Following the Trail: Determining the Origins of Linux/Bckdr-RKC

It is already known that the two Linux/Bckdr-RKC variants I have received have both been hosted by 216.83.44.229.  Furthermore, the first variant had a phone-home address of 216.83.44.226.

Both of these IP addresses are registered to the netblock owned by WIRELESS-ALARM.COM (not to be confused with the actual website wireless-alarm.com, which is registered to a different contact completely, and unrelated here).

Let's use what we already know to try to find the organization responsible for this malware.



Here is a traceroute I performed several days ago:




Hop(ms)(ms)(ms)     IP Address Host name


  0   0   0      206.123.64.154  jbdr2.0.dal.colo4.com  
  0   0   0       64.124.196.225  xe-4-2-0.er2.dfw2.us.above.net  

  0   Timed out   0      63.218.23.29  ge5-4.br02.dal01.pccwbtn.net  
  214   214   214      63.218.252.86  ge9-39.br03.hkg04.pccwbtn.net  
  214    214   258      112.121.160.221   -  
  213    213   213      112.121.160.18   -  
  218    218   217      112.121.160.198   -  
  213    213   212      216.83.44.226   -  


And here is a traceroute as performed today:

TraceRoute to 216.83.44.226




Hop(ms)(ms)(ms)     IP AddressHost name


  12   0   0      206.123.64.154  jbdr2.0.dal.colo4.com  
  0   0   0      64.124.196.225  xe-4-2-0.er2.dfw2.us.above.net  
  0   0   0      63.218.23.29  ge5-4.br02.dal01.pccwbtn.net  
  212   212   212      63.218.252.86  ge9-39.br03.hkg04.pccwbtn.net  
  Timed out   Timed out   Timed out        -  
  Timed out   Timed out   Timed out        -  
  Timed out   Timed out   Timed out        -  
  Timed out   Timed out   Timed out        -  


Seems that either the responsible organization has been disconnected from the network by their provider, or they have purposely disconnected themselves to hinder analysis.

Starting with 216.83.44.226 and working backwards, let's see who this section of IP addresses is registered to.

216.83.44.0 - 216.83.44.255 is registered to WIRELESS-ALARM.COM

OrgName: WIRELESS-ALARM.COM
OrgId: WIREL-46
Address: 3026 Ensley 5 Points W Avenue
City: Birmingham
StateProv: AL
PostalCode: 35208
Country: US
RegDate: 2009-12-30
Updated: 2011-09-24
Ref: http://whois.arin.net/rest/org/WIREL-46

OrgAbuseHandle: PQU12-ARIN
OrgAbuseName: Quagliano, Pedro
OrgAbusePhone: +1-877-605-5273
OrgAbuseEmail: pedroquagliano@cyanclouds.com

We already know that this is a fake registration, because all of my emails to pedroquagliano@cyanclouds.com were returned as non-deliverable due to DNS failures. That means cyanclouds.com is not an active domain.

Lets go up a level in IP address ownership.


216.83.32.0 - 216.83.63.255 is owned by Ether.Net LLC.

network:Class-Name:network
network:ID:216.83.32.0/20
network:Auth-Area:216.83.32.0/20
network:Network-Name:ETHRN-216-83-46-0
network:IP-Network:216.83.46.0/24
network:IP-Network-Block:216.83.46.0 - 216.83.46.255
network:Org-Name:InfoMove Hong Kong Limited.
network:Street-Address:Unit 2001, 20/F, New Tech Plaza, 8 Tai Yau Street
network:City:San Po Kong
network:State:HK
network:Country-Code:HK

Ether.NET appears to be a legitimate business operating in Hong Kong.

They have been around for many years. They have an AIM for support which I was able to trace back to 2003 posting on web hosting support forums. Doubtful that they're involved, so let's shift out focus elsewhere.


Going back to the IP range owned by WIRELESS-ALARM.COM, 216.83.44.0 - 216.83.44.255, lets look at what else is hosted there.

