Community

Christer Jakobsen wrote:

Since yesterday, we got alerts fr om Defender about 5 computers regarding this. It is not sufficient to create exceptions for the folders or processes. Fr om what I understand, we have to whitelist the RU Central server ip addresses. Unfortunately i have not found any dynamic server address that can be used, so I added ip address indicators to allow the traffic. (Defender portal->Settings->Endpoints-> Rules->Indicators->IP addresses.
64.20.61.146
172.241.164.247
216.158.232.18

There can be more IP addresses in use that might show up later, and they can be found by using Advanced hunting with this query:

DeviceNetworkEvents
| wh ere InitiatingProcessFileName == "rutserv.exe"
| wh ere RemotePort in (5650,5651,5652,5653,5654,5655)
| summarize count() by RemoteIP

Adding ip-address indicators to allow traffic will open up for all processes, so it probably should be used together with an endpoint firewall policy to only allow rutserv.exe to connect to these addresses and ports.

Josh D wrote:

Christer Jakobsen wrote:

Since yesterday, we got alerts fr om Defender about 5 computers regarding this. It is not sufficient to create exceptions for the folders or processes. Fr om what I understand, we have to whitelist the RU Central server ip addresses. Unfortunately i have not found any dynamic server address that can be used, so I added ip address indicators to allow the traffic. (Defender portal->Settings->Endpoints-> Rules->Indicators->IP addresses.
64.20.61.146
172.241.164.247
216.158.232.18

There can be more IP addresses in use that might show up later, and they can be found by using Advanced hunting with this query:

DeviceNetworkEvents
| wh ere InitiatingProcessFileName == "rutserv.exe"
| wh ere RemotePort in (5650,5651,5652,5653,5654,5655)
| summarize count() by RemoteIP

Adding ip-address indicators to allow traffic will open up for all processes, so it probably should be used together with an endpoint firewall policy to only allow rutserv.exe to connect to these addresses and ports.

Hey Christer,

Thanks for your reply, I was going to do this (as it's not the software being blocked per se)

However I was more inclined to check if 172.241.164.247 was an active RU IP and not a some sort of middle botnet which has been hijacked.

Thanks for the help, I imagine that's what I'll do shortly

Conrad Sallian wrote:

Hello everyone,

Yes, it is our server at 172.241.164.247. RU uses end-to-end encryption, and the servers simply relay the encrypted traffic. They cannot inspect forwarded packets and do not store any data.

The reason for this alert is banal and very typical for the modern “security industry”. Apparently, someone was “hacked” using social engineering methods, which in this case simply means they voluntarily installed RU, gave their access credentials to a fraudster/attacker, and the attacker connected to their computer using RU. The victim then complained to their ISP, the ISP submitted an “abuse report” to the hosting provider Leaseweb, and that was enough for the IP address to be labeled as a “botnet server”, despite the fact that it is used by hundreds of thousands of perfectly legitimate connections.

I don't know if it's possible to guarantee the ip-addresses are actually official RU servers. I

It is possible. Just ask here and we will answer. However, we will not disclose our entire infrastructure because we do not want it to be DDoSed or otherwise targeted. That is quite understandable.

Do not hesitate to ask if you have any questions.