How to get the whole planet to send abuse complaints to your best friends
1–10 of 125 posts
Re: How to get the whole planet to send abuse complaints to your best friends
#2It seems like systems shouldn't report abuse (at least automatically) for single packet, no round trip, requests unless its reaching denial of service levels of traffic (and maybe these are). Like in particular for SSH there's no way thats even a valid connection attempt until some sort of handshake has occurred.
Re: How to get the whole planet to send abuse complaints to your best friends
#3This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide.
Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.
Re: How to get the whole planet to send abuse complaints to your best friends
#4How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.
Re: How to get the whole planet to send abuse complaints to your best friends
#5This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.
> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide.
The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not just you anonymously claiming you're a good guy over the internet and expecting to be believed.
Re: How to get the whole planet to send abuse complaints to your best friends
#6> The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone.
Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It's amazing anything works anymore :D
Re: How to get the whole planet to send abuse complaints to your best friends
#7How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.
Probably easy, as long as you don't mind being on trial for violating something like CFAA.
Re: How to get the whole planet to send abuse complaints to your best friends
#8This is pretty clever
Re: How to get the whole planet to send abuse complaints to your best friends
#9How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.
Or someone would figure out how to find who’s behind the spoofed requests, as those orgs have the resources to do so
Re: How to get the whole planet to send abuse complaints to your best friends
#10This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. Then, as noted in the article, you're trying to prove a negative to someone who doesn't really care at all, which is borderline impossible.
> the legitimate answer to the abuse report ("someone is spoofing my IP, it isn't me, and the machine is not compromised") is the exact same excuse that a malicious actor would provide. The legitimate answer would include some sort of real-world attestation about you from a trusted third party. Probably the very least, some evidence of your identity and jurisdiction. Maybe including a video call or something. Not jus…
Hetzner (if they keep logs) should be able to verify if a user has been sending arbitrary packets out on port 22 very trivially