7 ms·

FWIW, in my experience, No-IP is very, very responsive and helpful to abuse complaints. Though that is the extent of my experience with them, I've never thought

by pktgen 12y ago

FWIW, in my experience, No-IP is very, very responsive and helpful to abuse complaints. Though that is the extent of my experience with them, I've never thought them to be actively harboring malicious activity (unlike, say, CloudFlare).

duskwuff 12y ago
While I'm not familiar with the exact situation here, I suspect the real problem is that the malware domains are being automatically created en masse, and No-IP have been slow or reluctant to do anything to slow that down. Being responsive to complaints is good for small-scale problems involving individual domains, but basically useless for large-scale abuse.
- gcb0 12y ago
  what if a company like microsoft approach you and say "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" granted, i'm not familiar with the matter. but I know what I would answer. also, removing noip or noip enabling whatever microsoft was bullying them to implement, would just delay it a few days until the worm creators rolled out their own service. heck that can even motivate them to get creative and encode IPs in a obfuscated pastebin, or stenographed in cat pictures in reddit, or noise mp3 in soundcloud... maybe having them rely on noip was good.... but again, i have no knowledge of the matter. maybe noip was being paid even after knowing it was for worms. who knows?
  - wfjackson 12y ago
    > "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" How can they patch it in their product without turning desktop Windows into something like iOS or Windows Phone/RT? Even Android has a ton of malware so the notion that Windows is somehow more hole ridden than other platforms stopped being true starting about 10 years ago with their Secure computing initiative. If the user can install Firefox, they can install malware. If Firefox doesn't need to get permission from MS for their next version, Windows cannot distinguish between Firefox.exe and Codec_Flash_Shady.exe. Sandboxing will disable system level utilities. MS is capable of making secure OSes. How many viruses and trojans do the 3 Xboxes, Windows Phone and RT have? Even Windows Server is pretty secure(atleast as secure as Linux) unless the admins start browsing on it. Malware is a real threat to any popular OS unless third party apps are entirely blocked or restricted by the use of a approval based App Store. Windows gives much more control to the user, which is why many users are able to stay away from infections. And it's ironic that you're blaming MS here instead of the folks that propagate it(including a YC company https://www.techdirt.com/articles/20130115/17343321692/why-are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml https://www.techdirt.com/articles/20130115/17343321692/why-a...) and people who install it(users). Remember the shitstorm that was raised against MS on here and elsewhere when they tried to secure users by preventing undetectable rootkits by enabling Secure Boot?
    - AnthonyMouse 12y ago
      Linux solved this problem almost twenty years ago. You have a package manager that does not contain malware and does contain 95% of the software any user would install on a regular basis, and you make the process of installing software outside of the package manager possible but not trivial. You download a binary and it doesn't have the execute bit set, and you don't get any kind of friendly thing that pops up to ask you if you want to set it. So the sort of person who can't distinguish between legitimate software and malware also can't figure out how to install the malware, but you don't prevent people who know what they're doing from doing what they want. The problem with Windows is that it has no package manager, so the default method of installing legitimate software is identical to the method of installing malware. The problem with Android is that the malware is in the app store. All you need is a known-good repository where you can get almost everything safely and people can spend most of their time. You don't then need to build a prison around it and trap everyone inside because most people will want to stay in the safe place. The people who want to (and can figure out how to) wander outside are the people who know what they're doing, and know to be suspicious of the things that conspicuously haven't been vetted by anyone else.
      - wfjackson 12y ago
        Package manager and repositories are not completely foolproof. http://www.zdnet.com/blog/hardware/how-much-more-malware-is-lurking-in-linux-official-repositories/8615 http://www.zdnet.com/blog/hardware/how-much-more-malware-is-... If Linux were to get as popular as Windows, the problem is going to way worse. Also, there's lot of Android malware that's installed from outside the app store, typically for piracy reasons which is another big malware vector on Windows.
        AnthonyMouse 12y ago
        > Package manager and repositories are not completely foolproof. Nothing is completely foolproof. http://www.theguardian.com/technology/appsblog/2013/aug/19/ios-malware-apple-iphone-ipad-jekyll http://www.theguardian.com/technology/appsblog/2013/aug/19/i... > If Linux were to get as popular as Windows, the problem is going to way worse. Everybody says this but it doesn't make any sense. Are the repositories going to get more malware when there are more people and funding available to notice and report it? > Also, there's lot of Android malware that's installed from outside the app store, typically for piracy reasons which is another big malware vector on Windows. All the more reason why it wouldn't happen on Linux. Nobody really pirates LibreOffice or gcc.
jlogsdon 12y ago
> unlike, say, CloudFlare Care to elaborate?
- nothxbro 12y ago
  A quick search shows exactly what he means. No elaboration necessary. http://www.webhostingtalk.com/showthread.php?t=1235995 http://www.webhostingtalk.com/showthread.php?t=1235995 http://www.organicweb.com.au/17240/internet/cloudflare-security-review/ http://www.organicweb.com.au/17240/internet/cloudflare-secur... http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...
