Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

11–20 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#11

Post by [deleted] »

dataflow wrote: post #5
ziddoap wrote: post #3

This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

[deleted]

Re: How to get the whole planet to send abuse complaints to your best friends

#12

Post by Avamander »

jmuguy wrote: post #2

It seems like systems shouldn't report abuse (at least automatically) for single packet, no round trip, requests unless its reaching denial of service levels of traffic (and maybe these are). Like in particular for SSH there's no way thats even a valid connection attempt until some sort of handshake has occurred.

Sometimes that's all the abuse you'll see though, with for example port scans.

Re: How to get the whole planet to send abuse complaints to your best friends

#13

Post by ziddoap »

dataflow wrote: post #5
ziddoap wrote: post #3

This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

>The legitimate answer would include some sort of real-world attestation about you from a trusted third party.

It's annoying to find someone (or some service) that is willing to attest on your behalf and have that person (or service) be trusted by your provider more than whoever filed the abuse complaint.

>Maybe including a video call or something.

It's annoying to find someone at your provider who will take the time to do this. It's annoying to take my time to have to do this.

My point, overall, was that this is just a really annoying problem.

Re: How to get the whole planet to send abuse complaints to your best friends

#14

Post by cobbal »

It's a similar problem to swatting. It relies on authorities taking severe action against an unverified source of problems.

I suppose a difference is that they use unaffiliated parties to send the complaint, instead of contacting the authority directly.

Re: How to get the whole planet to send abuse complaints to your best friends

#15

Post by 8338550bff96 »

dataflow wrote: post #5
ziddoap wrote: post #3

This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

Yeah, let's just have everyone hosting TOR nodes out themselves and their friends to local authorities...

Nice try Winnie Poo

Re: How to get the whole planet to send abuse complaints to your best friends

#16

Post by wizzwizz4 »

There's no in-band solution to this problem, but out-of-band solutions might exist! For example: (1) Notify the destination ISP that you're receiving backscatter. (2) That ISP checks where the packets are coming from, and notifies that ISP. (3) Repeat step 2 until source is found. (4) Quarantine that part of the network until it behaves better.

At the end of the day, the internet is people.

Re: How to get the whole planet to send abuse complaints to your best friends

#17

Post by Habgdnv »

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft, and all kinds of popular servers—Facebook, Instagram, and various chat services. Of course, these were all spoofed packets, which eventually led me to adjust my firewall rules to require a bit more validation.

So, I can assure you this is quite common. As a personal note, I know I’m a bit of an exception for operating multiple IP addresses, but I need the flexibility to send packets with any of my source addresses through any of my ISPs. That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP.

Re: How to get the whole planet to send abuse complaints to your best friends

#18

Post by JoshTriplett »

> Which means, if you just find one transit provider which doesn’t do BCP38 filtering… you can send IP packets tagged with any source IP you want! And unfortunately, even though the origins of BCP38 date back to 1998… there are still network providers 25 years later that don’t implement it.

What would it take to get enough network providers to start rejecting traffic from all ASes that don't implement this, so that spoofing was no longer possible?

Re: How to get the whole planet to send abuse complaints to your best friends

#19

Post by toast0 »

ziddoap wrote: post #3

This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.

Hertzner says in the email that no response is necessary.

Automated abuse reports of things that are easily spoofed don't justify a report, but might justify a quick check to make sure your box is still operating correctly and hasn't been taken over.

Re: How to get the whole planet to send abuse complaints to your best friends

#20

Post by Ekaros »

preciousoo wrote: post #9
ahofmann wrote: post #4

How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.

Or someone would figure out how to find who’s behind the spoofed requests, as those orgs have the resources to do so

Why not make ISPs responsible for blocking any such traffic. In the end it must originate from someone's network. And really they also should know who their peering partners are and what traffic should be allowed from there.
Post reply on HN