From http://bgp.he.net/net/216.83.44.0/24#_dns as of 12/31/2011 6:21 PST

IPPTRA
216.83.44.31 mail.bostonyarn.com
216.83.44.54 fold.bronxbreakfast.com
216.83.44.113 prn.iselinnotebook.com
216.83.44.115 joplinyear.com
216.83.44.116 mail.joplinyear.com
216.83.44.189 proe.northandoverschool.com
216.83.44.191 northbendlearning.com
216.83.44.202 wink.norwellobservation.com
216.83.44.204 mail.philadelphiafather.com e8lvbet.com, i3mic.com
216.83.44.221 copy.southplainfieldfeet.com
216.83.44.2
ns1.cyanclouds.com
216.83.44.3
ns2.cyanclouds.com
216.83.44.10
22073.com
216.83.44.18
int-pe.com, interush-pe.com
216.83.44.19
oll365.com
216.83.44.42
centrinofund.com, cf-pe.com
216.83.44.44
games456.us, gamt465.com, gmae456.info
216.83.44.45
com-com-com-com-com.com
216.83.44.46
111i.net, 23u9.com, 55-com.com, gamex6.com, llgame.net, org2.net
216.83.44.66
bmp79.com
216.83.44.67
app67.com, apt67.com, bbv78.com, bul79.com, ddc77.com, ght33.com, jjt55.com, jpg77.com, kky55.com, mmx88.com, rtr66.com, sta78.com, tgg33.com, uub33.com, vbo33.com, vvx45.com
216.83.44.68
aaz33.com, ccx89.com, ygk77.com
216.83.44.69
abo34.com, bmn99.com, ccx66.com, ese55.com, ffs234.com, jsa52.com, kbx33.com, kut99.com, kyy78.com, myb78.com, nnc99.com, rka77.com, ssx69.com, ttx77.com, tvn66.com, wsd22.com
216.83.44.70
kgb69.com
216.83.44.82
66hw.net, hk888.net
216.83.44.90
clubwptasia.com, haedongcheong.com, oce365.com, openrace24.com
216.83.44.99
ylg886.com
216.83.44.122
hg1138.com
216.83.44.123
fh636.com, hg3968.com, hk638.com, yh372.com
216.83.44.131
hg0608.com, hg1918.com, hg4568.com, hg9168.com, hg9338.com
216.83.44.132
hg7678.com
216.83.44.154
sc93.com
216.83.44.155
tv105.com
216.83.44.156
duooo.com
216.83.44.157
bbsveb.com
216.83.44.163
1999829.com, 3771mm.info, 911meinv.info, mytaojia.com, qgxinxi.info, taaobbao.com, wawachina.info, yayaqq.info
216.83.44.164
360meinv.info, 920meinv.com, 999taobao.com, kissbye.info, tabaserver.com
216.83.44.165
265gc.com
216.83.44.166
439995.com
216.83.44.186
03hz.com, 18018.com
216.83.44.194
ckk67.com, fta79.com, jkj88.com, ktm77.com, ktm99.com, mou79.com, nvb89.com, pub79.com, ssr999.com, ssx778.com, tot66.com, tut88.com, utp79.com, vub99.com, xxr44.com, yyc33.com
216.83.44.195
aki77.com, amu77.com, arp77.com, arv99.com, avc77.com, eed69.com, gje88.com, mmb77.com, mpo77.com, tup77.com, vcd79.com
216.83.44.197
vvz69.com
216.83.44.218
hg0035.com, hg1090.com
216.83.44.219
hg1095.com, hg8869.com
216.83.44.228
lcddos.com
216.83.44.229
todayg.com, xy100000.com
216.83.44.243
hg0091.com, hg0093.com, hg0094.com
216.83.44.245
hg0092.com
216.83.44.250
tt95588.com


Hmm, remember the registration for WIRELESS-ALARM.COM?
The email address pointed at cyancoulds.com... and the DNS servers for cyanclouds.com happen to be hosted in the same netblock. Could it be cyanclouds.com is also being controlled by the responsible organization?

So let's lookup the contact info for cyanclouds.com...

Domain Name: CYANCLOUDS.COM
Registrar: DIRECTNIC, LTD
Whois Server: whois.directnic.com
Referral URL: http://www.directnic.com
Name Server: NS1.CYANCLOUDS.COM
Name Server: NS2.CYANCLOUDS.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 31-jan-2011
Creation Date: 03-mar-2009
Expiration Date: 03-mar-2012

Registrant:
Good Names Network
342 Broadway
New York, NY 10013
US
212-555-1212


Domain Name: CYANCLOUDS.COM

Administrative Contact:
Operations, Network goodnames@yahoo.com
342 Broadway
New York, NY 10013
US
212-555-1212


Technical Contact:
Operations, Network goodnames@yahoo.com
342 Broadway
New York, NY 10013
US
212-555-1212


It looks like cyanclouds.com is registered by "proxy" through another company called the "Good Names Network". But wait...is this company real either?

