammers to phishers, bot-herders and all manner of other fraudsters and wrongdoers from the venal to the vicious. Just one big scam, called Rock Phish (where gullible internet users were tricked into entering personal financial information such as bank account details) made $150m last year, VeriSign estimates.
Despite the attention it is receiving from Western law enforcement agencies, RBN is not on the run. Its users are becoming more sophisticated, moving for example from simple phishing (using fake e-mails) to malware known as "Trojans" that sit inside a victim's computer collecting passwords and other sensitive information and sending them to their criminal masters.
A favorite trick is to by-pass the security settings of a victim's browser by means of an extra piece of content injected into a legitimate website. An unwary user enters his password or account number into what looks like the usual box on his log-in page, and within minutes a program such as Corpse's Nuclear Grabber, OrderGun and Haxdoor has passed it to a criminal who can empty his bank account. When VeriSign managed to hack into the RBN computer running the scam, it found accumulated data representing 30,000 such infections. "Every major Trojan in the last year links to RBN" says a VeriSign sleuth.
RBN even fights back. In October 2006, the National Bank of Australia took active measures against Rock Phish, both directly and via a national anti-phishing group to which the bank's security director belonged. RBN-based cybercriminals replied by crashing the bank's home-page for three days.
What can be done? VeriSign has tracked down the physical location of RBN's servers. But Western law enforcement officers have so far tried in vain to get their Russian counterparts to pursue the investigation vigorously. "RBN feel they are strongly politically protected. They pay a huge amount of people. They know they are being watched. They cover their tracks," says VeriSign. The head of RBN goes under the internet alias "Flyman". Repeated e-mails to RBN's purported contact addresses asking for comment have gone unanswered.
...I'm not one of the so-called "John Does" mentioned in this suit (and Essent would have a hard time proving otherwise). That being said, I want to address the allegation made by Hud that this blog caused PRMC's census to drop.
Had Hud looked beyond his office (and the BS Dickie was telling him), he would have seen the decline in census stems from the policies and practices Essent has put into place. Cut staff, demoralize who's left, don't give them the right tools to do the job, blow off keeping the place clean, anger the local physician staff, and folks are going to have less-than-stellar experiences. Bad news travels very quickly, and folks will talk, whether good or bad news. Those that can, will go elsewhere rather than deal with the possibility of a bad experience.
If Dr. Slipknot-oops, I meant Lui- has departed the staff, then that's a positive step. Ditto for Pranulis in the overgrown broom closet that passes for an emergency room.
If PRMC is supposed to be the flagship of this sad company, what does this say about the rest of the hospitals? So far, it seems PRMC is the only place making money, and not that much. With the other hospitals losing money hand over fist, Essent's bottom line is written in red, as in red ink. They've been rebuffed in recent attempts at purchasing new properties, dumped off one that was drowning in red ink when it was purchased (and was hemmorhaging worse when Essent sold it), and have been scrambling for more money to stay afloat.
Allegations? Fantasy? Nope, all are facts, and can be gleaned from other sources. Perhaps some slick ambulance-chaser can demean these facts, or even shoot the messenger, but they still stand regardless.
I believe in free enterprise and capitalism as Adam Smith wrotein his excellent text, and have no problem with any company who wants to make a profit- after all, profit means more money to invest in a business (or at least it's supposed to). However, any company who sacrifices its employees and customer base to boost its so-called bottom line will not last for long, nor should last.
Most likely the big cheeses in Essent will laugh, scoff, etc. when they read this, but that's OK. I have broad shoulders, and I know I'll still be employed when Hud and his buds are trying to either rearrange deck chairs on the Titanic/Essent, or start up yet another for-profit healthcare business when Essent finally sinks. And when that happens, I as well as others who are disgusted with Essent and its thugs will have the last laugh.
I miss Christus and all it believed in. Since Essent took over, it's all just a big mess.What more could I add?
I hope all you high and mighty.. Hud, whoever you are and the rest of these jokers realize what a damn mess you've made here. I wouldn't take my worst enemy for treatment at any of your facilities just because of how I've seen you conduct yourselves.
You can't expect the remaining employees to be inspired to do their jobs. I hear the morale is so bad. And you can't provide good service with all the cuts you've made. But, I guess you really don't care. The little people don't really make you lose any sleep at night. Shame on you.
I guess we're all wondering if we're going to be sued too.Probably they would if they could. They listed John Does 1-10 to have an opening, but unless Blogger maintains logs, there is no way of telling who left comments. Blogger is owned by Google, so good luck, Wes.... Hotmail is what, Microsoft? I delete emails, so discovery is moot. And, those with a touch of time on their hands, here is how to go through the Tor network and be 'truely' anonymous.Seems like you can't voice an opinion without having to defend it in court, especially with the ones you're dealing with.
