5 ms·

Why don't we just require major providers to provide a realtime list of IPs that are attacking so that we can drop them in a block list with an expiration date

Why don't we just require major providers to provide a realtime list of IPs that are attacking so that we can drop them in a block list with an expiration date of a month or so. If your computer is infected, I don't want to talk to you for a month. If it continues to be infected, I might up that to a year, or permanently ban you. It's your problem. Go fix it.

afavour 3y ago
Banning a large number of customers for an entire month? doesn’t make economic sense, it’ll be cheaper to just pay a big cloud provider for protection. (not to mention the number of false positives you'd get, etc etc)
scrpl 3y ago
Great solution for a world without shared and dynamic ips.
- dmm 3y ago
  Block the whole subnet and make it the ISP's problem?
  - cryptonym 3y ago
    Because when a single machine is infected, at one ISP, it's a good idea to block the whole subnet? I don't think any commercial activity could afford such security strategy, blindly blocking legit users by thousands.
  - judge2020 3y ago
    How does the ISP solve it? Send a mass mail/email telling people to reset their devices because someone has a device with botnet malware?
    - AnimalMuppet 3y ago
      Egress filtering? A botnet DDOS stream should not look like normal network traffic...
    - bluGill 3y ago
      That is their problem. Maybe the price needs to go up if you don't secure all your devices as the ISP is going to send a tech to your house. Or maybe the ISP has deep enough pockets to find a sue those cheap IOT device makers for not being secure thus funding their tech support team.
  - swarnie 3y ago
    > Sorry citizen, google services are inaccessible because the only ISP in your city sold a service to a bad actor. > We might fix this, we might not, you DONT have a choice. > Thank you for your continued business.
    - phone8675309 3y ago
      Indistinguishable from the kind of service I get from Google - the moment that I need a human involved I just close my account with whatever Google service is misbehaving and move on.
      - swarnie 3y ago
        But you have other options which is my point. (swap in any corpo-service provider you personally like the most) Blanket banning subnet ranges from services because of the actions of someone else is 3rd world shit.
    - tmpX7dMeXU 3y ago
      Hacker News nerds will argue all day long that the Internet is a utility when the argument happens to personally benefit them, then in the same breath say that a random network admin is justified in blocking a whole ISP subnet due to one “bad” actor. And of course by bad actor I mean person that almost certainly accidentally got themselves infected with malware by not understanding the completely Byzantine world of computers and the Internet.
      - grotorea 3y ago
        Well, if someone had somehow gotten their house wires damaged in a way that causes brownouts to neighbours, wouldn't the electric company be justified in cutting off the house?
  - phone8675309 3y ago
    So it’s the ISPs fault that my grandma never met a spam email that she didn’t want to click? One of the things that gets lost in this kind of debate is that the vast, vast majority of Internet users are not experts in how the Internet, computers, or their phones work. So expecting them to be able to "just not get exploited" is a naive strategy and bringing the pain to the ISP feels counterproductive because what, realistically, can they do to stop all of their unsophisticated users from getting themselves exploited? At the end of the day, the vast majority of the users of the Internet do not care how it works - they want their email, they want their cat videos, and they want to check up on their high school ex on Facebook. How can we rearchitect the Internet to be a) open b) privacy protecting, and c) robust against these kinds of attacks so that the targets of DDOS attacks have better protection than paying a third party and hoping that that third party can protect them?
  - tmpX7dMeXU 3y ago
    You are quite obviously speaking from the perspective as someone that wouldn’t be in a position to be making these calls.
  - DanielBMarkham 3y ago
    It's interesting to me that most of the push-back so far has been for the business model of the internet, ie people need link traversal and content publishing in order to make money from advertising (implied, but not stated). Therefore we need to add yet another layer to the mix, the cloud providers, and start paying those guys. And yes, we can block entire subnets. You own the IP addresses, you're responsible for stuff coming out of them, at least to the degree that it's not maliscious to the web as a whole. (but not the content itself, of course) I'm calling bullshit on these assumptions. The internet is a communications tool. If it's not communicating, it's broken. If you provide dynamic IPs to clients that attack people, you're breaking it. It's not my problem or something I should ever be expected to pay for. To be clear, my point is that we're suggesting yet another layer of commercial, paid crap on top of a broken system in order to fix it. It'd be phenomenally better just to publicly identify place and methods where it's broken and let other folks with more vested interests than information consumers worry about it. Hell, I'm not interested in paying for the current busload of bytes I'm currently consuming for every one sentence of value I receive.
  - scrpl 3y ago
    I‘m sure comcast is terrified that their users won’t be able to read my blog.
- nine_k 3y ago
