Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

31–40 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#31

Post by toast0 »

JoshTriplett wrote: post #18

> Which means, if you just find one transit provider which doesn’t do BCP38 filtering… you can send IP packets tagged with any source IP you want! And unfortunately, even though the origins of BCP38 date back to 1998… there are still network providers 25 years later that don’t implement it. What would it take to get enough network providers to start rejecting traffic from all ASes that don't implement this, so that s…

You'd have to find some way to make network providers care. Especially 'tier 1' transit providers and other networks of unusual size.

It's much easier to work on reducing reflection multipliers though, because you can scan (ipv4 anyway) for reflection vectors and yell at people that will respond with 10x the input bytes.

Re: How to get the whole planet to send abuse complaints to your best friends

#32

Post by boring_twenties »

Avamander wrote: post #12
jmuguy wrote: post #2

It seems like systems shouldn't report abuse (at least automatically) for single packet, no round trip, requests unless its reaching denial of service levels of traffic (and maybe these are). Like in particular for SSH there's no way thats even a valid connection attempt until some sort of handshake has occurred.

Sometimes that's all the abuse you'll see though, with for example port scans.

Well the obvious answer there is that port scans shouldn't be considered abuse absent other factors like rising to the level of a DoS.

Re: How to get the whole planet to send abuse complaints to your best friends

#33

Post by shadowgovt »

8338550bff96 wrote: post #15
dataflow wrote: post #5

Earlier quoted context omitted.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

Yeah, let's just have everyone hosting TOR nodes out themselves and their friends to local authorities... Nice try Winnie Poo

So it turns out at the network service level, anonymity has never been guaranteed. If I, as another chunk of the network, can't trust your chunk, it's going to get cut from accessing me.

There has to be some ability to establish baseline trust.

Re: How to get the whole planet to send abuse complaints to your best friends

#34

Post by Rasbora »

Back in the day I would scan for DrDoS reflectors in a similar way, no hosting provider wants to get reports for port scanning so the source address of the scan would belong to an innocent cloud provider with a reputable IP that reflectors would happily send UDP replies to. The cloud provider would of course get a massive influx of complaints but you would just say that you aren't doing any scanning from your server (which they would verify) and they wouldn't shut your service off. The server sending out the spoofed scan packets is undetectable so you're able to scan the entire internet repeatedly without the typical abuse issues that come with it.

I'm not sure how often this happens in practice but tracing the source of a spoofed packet is possible if you can coordinate with transit providers to follow the hops back to the source. One time JPMorgan worked with Cogent to tell us to stop sending packets with their IP addresses (Cogent is one of the most spoofer friendly tier 1's on the internet btw).

This is the first time I've heard of this being used to target TOR specifically which seems counterintuitive, you would think people sending out spoofed packets would be advocates of TOR. Probably just a troll, luckily providers that host TOR won't care about this type of thing.

Re: How to get the whole planet to send abuse complaints to your best friends

#35

Post by Ardren »

preciousoo wrote: post #10
dataflow wrote: post #5

Earlier quoted context omitted.

> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…

Hetzner (if they keep logs) should be able to verify if a user has been sending arbitrary packets out on port 22 very trivially

Just what type of logs do you expect Hetzner to keep?

Re: How to get the whole planet to send abuse complaints to your best friends

#36

Post by preciousoo »

Ardren wrote: post #35
preciousoo wrote: post #10

Earlier quoted context omitted.

Hetzner (if they keep logs) should be able to verify if a user has been sending arbitrary packets out on port 22 very trivially

Just what type of logs do you expect Hetzner to keep?

At minimum? In/outbound traffic

Re: How to get the whole planet to send abuse complaints to your best friends

#37

Post by salawat »

Asmod4n wrote: post #22
mrbluecoat wrote: post #6

> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone. Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's ama…

It’s quite sad the only mail server out there which checks if you are allowed to use a email address is exchange. With all others you can set the from: header however you like.

Who cares whether it's the MTA that does it or a collection of daemons invoked by the MTA? Just get things configured correctly, and you should be gold.

Now as far as every other mail operator setting up their stuff right such that From spoofing is no longer feasible, well... Can't help ya there. I don't run my email to make money, so the incentive to adopt pathological configs for the sake of maximizing the number of users/Domains who can send from one IP ain't there.

Re: How to get the whole planet to send abuse complaints to your best friends

#38

Post by Jerrrrrrry »

Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

  >As a personal note, I know I’m a bit of an exception ...That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP.
"...and obviously, Pennywise, I must spoof ingress and egress..."

"Of course, Agent Bond."

Re: How to get the whole planet to send abuse complaints to your best friends

#39

Post by matrix2003 »

Ardren wrote: post #35
preciousoo wrote: post #10

Earlier quoted context omitted.

Hetzner (if they keep logs) should be able to verify if a user has been sending arbitrary packets out on port 22 very trivially

Just what type of logs do you expect Hetzner to keep?

Splunk logs of traffic. It’s pretty common at the corporate level.
Post reply on HN