Notorious ‘Hijack Factory’ Shunned from Web

https://krebsonsecurity.com/2018/07/notorious-hijack-factory-shunned-from-web/

by dsr12 • 8 years ago

111 38 8 years ago

krebsonsecurity.com

okket• 8 years ago

See also previous discussion about this topic from yesterday

https://news.ycombinator.com/item?id=17501201 (56 comments)

wjnc2• 8 years ago

An underlying question I have: Is it useful to trust IP-addresses on their range / owner / (distant) past behavior?

peteretep• 8 years ago

If you don't, you have to track ownership information, which sounds like an administrative nightmare.

Arnt2• 8 years ago

It depends on the use. You probably wanted a simple answer, but it isn't a simple question.

wjnc2• 8 years ago

jacquesm is known to give pretty exhaustive answers ;) I knew it wasn't an easy question, but the article seemed to indicate that at least some parties do indiscriminate blocking which struck me as rather dumb. Hence the question.

jacquesm2• 8 years ago

IPV6 offers to all practical intents and purposes a near infinite range so there that tactic won't work (you will simply exhaust your storage at some point).

IPV4 addresses in 'known bad' ranges can be totally benign, I know this because I've been the owner/steward of a whole pile of such addresses over the years. Typically the hosting providers where our stuff was colocated would be the likes of Leaseweb and Dynamic Pipe which had a lot of porn customers and spammers as customers.

It would not be rare at all to be blocked either on entire class C's or ports from those blocks of addresses in spite of never having had interaction with certain parties before.

Kudos to the people at Spamhaus who never blocked us and went out of their way to ensure they only hit the boxes of the spammers with surgical precision.

Finally, 'distant past behavior' is what caused me to have to jump through all kinds of hoops to reclaim the IP address of my present day mail server.

There is no set protocol to register a change of tenancy for an IP address and I'm pretty sure if such a protocol did exist that spammers would abuse it but it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...).

dvfjsdhgfv• 8 years ago

it is super annoying to have to go begging cap in hand to the likes of Google, Apple and Microsoft for clemency when you've done nothing wrong (and to be ignored...).

This is really upsetting. The imbalance of power is especially pronounced here as they don't really care whether you deliver you mail or not - you do. You're totally at their mercy. That's why lots of people nowadays say "it's too much hurdle to maintain my own e-mail server, I'll just use some service" - and in this way they give even more power to Google and the rest.

We'll wake up one day and realize e-mail is no longer as free as it used to be, but it will be too late.

chatmasta2• 8 years ago

There is no set protocol to register a change of tenancy for an IP address

Yes there is. It's called the SWIP [0] process and if you buy an IP block, you are required to submit SWIP forms to register the reallocation with ARIN or RIPE. [1]

Of course, this only applies when the ownership of the range is changing. If you're using a hosting provider who owns the block, and another customer on the block was a spammer, then you're right -- there is no way to transfer. But you also don't really own the IP range in that case.

[0] https://en.wikipedia.org/wiki/Shared_Whois_Project

[1] https://www.arin.net/resources/request/reassignments.html

DanBC• 8 years ago

SPEWS doesn't seem to have achieved much other than make a bunch of people really fucking angry.

https://en.wikipedia.org/wiki/Spam_Prevention_Early_Warning_...

JulianMorrison• 8 years ago

I really don't know why this isn't more common.

Bad actors can often be identified. Their upstream should just disconnect them. Or their upstream should. Draw a boundary around them and their intransigent collaborators, and cut them out of the network like a cancer.

Cthulhu_• 8 years ago

Every party involved there has to be careful and do their due diligence though; you can't just cut it off because there might be an actual legitimate business or a critical service in there.

MaxBarraclough2• 8 years ago

Ah, you beat me to it.

djsumdog• 8 years ago

You could also get corporate censorship of the Internet, simply because a hosting provider may allow a lot of content that is offensive, but not illegal. I wrote about this last year using The Daily Stormer as an example:

https://fightthefuture.org/article/the-new-era-of-corporate-...

MaxBarraclough2• 8 years ago

The article seems to make no mention at all of the possibility of collateral damage.

Were any honest actors harmed by this 'shunning'? Seems unlikely that this 'Bitcanal' web-hosting company was used exclusively by malicious parties.

Also, if this 'shunning' idea were to really catch on, couldn't it end up colliding with net-neutrality laws?

jpalomaki• 8 years ago

Maybe they are afraid that once you start doing this, it may never end. Once you cut somebody out from your network, then you can no longer argue that you are just the dump pipe and don't judge your customers. This can lead to demands for cutting access to sites hosting controversial content etc. All this may generate tons of extra work and no matter what you do, you certainly are not going to please everybody.

smhenderson• 8 years ago

Yeah but if someone comes along, cuts open your dumb pipe and redirects the flow somewhere else you obviously have a right to go after them.

As others have stated this isn't about blocking content, this is about cutting off an entity that was actively damaging infrastructure.

ajnin• 8 years ago

Isn't this because of the various safe harbor provisions ? If you start policing content then you cease to be a mere pipe and your gain much higher legal responsibility for whatever content passes through your systems.