212-555-1212 will simply give you directory assistance for the 212 area code. (New York)

342 Broadway is actually a UPS Store which offers mailbox services...so this could be anyone.

So, another dead end?  This malware which has definite Chinese origins also has a link to an anonymous business New York.

This is where I'd like to point out the marvels of Google.  Specifically Google Street View.

Without Google Street View, we would never have known that next to this UPS Store at 344 Broadway is a shop called "Broadway Cleaners".  A quick Google search shows that Broadway Cleaners is actually owned by someone at 95 Worth Street, which happens to be in Chinatown.

Please note that this is absolutely speculation, and that there is no proof whatsoever anyone at Broadway Cleaners has anything to do with this.  However, the fact that the malware has definite ties to China, and the fact that the proxy company used to register WIRELESS-ALARM.COM's IP block is right next door to a business originating in Chinatown, is a very interesting coincidence.

Unfortunately this is where the trail goes cold.

This search for the origin of this malware has possibly raised more questions than provided answers.  But one thing is for certain - the network framework for this malware has definitely been in place for some time.  WIRELESS-ALARM.COM's IP block as well as cyanclouds.com have been registered since 2009.  This is not the work of a "fly-by-night" script kiddy.  Careful planning has been taken to not only develop this malware, but also to establish the hosting this malware would be using - and hide its true origins.

Of the 1.8 New Year's Resolutions We Make Every Year, 23% Fail Within Two Weeks: A Humorous Scientific Outlook on the Fallacy of New Year's Resolutions.

Image 1: I don't know about this "smart ass" in particular, but I would assume you have had enough "smart asses" post their knowledgeable tips on their blogs to get along without another "12 useful tips for 2012" from me, right?
I guess at least those of you who have been following this "blog" (I hope that you would agree that the SuppVersity has become more than another "blog") have come to "know" me well enough not to expect me to provide you with the 1001 list of ten, or at it has become fashionable as of late, twelve super-duper congenial tips to achieve your goals in 2012. Change, and this is the one wisdom I want to give you to take along for the next year, change rarely is something that comes over night or is "triggered" by the adherence to any fixed plan. Change is the result of the accumulation of small steps, dx/dt, as we physicists would say, i.e. covering an infinitesimal distance (=dx) within an infinitesimal short timespan (=dt). If we now denote steps that take you further towards your goal as positive and steps by which you depart from your ultimate goal as negative than any year in which the integral over dx/dt would be positive, or in non-physicist terms, where the number of infinitesimal steps you have taken towards your goal was greater than the ones by which you have distanced yourself from what you want to achieve, a successful year! Consider that before you file 2011 as another "lost" year.

Enough smart ass new years advice for 2011!

But hey, didn't I say, I would not give you wise ass advice? I guess we should get back to science then... after all the "-versity" in the name of this site denotes that we are doing serious stuff here, doesn't it? So, take my hand and descend (for the last time in this year) with me into the archives of science. The first thing we hit on is an editorial from the most prestigious medical journal in the world, The Lancet, in which the contemporary editor of the journal has the following well-phrased advice for you (I did not say I would not provide you with wise ass advice from others ;-)
The opening of a new year leads all of us to take some stock of the past and to formulate a certain number of resolutions for the future, and the frame of mind which is thus indicated should be indulged in, but only with moderation. To spend too much time in thinking over what has gone by will interfere with the work that lies under our hand; to make resolutions that are too large and too numerous for our powers is to court disappointment. None the less every thoughtful man will use his past experience to guide him in the future both as to what he will do and as to how he will do it. (The Lancet. 05. January 1907)
Image 2: New Years Eve is for most of us the time, when we simply cannot ignore the necessity to make a change, any longer.
Somehow, this reminds me of some of the "best tips, tweaks, tricks" and, above all, "common pitfalls to avoid in 2012", I have been reading elsewhere around the web over the course of the last days. I mean we all know that the more good intentions we have, the more likely they are to never materialize into significant changes. Being aware of this circumstance, Judith Stoner Halpern who wrote the editorial to January issue of the not just as famous *rofl* International Journal of Trauma Nursing suggests that (Halpern. 2001) "perhaps the best New Year’s resolution that we can make would be to learn how to make a better resolution"

