Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

111–120 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#111

Post by tmcdos »

ozozozd wrote: post #84
dataflow wrote: post #5

Earlier quoted context omitted.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

Why? If there is technology and established protocols to prevent spoofing, but some ISPs refuse to follow these protocols, why should it be your burden to prove it wasn’t you? Is it reasonable to allow people to get credit cards with your SSN, when it’s physically possible to confirm their identity when they present your SSN, but the bank is too lazy to do it, and we put it on you to show up and cancel the credit car…

Some ISPs (often those of the "last-mile") allow outgoing packets whose source IP does not belong to their subnet. They have no rules in IPtables preventing packets that do not belong to the given subnet assigned to end customers. This is how spoofed packets enter Internet most of the time. The ISPs on upper tiers can not use such filters (even if they want to) because their networks are not strictly hierarchical like the networks of the "last-mile" ISPs and such filters will simply break the connectivity. The only way to significantly reduce spoofed packets is if all "last-mile" ISPs implement proper filtration.

Re: How to get the whole planet to send abuse complaints to your best friends

#112

Post by costco »

nostrademons wrote: post #60

This is the IP version of SWATting, patent trolls, framing an innocent person, or using DMCA takedowns to remove the competition. It's basically weaponizing abuse-protection mechanisms to instead attack a target that is disliked. Interesting that the authorities can become a weak link here and be actively weaponized by unscrupulous actors to achieve their aims, but it's not really a new phenomena.

If they were smart and had their own relays it would also make them more likely to be selected proportional to how many other relays they took out. Looking at the number of relays and "bandwidth advertised" graphs on metrics.torproject.org it doesn't look like they've made much of a difference but it's interesting nonetheless.

To me, the worst part is that "Watchdog Cyber Defense," Spamhaus, Shadowserver, or some wannabe extortion artist like UCEPROTECT can submit millions of automated reports that hosts are de facto required to listen to lest their IP space be blacklisted.

Re: How to get the whole planet to send abuse complaints to your best friends

#113

Post by remram »

wizzwizz4 wrote: post #104
remram wrote: post #73

Earlier quoted context omitted.

Your steps 2&3 require a lot of people to put in work for free to solve someone else's problem.

But they're not arbitrarily-selected people: they're network administrators. Somebody spoofing IP addresses to the point of abuse reports is practically a personal insult to some of them. (Obligatory: https://xkcd.com/705/ )

Abuse reports that are not directed at them...

Re: How to get the whole planet to send abuse complaints to your best friends

#114

Post by tptacek »

timokoesters wrote: post #96
fragmede wrote: post #95

Earlier quoted context omitted.

Not especially, but most websites are protected by TLS, so the problem that DNS is insecure is less of a problem. It's mainly a coordination problem, you have up get a lot of people on board to design a new DNS-SECure, and then everyone would also have to adopt it. Which they did (create DNSSEC, that is), but it has not seen the desired adoption. The other one is DoH, DNS over https. It's not without issue either tho…

For TLS certificates, the certificate authority has to look up IPs to verify the domain. So the security is still based on DNS, right?

Security is based on a combination of:

* The integrity of registrar accounts that are the root of trust for most DNS zones (this was, last I checked, the overwhelming source of DNS corruption attacks),

* The security of one or more DNS lookups, depending (some CAs, like LetsEncrypt, do multi-perspective lookups), and

* The WebPKI Certificate Transparency system, which tracks the issuance of all certificates that Chrome and Mozilla will accept in a public ledger.

Re: How to get the whole planet to send abuse complaints to your best friends

#115

Post by Habgdnv »

Hikikomori wrote: post #89
Habgdnv wrote: post #47

Earlier quoted context omitted.

Okay, looks like I will reply to a few of the comments to clarify things. I’ll give a concrete, real example. I worked at a company that hosted some web assets on-prem in one of their branches. They had a 1Gbps connection there. However, at HQ, we had multiple 10G connections and a pretty good data center. So, we moved the web VM to HQ but kept the assigned IP address (a public static from ISP-A). We routed it throug…

For your second scenario you should announce the /23 to both and each /24 to one of them. Usually you can also prepend your own AS, ISPs I've worked could also prepend for you with select communities. I don't think your cases are good enough to allow anyone to spoof by default.

I said that we tried this. They do not care about the announce. They care about what is injected into the routing table. We are announcing it but they see better path and drop us.

And they also said that it should work that way - just announce it somehow and it will work. Yes but no. It does not work.

Re: How to get the whole planet to send abuse complaints to your best friends

#116

Post by cowboylowrez »

Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

>That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP.

don't we want source based filtering tho? sounds like the problem is a LACK of source based filtering.

Re: How to get the whole planet to send abuse complaints to your best friends

#117

Post by immibis »

iforgotpassword wrote: post #85
ziddoap wrote: post #29

Earlier quoted context omitted.

> but we do expect you to check it and to resolve any potential issues. That's the important part. If they receive another one (or two, or a few) more abuse reports, they assume it is not fixed, and will expect a response then. Which ends up being annoying.

Well they are hetzner, they should understand the issue. I don't know if they would go through the hassle to verify by themselves by running a capture on a router leading to your server though... I had a similar problem a good decade ago. Was running a game server for a while, and as it is with competitive games, some people get really angry when they lose. At some point I got DDoSed by a udp reflection attack, and a…

It's the converse - since they are Hetzner, I'd expect them to have an automatic system to delete servers if 2-3 abuse reports are received...

Re: How to get the whole planet to send abuse complaints to your best friends

#118

Post by immibis »

Jerrrrrrry wrote: post #38
Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

>As a personal note, I know I’m a bit of an exception ...That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP. "...and obviously, Pennywise, I must spoof ingress and egress..." "Of course, Agent Bond."

If it's your real IP, it's not spoofing, even if you send the packet through a different ISP than the one which gave you the IP. If you think about it: if you got an IP directly from ARIN you wouldn't have to send your packets through ARIN to make them legitimate.

Re: How to get the whole planet to send abuse complaints to your best friends

#119

Post by immibis »

alwayslikethis wrote: post #77
buildbuildbuild wrote: post #45

The “someone hates Tor relays” theory doesn’t sound worth the effort. This could be an entity running malicious relays, while also trying to unethically take down legitimate relays to increase the percentage of the network that they control.

Yeah. If you hate the tor network an easier thing to do is just to overwhelm it with traffic and degrade the service. Running some bittorrent downloads might be enough.

This consumes your own bandwidth though. And relay operators might coordinate and notice one address is using all the bandwidth.

Re: How to get the whole planet to send abuse complaints to your best friends

#120

Post by dadrian »

tptacek wrote: post #114
timokoesters wrote: post #96

Earlier quoted context omitted.

For TLS certificates, the certificate authority has to look up IPs to verify the domain. So the security is still based on DNS, right?

Security is based on a combination of: * The integrity of registrar accounts that are the root of trust for most DNS zones (this was, last I checked, the overwhelming source of DNS corruption attacks), * The security of one or more DNS lookups, depending (some CAs, like LetsEncrypt, do multi-perspective lookups), and * The WebPKI Certificate Transparency system, which tracks the issuance of all certificates that Chro…

Multi-perspective issuance corroboration is required starting in March of 2025 for CAs following the CAB/F Baseline Requirements

https://cabforum.org/working-groups/server/baseline-requirem...

Post reply on HN