  Not as bad as one may think. It's proper feedback which can be acted upon. Every reasonable connectivity provider would pay attention to this info, or face intense complaints from its users with shared and dynamic IPs. It would identify sources of attacks, and block them at higher granularity level, reporting that the range has been cleared. (If a provider lied, everyone would stop believing it, and the disgruntled customers would leave it.) For shared hosting providers it would mean blocking specific user accounts using a firewall, notifying users, and maybe even selling cleanup services. For home internet users, it also would mean blocking specific users, contacting them, helping them identify the infected machine at home. It would massively drive patching of old router firmware which is often cracked and infected. Same for IoT stuff, infected PCs, malicious apps on phones, etc. There would be an incentive to stay clean.
  - ilyt 3y ago
    Funny man, thinks big ISP cares you yourself blocked your own site from your own customers coming from the big ISP network.
    - nine_k 3y ago
      No; with a shared hosting, somebody else manages to blacklist the IP that serves many paying customers.
  - scrpl 3y ago
    If the one doing the blocking is not at FAANG it would do nothing of sorts. And FAANG benefit from DDoS by getting people into their walled cloud gardens.
Prickle 3y ago
I've been on the receiving end of "Your" (dynamic) "IP has been blocked." I would greatly prefer not having my semi-randomized IP blocked because someone used it maliciously a year ago.
- DanielBMarkham 3y ago
  Key phrase: "a year" If anybody is suggesting permanent bans of IPs, it's not me, at least not at a public level. I may very well choose privately to do that. To clarify, I, personally chooses a blacklist policy. Not some other org. I think if you offload this onto any kind of external structure, it breaks again. ADD: We make publicly-available, second-by-second, how the internet is broken and invite all comers, including me and my blocklist, to help fix it. There's a huge commerical interest in NOT fixing the problem of random crap showing up, from dancing cats selling things to targeted inserted ads. I get it. We saw this same thing happen with adblockers. It's now going on with "free" VPNs. Can't fight that perverse incentive, so don't fight it.
- tristan9 3y ago
  Thing is, don’t care. The problem is that ISPs whose customers are originating the attacks from don’t give a shit. If we have to give up 1% of legitimate traffic to thwart 90% of attacks, it is a good deal. If you and other customers complain to your ISP (or switch), eventually they’ll do something about it. We can’t seriously keep on accepting that « thousands of compromised devices » is a fine reality for a « small botnet ». These devices should be quarantined.
  - Prickle 3y ago
    Ok, that is somewhat fair. My personal want / solution would simply be "everything gets an IPV6, and IPV4 gets deprecated. Everything using IPV4 gets an algorithm slapped on top to covert it into IPV6. Dynamic ips become a thing of the past. But I realize that is significantly easier said than done. (Makes Minecraft servers easier to setup though)
  - dist-epoch 3y ago
    Amazon definitely cares if they lose 1% of sales. Guess who has more votes, you or Amazon.
lapcat 3y ago
"Moreover, the lifespan of a given IP in a botnet is usually short so any long term mitigation is likely to do more harm than good." "As we can see, many new IPs spotted on a given day disappear very quickly afterwards." https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://blog.cloudflare.com/technical-breakdown-http2-rapid-...
codedokode 3y ago
I propose to make a special "reject" packet. When a host, let's say 1.1.1.1, sends such packet to 2.2.2.2, all providers that see this packet, MUST reject any traffic from 2.2.2.2 to 1.1.1.1. This is very easy but very efficient and allows a single host to withstand the attack of any size. There is no need for any central authority and no need to maintain any lists.
- Swenrekcah 3y ago
  That actually sounds like a really good idea. This is already implemented in the physical world (in a much less efficient way) in the form of “no spam” stickers and registrations. Is there a reason other than inertia for why it hasn’t been implemented?
  - codedokode 3y ago
    ISPs do not want to spend money for fighting against criminals.
    - Swenrekcah 3y ago
      That doesn’t sound convincing to me. I mean I understand they don’t want to spend money but if cost is the only barrier it seems like that could be overcome somehow by interested parties.
      - bombcar 3y ago
        It's not the costs, it's that some ISPs like getting money from spammers and criminals, and carefully look the other way. And the other ISPs like getting paid for DDoS mitigation, so they also look the other way. There's no money to be made fixing the underlying problem.
  - bombcar 3y ago
    The main problem is how do you authenticate the request as being legitimate? It's already possible to spoof headers and "FROM-IP" (in fact, major DDoS attacks use just this as a replay attack, spoof a DNS request as coming from 1.1.1.1 and get a much larger response sent TO 1.1.1.1 from wherever).
fragmede 3y ago
You're assuming that identification of attack traffic is 100% correct which is unfortunately not the reality.
ilyt 3y ago
And now some of your services don't work because you blocked IP that turned out to be cloud service IP being reused for legit service
smath 3y ago
That would be giving away some of the secret sauce on the part of the cloud providers. They are selling security as (part of their) service. There are some community shared lists of botnets ofcourse, but they may not be vry real time or very up to date.

