5 ms·

Looking forward to hear from Shadowserver on a few points... • What led to the false positive. • What actions were taken to notify the domain owner about the

Looking forward to hear from Shadowserver on a few points... • What led to the false positive. • What actions were taken to notify the domain owner about the actions being taken against them. • Why there was not a comment put into the Whois entry — or in some other obvious place — saying what had been done to the domain.

datenwolf 7y ago
I'd rather like to know, what gives shadowserver the authority to initiate such domain takedowns/sinkholing in an act that's pretty much vigilantism?
- sbarre 7y ago
  The decision is made by the registrar, so that's who should be answering these questions.
  - datenwolf 7y ago
    As far as I can tell the chain of events was: 1. shadowserver had an oopsie (i.e. added a false entry to their list) 2. that list was taken by the prosecutor's office to without further checks and by the authority of the prosecutor's office (i.e. state attorneys) of Niedersachsen in Germany and contacted the registrar in India. 3. The registrar transferred the domain Between each of these steps, there are so many things that went wrong, on so many levels. Between 1 and 2: Why is the word of some rando org taken as gospel? Without being independently investigated by the office, which sole raison d'être is (independent) investigation of the claims brought to it. Between 2 and 3: A German prosecutor's office has no authority outside the EU; and even if it did, it could not tell anyone anything to take enforcing actions without a proper court order, even if it's an international request. Also in the grand scheme of things, considering this was all done to "take down a botnet", this is a path to hell paved with good intentions. How about creating incentive that software and hardware manufacturers get their shit together and secure their shit?
steve19 7y ago
I want to know why law enforcement allows a private organization to seize private property based on some algorithm. I have heard bad things about shadowserver in the past. Now I wonder how much other collateral damage they have done over the years.
- yc-kraln 7y ago
  Domain names are not property, and this is not under the pervue of law enforcement. The country registrar (NIXI) is working together with someone to prevent abuse of their systems. When you purchase a DNS entry, you agree to this sort of thing as part of the ToS.
  - derefr 7y ago
    Right; this is essentially the same as a mail server operator relying on a DNSBL.
    - anon176 7y ago
      Exactly
  - vsl 7y ago
    The domain got transfered to The Verden Public Prosecutor's Office. Evidently law enforcement was involved in some capacity.
- bscphil 7y ago
  This is what I was wondering as well, it seemed bizarre to me and I expected there to be much more outrage here about it. I wonder if it's a bit like local parking regulations, which tend to be written in ways that allow towing companies to abuse you as much as possible.
anon176 7y ago
Shadowserver runs the sinkhole, its up to the registrar/dns company (in this case namecheap) to point it at the sinkhole. The Feds provide a list of "identified" domains to all the major providers for the avalanche take down. Since this is an on going thing, someone at namecheap blindly ran the list without any verification.

datenwolf 7y ago

I'd rather like to know, what gives shadowserver the authority to initiate such domain takedowns/sinkholing in an act that's pretty much vigilantism?

sbarre 7y ago
The decision is made by the registrar, so that's who should be answering these questions.
- datenwolf 7y ago
  As far as I can tell the chain of events was: 1. shadowserver had an oopsie (i.e. added a false entry to their list) 2. that list was taken by the prosecutor's office to without further checks and by the authority of the prosecutor's office (i.e. state attorneys) of Niedersachsen in Germany and contacted the registrar in India. 3. The registrar transferred the domain Between each of these steps, there are so many things that went wrong, on so many levels. Between 1 and 2: Why is the word of some rando org taken as gospel? Without being independently investigated by the office, which sole raison d'être is (independent) investigation of the claims brought to it. Between 2 and 3: A German prosecutor's office has no authority outside the EU; and even if it did, it could not tell anyone anything to take enforcing actions without a proper court order, even if it's an international request. Also in the grand scheme of things, considering this was all done to "take down a botnet", this is a path to hell paved with good intentions. How about creating incentive that software and hardware manufacturers get their shit together and secure their shit?

steve19 7y ago

I want to know why law enforcement allows a private organization to seize private property based on some algorithm. I have heard bad things about shadowserver in the past. Now I wonder how much other collateral damage they have done over the years.

yc-kraln 7y ago
Domain names are not property, and this is not under the pervue of law enforcement. The country registrar (NIXI) is working together with someone to prevent abuse of their systems. When you purchase a DNS entry, you agree to this sort of thing as part of the ToS.
- derefr 7y ago
  Right; this is essentially the same as a mail server operator relying on a DNSBL.
  - anon176 7y ago
    Exactly
- vsl 7y ago
  The domain got transfered to The Verden Public Prosecutor's Office. Evidently law enforcement was involved in some capacity.
bscphil 7y ago
This is what I was wondering as well, it seemed bizarre to me and I expected there to be much more outrage here about it. I wonder if it's a bit like local parking regulations, which tend to be written in ways that allow towing companies to abuse you as much as possible.

anon176 7y ago

Shadowserver runs the sinkhole, its up to the registrar/dns company (in this case namecheap) to point it at the sinkhole. The Feds provide a list of "identified" domains to all the major providers for the avalanche take down. Since this is an on going thing, someone at namecheap blindly ran the list without any verification.