Deflect Labs Report #6: Фишинг и веб-атаки в кампании против правозащитников и независимых СМИ Узбекистана

Основные положения

    • Мы обнаружили скрытую кампанию с применением фишинга и веб-атак, мишенью которой стали в первую очередь независимые СМИ и активисты Узбекистана.
    • Эта кампания ведется с начала 2016 года; как мы выявили, веб-атаки применяются с декабря 2017, а фишинг – с марта 2018.
    • В данном отчете мы подробно опишем, как применяются веб-атаки и фишинг и какую инфраструктуру используют злоумышленники
    •  Мы не располагаем данными о том, кто стоит за этой кампанией, но список ее мишеней позволяет предположить, что она направлена против активистов и СМИ Узбекистана.

Введение

Cервис Deflect был создан для защиты сайтов гражданского общества после публикации Центром Беркмана​ “​Интернет​ и ​ общество​” отчета “DDoS против независимых СМИ и сайтов по защите прав человека”. ​На протяжении нескольких лет мы изучали атаки на веб-сайты, защищенные сервисом Deflect; итогом этих наблюдений стало несколько отчетов.

Атаки, которые будут описаны в данном отчете, значительно отличались от привычных действий злоумышленников, которым противостоит Deflect, так как при веб-атаках использовались профессиональные программы, такие как Acunetix. В тот момент, как мы обнаружили, что в начале веб-атак создавались поддельные домены gmail, привязанные к определенному серверу, мы поняли, что тут происходит нечто более важное.

В данном отчете мы дадим описание всех собранных нами фрагментов одной общей картины этой кампании, чтобы предать гласности факты об атаках, направленных на гражданское общество, и стимулировать обсуждение этого сложного явления.

Контекст: права человека и цифровое наблюдение в Узбекистане

Многие правозащитные организации считают Узбекистан авторитарным государством, которое на протяжении длительного периода подавляло развитие гражданского общества и ограничивало независимость СМИ. С момента распада Советского Союза два президента руководили системой, которая
институционализировала пытки и запрещала свободу слова, что документально подтверждено Human Rights Watch, Amnesty International, Front Line, а также многими другими. Репрессии широко распространились на СМИ и правозащитников, многим из которых пришлось покинуть страну и продолжить свою работу в диаспоре.

Узбекистан был одним из первых государств, которое создало широкую инфраструктуру интернет-цензуры, заблокировав доступ к СМИ и сайтам по правам человека. Если же говорить о цифровом наблюдении, то факт наличия серверов компании Hacking Team в Узбекистане был установлен специалистами the Citizen Lab уже в 2014 году. Позже пользователи Интернета получили доступ к электронной переписке Hacking Team , которая показывала, что Служба государственной безопасности Узбекистана пользовалась услугами этой компании. В отчете организации Privacy International за 2015 год говорится о том, что в Узбекистане было создано несколько центров мониторинга, оснащенных средствами для массового наблюдения; их поставщиком было израильское ответвление американской компании Verint Systems и израильской компании NICE Systems. В 2017 году вышел отчет Amnesty International под заголовком «Мы найдем тебя везде», где подробнее говорится о применении этих средств: тут речь идет о цифровом наблюдении и целевых атаках, направленных на узбекских журналистов и правозащитников. В частности, история независимой информационной службы Uznews.net показывает, как широко правительство Узбекистана использовало направленные атаки для подавления независимых СМИ. Служба Uznews.net была создана вслед за тем, как в 2005 году, после Андижанской бойни, главный редактор службы Галима Бухарбаева покинула Узбекистан. В 2014 году она обнаружила, что ее электронная почта была взломана с помощью фишинга, после чего злоумышленники опубликовали в Сети информацию, включая имена и персональные данные журналистов. Галима сейчас представляет редакцию независимой медийной площадки Centre1, сайт которой защищен сервисом Deflect и является одной из мишеней хакерских атак, о которых идет речь в этом исследовании.

Новая кампания фишинга и веб-атак

16 ноября 2018 года мы выявили массированную атаку, мишенью которой стали некоторые веб-сайты, защищенные сервисом Deflect. При этом использовались профессиональные средства аудита безопасности, такие как NetSparker и WPScan, для сканирования сайтов eltuz.com и centre1.com.
Пик траффика во время атаки (16 ноября 2018):


Пик трафика во время атаки (16 ноября 2018)

Эта атака проводилась с IP-адреса 51.15.94.245 (AS12876 – Online AS, но в диапазоне IP-адресов, принадлежащих серверам Scaleway). Изучая историю траффика с того же IP-адреса, мы установили, что он использовался для нескольких других атак на веб-сайты, защищенные Deflect, а также обнаружили привязанные к этому IP-адресу домены, имитирующие google и gmail, такие как auth.login.google.email-service.host или auth.login.googlemail.com.mail-auth.top. Мы изучили «пассивные» данные DNS (используя PassiveTotal Community Edition и другие инструменты, такие как RobTex) и сопоставили полученную информацию со сведениями об атаках на веб-сайты, защищенные сервисом Deflect, где велся журнал событий. Так мы обнаружили масштабную кампанию атак, направленных на СМИ и активистов. Мы обнаружили, что эта группа злоумышленников активизировалась в феврале 2016 года, а первые атаки осуществлялись с декабря 2017.

Список веб-сайтов, ставших мишенями этих атак, дает представление о контексте данной кампании. Мы выявили четыре таких веб-сайта:

  • Fergana News ведущий независимый русскоязычный новостной сайт, освещающий события в странах Центральной Азии и бывшего СССР
  • Eltuz независимый узбекский сайт
  • Centre1 независимая информационная служба, специализирующаяся на новостях из Центральной Азии
  • Palestine Chronicle сайт некоммерческой организации, которая занимается защитой прав человека в Палестине

Все эти ресурсы освещают актуальный проблемы в Узбекистане. Мы связались с главными редакторами этих СМИ и несколькими другими узбекскими активистами, чтобы узнать, получали ли они фишинговые электронные письма в рамках этой кампании. Некоторые из них смогли подтвердить получение таких сообщений и переслали их нам для дальнейшего расследования. Мы также смогли получить подтверждение фишинговых атак от некоторых узбекских активистов, которые не были связаны с сайтами, защищенными Deflect.

Любопытно, что среди мишеней мы находим и сайт Palestine Chronicle, который кажется тут исключением из правила. У нас нет убедительной гипотезы о том, почему подверглась атаке данная организация.

Год веб-атак на гражданское общество

Исследуя «пассивные» DNS, мы выделили три IP-адреса, которыми пользовались злоумышленники в ходе этой операции:

  • 46.45.137.74 использовался в 2016 и 2017 годах (точная хронология неясна, Istanbul DC, AS197328)
  • 139.60.163.29 использовался между октябрем 2017 и августом 2018 (HostKey, AS395839)
  • 51.15.94.245 использовался между сентябрем 2018 и февралем 2019 (Scaleway, AS12876)

Мы выявили 15 атак на веб-сайты, защищенные сервисом Deflect, с IP-адресов 139.60.163.29 и 51.15.94.245 с декабря 2017:

Date IP Target Tools used
2017/12/17 139.60.163.29 eltuz.com WPScan
2018/04/12 139.60.163.29 eltuz.com Acunetix
2018/09/15 51.15.94.245 www.palestinechronicle.com eltuz.com www.fergana.info and uzbek.fergananews.com Acunetix and WebCruiser
2018/09/16 51.15.94.245 www.fergana.info Acunetix
2018/09/17 51.15.94.245 www.fergana.info Acunetix
2018/09/18 51.15.94.245 www.fergana.info NetSparker and Acunetix
2018/09/19 51.15.94.245 eltuz.com NetSparker
2018/09/20 51.15.94.245 www.fergana.info Acunetix
2018/09/21 51.15.94.245 www.fergana.info Acunetix
2018/10/08 51.15.94.245 eltuz.com, www.fergananews.com and news.fergananews.com Unknown
2018/11/16 51.15.94.245 eltuz.com, centre1.com and en.eltuz.com NetSparker and WPScan
2019/01/18 51.15.94.245 eltuz.com WPScan
2019/01/19 51.15.94.245 fergana.info www.fergana.info and fergana.agency Unknown
2019/01/30 51.15.94.245 eltuz.com and en.eltuz.com Unknown
2019/02/05 51.15.94.245 fergana.info Acunetix

Кроме распространенных инструментов с открытым кодом вроде WPScan, для этих атак использовались разнообразные коммерческие средства аудита безопасности, такие как NetSparker или Acunetix. Если у Acunetix существует пробная версия, которая могла тут применяться, NetSparker пробной версии не предлагает; это значит, что злоумышленники обладали немалыми денежными средствами (стандартная оплата тут $4995 в год, могла также использоваться взломанная версия).

Кроме того, удивительно, что сервер применял множество различных инструментов, при том что многие из них требуют Graphical User Interface. Когда мы просканировали IP 51.15.94.245, то обнаружили, что на нем расположен squid-прокси на порте 3128; мы предполагаем, что этот прокси использовался для переадресации траффика с компьютера злоумышленника.

