Netlab 360 Blog

> Chinese just try to destroy and censor. Worked at a company which hosted presentations, one of their 5 million presentations was critical of China. We received over 10,000 phone calls and close to a million emails in two days, and a sustained 10gbps ddos attack for a week. Do you have any proof it had to do with the presentation? You're treating "China" as if it was one person. > Letting russia and china on the internet was a massive security mistake we should rectify. The world spends literally BILLIONS because chinarussia are frankly assholes online. China Unicom IPs trying to guess your root password over SSH is not a cyberwarfare campaign. China regularly takes down botnets (read https://blog.netlab.360.com/). It is a result of a bunch of cheap IoT devices with default passwords. > Russisns mostly try to disrupt and steal because thats their foreign policy. Great! Now Russians go straight to using a US residential proxy when they commit fraud because they see they are being blocked instead of silently raising their internal risk score or any of the 50 smarter things you could have done.

I mean it's enough to make at the most a few thousand a month selling residential proxy plans on crime forums. Not really significant. There are orders of magnitude larger botnets (some 100k, 400k+ in size) you can read about on https://blog.netlab.360.com/. Edit: I agree it is important to do takedowns. Qakbot, GameOver Zeus, Emotet, Snake, etc all had actual espionage risk / were cumulatively involved in billions of dollars of theft. But this botnet seems sort of irrelevant.

Key point: >>"kernel maintainers (and maintainers of many other free-software projects) are overworked and do not have the time to properly review every patch that passes through their hands. They are, as a result, forced to rely on the trustworthiness of the developers who submit patches to them. The kernel development process is, arguably, barely sustainable when that trust is well placed; it will not hold together if incoming patches cannot, in general, be trusted. " Yet these UMN "researchers" deliberately chose to violate that trust. Are they so ethically clueless and arrogant that they didn't think to review the plan? Did they hold any kind of ethical review and pass it, or fail it and decide to proceed anyway? In any case, they've now alerted the entire world that the Linux dev process and OS dev processes in general are incredibly vulnerable to malicious actors. This vulnerability is also shown by another #1 HN story[1] [1] https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/

https://blog.netlab.360.com/icnanker-trojan-downloader-shc-en/ has: cp -f /usr/bin/chattr /usr/bin/lockr

article with some indicators[for now] listed. a number of sources seem to agree this is not finished ware, there are some feature stubs in the code. alternatively i would also explore the idea that a full featured ware was not paid for so, the basic user tier is in play, rather than B1txor20 premium. https://blog.netlab.360.com/b1txor20-use-of-dns-tunneling_en/ has a nice breakdown of the code

Click bait title; link to source: https://blog.netlab.360.com/ongoing-credit-card-data-leak/

A much better, more thorough analysis, complete with affected router model numbers, graphs, charts, and area affected map are at the source post: https://blog.netlab.360.com/bcmpupnp_hunter-a-100k-botnet-turns-home-r…