Mobiquant - when IT security goes badly wrong

UPDATE: as of September 2013, this site appears to have been cleaned up.

Mobiquant appears to be a a small French IT security company run by a gentleman called Reda Zitouni that has been reportedly struggling a bit and may have shut up shop earlier in the year. They describe themselves thusly: "Mobiquant Technologies is a leading company provides mobile SECURITY management technology to enterprises & carriers (BYOD, MDM, MSM)"

They have a couple of Twitter accounts, one of which has been switched to protected and the other one has not Tweeted since April. There's very little evidence to indicate any kind of activity (although we'll get to that in a moment) and this site has it marked as "Cessé économiquement" ("Ceased economically") according to INSEE.

The problem is that their website has been serving up a RedKit exploit kit for at least the past ten days. And despite several attempts to contact them via email, Twitter and a variety of other means the exploit kit remains.

It's not a surprise to see an abandoned website being infected like this, but it is embarrassing for an IT security company. But more worryingly, it could be a watering hole attack which is deliberately targeting people involved in IT security. Not that the affiliate domain yesucantechnologies.com also appears to have been compromised.

The plot thickens though. Because it is sometimes nice to let people know that they have been hacked I looked at the WHOIS records for the domain to find the contact details. And this is what I found:

Registrant Contact:
   Fortesia
   RZ Group ()
  
   Fax:
   7
   Cheval Place
   London, P S6SDJ7
   GB

Administrative Contact:
   Fortesia
    Group (adds31@gmail.com)
   +44.20777777777
   Fax: +44.20734596895
   7
   Cheval Place
   London, P S6SDJ7
   GB

What is wrong with these records? Everything! The WHOIS details claim to be for a UK company, but according to Companies House there is no such entity in the UK as Mobiquant or RZ Group, and no active companies by the name of Fortesia. "P S6SDJ7" is not a valid UK postcode, and the address is actually an East African Restaurant. Although the fax number is potentially valid, the +44.20777777777 telephone number is extremely unlikely. What sort of company fakes its WHOIS records?

Now, when you have invalid WHOIS details for a malware site one of the quickest things to do is file a report with ICANN. I did this, expecting that this apparently zombie site would be shut down. But what happened instead is that the WHOIS details changed:

   WhoisGuard, Inc.
   WhoisGuard Protected (26ae68e0b9764d38a5d0ca312cc0d367.protect@whoisguard.com)
   +507.8365503
   Fax: +51.17057182
   P.O. Box 0823-03411
   Panama, Panama NA
   PA

Now, this is kind of odd because it means that someone must be home at Mobiquant, and they were prepared to correct their WHOIS details (or risk losing their site), but are not prepared to clean up the infection. Incidentally, the fake WHOIS details can still be seen at the site mobiquantacademy.com.

Indeed, mobiquantacademy.com (apparently uninfected) was active a few days ago which indicates that something is still happening at the company. But fixing their web site is not one of those somethings..

Strangely too, Mobiquant managed to push out a press release (don't click the Mobiquant link on that page) in the past few days about being invited to a conference (is that really news?).

Now, I don't know exactly what is happening at Mobiquant, but it does seem that they are recklessly ignoring the problems with their web site which is placing customers and visitors at risk. Is that really a good way for an IT security company to behave?

UPDATE: after publishing this post a year ago and noting that the problem has been cleaned up, Mobiquant have responded to my criticism by making personal attacks and making statements that are not true. My personal opinion is that this just shows what an unprofessional organisation they are, I would certainly not recommend doing business with them under any circumstances.

Firstly, Mobiquant did acknowledge there had been an issue with their site:

From:     Grzegorz Tabaka [markcom@mobiquant.com]
Date:     26 August 2013 19:14
Subject:     Mobiquant Technology

Dear Mr. Langmore,

My name is Grzegorz Tabaka, I am communication manager at Mobiquant Technology.
Let me first congratulate you for your great blog dynamoo.com. I went through it today, and I saw your post about us regarding the issue we had few weeks ago with some malicious code that infected our website.
I know you sent us messages about it, unfortunately we didn't receive any of them, please accept my apology for that.
I only wanted to inform that our website has been cleaned weeks ago and now is completely safe.
I suppose you wont delete this post about Mobiquant, but would you be so kind and post there a short statement, that the website is now clean and safe to visit? I will be really grateful if you could do that.