Фрагменты nmap-скана IP 51.15.94.245 в декабре 2018:

3128/tcp  open     http-proxy Squid http proxy 3.5.23
|_http-server-header: squid/3.5.23
|_http-title: ERROR: The requested URL could not be retrieved

Масштабная кампания фишинговых атак

Обнаружив множество фишинговых доменов, мы предположили, что в ходе кампании также широко применялся фишинг. Мы связались с владельцами сайтов, ставших мишенями атак, и с несколькими узбекскими правозащитниками и выявили 14 разных фишинговых электронных писем, полученных двумя из них между мартом 2018 и февралем 2019:

Date Sender Subject Link
12th of March g.corp.sender[@]gmail.com У Вас 2 недоставленное сообщение (You have 2 undelivered message) http://mail.gmal.con.my-id[.]top/
13th of June 2018 service.deamon2018[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) http://e.mail.gmall.con.my-id[.]top/
18th of June 2018 id.warning.users[@]gmail.com Ваш новый адрес в Gmail: (Your new email address in Gmail: ) http://e.mail.users.emall.com[.]my-id.top/
10th of July 2018 id.warning.daemons[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) hxxp://gmallls.con-537d7.my-id[.]top/
10th of July 2018 id.warning.daemons[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) http://gmallls.con-4f137.my-id[.]top/
18th of July 2018 service.deamon2018[@]gmail.com [Ticket#2011031810000512] – 3 undelivered messages http://login-auth-goglemail-com-7c94e3a1597325b849e26a0b45f0f068.my-id[.]top/
2nd of August 2018 id.warning.daemon.service[@]gmail.com [Important Reminder] Review your data retention settings None
16th of October 2018 lolapup.75[@]gmail.com Экс-хоким Ташкента (Ex-hokim of Tashkent) http://office-online-sessions-3959c138e8b8078e683849795e156f98.email-service[.]host/
23rd of October 2018 noreply.user.info.id[@]gmail.com Ваш аккаунт будет заблокировано (Your account will be blocked.) http://gmail-accounts-cb66d53c8c9c1b7c622d915322804cdf.email-service[.]host/
25th of October 2018 warning.service.suspended[@]gmail.com Ваш аккаунт будет заблокировано. (Your account will be blocked.) http://gmail-accounts-bb6f2dfcec87551e99f9cf331c990617.email-service[.]host/
18th of February 2019 service.users.blocked[@]gmail.com Важное оповещение системы безопасности (Important Security Alert) http://id-accounts-blocked-ac5a75e4c0a77cc16fe90cddc01c2499.myconnection[.]website/
18th of February 2019 mail.suspend.service[@]gmail.com Оповещения системы безопасности (Security Alerts) http://id-accounts-blocked-326e88561ded6371be008af61bf9594d.myconnection[.]website/
21st of February 2019 service.users.blocked[@]gmail.com Ваш аккаунт будет заблокирован. (Your account will be blocked.) http://id-accounts-blocked-ffb67f7dd7427b9e4fc4e5571247e812.myconnection[.]website/
22nd of February 2019 service.users.blocked[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) http://id-accounts-blocked-c23102b28e1ae0f24c9614024628e650.myconnection[.]website/

Почти все эти письма имитировали предупреждения от Gmail, в которых адресату предлагали кликнуть определенную ссылку. Так, например, одно письмо, полученное 23 октября 2018, сообщает, что ее аккаунт скоро будет закрыт, при этом используется изображение текста, размещенное на imgur, чтобы избежать распознания со стороны Gmail:

Единственным исключением было электронное письмо от 16 октября 2018, содержащее якобы конфиденциальную информацию о бывшем хокиме Ташкента:

Некоторые электронные письма маскировались, чтобы избежать выявления, либо с помощью сервиса для получения коротких ссылок drw.sh (инструмента российской компании Doctor Web), либо некоторых инструментов Google для открытого перенаправления.

Каждое электронное письмо использовало свой субдомен, включая письма с одного и того же аккаунта Gmail и с той же темой. Так, два разных письма с темой «Прекращение предоставления доступа к сервису», отправленные с одного и того же адреса, использовали, соответственно, фишинговые домены hxxp://gmallls.con-537d7.my-id[.]top/ и http://gmallls.con-4f137.my-id[.]top/. Мы предполагаем, что злоумышленники применяли разные субдомены, чтобы не попасть в черный список доменов Gmail. Этим объясняется большое число субдоменов, которые можно идентифицировать с помощью «пассивных» DNS. Мы выявили 74 субдомена для 26 доменов второго уровня, используемых в данной кампании (см. приложение с полным списком индикаторов компрометации, IOC).

Мы предполагаем, что фишинговая страничка работала онлайн лишь в течение короткого времени после получения письма, чтобы помешать аналитикам изучать кампанию. Мы получили доступ к фишинговым страничкам некоторых электронных писем. Мы можем подтвердить, что фишинговый инструментарий проверял правильность пароля, и предполагаем, что он мог работать с двухфакторной аутентификацией с помощью текстовых сообщений или двухфакторных приложений, хотя не можем этого доказать.

Хронология кампании

Мы нашли первые признаки активности злоумышленников: 21 февраля 2016 года они зарегистрировали домен auth-login.com. Поскольку мы лишь недавно обнаружили, что идет такая кампания, у нас немного информации об атаках на протяжении 2016 и 2017 годов, но дата регистрации домена указывает на его активность в июле и декабре 2016, а затем в августе и октябре 2017. Вероятнее всего кампания началась в 2016 году и продолжалась в 2017, о чем пользователи ничего не знали.

Вот первая хронология кампании, созданная нами на основании дат регистрации домена и дат веб-атак и рассылки фишинговых электронных писем:

Чтобы доказать, что данная группа злоумышленников была активна на протяжении 2016 и 2017 годов, мы собрали сертификаты этих доменов и субдоменов с помощью базы данных crt.sh Certificate Transparency Database. Мы обнаружили 230 сертификатов, созданных для этих доменов по большей части с помощью сервиса Cloudfare. Вот новая хронология кампании, которая опирается также и на данные создания TLS-сертификатов:

Как мы можем видеть, многие сертификаты были созданы после декабря 2016 и на протяжении 2017 года, а это значит, что группа в тот период осуществляла какие-то действия. Значительное число доменов на протяжении 2017 и 2018 годов появлялось на свет при помощи сервиса Cloudfare, создававшего краткосрочные сертификаты и в то же время защищавшего веб-сайт.

Любопытно также, что кампания была начата в феврале 2016, а особая активность наблюдалась летом 2016, то есть тем летом, когда умер прежний президент Узбекистана Ислам Каримов, о чем первым известил публику сайт Fergana News, ставший главной мишенью атак в ходе этой кампании.

Анализ сетевой инфраструктуры

Мы выявили домены и субдомены данной кампании с помощью анализа данных о «пассивных» DNS, используя преимущественно общий доступ PassiveTotal. Многие домены в 2016-2017 годах применяли один и тот же контактный e-mail домена – b.adan1@walla.co.il, – что помогло нам выявить другие домены, связанные с этой кампанией:

Этот список позволил нам идентифицировать субдомены и IP-адреса, связанные с ними, и выявить три IP-адреса, используемые в ходе кампании. Мы применяли Shodan для поиска данных о временных параметрах и информацию о «пассивных» DNS, чтобы воссоздать хронологию применения разных серверов:

  • 46.45.137.74 использовался в 2016 и 2017
  • 139.60.163.29 использовался между октябрем 2017 и августом 2018
  • 51.15.94.245 использовался между сентябрем 2018 и февралем 2019

Мы выявили 74 субдомена для 26 доменов второго уровня, используемых в кампании (см. приложение с полным списком индикаторов компрометации, IOC). Большинство этих доменов имитировало Gmail, но некоторые также имитировали Yandex (auth.yandex.ru.my-id.top), mail.ru (mail.ru.my-id.top), qip.ru (account.qip.ru.mail-help-support.info), yahoo (auth.yahoo.com.mail-help-support.info), Live (login.live.com.mail-help-support.info) или rambler.ru (mail.rambler.ru.mail-help-support.info). Большинство из этих доменов являлись субдоменами доменов второго уровня (таких как auth-mail.com), но встречались и некоторые специфические домены второго уровня, представляющие особый интерес:

  • bit-ly[.]host имитирующий bit.ly
  • m-youtube[.]top и m-youtube[.]org вместо Youtube
  • ecoit[.]email который, возможно, имитировал https://www.ecoi.net
  • pochta[.]top вероятно, имитация https://www.pochta.ru/, Почты России
  • Мы не нашли какой-либо информации относительноvzlom[.]top и fixerman[.]top. Судя по значению русского слова «взлом», vzlom.top – антивирусный сайт или его имитация.

Таинственная сеть киберпреступников

Обычно мы не находим связей между целенаправленными атаками и киберпреступностью, но в процессе данного расследования мы обнаружили два вида взаимодействия между этой кампанией и группами киберпреступников.

Во-первых, 7 декабря 2016 года через контактный адрес b.adan1@walla.co.il был зарегистрирован домен msoffice365[.]win (как и многие другие домены в ходе кампании). Как выяснилось, к этому домену был привязан C2-сервер для кражи криптовалюты под названием Quant, о чем говорится в отчете Forcepoint, опубликованном в декабре 2017 года. Сервис Virus Total подтверждает тот факт, что в ноябре 2017, в период его регистрации (он был зарегистрирован на год), этот домен содержал вредоносные программы. Мы не могли наблюдать какой-либо преступной деятельности, связанной с доменом, в ходе кампании атак, но, как уже было сказано, мы мало чего знаем о деятельности этой группы в 2017 году.

