Foro Wifi-libre.com

 _____  ______ ______ __  ____   _____ _______ 
 |  __ \|  ____|  ____/_ |/ __ \ / ____|__   __|
 | |__) | |__  | |__   | | |  | | |       | |   
 |  _  /|  __| |  __|  | | |  | | |       | |   
 | | \ \| |____| |     | | |__| | |____   | |   
 |_|  \_\______|_|     |_|\____/ \_____|  |_|   
                                                
                                              
        _           _                          
       | |         | |                         
   __ _| | _____  _| |_ __ _ _ __   __ _  ___  
  / _` | |/ _ \ \/ / __/ _` | '_ \ / _` |/ _ \ 
 | (_| | |  __/>  <| || (_| | | | | (_| | (_) |
  \__,_|_|\___/_/\_\\__\__,_|_| |_|\__, |\___/ 
                                    __/ |      
                                   |___/       
** INTERNAL USE ONLY ** 
2017-10-05

Introduction
============

During the morning of the 1st of October we were asked to look into the 
Denial of Service attacks taking place against the servers responsible of
validating the voters during the 1-O Referendum in Catalunya.

Once the domain name  registremeses.com was not longer accessible in the
voting stations, a set of "reverse proxies" were made available to reach the
site.

The voting stations were asked to reach the website using different IP 
addresses instead of the domain name registremess.com

One of those IP addresses was 34.241.22.106, and our "darknet" sensor network
collected evidence of the denial of service attacks (SYN Floodings)

ForoCoches.com
==============

At 10 AM, just one hour after the opening of the voting stations, a discussion
thread is opened in the bulleting board site: forocoches.com

The thread with the title "Ayuda, paremos esta pantomima, ddos #novotaran" was
created by the user with the nick "alextango"

The discussion thread was closed after the attacks but fortunately we managed 
to collect dozens of screenshoots of all the discussions, some of them are also
available via the Google Search responses:

Search: forocoches #novotaran alextango

The results are not in the google cache.

A backup of the Forum screenshoots is available here:

http://google.qurium.org/qurium.org/wp-content/ref1oct/forocoches/index.php?gallery=pics

The screenshoots show how alextango coordinated the Denial of Service attacks
providing (1) timely information to other members as the status of the servers 
and (2) when new IP addresses were in use.

We also encouraged others to join the attacks as he considered DDOS was legitimate
and just a way to support the Guardia Civil.

Tracking alextango
==================

In order to track alextango:

* SEARCH for his e-mail in the forum:

 https://www.forocoches.com/foro/showthread.php?t=609254&page=25
 alexatleti@gmail.com

* REVIEW postings were alextango is interested in:

  : rock climbing: http://www.viaclasica.com/foro/viewtopic.php?f=3&t=401
  : quads: http://quadtreros.net/forum/forum/subforos-de-quadtreros-com/taller/4877-tengo-el-manual-de-taller-kxr250/page13

* FOUND second e-mail address:
  alexatleti@hotmail.com

* CORRELATE identical nicks
  The two users use the same nick: alextango and the e-mails: 
  alexatleti@gmail.com
  alexatleti@hotmail.com

  Both accounts share common interests in forocoches and quadtreros.
  e.g: both users have the same Quad Model:  mxu 250 
       both are intested in dogs as the staffordshire
* FOUND Rock climbing forum 

  With the email alexatleti@hotmail.com we identified a rockclimbing forum
  http://rokipankis.blogspot.se

* FOUND Personal Blogger Account
  The rock climbing form includes references to his Blogger profile
  https://www.blogger.com/profile/12593632842302905679

* Update: 2017-10-6
  The user alexatleti/alextango deletes his blogger and forocoches accounts 

Attribution
===========

The forensic evidence collected strongly suggest that:

 * The user with nick alextango coordinated attacks the referendum servers the 1-OCT
 * Such user has used the e-mails: alexatleti@gmail.com and alexatleti@hotmail.com

08:40:32.490444 IP (tos 0x0, ttl 44, id 0, offset 0, flags [DF], proto TCP (6), length 44)
34.241.22.106.80 > X.X.X.124.31365: Flags [S.], cksum 0xcdfd (correct), seq 4101521145, ack 1295182152, win 26883, options [mss 1360], length 0