afavour 3y ago

Banning a large number of customers for an entire month? doesn’t make economic sense, it’ll be cheaper to just pay a big cloud provider for protection. (not to mention the number of false positives you'd get, etc etc)

scrpl 3y ago

Great solution for a world without shared and dynamic ips.

dmm 3y ago
Block the whole subnet and make it the ISP's problem?
- cryptonym 3y ago
  Because when a single machine is infected, at one ISP, it's a good idea to block the whole subnet? I don't think any commercial activity could afford such security strategy, blindly blocking legit users by thousands.
- judge2020 3y ago
  How does the ISP solve it? Send a mass mail/email telling people to reset their devices because someone has a device with botnet malware?
  - AnimalMuppet 3y ago
    Egress filtering? A botnet DDOS stream should not look like normal network traffic...
  - bluGill 3y ago
    That is their problem. Maybe the price needs to go up if you don't secure all your devices as the ISP is going to send a tech to your house. Or maybe the ISP has deep enough pockets to find a sue those cheap IOT device makers for not being secure thus funding their tech support team.
- swarnie 3y ago
  > Sorry citizen, google services are inaccessible because the only ISP in your city sold a service to a bad actor. > We might fix this, we might not, you DONT have a choice. > Thank you for your continued business.
  - phone8675309 3y ago
    Indistinguishable from the kind of service I get from Google - the moment that I need a human involved I just close my account with whatever Google service is misbehaving and move on.
    - swarnie 3y ago
      But you have other options which is my point. (swap in any corpo-service provider you personally like the most) Blanket banning subnet ranges from services because of the actions of someone else is 3rd world shit.
  - tmpX7dMeXU 3y ago
    Hacker News nerds will argue all day long that the Internet is a utility when the argument happens to personally benefit them, then in the same breath say that a random network admin is justified in blocking a whole ISP subnet due to one “bad” actor. And of course by bad actor I mean person that almost certainly accidentally got themselves infected with malware by not understanding the completely Byzantine world of computers and the Internet.
    - grotorea 3y ago
      Well, if someone had somehow gotten their house wires damaged in a way that causes brownouts to neighbours, wouldn't the electric company be justified in cutting off the house?
- phone8675309 3y ago
  So it’s the ISPs fault that my grandma never met a spam email that she didn’t want to click? One of the things that gets lost in this kind of debate is that the vast, vast majority of Internet users are not experts in how the Internet, computers, or their phones work. So expecting them to be able to "just not get exploited" is a naive strategy and bringing the pain to the ISP feels counterproductive because what, realistically, can they do to stop all of their unsophisticated users from getting themselves exploited? At the end of the day, the vast majority of the users of the Internet do not care how it works - they want their email, they want their cat videos, and they want to check up on their high school ex on Facebook. How can we rearchitect the Internet to be a) open b) privacy protecting, and c) robust against these kinds of attacks so that the targets of DDOS attacks have better protection than paying a third party and hoping that that third party can protect them?
- tmpX7dMeXU 3y ago
  You are quite obviously speaking from the perspective as someone that wouldn’t be in a position to be making these calls.
- DanielBMarkham 3y ago
  It's interesting to me that most of the push-back so far has been for the business model of the internet, ie people need link traversal and content publishing in order to make money from advertising (implied, but not stated). Therefore we need to add yet another layer to the mix, the cloud providers, and start paying those guys. And yes, we can block entire subnets. You own the IP addresses, you're responsible for stuff coming out of them, at least to the degree that it's not maliscious to the web as a whole. (but not the content itself, of course) I'm calling bullshit on these assumptions. The internet is a communications tool. If it's not communicating, it's broken. If you provide dynamic IPs to clients that attack people, you're breaking it. It's not my problem or something I should ever be expected to pay for. To be clear, my point is that we're suggesting yet another layer of commercial, paid crap on top of a broken system in order to fix it. It'd be phenomenally better just to publicly identify place and methods where it's broken and let other folks with more vested interests than information consumers worry about it. Hell, I'm not interested in paying for the current busload of bytes I'm currently consuming for every one sentence of value I receive.
- scrpl 3y ago
  I‘m sure comcast is terrified that their users won’t be able to read my blog.
nine_k 3y ago
Not as bad as one may think. It's proper feedback which can be acted upon. Every reasonable connectivity provider would pay attention to this info, or face intense complaints from its users with shared and dynamic IPs. It would identify sources of attacks, and block them at higher granularity level, reporting that the range has been cleared. (If a provider lied, everyone would stop believing it, and the disgruntled customers would leave it.) For shared hosting providers it would mean blocking specific user accounts using a firewall, notifying users, and maybe even selling cleanup services. For home internet users, it also would mean blocking specific users, contacting them, helping them identify the infected machine at home. It would massively drive patching of old router firmware which is often cracked and infected. Same for IoT stuff, infected PCs, malicious apps on phones, etc. There would be an incentive to stay clean.
- ilyt 3y ago
  Funny man, thinks big ISP cares you yourself blocked your own site from your own customers coming from the big ISP network.
  - nine_k 3y ago
    No; with a shared hosting, somebody else manages to blacklist the IP that serves many paying customers.
- scrpl 3y ago
  If the one doing the blocking is not at FAANG it would do nothing of sorts. And FAANG benefit from DDoS by getting people into their walled cloud gardens.