Во-вторых, мы выявили связь между доменом auth-login.com и группами, стоящими за трояном Bedep и инструментом Angler exploit kit. Они связаны с доменом auth-login.com через субдомен login.yandex.ru.auth-login.com – похоже, это типичный домен с длинным именем, имитирующий Yandex в ходе кампании атак, и он был привязан к тому же IP-аресу 46.45.137.74 в марте и апреле 2016 года (по данным компании RiskIQ). Этот домен был зарегистрирован в феврале 2016 года с адреса yingw90@yahoo.com (принадлежащего, по данным whois, Дэвиду Бауэрсу из Гровтауна, штат Джорджия, США). Тот же электронный адрес использовался для регистрации сотни доменов, задействованных в кампании Bedep в феврале 2016, по данным Talos (что подтверждает и несколько других отчетов). Angler exploit kit – один из самых печально известных инструментов киберпреступников в период между 2013 и 2016 годами. Bedep – бэкдор, выявленный в 2015 году, который применялся почти исключительно с инструментом Angler exploit kit. Нужно отметить что, по данным Trustwave, в 2015 году Bedep использовался для увеличения количества просмотров пропагандистских пророссийских видеороликов.

У нас нет свидетельств о том, чтобы два этих домена использовались в ходе кампании атак, тем не менее такого рода связи с миром киберпреступности слишком сильны, чтобы считать их простой случайностью. Они говорят о том, что группы киберпреступников взаимодействуют с группами или службами, поддерживаемыми правительством. Любопытно вспомнить о том, что, как утверждает Amnesty international, в 2014 году российские хакеры участвовали в атаках на редактора Uznews.net. Это позволяет предположить, что подобные группы участвовали и в данной кампании атак.

Серверы нелегко обрушить

Когда мы выявили атаку, то решили расследовать происходящее, не подавая жалобы, пока у нас не будет ясного представления об идущей кампании. В январе мы поняли, что собрали достаточно сведений, и стали посылать жалобы на на нелегитимное использование сервисов. Мы послали жалобы по поводу Gmail-адресов в Google, а по поводу сервиса сокращения url – в Doctor Web. Мы не получили ответа, но могли увидеть, что компания Doctor Web несколько дней спустя приняла надлежащие меры.

В случае же сервера Scaleway мы неожиданно столкнулись с неразрешимой проблемой в связи с нелегитимным использованием инфраструктуры. Обычно Scaleway отсылает жалобу на абьюз непосредственно потребителю, а затем убеждается в том, что потребитель исправил нарушения. Такой подход прекрасно работает в случае скомпрометированного сервера, но не тогда, когда сервер умышленно арендуется для злонамеренной деятельности. В нашем случае мы не хотели посылать отчет о ненадлежащем  использовании, потому что тогда нам пришлось бы открыть злоумышленникам то, что нам известно, без какой-либо пользы для дела. Мы связались непосредственно со Scaleway, и прошло какое-то время, прежде чем мы нашли нужного человека из числа ответственных за безопасность. Сотрудники Scaleway признали, что их сервер замешан в абьюзе, и, получив версию нашего отчета, в которой были скрыты некоторые имена, с приложенными доказательствами в виде фишинговых страничек, привязанных к их серверу, они около 25 января 2019 года закрыли сервер.

Мы понимаем, что провайдеру инфраструктуры нелегко реагировать на подобные жалобы. Для многих хостинг-провайдеров критерием остроты той или иной проблемы является количество жалоб, но в случае гражданского общества мы имеем дело со злоумышленниками, которые действуют целенаправленно и скрытно, так что иногда их мишенями становятся лишь несколько людей, а при этом они изо всех сил стараются оставаться незаметными. Стандартные процедуры в таких случаях часто не работают, и, как мы считаем, хостинг-провайдеры должны заниматься подобными случаями абьюза. Мы призываем хостинг-провайдеров принимать во внимание целенаправленные атаки на гражданское общество и теснее взаимодействовать с организациями, которые его защищают, устанавливать отношения взаимного доверия с ними, что позволит быстро ограничивать масштаб подобных кампаний.

Заключение

В данном отчете мы приводим данные о продолжительной кампании фишинга и веб-атак, направленных на СМИ, освещающие жизнь в Узбекистане, и на узбекских правозащитников. Наш отчет в очередной раз указывает на то, что цифровые атаки представляют угрозу для защитников прав человека и независимых СМИ. На протяжении многих лет мы могли видеть, как группы злоумышленников используют и фишинг, и веб-атаки (подобно связанной с Вьетнамом группе Ocean Lotus), но данная кампания делает своими мишенями одновременно как сайты гражданского общества, так и их руководителей, используя при этом одни и те же серверы.

У нас нет доказательств того, что в этой кампании участвует правительство, но это, несомненно, целенаправленные атаки политического характера, а список ее мишеней указывает на то, что она направлена на гражданское общество Узбекистана. Кроме того, она во многом сходна с атаками на Uznews.net в 2014 году, когда главный редактор получила фишинговое электронное письмо, имитирующее уведомление Google о том, что ее аккаунт участвует в распространении незаконной порнографии.

На протяжении последних 10 лет такие организации, как Citizen Lab или Amnesty International, потратили немало времени и усилий на то, чтобы выявить факты применения цифрового наблюдения и целенаправленных атак против гражданского общества. Изучая эту кампанию, мы увидели, что и 2019 году те же самые инструменты представляют угрозу для журналистов и активистов, которые – нередко в крайне тяжелых обстоятельствах – сражаются за гражданские права и свободное распространение информации.

Мы надеемся, что данный отчет внесет вклад в это общее дело и поможет понять, что сегодня более, чем когда-либо, нам нужно продолжать бороться и поддерживать гражданское общество в его противостоянии цифровому наблюдению.

Как защищаться от подобных атак

Если вы подозреваете, что можете стать мишенью подобных кампаний, есть ряд мер, которые помогут вам себя защитить.

Для защиты от фишинга вам важно научиться распознавать классические фишинговые электронные письма. Мы привели некоторые образцы в данном отчете, но вы можете почитать другие подобные отчеты, созданные the Citizen Lab. Вы можете также прочесть это прекрасное разъяснение от NetAlert и проверить себя с помощью теста Google Jigsaw. Во-вторых, важно убедиться в том, что вы настроили двухфакторную аутентификацию для аккаунтов вашей почты и социальных сетей. Это значит, что для аутентификации при входе в аккаунт используется и пароль, и что-то еще дополнительно. В качестве второго фактора чаще всего применяют текстовые сообщения, приложения, создающие временные пароли, или аппаратные ключи защиты. Мы советуем не полагаться на текстовые сообщения, которые не слишком надежны, но вместо этого пользоваться либо приложениями для создания временных паролей (такими как Google Authenticator или FreeOTP), либо аппаратными ключами (такими как YubiKeys). Аппаратные ключи защиты считаются наиболее надежными, так что это предпочтительная защита в том случае, если вы активист или журналист, рискующий стать мишенью злоумышленников. В последний годы мы видели случаи, когда фишинговые атаки преодолевали другие типы двухфакторной защиты (тут об этом говорится подробнее).

В случае же веб-атак, если вы используете такие системы управления содержимым (CMS), как WordPress или Drupal, очень важно постоянно обновлять как саму CMS, так и ее плагины, и отказаться от уязвимых плагинов (очень часто именно устаревшие плагины были причиной компрометации веб-сайтов). Мы также рекомендуем, если это возможно, применять Web Application Firewalls, настроив его так, чтобы оно распознавало атаки на вашу CMS. Если вы используете «самодельный» сайт, вам, быть может, следует провести аудит безопасности применяемого программного кода.

Приложение

Благодарность

Мы хотим поблагодарить Defenders и Scaleway за оказанную помощь. Мы также признательны ipinfo.io и passive total, снабдившим нас теми инструментами, которые помогли нам провести данное расследование.

Индикаторы компрометации (Indicator of Compromise, IOC)

Top level domains :

email-service.host
email-session.host
support-email.site
support-email.host
email-support.host
myconnection.website
ecoit.email
my-cabinet.com
my-id.top
msoffice365-online.org
secretonline.top
m-youtube.top
auth-mail.com
mail-help-support.info
mail-support.info
auth-mail.me
auth-login.com
email-x.com
auth-mail.ru
mail-auth.top
msoffice365.win
bit-ly.host
m-youtube.org
vzlom.top
pochta.top
fixerman.top

Полный список индикаторов можно найти на github: https://github.com/equalitie/deflect_labs_6_indicators

Статья переведена с английского: Phishing and Web Attacks Targeting Uzbek Human Right Activists and Independent Media .

Read More

Deflect Labs Report #6: Phishing and Web Attacks Targeting Uzbek Human Right Activists and Independent Media

Key Findings

  • We’ve discovered infrastructure used to launch and coordinate attacks targeting independent media and human rights activists from Uzbekistan
  • The campaign has been active since early 2016, using web and phishing attacks to suppress and exploit their targets
  • We have no evidence of who is behind this campaign but the target list points to a new threat actor targeting Uzbek activists and media

Introduction

The Deflect project was created to protect civil society websites from web attacks, following the publication of “Distributed Denial of Service Attacks Against Independent Media and Human Rights Sites report by the Berkman Center for Internet & Society. During that time we’ve investigated many DDoS attacks leading to the publication of several reports.

