Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

21–30 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#21

Post by pixl97 »

Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

>I’ll switch to a different ISP.

I mean, technically those ISPs would be in violation too. You need your own ASN.

Re: How to get the whole planet to send abuse complaints to your best friends

#22

Post by Asmod4n »

mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

It’s quite sad the only mail server out there which checks if you are allowed to use a email address is exchange. With all others you can set the from: header however you like.

Re: How to get the whole planet to send abuse complaints to your best friends

#23

Post by benlivengood »

JoshTriplett wrote: post #18

> Which means, if you just find one transit provider which doesn’t do BCP38 filtering… you can send IP packets tagged with any source IP you want! And unfortunately, even though the origins of BCP38 date back to 1998… there are still network providers 25 years later that don’t implement it. What would it take to get enough network providers to start rejecting traffic from all ASes that don't implement this, so that s…

Cloudflare is probably enough. They already control enough ingress that their "checking the security of your connection" could actually mean something.

Re: How to get the whole planet to send abuse complaints to your best friends

#24

Post by pixl97 »

preciousoo wrote: post #9
ahofmann wrote: post #4

How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.

Or someone would figure out how to find who’s behind the spoofed requests, as those orgs have the resources to do so

I'm going to guess quite often these spoofed requests are coming from other nations that have little interest in playing nice on the global internet.

Re: How to get the whole planet to send abuse complaints to your best friends

#25

Post by jcalvinowens »

Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

> but I need the flexibility to send packets with any of my source addresses through any of my ISPs

As someone who always enables rp_filter everywhere... I'm very curious why?

Re: How to get the whole planet to send abuse complaints to your best friends

#26

Post by dataflow »

8338550bff96 wrote: post #15
dataflow wrote: post #5

Earlier quoted context omitted.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

Yeah, let's just have everyone hosting TOR nodes out themselves and their friends to local authorities... Nice try Winnie Poo

Damn, well you definitely foiled my plan there.

Re: How to get the whole planet to send abuse complaints to your best friends

#27

Post by colechristensen »

mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

The thing is, obviously, that the Internet isn't broken, it has incredible utility and reliability. If it was designed and operated to be perfect, then it would likely be massively broken quite often. It is the tolerance for mild brokenness that has contributed significantly to its robustness and utility.

That isn't an argument for not improving things though, just a warning against perfection, if you chase it then you're liable to make really big mistakes that ruin everything.

Re: How to get the whole planet to send abuse complaints to your best friends

#28

Post by preciousoo »

pixl97 wrote: post #24
preciousoo wrote: post #9

Earlier quoted context omitted.

Or someone would figure out how to find who’s behind the spoofed requests, as those orgs have the resources to do so

I'm going to guess quite often these spoofed requests are coming from other nations that have little interest in playing nice on the global internet.

For sure, but orgs tracking abuse on the net like CF and the like have demonstrated the ability to identify nation state level actors

Re: How to get the whole planet to send abuse complaints to your best friends

#29

Post by ziddoap »

toast0 wrote: post #19
ziddoap wrote: post #3

This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.

Hertzner says in the email that no response is necessary. Automated abuse reports of things that are easily spoofed don't justify a report, but might justify a quick check to make sure your box is still operating correctly and hasn't been taken over.

>but we do expect you to check it and to resolve any potential issues.

That's the important part.

If they receive another one (or two, or a few) more abuse reports, they assume it is not fixed, and will expect a response then. Which ends up being annoying.

Post reply on HN