Interestingly, and this is probably the first thing that goes beyond "conventional new year's resolution wisdom", the first reason she invokes is the time of the year!
An easy answer is to blame January 1. For one half of the world, it falls in the middle of winter, and for the other half, the middle of summer. This is not the most opportune time to enact a dramatic change. The middle of a season often causes us to feel a lack of commitment; this may be part of the reason that ancient cultures chose spring or fall as the time to start anew. For some, January 1 may feel like an artificial time for change.
When you come to think about it, this is actually quite a reasonable argument. With the "winter blues" upon us January certainly is not the best time to "blossom". The neo-paleolithic folks many of us recently believe we are, we should better crawl up in our dugouts and set up our plan of attack in order to mimic the "ancient cultures" and start anew in spring.

Does understanding the psychology of change hold the key for success?

The question yet remains, how do we instigate a new-or restart? A possible answer may come from Freeman and Dolan's theoretical model of change that in turn is based on a previous model by DiClemente that has been extensively discussed in the scientific literature on psychotherapy. According to the model, the authors propose in their 2001 paper in Cognitive and Behavior Practice, there are 10 stages. Where the last one, maintenance marks the (temporary) achievement of preferably positive "change".

Figure 1: The psychology of change - an illustration based on the "revisited stages of change model by Freeman and Dolan (Freeman. 2001)
If you take a closer look at my graphical illustration, you will realize that you have (hopefully) already overcome the initial stages of
  • noncontemplation, where, in your everyday oblivion, you do not even consider making a change
     
  • anticontemplation, where you are trying to convince yourself that you are "just fine the way you are" or that it would be impossible to make a change, anyways
     
  • precontemplation, where you are thinking and often dreaming about what would happen if you were able to make a change
Interestingly, for most of us the realization that another year is almost over usually makes us go through these stages (many of you may skip the 2nd one, some may get stuck there), automatically. So even if you are not one of Freeman and Dolan's persons, chances are that you are now, as they put it "directly and actively considering change" and have "reached a point of readiness to engage in the change process." 

Sitting in your neo-paleolithic dugout - or, for those who have not been infected by the paleo-virus in the course of 2011, simply in your cozy home - it is now about time to lay out your plan of attack!
Action planning is the stage of change when the therapist and patient have collaboratively developed a treatment focus and treatment plan. The therapetnic process has begun and the patient is beginning to make plans on how change will occur. The key phrase with this group is, "I plan to change."
Now, I don't know whether you have a therapist, or not (note: this is nothing to be ashamed of - I would even count the people I know that are in psychotherpeutical care among the few relatively sane human beings which populate this planet ;-), are working with a trainer, nutrionist or just a good friend who will help you on your way. In the end, it will always be about your commitment to your plan to change and eventually your success. That you have to determine the latter based on the integral over the steps in the right and steps in the wrong direction is something I have mentioned before. Freeman and Dolans model, however, provides a theoretical framework to understand this sometimes annoying, often frightening and in many cases discouraging back-and-forth even better.
Figure 2: Reported success rates at different timepoints in the new year and at 2 year follow up (data based on Norcross. 1989).
What are typical New Year's Resolutions? I must admit that I was quite disappointed about the lack of scientific data on the real-world outcome of New Year's Resolutions. Similar to the previously discussed issue of holiday weight gain which turned out to be at least less pronounced than everyone would have it (cf. "Santa is Coming to Town"), there is almost no realiable, non-specific, i.e. not related to only one goal (mostly smoking cessation), scientific data that would proof that the majority of new years resolutions fail.

In one of the two peer-reviewed studies I could come up with (both based on the same dataset), Norcross et al. report that their 213 study participants "made an average of 1.8 New Year’s resolutions" (Norcross. 1989). Among those, smoking cessation (30%) and weight loss (38%) together accounted for two-thirds of the resolutions. Other non-idiosyncratic New Year's Resolutions revolved around relationship improvement (5%), reduction in alcohol consumption (2%), and an increase in monetary savings (2%). A cursory glance at figure 2 does yet suffice to see that the difference between the real and the commonly assumed "success"-rates is much less pronounced than in the previously cited case of holiday weight gain. With a 23% chance of failure after no more than 2 weeks and a drop out rate of  57% after three months, chances that the average 16-75 year old citizen of northeastern Pennsylvania is able to realize his resolutions for the new year really isn't very high. A reported (do we believe those guys?) success rate of 19% after 2 years is nevertheless more than what my personal observations would suggest.

