Russian Hosting Firm Denies Criminal Ties, Says It May Sue Blacklister

Fugitif · 16 Oct 2007

Speaking to the Western press for the first time, a Russia-based web-hosting firm pilloried by security companies as a free zone for online crime insists that it's really just misunderstood.

"We can't understand on which basis these organizations have such an opinion about our company," Tim Jaret of the Russian Business Network says in an e-mail interview. "We can say that this is subjective opinion based on these organizations' guesswork." Jaret's e-mail signature identifies him as working in RBN's abuse department.

Security researchers and anti-spam groups say the St. Petersburg-based RBN caters to the worst of the internet's scammers, renting them servers used for phishing and malware attacks, all the while enjoying the protection of Russian government officials. A report by VeriSign called the business "entirely illegal."

"They just figured out that in Russia no one will prosecute them, or if they do, they can pay them off," says Johannes Ullrich, chief technology officer of the SANS Internet Storm Center. Ullrich says RBN maintains a veneer of legitimacy by paying lip service to abuse complaints, but nothing more.

"What typically happens is a phishing site sets up with RBN, and when someone complains enough, RBN will take it down. But it will be back up the next day," Ullrich told Wired News. "There is lots of pseudo-compliance."

RBN allegedly rents dedicated servers to online criminals for $600 per month, promising "bullet-proof hosting." That term means sites won't be taken down when complaints are made, according to an analyst for iDefense, VeriSign's cybersecurity reporting arm, who spoke on condition of anonymity.

RBN offers customer support, has partners and subsidiaries, and sells various tiers of service. "If I were engaged in cybercrime, I would totally use them," says the analyst.

But Jaret, in what appears to be RBN's first press interview since the firm was founded in June 2006, claims the organization has made efforts to respond to complaints of wrongdoing on its network.

"We tried to cooperate with one of such organizations called Spamhaus, and this experience showed that such cooperation wasn't constructive."

Spamhaus, an antispam operation, includes the entire 2,048 internet addresses controlled by RBN on its widely used blacklist of known spammers. It lists the network as "among the world's worst spammer, child-pornography, malware, phishing and cybercrime-hosting networks" -- a description that displeases the RBN.

"Now we are considering a lawsuit as a way of resolving this issue," Jaret says of Spamhaus.

Spamhaus did not immediately respond to a request for comment.

But some of the internet's most respected researchers and security companies agree with Spamhaus, listing RBN as a key and blatant player in the increasingly professional world of online crime.

iDefense's clients have all configured their networks to block traffic from the IP addresses assigned to RBN. But since some of RBN's business partners have legitimate businesses, it's tough for large ISPs to block the unwanted traffic without collateral damage. "RBN is such a filthy network that touches the entire world, but we can't stop connecting," says Gadi Evron, a botnet expert and former director of Israel's Computer Emergency Response Team. "Who says who can connect to whom? Is that decision mine to make for the entire world?"

Despite the consensus of the security community, and recent press reports from The Economist and The Washington Post, RBN denies that it's a web shop for criminals. RBN doesn't have any more criminal activity on its network than any other provider, and it responds to abuse reports submitted via e-mail and a telephone hotline, says Jaret. He claims the organization closes criminals' sites down within 24 hours of notification.

Jaret also says there's no mystery about the company's ownership. According to Jaret, an offshore company called First Connect Telecom Limited Inc. owns RBN, though the company's principals remain anonymous. The registration information for the company's website lists a company called Absolutee Corp. LTD as the owner of the domain name.

After security companies began scrutinizing RBN, the company took down its website and changed its registration information. The iDefense analyst says RBN doesn't need a website, because it gets its business through word of mouth in the underworld, and from dodgy crime-oriented web forums. RBN says it gets its customers through resellers, and that a new website is under development.

Wired News asked RBN to provide the URLs for some legitimate customers, and Jaret says he couldn't oblige -- for legal reasons.

"Our customers are regional providers, legal entities and physical persons," Jaret says.

"We won't give you their names and brands as our contracts prohibit us to do this. We can give such information only in reply to formal request of officials."
Click to expand...

FROM:

http://www.wired.com/politics/security/news/2007/10/russian_network

Useful Searches

Russian Hosting Firm Denies Criminal Ties, Says It May Sue Blacklister

Fugitif Elder - Старейшина