The attacks leading to the publication of this report quickly stood out from the daily onslaught of malicious traffic on Deflect, at first because they were using professional vulnerability scanning tools like Acunetix. The moment we discovered that the origin server of these scans was also hosting fake gmail domains, it became evident that something bigger was going on here.

In this report, we describe all the pieces put together about this campaign, with the hope to contribute to public knowledge about the methods and impact of such attacks against civil society.

Context : Human Rights and Surveillance in Uzbekistan

Emblem of Uzbekistan (wikipedia)

Uzbekistan is defined by many human-rights organizations as an authoritarian state, that has known strong repression of civil society. Since the collapse of the Soviet Union, two presidents have presided over a system that institutionalized  torture and repressed freedom of expression, as documented over the years by Human Rights Watch, Amnesty International and Front Line Defenders, among many others. Repression extended to media and human rights activists in particular, many of whom had to leave the country and continue their work in diaspora.

Uzbekistan was one of the first to establish a pervasive Internet censorship infrastructure, blocking access to media and human rights websites. Hacking Team servers in Uzbekistan were identified as early as 2014 by the Citizen Lab. It was later confirmed that Uzbek National Security Service (SNB) were among the customers of Hacking Team solutions from leaked Hacking Team emails. A Privacy International report from 2015 describes the installation in Uzbekistan of several monitoring centers with mass surveillance capabilities provided by the Israeli branch of the US-based company Verint Systems and by the Israel-based company NICE Systems. A 2007 Amnesty International report entitled ‘We will find you anywhere’ gives more context on the utilisation of these capabilities, describing digital surveillance and targeted attacks against Uzbek journalists and human-right activists. Among other cases, it describes the unfortunate events behind the closure of uznews.net – an independent media website established by Galima Bukharbaeva in 2005 following the Andijan massacre. In 2014, she discovered that her email account had been hacked and information about the organization, including names and personal details journalists in Uzbekistan was published online. Galima is now the editor of Centre1, a Deflect client and one of the targets of this investigation.

A New Phishing and Web Attack Campaign

On the 16th of November 2018, we identified a large attack against several websites protected by Deflect. This attack used several professional security audit tools like NetSparker and WPScan to scan the websites eltuz.com and centre1.com.


Peak of traffic during the attack (16th of November 2018)

This attack was coming from the IP address 51.15.94.245 (AS12876 – Online AS but an IP range dedicated to Scaleway servers). By looking at older traffic from this same IP address, we found several cases of attacks on other Deflect protected websites, but we also found domains mimicking google and gmail domains hosted on this IP address, like auth.login.google.email-service[.]host or auth.login.googlemail.com.mail-auth[.]top. We looked into passive DNS databases (using the PassiveTotal Community Edition and other tools like RobTex) and crossed that information with attacks seen on Deflect protected websites with logging enabled. We uncovered a large campaign combining web and phishing attacks against media and activists. We found the first evidence of activity from this group in February 2016, and the first evidence of attacks in December 2017.

The list of Deflect protected websites chosen by this campaign, may give some context to the motivation behind them. Four websites were targeted:

  • Fergana News is a leading independent Russian & Uzbek language news website covering Central Asian countries
  • Eltuz is an independent Uzbek online media
  • Centre1 is an independent media organization covering news in Central Asia
  • Palestine Chronicle is a non-profit organization working on human-rights issues in Palestine

Three of these targets are prominent media focusing on Uzbekistan. We have been in contact with their editors and several other Uzbek activists to see if they had received phishing emails as part of this campaign. Some of them were able to confirm receiving such messages and forwarded them to us. Reaching out further afield we were able to get confirmations of phishing attacks from other prominent Uzbek activists who were not linked websites protected by Deflect.

Palestine Chronicle seems to be an outlier in this group of media websites focusing on Uzbekistan. We don’t have a clear hypothesis about why this website was targeted.

A year of web attacks against civil society

Through passive DNS, we identified three IPs used by the attackers in this operation :

  • 46.45.137.74 was used in 2016 and 2017 (timeline is not clear, Istanbul DC, AS197328)
  • 139.60.163.29 was used between October 2017 and August 2018 (HostKey, AS395839)
  • 51.15.94.245 was used between September 2018 and February 2019 (Scaleway, AS12876)

We have identified 15 attacks from the IPs 139.60.163.29 and 51.15.94.245 since December 2017 on Deflect protected websites:

Date IP Target Tools used
2017/12/17 139.60.163.29 eltuz.com WPScan
2018/04/12 139.60.163.29 eltuz.com Acunetix
2018/09/15 51.15.94.245 www.palestinechronicle.com eltuz.com www.fergana.info and uzbek.fergananews.com Acunetix and WebCruiser
2018/09/16 51.15.94.245 www.fergana.info Acunetix
2018/09/17 51.15.94.245 www.fergana.info Acunetix
2018/09/18 51.15.94.245 www.fergana.info NetSparker and Acunetix
2018/09/19 51.15.94.245 eltuz.com NetSparker
2018/09/20 51.15.94.245 www.fergana.info Acunetix
2018/09/21 51.15.94.245 www.fergana.info Acunetix
2018/10/08 51.15.94.245 eltuz.com, www.fergananews.com and news.fergananews.com Unknown
2018/11/16 51.15.94.245 eltuz.com, centre1.com and en.eltuz.com NetSparker and WPScan
2019/01/18 51.15.94.245 eltuz.com WPScan
2019/01/19 51.15.94.245 fergana.info www.fergana.info and fergana.agency Unknown
2019/01/30 51.15.94.245 eltuz.com and en.eltuz.com Unknown
2019/02/05 51.15.94.245 fergana.info Acunetix

Besides classic open-source tools like WPScan, these attacks show the utilization of a wide range of commercial security audit tools, like NetSparker or Acunetix. Acunetix offers a trial version that may have been used here, NetSparker does not, showing that the operators may have a consistent budget (standard offer is $4995 / year, a cracked version may have been used).

It is also surprising to see so many different tools coming from a single server, as many of them require a Graphical User Interface. When we scanned the IP 51.15.94.245, we discovered that it hosted a Squid proxy on port 3128, we think that this proxy was used to relay traffic from the origin operator computer.

Extract of nmap scan of 51.15.94.245 in December 2018 :

3128/tcp  open     http-proxy Squid http proxy 3.5.23
|_http-server-header: squid/3.5.23
|_http-title: ERROR: The requested URL could not be retrieved

A large phishing campaign

After discovering a long list of domains made to resemble popular email providers, we suspected that the operators were also involved in a phishing campaign. We contacted owners of targeted websites, along with several Uzbek human right activists and gathered 14 different phishing emails targeting two activists between March 2018 and February 2019 :

Date Sender Subject Link
12th of March 2018 g.corp.sender[@]gmail.com У Вас 2 недоставленное сообщение (You have 2 undelivered message) http://mail.gmal.con.my-id[.]top/
13th of June 2018 service.deamon2018[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) http://e.mail.gmall.con.my-id[.]top/
18th of June 2018 id.warning.users[@]gmail.com Ваш новый адрес в Gmail: alexis.usa@gmail.com (Your new email address in Gmail: alexis.usa@gmail.com) http://e.mail.users.emall.com[.]my-id.top/
10th of July 2018 id.warning.daemons[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) hxxp://gmallls.con-537d7.my-id[.]top/
10th of July 2018 id.warning.daemons[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) http://gmallls.con-4f137.my-id[.]top/
18th of July 2018 service.deamon2018[@]gmail.com [Ticket#2011031810000512] – 3 undelivered messages http://login-auth-goglemail-com-7c94e3a1597325b849e26a0b45f0f068.my-id[.]top/
2nd of August 2018 id.warning.daemon.service[@]gmail.com [Important Reminder] Review your data retention settings None
16th of October 2018 lolapup.75[@]gmail.com Экс-хоким Ташкента (Ex-hokim of Tashkent) http://office-online-sessions-3959c138e8b8078e683849795e156f98.email-service[.]host/
23rd of October 2018 noreply.user.info.id[@]gmail.com Ваш аккаунт будет заблокировано (Your account will be blocked.) http://gmail-accounts-cb66d53c8c9c1b7c622d915322804cdf.email-service[.]host/
25th of October 2018 warning.service.suspended[@]gmail.com Ваш аккаунт будет заблокировано. (Your account will be blocked.) http://gmail-accounts-bb6f2dfcec87551e99f9cf331c990617.email-service[.]host/
18th of February 2019 service.users.blocked[@]gmail.com Важное оповещение системы безопасности (Important Security Alert) http://id-accounts-blocked-ac5a75e4c0a77cc16fe90cddc01c2499.myconnection[.]website/
18th of February 2019 mail.suspend.service[@]gmail.com Оповещения системы безопасности (Security Alerts) http://id-accounts-blocked-326e88561ded6371be008af61bf9594d.myconnection[.]website/
21st of February 2019 service.users.blocked[@]gmail.com Ваш аккаунт будет заблокирован. (Your account will be blocked.) http://id-accounts-blocked-ffb67f7dd7427b9e4fc4e5571247e812.myconnection[.]website/
22nd of February 2019 service.users.blocked[@]gmail.com Прекращение предоставления доступа к сервису (Termination of access to the service) http://id-accounts-blocked-c23102b28e1ae0f24c9614024628e650.myconnection[.]website/

Almost all these emails were mimicking Gmail alerts to entice the user to click on the link. For instance this email received on the 23rd of October 2018 pretends that the account will be closed soon, using images of the text hosted on imgur to bypass Gmail detection :

The only exception was an email received on the 16th of October 2018 pretending to give confidential information on the former Hokim (governor) of Tashkent :

Emails were using simple tricks to bypass detection, at times drw.sh url shortener (this tool belongs to a Russian security company Doctor Web) or by using open re-directions offered in several Google tools.