Lapses are integral parts of change - accept them work, through them, or fail

Image 3: If your New Year's resultion incorporates letting go of junk food, thinking of Mark Haub, the "Twinkie Diet Professor", probably would not be one of the "behavioral skills" to incorporate in your mental toolbox.
Let's assume you are a carbohydrate-addict and decided to cut back on carbs in the next year. Do I see you tremble in apprehension? Well, this is actually an apprehension of the prelapse phase, a phase that is "characterized by active and often overwhelming cognitions related to the reversal of the changed behavior" the carb-junkie you are, even the thought of having to put down your twinkies and dingdongs (whatever the latter may be) is getting you all psyched up. If it was already January the 1st, this would be the moment, when you are eating your eggs and bacon for breakfast, look at the cereals your brother is shuffling down his throat and think to yourself: "How can I possible endure that for the rest of my life?" Then you remember the words of the mighty paleo guru Robb Wolf to "give it a shot for thirty days" and gag down the last piece of bacon.

Psychotherapists refer to simple tricks like this as "behavioral skills", i.e. (mostly cognitive) techniques by which you can "short-circuit the prelapse before it leads to the old behaviors."

Figure 3: Successful and unsuccessful strategies to stay on track; * indicate statistically significance for success (data based on Norcross. 1989).
Which "behavioral skills" are most helpful? In the aforementioned study, Norcross and Vangarelli also analyzed which methods the participants successfully (figure 3, green) and unsuccessfully (figure 3, red) applied to achieve their aims. As you can see planning ahead (contingency management), managing "dangerous" stimuli, exercise (obviously not the way to distract yourself from the temptations if your new years resolution was to exercise more) and, above all, taking one step after the other, were the most effective strategies in the toolboxes of the 213 study participants, of whom only 18% said that "nothing hindered their resolution". Among the remaining 82%, most invoked their own lack of willpower (34%) as the fundamental obstacle. 16 subjects found that the realization of their resolution was not compatible with their lifestyle and 8 maintained that they had not been serious enough about their resolution.
(Un-?)fortunately, you are human and thusly destined to let reason go and fall back to old, oftentimes bad habits. So, there will come a day, when you will be sitting next to your meanwhile "no longer so loved ones" (after all, they are allowing themselves to eat all those jummy junk right next to you at your table ;-) and stare at the twinkies and dingdongs they are indulging. Suddenly a thought crosses your head: "Wasn't there this funky professor who lost a ton of weight on the twinkie diet?" You reach out and, probably much to the secret delight of your "formerly loved ones" who have been jealous of how fast you have been losing weight in the course of the last weeks, grab one of the twinkies that have been waiting for so long for you to take appropriate care of them... I guess I don't have to tell you the rest of the story, do I?

What is important, though, is that whenever lapses like this happen is that you always remember that no matter how many twinkies you may have eaten, how many training sessions you may have skipped, and/or how many cigarettes you have smoked, it is still your choice:
  • You can either return to the anticontemplative phase by persuading yourself that you could shed off the extra points just as well on twinkies and dingdongs - and even if that would not work, why would you have to make a change, in the first place? After all, you feel "fine just the way you are"!
     
  • Or you can analyze what triggered your temporary loss of memory and inability to apply one of the various behavioural skills that have prevented you from "lapsing" before.
I guess, it is not difficult to tell that option #2 would be the way to go. You have to go back to the drawing board. Not to start all over again, but to develop new skills and cognitions and to practice old to make sure that your next dt/dx's will be positive again. In that the ability to accept your own fallibility and the insight that a bunch of twinkies won't ruin the admirable success of the previous weeks, may be one of the key elements that will eventually enable you to achieve your contemporary goals, maintain your success and reach for the stars.

Along these lines, I wish all of you, my dear silent and not so silent readers, your families and loved ones, a successful, happy and, above all, healthy year 2012.