If you have any questions don't hesitate to ask,

looking forward to prompt reply.

best regards

So, as requested I amended the post to say that the site was clean. But I still had my reservations over a company that did (and still does) rely on fake WHOIS details to protect its domains, and that did not bother responding to multiple reports of an issue with their web site.

Mobiquant then decided that instead of engaging in a dialogue, they would launch a personal attack against me in their blog. Their blog got deleted for some reason (I assumed they they had done it), something that happened several months ago.. but now they have decided to blame me for it and have republished it (I suspect that all they did was screw up their own DNS entries, but whatever).

To be clear, I did not request that their blog be removed. The post they made about me was so badly written and petty that it clearly demonstrated what an unprofessional organisation Mobiquant is. And company that would behave in this way does not meet the minimum ethical and professional standards that a business should have. I'm not going to link to their blog, but I will respond to it:

UPDATE:
We learnt  (by different security friends) that the CONRAD LONGMORE loves denigrating people, revealing their personal life for free BUT DON T LIKE THIS FOR HIMSELF. ;-) YES ! in fact he asked GOOGLE to remove his post from the results in the Google search. Crazy ! that our White security Knight don t like what he does to (some) honest people and companies to ensure the Buzz and traffic on his eCommerce Blog where he is still selling crap things that Have nothing related about security.
So here we are again guys !!

Sure, I will reveal the details of bad actors when I find them. But I never put in a request to Google to remove the blog, simply because this laughable and pathetic rant from Mobiquant simply shows what kind of an outfit they are.

Earlier, in August we were informed  by some partners of a strange post from a guy claiming being a "security expert". This dude called Conrad Longmore from a blog we never heard about (dynamoo), posted an article about Mobiquant Technologies. He maybe got his freeware antivirus warning him about a malicious javascript resulting of an infection on our hoster files. The strange thing here is fully about the behaviour of the guy claiming to belong to the security community. After 20 years in the sec arena we never seen a hacked victim behing blamed and denigrated having its website infected. What about the hackers? sure it requires a real true technical work. Not given to everyone.

Actually the truth of what happened is that I attempted to contact them several times with no response. From all the evidence at the time, it appeared that all activity at the company had ceased, which was backed up company reports in France. My criticism is that Mobiquant ignored the problem and had their site infected for several weeks, not the thing that make an IT security company look good. Not that this paragraph does explicitly acknowledge that they were hacked,

We  made a quick search about this unknown blogger.
[removed to avoid Google removal ]$
He is using a personal blog space on google blogspot, after apparently having tried several corp domain (www.Conrad-longmore.co.uk 404 error, no files) and a wordpress free space (http://en.wordpress.com/tag/conrad-longmore/ 404 error , no files).)

Wow.. a dead website parked at a host I don't use and a WordPress tag about me. And your point is....?

No company, no professional profile. Jobless or Yet another freelancer. Website : dynamoo.com seems to be a fake or outdated (last update 2003) website as many links are broken. Kind of blogsite quickly setup and stopped by this myserious guy.
We found some related facebook link :https://www.facebook.com/conrad.longmore‎ ,  with a profile picture of a guy having a walk in the british countryside holding a bag with a kiddy puppet  in the back :

I don't mention the company I work for, for a number of reasons. But bits of my website haven't been updated since 2003? Wrong. There are bits of my website that haven't been updated since the mid-1990s. And actually I blog about stuff most days, but really.. what's is Mobiquant's point. As for the Facebook profile, they are referring to this picture.

Yes, there's a stuffed reindeer peeking out of my backpack of the photo on my Facebook page. Oh no.

and a twitter account with some strange twitts taking position for the [removed to avoid Google removal] community :

The original post read:

and a twitter account with some strange twitts taking position for the  homosexual community : 

Basically, Mobiquant went through all my Twitter posts and found something advocating gay rights, which they are using a reason to attack me. Does this make Mobiquant a homophobic company? I'll let you make up your own mind, but given that Mobiquant appears to operate partly from Morocco, then the answer is definitely maybe.