Prickle 3y ago

I've been on the receiving end of "Your" (dynamic) "IP has been blocked." I would greatly prefer not having my semi-randomized IP blocked because someone used it maliciously a year ago.

DanielBMarkham 3y ago
Key phrase: "a year" If anybody is suggesting permanent bans of IPs, it's not me, at least not at a public level. I may very well choose privately to do that. To clarify, I, personally chooses a blacklist policy. Not some other org. I think if you offload this onto any kind of external structure, it breaks again. ADD: We make publicly-available, second-by-second, how the internet is broken and invite all comers, including me and my blocklist, to help fix it. There's a huge commerical interest in NOT fixing the problem of random crap showing up, from dancing cats selling things to targeted inserted ads. I get it. We saw this same thing happen with adblockers. It's now going on with "free" VPNs. Can't fight that perverse incentive, so don't fight it.
tristan9 3y ago
Thing is, don’t care. The problem is that ISPs whose customers are originating the attacks from don’t give a shit. If we have to give up 1% of legitimate traffic to thwart 90% of attacks, it is a good deal. If you and other customers complain to your ISP (or switch), eventually they’ll do something about it. We can’t seriously keep on accepting that « thousands of compromised devices » is a fine reality for a « small botnet ». These devices should be quarantined.
- Prickle 3y ago
  Ok, that is somewhat fair. My personal want / solution would simply be "everything gets an IPV6, and IPV4 gets deprecated. Everything using IPV4 gets an algorithm slapped on top to covert it into IPV6. Dynamic ips become a thing of the past. But I realize that is significantly easier said than done. (Makes Minecraft servers easier to setup though)
- dist-epoch 3y ago
  Amazon definitely cares if they lose 1% of sales. Guess who has more votes, you or Amazon.

lapcat 3y ago

"Moreover, the lifespan of a given IP in a botnet is usually short so any long term mitigation is likely to do more harm than good." "As we can see, many new IPs spotted on a given day disappear very quickly afterwards." https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://blog.cloudflare.com/technical-breakdown-http2-rapid-...

codedokode 3y ago

I propose to make a special "reject" packet. When a host, let's say 1.1.1.1, sends such packet to 2.2.2.2, all providers that see this packet, MUST reject any traffic from 2.2.2.2 to 1.1.1.1. This is very easy but very efficient and allows a single host to withstand the attack of any size. There is no need for any central authority and no need to maintain any lists.

Swenrekcah 3y ago
That actually sounds like a really good idea. This is already implemented in the physical world (in a much less efficient way) in the form of “no spam” stickers and registrations. Is there a reason other than inertia for why it hasn’t been implemented?
- codedokode 3y ago
  ISPs do not want to spend money for fighting against criminals.
  - Swenrekcah 3y ago
    That doesn’t sound convincing to me. I mean I understand they don’t want to spend money but if cost is the only barrier it seems like that could be overcome somehow by interested parties.
    - bombcar 3y ago
      It's not the costs, it's that some ISPs like getting money from spammers and criminals, and carefully look the other way. And the other ISPs like getting paid for DDoS mitigation, so they also look the other way. There's no money to be made fixing the underlying problem.
- bombcar 3y ago
  The main problem is how do you authenticate the request as being legitimate? It's already possible to spoof headers and "FROM-IP" (in fact, major DDoS attacks use just this as a replay attack, spoof a DNS request as coming from 1.1.1.1 and get a much larger response sent TO 1.1.1.1 from wherever).

fragmede 3y ago

You're assuming that identification of attack traffic is 100% correct which is unfortunately not the reality.

ilyt 3y ago

And now some of your services don't work because you blocked IP that turned out to be cloud service IP being reused for legit service

smath 3y ago

That would be giving away some of the secret sauce on the part of the cloud providers. They are selling security as (part of their) service. There are some community shared lists of botnets ofcourse, but they may not be vry real time or very up to date.