In general I think it is a very bad idea to give this kind of policing power in the hands of private companies. They tend to be very conservative to avoid legal liability and they can also take arbitrary decisions. When Cloudfront decided to cutoff the Daily Stormer they crossed a line and many people were justifiably upset. It's the job of the legal system.

hankhill• 8 years ago

Policing content isn't the same thing as stopping active damage to the internet. Even in the US where free speech is king, you can't go around slashing tires or taking down stop signs and say it's protected by the 1st amendment or something.

jerkstate• 8 years ago

announcing bgp routes that someone else owns is completely cut and dried wrongdoing, there are no shades of gray there. it's like stealing postal mail from someone else's mailbox.

Kadin• 8 years ago

If someone reports to you that a bad actor (spammer, bruteforcer, whatever) is on your network, it would seem to eliminate your plausible deniability and safe harbor defense.

The real problem is economic; for any given ISP, they are going to side with their customers over some rando complainer most of the time. You don't get rich by disconnecting your own customers unless you absolutely have to.

Sometimes, this is good, if you're the one who might get disconnected (Cox was a great ISP to have, because for many years they would blithely ignore Bittorrent complaints and give you a dozen or so 'strikes' without consequence); it's awful and obnoxious if you are on the receiving end of an attack, and some shitlord low-budget VPS reseller or datacenter operator won't unplug the control server or whatever, or drags their feet to a ridiculous extent.

All about whose ox is getting gored.

oliwarner5• 8 years ago

The conversations that strike up off the back of things like this (why does it take 4 years to disconnect them‽) really make me wonder what the internet will look like in a couple of decades.

There clearly is appetite at most levels of government for a restricted internet. Obvious crime, paedophilia, terrorism, etc but increasingly, you're seeing direct-to-consumer sites like Alibaba and Wish flogging knock-off crap over borders without paying taxes, without consumer safety checks and often without having license to make and sell that stuff in the first place.

It's not going to be long before somebody legislates that you're only allowed to peer a network if you agree to cut anybody off who enables that, including other peers who ignore abuse across their network. It'll effectively limit what "the internet" is allowed to contain. Essentially embargoing bad actors and those that enable them, and all in a very pro-active way.

It will —and should— put the fear of iJesus into consumer ISPs. They could easily cut off customers with computers operating within botnets, alerting them to infections, etc. At the peril of having your peerings cut off, you'd expect them to be a lot more pro-active too.

I honestly don't how I'd feel about this. It seems safer but if life has taught me anything, that usually just means it's not, and somebody's just quietly getting rich in the corner.

dcbadacd• 8 years ago

The first question is who decides what's illegal? Being gay is illegal in certain countries...

Making ISPs more proactive is only doable with either heavy restrictions what communication is allowed or heuristics (that fail). That sounds like anyone out of the ordinary (so a majority of this site's users) will get flagged as suspicious. The fun thing is that I've seen both methods already applied and either me or someone I know has been encumbered by them.

There's not a single piece of me that feels that this would somehow end up positive in total.

oliwarner5• 8 years ago

I think it would have to be a single multi-signatory convention. And part of that stipulates that you can only peer against networks in signatory nations.

The process of deciding that sort of law would be awful but if everybody focussed on serious and network focussed crime and not protecting Mickey Mouse et al, something good could come from it.

But you are probably right. The US —esp with current leadership— could very easily force protectionist terms on others. Nobody would want to be separated from the US. Switzerland would have no leverage. African countries would have no leverage. The EU and China might have a chance, but the latter especially stands to lose a lot more than it could gain. China still needs access to a global market.

It's definitely has potential to be deeply insidious. But with the value of the network, I'm just surprised people aren't suggesting more things like this.

To be clear, I'm not advocating this. I just see it as an inevitability.

oliwarner5• 8 years ago

On the point of ISP pro-activeness, I really just mean that —without a warrant or other court order (or national security edict)— they currently do somewhere between zilch and nothing with abuse emails.

And everybody on the Internet knows this. When somebody brutes your login page or SSH server, what do you do? Nothing. It should be trivial to report IPs and timestamps back to ISPs. Many ISPs are already required to log connections at some level (destination and port) so this stands to verify the abuse report. Get a number of these shoot through for a single customer (IPs are unimportant at this point), and it's time for a nasty conversation.

The machinery to make this work already exists. It's the ISP that's the problem. Threaten non-compliance of continued abuse (or a lack of reduction in botnet activity, whatever) with disconnection to the parent peer, so the ISP takes it seriously, and we'll see reporting rates rocket.

Monitored at local level (FCC, Ofcom, etc), per existing ISP complaints.

But yeah, no ISP is going to do this without serious threat of action.

arwineap• 8 years ago

BGP hijacking is pretty obviously bad-actor from the perspective of companies trying to give internet access.

I do see your argument for a slippery slope, but in this case the example given is clearly in the core competency of the company. There's no morals needed; this is how the internet is supposed to work, and you've bypassed that. Kick him out.

We don't think about slippery slopes when a renter starts burning the house down; it's clearly within the homeowners rights to start evicting.

monkeynotes• 8 years ago

It's really hard to reason around the 'think of the children' dilemma in these situations. Risk allows for creativity and many other valuable benefits in life, but with risk comes accepting the unacceptable. I think inside this lies the human condition.

api• 8 years ago

Pet peeve: shunned from Internet, not web.

Notorious ‘Hijack Factory’ Shunned from Web

Related Stories