After having contacted the guy , our team did not have any answer from him.

Which is not true.

Seems that this guy is using various ways to drive some traffic to his blog by denigrating different websites and people with no reasons claiming they are all hackers or malicious internets users and has already many enemies apparently:

Hell, yes.. the bad guys tend not to like you much if you spoil their evil plans. But as for "no reasons".. well, anyone who reads my blog can see that it is very much centered around evidence.

This is clearly to make some business about mobile items sold on his web and by using this  technique of degritation to do some buzz ( audience is poor) he is  selling mobile accessories. Security ? ecommerce ? mobile accessories ? strange guy ;-). People are complaining on forums about receiving spam email from him to buy mobiles parts : "
Conrad Longmore does appear to sell all kinds of things,  including mobile phones, and portable air conditioners, so the guy must have read the site and added the PS for shits and giggles" :  Forum of victims describing what happened to them.

I have some old (and dead) affiliate links on my personal website promoting all sorts of things. So what? And I was a victim of a Joe Job a long time ago, after exposing this criminal activity. So what?

The malware a classical non critical  HH. JS, among thousands variants of this kind,  have spreaded thoughout the web since years, and it has infected again this summer up to 252 000 website among which Apple.com and some others which were unavailable for nearly one week for some of them.
Our dude find that on our website, which is obviously technically hosted on a distinct independent infrastructure than the corporate one, thought it was a valid and major reason to drive a deep dive study about : the company, its financial status (with French reading bad expertise ;-)) , our management, our domain .... and yes absolutely not about this malware, the security countermeasures etc . In short nothing related with security and IT.

The malware was Redkit, which was a very dangerous exploit kit. As far as I know, Apple.com was never infected with Redkit. The infection is clear from my original blog post. But in particular, the infection was dangerous because the site was still running with no apparent oversight, and the victims would have been mostly IT administrators and similar which is basically paydirt for the bad guys who had hacked the site.

The funny thing is that he did criticize our website about having a temporary non critical js malware and we thought we should find a perfect website on his side. This was aboslutely not the case:
- broken links(25/70), outdated references( last update is 2003),blogsite is  badly designed, coded and graphically disgusting. We even find 5 vulnerabilities and it  looks like a beginner web blogger.

This is the non-critical issue that was in fact an exploit kit. And my site is "graphically disgusting"? Oh no! As for vulnerabilities.. well, I'm not aware of any. The site is simply coded, and you'll notice that they don't actually have any supporting evidence.

By the way we decided not to take any action again this anonymous strange blogger which apparently is using strange techniques to exists and shine on the web to make money on our back.

I could turn this paragraph around and use it about Mobiquant myself.

Finnally, after some discussion with famous security real bloggers on the web most of them told us they never heard of him and few who did know him,  had some negative feedback about his behaviour. As in any case a security professional will  blame a hacked victim for being infect or hacked. Our company never decided to be infected for some days earlier during summer time. This mix of corporate, financial -(he is also a financial expert ;-)) and personal elements in a security analysis demonstrate clearly the guy is somehow not in the security space but just personnally blogging using security as an excuse.

Did you really? But notice again, they admit to having been hacked despite denying it in the same post. Internal inconsistencies like this are an easy way to spot a lie.

This is how the web is going nowadays :  giving some space  to unknown people, having lot of freetime to blog on all and nothing.

Perhaps if Mobiquant hired some professionals rather than the kind of idiot that wrote this, then the company might be in better shape.

Remember.. I got word of this compromised web site and tried to warn Mobiquant several times (something made more difficult by their fake WHOIS details) but I never got a response. So I instead communicated with the web host and domain registrar to attempt to get the threat removed, and warned the wider community that the Mobiquant site was dangerous. If Mobiquant actually read their emails then they would have know there was a problem, which is entirely their own fault.

Anyway, Mobiquant are entitled to their point of view, but my point of view is that in my personal opinion, this is a deeply unprofessional company that you should avoid doing business with.