Every email we have seen used a different sub-domain, including emails from the same Gmail account and with the same subject line. For instance, two different emails entitled “Прекращение предоставления доступа к сервису” and sent from the same address used hxxp://gmallls.con-537d7.my-id[.]top/ and http://gmallls.con-4f137.my-id[.]top/ as phishing domains. We think that the operators used a different sub-domain for every email sent in order to bypass Gmail list of known malicious domains. This would explain the large number of sub-domains identified through passive DNS. We have identified 74 sub-domains for 26 second-level domains used in this campaign (see the appendix below for  full list of discovered domains).

We think that the phishing page stayed online only for a short time after having sent the email in order to avoid detection. We got access to the phishing page of a few emails. We could confirm that the phishing toolkit checked if the password is correct or not (against the actual gmail account) and suspect that they implemented 2 Factor authentication for text messages and 2FA applications, but could not confirm this.

Timeline for the campaign

We found the first evidence of activity in this operation with the registration of domain auth-login[.]com on the 21st of February 2016. Because we discovered the campaign recently, we have little information on attacks during  2016 and 2017, but the domain registration date shows some activity in July and December 2016, and then again in August and October 2017. It is very likely that the campaign started in 2016 and continued in 2017 without any public reporting about it.

Here is a first timeline we obtained based on domain registration dates and dates of web attacks and phishing emails :

To confirm that this group had some activity during  2016 and 2017, we gathered encryption (TLS) certificates for these domains and sub-domains from the crt.sh Certificate Transparency Database. We identified 230 certificates generated for these domains, most of them created by Cloudfare. Here is a new timeline integrating the creation of TLS certificates :

We see here many certificates created since December 2016 and continuing over 2017, which shows that this group had some activity during that time. The large number of certificates over 2017 and 2018 comes from campaign operators using Cloudflare for several domains. Cloudflare creates several short-lived certificates at the same time when protecting a website.

It is also interesting to note that the campaign started in February 2016, with some activity in the summer of 2016, which happens to when the former Uzbek president Islam Karimov died, news first reported by Fergana News, one of the targets of this attack campaign.

Infrastructure Analysis

We identified domains and subdomains of this campaign through analysis of passive DNS information, using mostly the Community access of PassiveTotal. Many domains in 2016/2017 reused the same registrant email address, b.adan1@walla.co.il, which helped us identify other domains related to this campaign :

Based on this list, we identified subdomains and IP addresses associated with them, and discovered three IP addresses used in the operation. We used Shodan historical data and dates of passive DNS data to estimate the timeline of the utilisation of the different servers :

  • 46.45.137.74 was used in 2016 and 2017
  • 139.60.163.29 was used between October 2017 and August 2018
  • 51.15.94.245 was used between September and February 2019

We have identified 74 sub-domains for 26 second-level domains used in this campaign (see the appendix for a full list of IOCs). Most of these domains are mimicking Gmail, but there are also domains mimicking Yandex (auth.yandex.ru.my-id[.]top), mail.ru (mail.ru.my-id[.]top) qip.ru (account.qip.ru.mail-help-support[.]info), yahoo (auth.yahoo.com.mail-help-support[.]info), Live (login.live.com.mail-help-support[.]info) or rambler.ru (mail.rambler.ru.mail-help-support[.]info). Most of these domains are sub-domains of a few generic second-level domains (like auth-mail.com), but there are a few specific second-level domains that are interesting :

  • bit-ly[.]host mimicking bit.ly
  • m-youtube[.]top and m-youtube[.]org for Youtube
  • ecoit[.]email which could mimick https://www.ecoi.net
  • pochta[.]top likely mimick https://www.pochta.ru/, the Russian Post website
  • We have not found any information on vzlom[.]top and fixerman[.]top. Vzlom means “break into” in Russian, so it could have hosted or mimicked a security website

A weird Cyber-criminality Nexus

It is quite unusual to see connections between targeted attacks and cyber-criminal enterprises, however during this investigation we encountered two such links.

The first one is with the domain msoffice365[.]win which was registered by b.adan1@walla.co.il (as well as many other domains from this campaign) on the 7th of December 2016. This domain was identified as a C2 server for a cryptocurrency theft tool called Quant, as described in this Forcepoint report released in December 2017. Virus Total confirms that this domain hosted several samples of this malware in November 2017 (it was registered for a year). We have not seen any malicious activity from this domain related to our campaign, but as explained earlier, we have marginal access to the group’s activity in 2017.

The second link we have found is between the domain auth-login[.]com and the groups behind the Bedep trojan and the Angler exploit kit. auth-login[.]com was linked to this operation through the subdomain login.yandex.ru.auth-login[.]com that fit the pattern of long subdomains mimicking Yandex from this campaign and it was hosted on the same IP address 46.45.137.74 in March and April 2016 according to RiskIQ. This domain was registered in February 2016 by yingw90@yahoo.com (David Bowers from Grovetown, GA in the US according to whois information). This email address was also used to register hundreds of domains used in a Bedep campaign as described by Talos in February 2016 (and confirmed by several other reports). Angler exploit kit is one of the most notorious exploit kit, that was commonly used by cyber-criminals between 2013 and 2016. Bedep is a generic backdoor that was identified in 2015, and used almost exclusively with the Angler exploit kit. It should be noted that Trustwave documented the utilization of Bedep in 2015 to increase the number of views of pro-Russian propaganda videos.

Even if we have not seen any utilisation of these two domains in this campaign, these two links seem too strong to be considered cirmcumstantial. These links could show a collaboration between cyber-criminal groups and state-sponsored groups or services. It is interesting to remember the potential involvement of Russian hacking groups in attacks on Uznews.net editor in 2014, as described by Amnesty international.

Taking Down Servers is Hard

When the attack was discovered, we decided to investigate without sending any abuse requests, until a clearer picture of the campaign emerged. In January, we decided that we had enough knowledge of the campaign and started to send abuse requests – for fake Gmail addresses to Google and for the URL shorteners to Doctor Web. We did not receive any answer but noticed that the Doctor Web URLs were taken down a few days after.

Regarding the Scaleway server, we entered into an unexpected loop with their abuse process.  Scaleway operates by sending the abuse request directly to the customer and then asks them for confirmation that the issue has been resolved. This process works fine in the case of a compromised server, but does not work when the server was rented intentionally for malicious activities. We did not want to send an abuse request because it would have involved giving away information to the operators. We contacted Scaleway directly and it took some time to find the right person on the security team. They acknowledged the difficulty of having an efficient Abuse Process, and after we sent them an anonymized version of this report along with proof that phishing websites were hosted on the server, they took down the server around the 25th of January 2019.

Being an infrastructure provider, we understand the difficulty of dealing with abuse requests. For a lot of hosting providers, the number of requests is what makes a case urgent or not. We encourage hosting providers to better engage with organisations working to protect Civil Society and establish trust relationships that help quickly mitigate the effects of malicious campaigns.

Conclusion

In this report, we have documented a prolonged phishing and web attack campaign focusing on media covering Uzbekistan and Uzbek human right activists. It shows that once again, digital attacks are a threat for human-right activists and independent media. There are several threat actors known to use both phishing and web attacks combined (like the Vietnam-related group Ocean Lotus), but this campaign shows a dual strategy targeting civil society websites and their editors at the same time.

We have no evidence of government involvement in this operation, but these attacks are clearly targeted on prominent voices of Uzbek civil society. They also share strong similarities with the hack of Uznews.net in 2014, where the editor’s mailbox was compromised through a phishing email that appeared as a notice from Google warning her that the account had been involved in distributing illegal pornography.

Over the past 10 years, several organisations like the Citizen Lab or Amnesty International have dedicated lots of time and effort to document digital surveillance and targeted attacks against Civil Society. We hope that this report will contribute to these efforts, and show that today, more than ever, we need to continue supporting civil society against digital surveillance and intrusion.

Counter-Measures Against such Attacks

If you think you are targeted by similar campaigns, here is a list of recommendations to protect yourself.

Against phishing attacks, it is important to learn to recognize classic phishing emails. We give some examples in this report, but you can read other similar reports by the Citizen Lab. You can also read this nice explanation by NetAlert and practice with this Google Jigsaw quizz. The second important point is to make sure that you have configured 2-Factor Authentication on your email and social media accounts. Two-Factor Authentication means using a second way to authenticate when you log-in besides your password. Common second factors include text messages, temporary password apps or hardware tokens. We recommend using either temporary password apps (like Google AuthenticatorFreeOTP) or Hardware Keys (like YubiKeys). Hardware keys are known to be more secure and strongly recommended if you are an at-risk activist or journalist.

