Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to get the whole planet to send abuse complaints to your best friends

delroth.net

Post reply on HN
Print view View original

51–60 of 125 posts

Re: How to get the whole planet to send abuse complaints to your best friends

#51

Post by ianburrell »

toast0 wrote: post #48
rvnx wrote: post #43

Earlier quoted context omitted.

Is IPv6 fixing such cases by design or it's not changing anything ?

Not really. Early IPv6 documentation kind of assumed that the vast address space would lead towards hierarchical addressing and that a multi-homed user would use addresses assigned by all of their ISPs, but at least in my experience, that doesn't really pan out --- if you have router advertisements from two different ISP prefixes, automatic configuration on common OSes (windows, linux, freebsd) will lead towards ofte…

The advantage of IPv6 is that can multiple addresses. This means that good way to organize network is to have machines use local provider addresses to access the Internet.

Then have ULA addresses for internal network. Those will be routed with tunnels and VPNs. That separates accessing the internet from internal network, and means that don't need to have routable address space.

The only people who would need own address space have data centers and routers.

Re: How to get the whole planet to send abuse complaints to your best friends

#52

Post by fullspectrumdev »

boring_twenties wrote: post #32
Avamander wrote: post #12

Earlier quoted context omitted.

Sometimes that's all the abuse you'll see though, with for example port scans.

Well the obvious answer there is that port scans shouldn't be considered abuse absent other factors like rising to the level of a DoS.

Exactly this. A single SYN or TCP connection doesn’t constitute abuse.

Unfortunately many people seem to think otherwise and will spaff abuse reports over an errant SYN packet

Re: How to get the whole planet to send abuse complaints to your best friends

#53

Post by fullspectrumdev »

ahofmann wrote: post #4

How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.

Trivial to accomplish really.

Just acquire a few boxes that don’t block spoofing outbound SYN packets and start spamming random IP’s from random IP’s with SYN packets.

It will generate a shitload of abuse emails and accomplish mostly nothing except fill up disk space with useless emails and such.

Re: How to get the whole planet to send abuse complaints to your best friends

#54

Post by 4star3star »

salawat wrote: post #42
Ekaros wrote: post #20

Earlier quoted context omitted.

Why not make ISPs responsible for blocking any such traffic. In the end it must originate from someone's network. And really they also should know who their peering partners are and what traffic should be allowed from there.

Which do you prefer? Internet where you send a packet over the wire and the network takes it and delivers it per RFC. Basically OG Internet. Network of networks of more or less trusted peers. Or Internet where you need to requisition every connection/circuit be provisined before it is routed, which includes explaining why you need the service, and where any provider in the chain will deny you transit by default? You…

Good comment. I looked up "nexii" out of curiosity, and it appears that "nexuses" is the appropriate plural, FYI.

Re: How to get the whole planet to send abuse complaints to your best friends

#55

Post by Stefan-H »

Habgdnv wrote: post #47
Habgdnv wrote: post #17

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I'd receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft,…

Okay, looks like I will reply to a few of the comments to clarify things. I’ll give a concrete, real example. I worked at a company that hosted some web assets on-prem in one of their branches. They had a 1Gbps connection there. However, at HQ, we had multiple 10G connections and a pretty good data center. So, we moved the web VM to HQ but kept the assigned IP address (a public static from ISP-A). We routed it throug…

In your first scenario, any connections established through the ISP-A's IP address would be routed back through the VPN connection that they came in on. If that server were to establish it's own connections to external resources, it would feasibly be able to use the 10g connection from ISP-B. It would not be able to dictate what source address was used with connections coming from ISP-B.

Re: How to get the whole planet to send abuse complaints to your best friends

#56

Post by SSLy »

Rasbora wrote: post #34

Back in the day I would scan for DrDoS reflectors in a similar way, no hosting provider wants to get reports for port scanning so the source address of the scan would belong to an innocent cloud provider with a reputable IP that reflectors would happily send UDP replies to. The cloud provider would of course get a massive influx of complaints but you would just say that you aren't doing any scanning from your server…

Cogent seems terrible in general.

> Probably just a troll

Or someone wanting TOR to be treated like nuclear waste, because it offends their surveillance ops.

Re: How to get the whole planet to send abuse complaints to your best friends

#57

Post by Avamander »

boring_twenties wrote: post #32
Avamander wrote: post #12

Earlier quoted context omitted.

Sometimes that's all the abuse you'll see though, with for example port scans.

Well the obvious answer there is that port scans shouldn't be considered abuse absent other factors like rising to the level of a DoS.

Recon is the first step in an attack chain. So just ignoring it would let a lot of criminals operate without constraints.

Re: How to get the whole planet to send abuse complaints to your best friends

#58

Post by jcalvinowens »

Stefan-H wrote: post #55
Habgdnv wrote: post #47

Earlier quoted context omitted.

Okay, looks like I will reply to a few of the comments to clarify things. I’ll give a concrete, real example. I worked at a company that hosted some web assets on-prem in one of their branches. They had a 1Gbps connection there. However, at HQ, we had multiple 10G connections and a pretty good data center. So, we moved the web VM to HQ but kept the assigned IP address (a public static from ISP-A). We routed it throug…

In your first scenario, any connections established through the ISP-A's IP address would be routed back through the VPN connection that they came in on. If that server were to establish it's own connections to external resources, it would feasibly be able to use the 10g connection from ISP-B. It would not be able to dictate what source address was used with connections coming from ISP-B.

It could work the way OP described if they routed all outbound traffic via ISP-A regardless of source address, and ISP-A allowed spoofing. I think that's what they meant.

Re: How to get the whole planet to send abuse complaints to your best friends

#59

Post by 8338550bff96 »

shadowgovt wrote: post #33
8338550bff96 wrote: post #15

Earlier quoted context omitted.

Yeah, let's just have everyone hosting TOR nodes out themselves and their friends to local authorities... Nice try Winnie Poo

So it turns out at the network service level, anonymity has never been guaranteed. If I, as another chunk of the network, can't trust your chunk, it's going to get cut from accessing me. There has to be some ability to establish baseline trust.

Is this something that is necessarily true or true due to policy decisions or tech debt?

Honest question as someone that is definitely not a networking expert.

Re: How to get the whole planet to send abuse complaints to your best friends

#60

Post by nostrademons »

This is the IP version of SWATting, patent trolls, framing an innocent person, or using DMCA takedowns to remove the competition. It's basically weaponizing abuse-protection mechanisms to instead attack a target that is disliked. Interesting that the authorities can become a weak link here and be actively weaponized by unscrupulous actors to achieve their aims, but it's not really a new phenomena.
Post reply on HN