On my blog: One weird trick to get the whole planet to send abuse complaints to your best friend(s)
delroth.net/posts/spoofed-mass…
Summary of my adventures from last evening, as read in this Mastodon thread: mastodon.delroth.net/@delroth/…
#infosec #networking #tor
delroth's homepage - One weird trick to get the whole planet to send abuse complaints to your best friend(s)
delroth's homepage
By any chance did anyone recently also get an abuse report from "watchdogcyberdefense.com"?Hetzner forwarded one to me claiming that my server has been ssh-scanning some random network, but uh, I've looked for a while and can't find any evidence of weirdness (granted, can't easily prove a negative). And that company seems awfully fishy in terms of online presence.
I'm half expecting it to be spam but I can't figure out what their strategy would be. Or incompetence perhaps?
Phil
in reply to Pierre Bourdon • • •State of IP Spoofing
spoofer.caida.orgNulhomme
in reply to Pierre Bourdon • • •slower traffic keep right
in reply to Pierre Bourdon • • •innerand
in reply to Pierre Bourdon • • •Jeroen Baert
in reply to Pierre Bourdon • • •kasperd
in reply to Pierre Bourdon • • •I assume you told Hetzner about your findings. Did they write a sensible reply?
From the thread I see that multiple Hetzner customers have been targeted. It should be clear to Hetzner by now that their customers are the victims and as such I think they should apologize to the people they have forwarded complaints to.
Regarding what people say about IP-ID in the thread, it's not true that IP-ID is randomized on every OS. I recently looked into how Linux does and learned that it is only on IPv6 that IP-ID is randomized, and that's something which was introduced less than 10 years ago.
The IP-ID values on IPv4 are still generated using a simple counter. However it uses different counters depending on a hash of the source and destination IP addresses, which makes idle scanning much harder than it used to be. But if you can find a combination of IP addresses which produce the same hash, then it's still possible.
A few years ago the number of counters was increased from 1024 to 262144. But due to the birthday paradox you only need around 512 IP address combinations to get assigned the same counter twice.
Pierre Bourdon
in reply to kasperd • • •Pierre Bourdon
in reply to Pierre Bourdon • • •Update: I got an email from Hetzner's legal team today saying they came across my blog post (nice!). Paraphrasing:
- They're monitoring and understand that there is no actual abuse being done from these Tor relays getting spoofed.
- They emphasized that they do not routinely take action on this kind of abuse complaints, and that's why they forward them without requiring reply/action from the customer.
Love hearing this, and I'm actually impressed by Hetzner's response! Major props.
Pierre Bourdon
in reply to Pierre Bourdon • • •New update: the CTO from "watchdogcyberdefense.com" has been in my emails, and I can only summarize our exchanges by my current feeling of "wow there should be an exam to be allowed to send more than N abuse complaints/day".
To quote from them: they're seeing "1.3 billion attacks logged in the past 24h", they claim IPs are infected because VirusTotal says so, and they're trying to make a deal with me where if I iptables OUTPUT DROP their network they'll stop sending abuse complaints to Hetzner.
gudenau
in reply to Pierre Bourdon • • •Pierre Bourdon
in reply to gudenau • • •gudenau
in reply to Pierre Bourdon • • •rabln
in reply to Pierre Bourdon • • •Pierre Bourdon
in reply to Pierre Bourdon • • •My post to nanog made it out of the mod queue, so this is my latest attempt to get some awareness about this abusive company to the internet community: mailman.nanog.org/pipermail/na…
Hopefully it will reach a few more people working in NOCs and abuse departments? Who knows.
robryk
in reply to Pierre Bourdon • • •Jeroen Baert
in reply to Pierre Bourdon • • •rabln
in reply to Pierre Bourdon • • •Dan
in reply to Pierre Bourdon • • •viq
in reply to Pierre Bourdon • • •