Against web attacks, if you are using a CMS like WordPress or Drupal, it is very important to update both the CMS and its plugins very regularly, and avoid using un-maintained plugins (it is very common to have websites compromised because of outdated plugins). Civil society websites are welcome to apply to Deflect for free website protection.

Appendix

Acknowledgement

We would like to thank Front Line Defenders and Scaleway for their help. We would also like to thank ipinfo.io and RiskIQ for their tools that helped us in the investigation.

Indicators of Compromise

Top level domains :

email-service.host
email-session.host
support-email.site
support-email.host
email-support.host
myconnection.website
ecoit.email
my-cabinet.com
my-id.top
msoffice365-online.org
secretonline.top
m-youtube.top
auth-mail.com
mail-help-support.info
mail-support.info
auth-mail.me
auth-login.com
email-x.com
auth-mail.ru
mail-auth.top
msoffice365.win
bit-ly.host
m-youtube.org
vzlom.top
pochta.top
fixerman.top

You can find a full list of indicators on github : https://github.com/equalitie/deflect_labs_6_indicators

Read More

eQualitie statement on the detention of Ola Bini

EMBASSY OF ECUADOR
99 Bank, Suite 230
Ottawa, Ontario
K1P 6B9

To the Ambassador of Ecuador in Canada – Mr. Diego Stacey Moreno and to the Minister of Political and Economic Affairs, Mrs. Elizabeth Moreano,

On April 11, data privacy and open source advocate Ola Bini was arrested at the Quito International Airport, where he was accused of “conspiring against the state”. As of yet, no formal charges have been made, and Ola continues to be in pretrial detention. eQualitie wants to remind Ecuadorian authorities of their obligations before ratified treaties and international covenants ensuring that detained persons are treated humanely, and are not subjected to cruel, inhuman, or degrading treatment or punishment; as well as Article 89 of the Ecuadorian constitution ensuring habeas corpus proceedings. If there is a case to be brought against Ola, the authorities should present it and allow the judicial process to run its course. If not, Ola should be considered innocent until proven guilty, and released from detention.

Respectfully,

The eQualitie team

 

eQualitie is a Canadian  organization developing open and reusable systems with a focus on privacy, resilience and self-determination. Our goal is to create accessible technology to promote and defend human rights on the Internet. Our approach and motivation is described in the  eQualitie Manifesto.

Read More

News from Deflect Labs: DDoS attacks against Caucasian Knot

Key Findings

  • In November and December 2018, we identified 3 DDoS attacks against independent media website (Caucasian Knot)
  • The first attack was by far the largest DDoS attack seen by the Deflect project in 2018, clocking over 7.7 million queries in 4 hours
  • The three attacks used different types of relays, including open proxies, botnets and WordPress pingbacks. We could not find any technical intersection between the incidents to point to their orchestration or provenance.

Context

Caucasian Knot is an online media covering the Caucasus, comprised of 20 regions from the North and South Caucasus. The publication has eleven thematic areas with a focus on human right issues. Several reporters paid the ultimate price for their journalism, including Akhmednabi Akhmednabiev, killed in Dagestan in 2013. Another young Chechen journalist  Zhalaudi Geriev, was kidnapped and tortured in 2016, and is now in Chernokozovo prison. On several occasions, Chechen government officials have publicly called for violence against Caucasian Knot reports and editors.

Caucasian Knot has received several journalism awards, including the The Free Press of Eastern Europe award in 2007 and the Sakharov prize in 2017.

First attack : millions of requests from open proxies on October 19th

The Caucasian Knot website joined Deflect on the 19th of October, under the barrel of a massive DDoS attack that had knocked their servers offline.  Deflect logged over 7, 700, 000 queries to / on www.kavkaz-uzel.eu between 11h am and 3pm. This was by far the largest DDoS attack we have seen on Deflect in 2018.

The attack was coming from 351 different IP addresses doing requests to /, adding random HTTP queries to bypass any caching mechanism, with queries like GET /?tone=hot or GET /?act=ring, and often adding random referrers like http://www.google.com/translate?u=trade or http://www.comicgeekspeak.com/proxy.php?url=hot. Most of these IP addresses were open proxies used as relays, like the IP 94.16.116.191 which did more than 112 000 queries –  listed as an open proxy on different proxy databases.

Many open-proxies are “transparent”, which mean that they do not add or remove any header, but it is common to have proxies adding a header X-Forwarded-for with the origin IP address. Among the long list of proxies used, several of them actually added this header which revealed the IP addresses at the origin of the attack (an occurrence similar to what we’ve previously documented in Deflect Report #4)

  • 157.52.132.202 1,157,759
  • 157.52.132.196 1,127,194
  • 157.52.132.191 1,018,789
  • 157.52.132.190 1,008,426
  • 157.52.132.197 984,914

These IPs are servers hosted by a provider called Global Frag, that propose servers with DDoS protection (sic!). We have sent an abuse request to this provider on the 19th of November and the servers were shutdown a few weeks after that (we cannot be sure if it was related to our abuse request). We have not recorded any other malicious traffic from these servers to the Deflect network.

Second attack: botnet attack on November 18th

On this day we identified a second, smaller attack targeting the same website.

The attack queried the / path more than 2 million times, this time without any query string to avoid caching, but the source of the attack is really different. Most of the attacks are coming from a botnet, with 1591positively identified IP addresses (top 10 countries listed here):

  • 213 India
  • 163 Indonesia
  • 99 Brazil
  • 63 Egypt
  • 63 Morocco
  • 59 Romania
  • 58 Philippines
  • 57 United States
  • 46 Poland
  • 44 Vietnam

A small subset of this attack was actually using the WordPress pingback method, generating around 30 000 requests. WordPress pingback attacks are DDoS attacks using WordPress websites with the pingback feature enabled as relay, which allows to generate traffic to the targeted website. A couple of years ago, the WordPress development team updated the user-agent used for pingback to include the IP address of the origin server. In our logs we see two different types of user-agents for the pingback :

  • User agents before WordPress 3.8.2 having only the WordPress version and the website, like WordPress/3.3.2; https://equalit.ie
  • User-agents after version 3.8.1 having an extra field giving the IP address at the origin of the query like WordPress/4.9.3; http://[REDACTED]; verifying pingback from 188.166.105.145

By analyzing user-agents of modern WordPress websites, we were able to distinguish the following 10 attack origin IPs:

45.76.34.217 - 2403
209.250.240.49 - 2396
188.166.43.4 - 2377
209.250.250.52 - 2362
209.250.255.162 - 2351
95.179.183.197 - 2347
174.138.13.37 - 2334
188.166.26.137 - 2274
188.166.125.216 - 2247
188.166.105.145 - 2238

All these IPs were actually part of a booter service (professional DDoS-for-hire) that also targeted BT’selem and that we described in detail in our Deflect Labs Report #4.

Third attack: WordPress PingBack and Botnets on the 3rd of December

On the 3rd of December around 3pm UTC, we saw a new attack targeting www.kavkaz-uzel.eu, again with requests only to /. On the diagram below  we can see two peaks of traffic around 2h20 pm and 3pm when checking only the requests to / at that time :

Peak of traffic to / on www.kavkaz-uzel.eu on the 3rd of December

Looking at the first peak of traffic, we were able to establish another instance of a WordPress Pingback attack with user agents like WordPress/3.3.2; http://[REDACTED] or WordPress/4.1; http://[REDACTED]; verifying pingback from 185.180.198.124. We analyzed the user-agents from this attack and identified 135 different websites used as relays, making a total of 67 000+ requests. Most of these websites were using recent WordPress version, showing the IP as the origin of this attack, 185.180.198.124 a server from king-servers.com. King Server is a Russian Server provider considered by some people to be a bullet-proof provider. Machines from King Servers were also used in the hack of Arizona and Illinois’ state board of elections in 2016. Upon closer inspection, we could not find any other interesting services running on this machine or proof that it was linked to a broader campaign. Among the 135 websites used as relay here, only 25 were also used in the 2nd attack described above, which seems to show that they are coming from an actor with a different list of WordPress relays.

Peak of traffic by user-Agent type, first peak colour is for WordPress user-agents, second peak color is for Chrome user-agents

 

The second peak of traffic was actually coming from a very different source: we identified 252 different IP addresses as the origin of this traffic, mostly coming from home Internet access routers, located in different countries. We think this second peak of traffic was from a small botnet of compromised end-systems. These systems were mostly located in Russia (32), Egypt (20), India (17), Turkey (14) and Thailand (10) as shown in the following map :

Conclusion

The first DDoS attack had a significant impact on the Caucasian Knot website, leading to their joining the Deflect service. It took us a few days to mitigate this attack, using specific filtering rules and javascript challenges to ban hosts. The second and third attacks were largely smaller and were automatically mitigated by Deflect.

In our follow up investigations we could not find a direct technical link to explain attackers’ motivation, however in all cases attacks were launched within a 24-hour window of a publication critical of the Chechen government and when countering its official narratives. We did not find any similar correlation with other thematic or region specific publications on this website, within a 24-hour window between publication and attack.