I think that's the problem here. Are our isp identifications up for grabs, too?
Is the U.S. housing blowout going to hurt the rest of the world? Certainly, a major slowdown in the planet's biggest economy would cause some countries pain.The old theory is that when America sneezes the rest of the world gets sick (hence, the illustration) but it may not apply these days.
But much of the globe will likely shrug off the worst effects of any American slump. "The global economy is no longer U.S.-centric," says Ed Yardeni, an economist who heads Yardeni Research in New York. "We may find that the global economic boom continues, notwithstanding the slowdown in the U.S."
Man came in said, "All rise." We all stood up, and Obie stood up with the twenty seven eight-by-ten colour glossy pictures, and the judge walked in sat down with a seeing eye dog, and he sat down, we sat down. Obie looked at the seeing eye dog, and then at the twenty seven eight-by-ten colour glossy pictures with circles and arrows and a paragraph on the back of each one, and looked at the seeing eye dog. And then at twenty seven eight-by-ten colour glossy pictures with circles and arrows and a paragraph on the back of each one and began to cry,'cause Obie came to the realization that it was a typical case of American blind justice, and there wasn't nothing he could do about it, and the judge wasn't going to look at the twenty seven eight-by-ten colour glossy pictures with the circles and arrows and a paragraph on the back of each one explaining what each one was to be used as evidence against us. ...from Arlo Guthrie's Alice's Restaurant
A man falls off the Empire State Building, and half-way to the ground he yells to someone watching, "So far, so good...."
The initial ruling (on disclosure) is apparently against me. Which means the appellate process. While this isn't the actual lawsuit, it is most critical. It's hard to believe the standards for disclosure were met under Cahill.
As Cahill's "Summary Judgment" Standard contends:
It requires that a plaintiff, suing for defamation, must satisfy a summary judgment standard in order to unmask the identity of the anonymous speaker. In this case, Cahill was a public figure, and to prevail in a defamation lawsuit, he had to prove that (1) Doe made a defamatory statement (damaging to Cahill’s reputation); (2) the statement was concerning Cahill; (3) the statement was published (disseminated to others); (4) others would understand the statement to be defamatory; (5) the statement was false; and (6) Doe made the statement with actual malice (he either knew it was false or acted in reckless disregard of the truth).
The Court concluded that Cahill must satisfy the summary judgment standard relating to most of these elements. That means that Cahill must show that there’s a genuine issue of material fact about these issues. In other words, he must show enough evidence to justify why he should proceed to a jury on these issues.
...the easier one can expose the identities of John Does, the more likely it will "chill the use of the Internet as a medium for free-ranging debate and experimentation with unpopular or novel ideas".
The biggest issue is #5: Was it false?
Example: Items 24&25 in the suit deal with specific accusations of falsehood by John Doe#1.
So, to prove #24, the hospital would be required to provide logs of call personnel, a list of the types of studies done by the call personnel, and statements from the call personnel and the staff that called in the tech. And a copies of their certifications. All of which they should have on hand.
Up-coding verification requires the patient records, and the submitted billings, but it was indicated in the blog that it was 'suspected', not as an absolute. Didn't one of the supposed Essent resonsive comments mention a Medicare audit? With a specific settlement figure? Maybe they were suspected....
As for demonstrating #25, the hospital would have to provide to the court the same information they provide to the state and CMS. Not a terribly demanding task.
Many of the quotes that are attributed to me in the lawsuit are not mine. A careful study of the context they were clipped from will plainly demonstrate that fact. In many cases, I specifically mention that they are quotations from comments, either before or after, in others I used italics to indicate where my comments started.
The gain from 'unmasking' me towards identifying the commenters is negligible. The thought that an anonymous blogger is going to know who an anonymous commenter is tends to strain the fabric of the argument. The only security one has in this is that which is generated by the anonymity of both parties. Additionally, comments are deleted automatically from the queue as they are published.
The only thing this might do is silence an open criticism of Essent's method of doing business.
Long before going green was an international pastime, when the only corporate responsibility was to the bottom line, a small store opened in Brighton, England, selling homemade moisturizers and hair-care products packaged in plastic urine-sample jars. The cosmetics were all-natural, the containers were reusable and the ethos — creating products that were as good for the earth as they were for your skin — was still considered radical, the kind of thing only hippies cared about. But when Anita Roddick opened The Body Shop in 1976 ...Anita Roddick died September 10th at age 64. She was an inspiration to us all and will be missed.