Bulletproof Networks and Residential IP Addresses

On, August 19, 2019 Krebs on Security reported on on Bulletproof resiential networks and their use in bots malicious traffic. Bulletproof networks are networks which have a low likelihood of being blocked or terminated even when the hosts serve malicious traffic. Resnet is the focus of the discussion, which is a network of 70,000 IPv4 addresses and advertises itself as a a bulletproof network perfect for bots or buying items with stolen credentials. These residential networks are viewed as bulletproof because online retailers are unlikely to block residential IP addresses because these addresses are shared among whole blocks of residential IP addresses. Due to the rotating addresses, retailers are very cautious to block a potentially legitimate customers when the addresses are reassigned.

Recommendations

Ensure that you're running a virus scanner with up to date signatures.
Monitor home network traffic for unexpected connections or data.

Details

Residential networks are being increasingly used for smuggling malicious traffic as reported by Krebs on Security. These networks are attractive to hackers because of their low likelihood of being blocked. Since IP addresses are shared among residential customers, retailers are unlikely to block addresses that exhibit malicious behavior in fear of blocking a future customer who may get assigned one of these addresses.

Resnet, the focus of the investigation, revealed that it contained 70,000 IP residential IP addresses, including AT&T, Verizon, and Comcast. Additionally, 7,000 of these addresses belong to mobile customers. After searching for details of Resnet several references to Hackforums[.]net were found on the forums with advertising that the addresses for sale were botting and shoe buying.

As it turns out, shoe bots are very profitable because designer, limited edition shoes are often bought with stolen credit information and then resold at a much higher markup with profits going directly to the hackers. These networks are perfect for conducting this sort of business because of the low chance that they will be blocked. Even more unsettling is a report from Akamai which states that automated bot activity accounts for almost half of internet bandwidth directed at online retailers.

At this time it is difficult to determine whether these residential networks are legitimately acquired versus obtained through legal means. For instance, WDSPC, which uses AT&T's address space was duped into leasing a large portion of AT&T's address space because WDSPC received a letter claiming to be from AT&T which recommended Resnet as a customer. Given both legitimate and illegitimate methods for claiming residential IP space, residential networks appear to be a long term, viable solution for attackers to have bulletproof networks used for all kinds of malicious traffic.

Breaking News: 2019-08-19

Router Network Isolation Broken By Covert Data Exfiltration - BleepingComputer

Software based isolation is a key feature in home routers which will often have separate networks for guests and normal home users. Researchers have found that by sending specially crafted packets that data can be leaked from one network to another. For instance, the researchers were able to craft DHCP packets such that certain responses were sent to both networks. Using this, a covert attacker can encode data in DHCP's 32-bit Transaction ID, and then surreptitiously leak that data across network boundaries.

See the full report here: https://www.bleepingcomputer.com/news/security/router-network-isolation-broken-by-covert-data-exfiltration/

'Coordinated Ransomware Attack' in Texas Hits 23 Local Governments - BleepingComputer

Ransomware attacks have been targeting local government officials in Texas. Currently, there are at least 23 government entities impacted. The attack seems to have originated from a single threat actor using an unknown strain of file encrypting malware. The attack has caused multiple organizations to get involved with determining the scope of the damage, including the Department of Homeland Security and the FBI. However, the details and scope of the coordinated attacks is still being investigated.

See the full report here: https://www.bleepingcomputer.com/news/security/coordinated-ransomware-attack-in-texas-hits-23-local-governments/

Mozilla Firefox Bug Let Third-Parties Access Saved Passwords - BleepingComputer

Mozilla just patched a vulnerability in Firefox that allowed any user to copy password information from the browser's built in database. Fortunately, the exploit requires the user to be local on the machine. Additionally, the password database is enabled by default and does not require a master password to be setup before allowing users to use the saved passwords feature.

See the full report here: https://www.bleepingcomputer.com/news/security/mozilla-firefox-bug-let-third-parties-access-saved-passwords/