Read More

Distributed Deflect – project review

This is the fifth year of Deflect operations and an opportune time to draw some conclusions from the past and provide a round of feedback to our many users and peers. We fought and won several hundred battles with various distributed denial of service and social engineering attacks against us and our clients, expanding the Deflect offerings of open source mitigation solutions to also include website hosting and attack analytics. However, several important missteps were taken to arrive here and this post will concentrate on lessons learned and the way forward in our battle to reduce to prevalence of DDOS as an all too common technique to silence online voices.

Our reflections and this post were motivated by an external evaluation report of the Distributed Deflect service, which you can read in this PDF. The project itself was a technical long shot and an ambitious community building exercise. Lessons learned from this endeavor are summarized within. Its about a 10 minute read :)

During peak times on Deflect throughout 2012-2016 we were serving an average of 3 million unique daily readers and battling with simultaneous DDoS attacks against several clients. The network served websites continuously for the entire 3 1/4 years of project duration, recording less than 30 minutes of down time in total. The project had direct impact on over four hundred independent media, human rights and democracy building organizations.

final_report_graphWhat we did

eQualit.ie released 10 open source libraries, toolkits and frameworks including tools for network management and DDoS mitigation; a WordPress managed hosting framework; classification and analysis of malicious network behaviour; the Bundler library for website encryption and delivery across an untrusted network, which was also reused in the Censorship.NO project for circumventing Internet filtering infrastructure.

Over three hundred and fifty websites passed through the Deflect protection service. These websites ranged in size and popularity, receiving anything between a dozen daily readers to over a million. Our open door policy meant that websites who had changed their mind about Deflect protection were free to leave and unhindered in any way from doing so. Over the course of the project, we have mitigated over four hundred DDoS attacks and served approximately 1% of Internet users each calendar year (according to our records correlated against Internet World Statistics). Our work also appeared in topical and mainstream media.

Aside from the DDoS protection service, we trained numerous website administrators in web security principles, worked with several small and medium ISPs to set up their own Deflect infrastructure and enabled Internet presence for key organizations and movements involved in national and international events, including the ’13 election in Iran, ’14 elections in Ukraine, Iguala mass kidnapping, Panama papers, and Black Lives Matter among others.

Distributed Deflect

As attacks grew in size, we debated the long-term existence of the project, deciding to prototype an in-kind DDoS mitigation service, whereby websites receiving free protection and any volunteers could join and expand the mitigation network’s size and scope. We wanted to create a service run by the people it protected. The hypothesis envisioned the world’s first participatory botnet infrastructure, whereby the network would be sustained with around a hundred servers run by the Deflect project and several thousand volunteer nodes. Our past experience showed that the best way to mitigate a botnet attack was with a distributed solution, utilizing the design of the Internet to nullify an attack that any single end point/s could not handle by itself. Distributed Deflect brought together people of various background and competencies, blending software development and technical service provision, customer support and outreach, documentation and communications. We designed, prototyped and brought into production core components of a distributed volunteer infrastructure, only to realize that the hypothesis behind our proposal could not scale if we were to maintain the privacy and security of all participants in our network.

ddeflect

An infrastructure that would accept voluntary (untrusted) network resources had to introduce checks for content accuracy and confidentiality, otherwise a malicious node could not only see who was doing what on the Deflect network but delete or change content as it passed through their machine. Our solution was to encrypt web pages as they left the origin server and deliver them to readers as an encrypted bundle, with an additional authentication snippet being sent by another node for verification. Volunteer nodes would only be caching encrypted information and would not be able to replace it with alternative content.

bundler

All necessary infrastructure design and software tools to implement this model were built to specification. However, once ready for production and undergoing testing, we realized the error in hypothesis made at the onset. Encrypted bundles grew in size, as all page fonts and various third-party libraries – that make up the majority of web pages today and are usually stored in the browser’s cache – had to be included in each bundle.

This increased network latency and could not scale during a DDoS attack. We were worsening the performance of our infrastructure instead of improving it. Another important factor driving our deliberation was the low cost of server infrastructure. By renting our machines with commercial providers, and using their competitive pricing to our advantage, we have managed to maintain infrastructure costs below 5% of our overall monthly expenditure. Monetary support for a worldwide infrastructure of Deflect servers was not significant when compared with the resources required to service the network. By concentrating development efforts on encrypting and delivering website content from our distributed cache and performance load balancing on a voluntary node infrastructure, we held back work on improving network management and task automation. This meant that the level of entry to providing technical support for the network was set quite high and excluded the participation of technically minded volunteers protected by Deflect.

ddeflect-headers-response

After several months of further testing, deliberation and consultation with our funders, we decided to abandon the initiative to include voluntary network resources, in favour of continuing the existing mitigation platform and improving its services for clients. As attack mitigation became routine and Deflect successfully defended its clients from relentless DDoS offensives, the team began to look at the impunity currently enjoyed by those launching the attacks. Beginning with a case of a Vietnamese independent media website targeted by bots originating from a state-regulated and controlled Vietnamese ISP, we understood that a story could be extracted from the forensic trail of an attack, that may contain evidence of motivation, method and provenance. If this story could be told, it would give huge advocacy power to the target and begin to peel away at the anonymity enjoyed by its organizers. The cost for attacking Deflectees would raise as exposure and media attention around the event upended the attackers’ goals.

We began to develop an infrastructure that would capture a statistically relevant segment of an attack. Data analysis was achieved through machine-led technology for profiling and classifying malicious actors on our network, visualization tools for human-led investigation and cooperation with peer organizations for tracing activity in our respective networks. This effort became Deflect Labs and in its first twelve months we published three detailed reports covering a series of incidents targeting websites protected by Deflect, exposing their methodology and profiling their networks. Doing some open source intelligence and in collaboration with website staff, we identified a story in each attack exposing possible motivations and identity of the attackers. Following publication and media attention created by these reports, attacks against one of the websites reduced significantly and ceased altogether for the other one.

Bot behavior follows a certain pattern inside the seven dimensional space create by Bothound analytics

Bot behavior follows a certain pattern inside the seven dimensional space create by Bothound analytics

Challenges

Many difficulties and problems could be expected with running a high-impact, 24/7 security service for several million daily readers. Fatigue, lack of time for developing new features, round-the-clock emergency coverage and numerous instances of high-stress situations led to burnout and staff turnover. The resources invested in the Distributed Deflect model set back development considerably for other project ambitions.
At around the same time as Deflect was gaining popularity, free mitigation offerings from Cloudflare and Google were introduced in tandem with outreach campaigns targeting independent media and human rights organizations. This led to more options for civil society organizations seeking website protection but made it harder for us to attract the expected number of websites. We started a campaign to define differences in our distinctive approaches to client eligibility, respect for their privacy and clear terms of service, trying a variety of communications and outreach strategies. We were disappointed nonetheless to not have received more support from within our community of peers, as open source solutions and data ownership did not figure highly as criteria for NGOs and media when selecting mitigation options.

… we carry on

Deflect continues to operate and innovate, gradually growing and solidifying. Our ongoing ambitions include offering our clients broader hosting options and coming up with standards and systems for responsible data sharing among like-minded ISPs and mitigation providers. Look out for pleasant graphic user interfaces in our control panels and documentation platforms. We are also prototyping several different approaches to generating revenue in order to sustain the project for the foreseeable future. The goal is to get better without losing track of what we came here to do in the first place. As always, we are here to support our clients’ mission and their right to free expression. We are heartened by their feedback and testimonials.

Read More

Distributed Denial of Women – a general strike

It’s a well-known problem: the tech industry, be it proprietary or open source, hasn’t managed to tackle inequality in its ranks despite several proactive efforts and millions of dollars invested to diversify their staff. There are many explanations and critiques of these approaches, but in the end what counts is that technology is still developed and maintained by a homogeneous population of mainly English-speaking cisgender white men.
That’s why on the 23rd February 2017 women and non-binary people in tech are called to join a general strike, the Distributed Denial of Women.

 

We are calling on all women and non-binary people to stand in solidarity and pledge to stay offline, organize or join public gatherings, or stay home in protest of being constantly overlooked, undervalued, underpaid, and downright attacked for daring to demand basic dignity and respect.

 

The organizers of the Distributed Denial of Women acknowledge that not all women and non-binary people have the privilege to participate in this strike, and offer several ways of joining the protest, also through social media. As women working at eQualit.ie, we have decided to join the strike in solidarity with women and non-binary people in tech who regularly face exclusion, microaggressions or abuse. We will participate in the protest with a proactive attitude, so that the Distributed Denial of Women is not a one-off event but a step in a wider process aiming at inclusion and at creating a safer space within our working place, even though it is a virtual and geographicallydistributed one.
For example, in the coming weeks we have committed, as a team, to set aside dedicated time to tackle (or continue developing) our hiring and recruitment processes (with a focus on actively pursuing diversity and standardising assessments); reviewing material we publish for exclusionary language; and opening dialogues within the team about adopting a code of conduct that reflects the kind of balanced environment we want to work in.
We realize that gender gaps exist across all sectors. In Canada, where eQualit.ie was founded, women earn on average 66.7 cents for every dollar men earn, according to the most recent national statistics. The field of tech particularly exemplifies this disparity, with qualified female candidates often passed over in favour of male candidates, and women earning less money and being hired more often than men in non-technical roles. This is in addition to the harassment regularly directed at women in the workplace.
In showing that we actively stand against discrimination we believe, as a first step, that the DDoW campaign being organised on February 23rd is a positive way to bring attention to these important issues. Furthermore, eQualit.ie pledges to develop and keep defining standards of fairness and diversity as we move forward, to keep taking necessary steps to show that despite statistics and biased industry standards, we are committed to living up to our name and doing our work in an inclusive environment.
Are you or your organisation taking part in the Distributed Denial of Women campaign? Let us know!
Read More

Deflecting cyber attacks against the Black Lives Matter website

Last week and throughout the weekend, Deflect helped mitigate several DDoS attack bursts against the official Black Lives Matter website. At current estimates over 12,000 bots pounded the website just over 35 million times in 24 hours. An unusual trait of this attack was the prevalence of  malicious connections originating from the US. An in-depth analytic report will follow this prima facie bulletin.

 

hits_BLM

Hits against the BLM site

unique_ip_country

All unique visitors (IP) by country

unique_bots_by_country

Unique bots (IP) by country

The Black Lives Matter website had already been attacked in May using a similar method of a WordPress Pingback reflective attack and similarly an unusually high percentage of bots from the US.

unique_ip_banned_ddosrule

Deflect banning rules triggered by the attacks

Despite its intensity, the attack has been successfully contained by Deflect, and the Black Lives Matter website is functional and accessible throughout much of the weekend. Black Lives Matter has released an official statement on this incident together with eQualit.ie, Design Action Collective and May First/People Link:

Keeping a website available when attackers are seeking to take it off-line is essential for many reasons. The most obvious is the importance of protecting the fundamental right to human communication. But the specific targeting that characterizes recent DDOS attacks (on networks supporting reproductive rights, Palestinian rights and the rights of people of color) highlights this type of on-line attack as part of the arsenal being used to quash response and social change movements.

DDOS attacks will increase as our protests and organizing increases and so must our movements’ ability to resist them and stay on-line. The collaborative work that spawned the response to this attack is both an example of this protective effort and yet another step in improving it and making it stronger.

Our organizations work in different areas with different programs but we are united in our  commitment to vigorously preserving our movements’ right to communicate and defeating all attempts to curtail that right. Without the ability to communicate freely, we can’t organize and, if we can’t organize, our world can never be truly free.

Read the Statement on the Recent Attacks on Black Lives Matter’s Website.

We are in the process of studying and classifying these attack using Deflect Labs technology and aim to publish the results in our next Deflect Labs report.

Read More

Deflect stats March 2016

This is the first in a monthly series of posts sharing and discussing statistics on the Deflect network. March 2016 was a busy month for us. We began to publish analytic reports on DDoS attacks against some of the clients we protect on the network. Our aim is to help the target’s advocacy efforts and begin strip away at the impunity currently enjoyed by botnet operators. As our analytic tooling and understanding of these attacks improve, so will the reports.

In terms of people served and traffic on the network, this was our busiest month to date. We averaged around 20 million daily hits, a significant percentage of which came from readers in Mexico. Around ten separate DDoS incidents were recorded during the month, of various strength and sophistication.

 

Total hits this month, unique IPs we banned; unique IPs we served

Total hits this month, unique IPs we banned; unique IPs we served

 

Daily hits on the Deflet network

Daily hits on the Deflect network

 

Daily count of unique IPs by country of origin

Daily count of unique IPs by country of origin

 

This month's share of unique IPs by country of origin is a tortilla!

This month’s share of unique IPs by country of origin is a tortilla!

 

Most popular operating systems on the network

 

Attacks on the Deflect network in March 2016

Around a dozen separate incidents were recorded on the network in March. It’s important to note that these are requests that triggered our banning mechanisms. In reality there may have been many more malicious requests.

IP-Bans_by_country_date_histogram

Daily unique IP bans by country

 

Geographical bot distribution

Geographical bot distribution

We are also beginning to track botnets as anomalies on the network. Herein a graph built using the Timelion toolkit for ElasticSearch. It consists of time-series based representation of total hits on the network (red line) and a moving average (blue line) – specific browsing patterns as generated by readers behavior week upon week. We then multiply the blue line values by 3 so we can clearly see when an anomaly is happening on the network. Most of the time, although not every-time, the anomaly represents a spike in traffic or hits on websites – an attack.

timelion

We have also been contributing towards the development of a tool called GreyMemory. It is an anomaly detection tool which accepts any multi-dimensional time series as input, then predicts the next state of the system, measures the error of prediction and generates an anomaly rate. It uses predictive algorithms to evaluate what might happen next on the network, and compares this evaluation with the eventual result. If the quality of prediction drops, it alerts the anomaly. On the following diagram GRAY is the ratio of successful HTTP requests divided by the total # HTTP requests; BLUE is the anomaly rate, as calculated by GreyMemory and ORANGE is the anomaly Alert, where we should create incidents. Alerts are triggered when anomaly rate exceeds a threshold, which is currently on 95%

GreyMemoryReportMarch2016_2

Read More

Deflect Labs – fighting impunity with analytics and advocacy

For the last four years, the Deflect DDoS mitigation system has protected independent online voices from the onslaught of cyber-attacks aiming to silence them. We have grown, learning our lessons as we took the punches. One aspect of this work stood out as particularly interesting during this time: there were stories to be told in the sea of data brought on by each attack. Those stories could shine a light in the direction of the provenance of the attacks and the motivations of the actors behind them. Most importantly, it would aid the advocacy efforts of the targeted website and begin to strip away the impunity for launching these attacks, raising their cost in the long run. The more they attack us, the smarter we’ll get.

Deflect Labs is a new effort to collect and study distributed denial of service (DDoS) attacks launched against the websites we protect. It is built on a variety of open source tools, utilizing machine learning, time-series anomaly detection and botnet classification tools, many of which have been contributed to or wholly developed by eQualit.ie’s Deflect team. We aim to responsibly share news and our analysis of the attacks in a series of ongoing reports, the first of which is released today.

infogram

Read More

DDoS mitigation on a network of principles and openness

Yesterday saw the public launch of Project Galileo, a CloudFlare initiative that partners with reputable international advocacy and civil society organizations to offer free DDoS mitigation services to human rights and independent media groups. As with our support for Google’s Project Shield last year, we welcome all attempts to bring DDoS mitigation to a wider audience of at-risk users around the world and would like to take this opportunity to encourage serious consideration of the ethical and operational standards as followed by eQualitie and our peers. There are both moral and technical obligations that we feel bound by in this industry, from combating hate speech to respecting our client’s privacy.

To this end, eQualit.ie is today putting forward a set of principles which we hope will receive the support of commercial and non-profit providers alike, as well as any partner organizations endorsing these services. Websites signing on for Internet hosting and content distribution services should have a sound understanding of how their providers operate and what motivates each of us to do this work. We strongly agree with CloudFlare’s stated aims:

…to build a better Internet. Fundamental to that is ensuring that bullies cannot use attacks to censor content simply because they disagree with it. We knew we needed to do something to stop this troubling trend.

However, we would add that to engage in activism you have to take a stand and you have to pick sides. By standing firmly against censorship, we cannot also protect groups which would misuse our network for political censorship or as a launchpad for the very same attacks we are trying to stop. Equally, we cannot accept websites which propagate hate speech and advocate for the disenfranchisement or even outright destruction of their adversaries. Such malicious actors are welcome to find a solution elsewhere but it is not accepted practice within our corner of the digital security field to defend rights defenders and rights deniers at the same time. There is no way for us to reconcile protecting both an LGBT site and an anti-LGBT site on our network without, at the very least, disrespecting the values of the former and enabling the latter.

For this reason we ask every organization entering this field to consider the harm done in protecting all sides which operate within a given conflict. To make no choice at all about who your customers are serves only to perpetuate each conflict, breed mistrust among activists and journalists involved and undermine our common aims.

That CloudFlare has chosen to join the fight against censorship-by-DDoS is a huge benefit to groups on the frontline who struggle every day to keep their voices heard. We see our partners face enormous financial, legal, political and personal risks by speaking out for what they believe is right and we understand it is our shared responsibility as protectors of their websites to perform our small part in their work without any ambiguity of operation and purpose.

Signed

The Deflect team

Read More

Take Back The Net!

This week eQualitie will be attending Take Back The Net, a two-day conference in which “human rights advocates and transformative technology providers will meet to discuss what civil society organisations and individuals can do to restore trust in communication infrastructure”. We are attending as guests of the Association of Progressive Communications, organisers of the conference and we are grateful to them for this opportunity to speak directly with many at-risk activists and to understand these vital issues from frontline perspectives.

Read More

Sweden gets eQualitie

Last week eQualitie attended the Stockholm Internet Forum 2014, an annual gathering of multi-stakeholders from internet governance, global civil society, freedom of expression networks, independent media and even some progressive-minded government types. We spent three days meeting with activists, journalists and policy makers to listen to their concerns and discuss the best ways forward for the Internet Freedom movement. We championed open source principles and distributed solutions as the best way to engage and mutually benefit users from across the spectrum in the fight against censorship, surveillance and exclusion on the Net. Our gratitude goes out to the organisers for the invitation and particularly to our friends at Civil Rights Defenders for introducing us. Skol!

Read More