  - jlogsdon 12y ago
    Thanks, what I searched for didn't really bring anything up.
  - lucb1e 12y ago
    In all 3 links this is the only relevant part I've been able to find regarding them being malicious: > Heck, if the DDoS for hire services protect themselves against DDoS attacks by using CloudFlare then CloudFlare must be damn good! So they protect their customers from DDoS attacks. All of them. I see nothing bad in this. Saying they shouldn't is like saying a government should put all criminals together in a village and then have them perform criminal activity on each other. The link to Kreb's is basically the same: people protecting themselves. Should CloudFlare play for judge and ban people that do not violate their terms? Because I'm sure they boot people that perform illegal activities on their network or otherwise harm their network from within, but I can see why they don't proactively take down any website mentioning "we offer DDoS attacks". Like I said before, that person A kills another person doesn't mean that another person may kill person A, at least not within our current laws. Even if it did, is CloudFlare the one who should be calling the shots? Finally your first link is someone complaining to CloudFlare about LOIC (or related perl scripts launched from VPSes) and cloudflare responds that they see no harmful traffic and that logs or other details should be attached. Merely saying "hey I'm having trouble" has never gotten anyone further in resolving issues. That's why we have logs so that CloudFlare can check their own logs to see what happened. Perfectly reasonable. So yeah elaboration is necessary. I do not see why CloudFlare is harmful.
efiftythree 12y ago
I use their service and am a bit concerned that I've not heard about this until now and taking a look at their blog/website I see no information about this.
- kbar13 12y ago
  i believe everything I see in uncited hacker news comment threads too.
  - efiftythree 12y ago
    Which part of this is un-cited? The article linked is fairly conclusive evidence that this is in fact a real thing.
- devicenull 12y ago
  Why would you expect them to be talking about this?
eastdakota 12y ago
At CloudFlare, we have a Trust & Safety team dedicated to dealing with the abuse of our network. We sit in front of more than 2 million sites. The vast majority of them are not controversial (the site you're reading this on, for instance), but some are not. The majority of the abuse requests we receive are DMCA requests, but we get other reports as well. Dealing with these requests is a hard problem because a large number of the abuse requests we receive turn out to be attackers trying to get the origin IP in order to circumvent our protection. As I've blogged about before (http://blog.cloudflare.com/thoughts-on-abuse http://blog.cloudflare.com/thoughts-on-abuse), we've designed an abuse system that attempts to act as a proxy: passing abuse requests to the customer and their host without exposing the customer's origin to attack. Malware is one of the situations where we'll actually take content down because it is, per se, harmful. However, we also don't think terminating the customer who has malware hosted on their site is a good solution. Since we're a proxy, terminating the customer doesn't remove the malware from the Internet but instead just kicks the problem down the road to the host. Instead, we developed a system that replaces the infected URLs with a warning page to protect users. This has the ancillary benefit when a site is being used for botnet command and control of allowing us to gather data on machines that make up the botnet. This data is fed back into our system in order to better protect our customers and we're talking other organizations about a way of responsibly sharing this data. Our Trust & Safety team works with trusted malware reporters regularly, including the team at Microsoft that handled the no-ip.com takedown. We will continue to adjust our process to walk the careful line between ensuring our network isn't causing per se harm while, at the same time, avoiding the risk of becoming a censor. Matthew Prince / Co-founder & CEO, CloudFlare
- pktgen 12y ago
  My own comments about your company are based on what I described in https://news.ycombinator.com/item?id=7880514 https://news.ycombinator.com/item?id=7880514. Would you care to respond to my statements in that post?
  - devicenull 12y ago
    And without your usual comment of "the attack traffic is not from our network, so it's not our problem".
rdl 12y ago
Hey pktgen: I'm new at CloudFlare, but I'd be really interested in chatting with you (or grabbing a beer) to hear if there's something we could do better. Contact info in my profile. I'll be at Defcon and HOPE too if that's easier. (Free speech vs. keeping the overall network safe is a hard decision. I think all pro-privacy and pro-liberty services have had to answer this question -- same thing happened with cypherpunks list, HavenCo, Freenet, various payment systems, etc.)
- pktgen 12y ago
  Thanks, I'm also interested in having a chat with you about it, so I'll take you up on that offer in a bit. :)
  - rdl 12y ago
    (Offer is open to anyone who ever has security/privacy/etc. issues w.r.t. CloudFlare. I like talking to people about security and "Internet politics", either at conferences or at home.)

by pktgen 12y ago

duskwuff 12y ago

While I'm not familiar with the exact situation here, I suspect the real problem is that the malware domains are being automatically created en masse, and No-IP have been slow or reluctant to do anything to slow that down. Being responsive to complaints is good for small-scale problems involving individual domains, but basically useless for large-scale abuse.

gcb0 12y ago
what if a company like microsoft approach you and say "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" granted, i'm not familiar with the matter. but I know what I would answer. also, removing noip or noip enabling whatever microsoft was bullying them to implement, would just delay it a few days until the worm creators rolled out their own service. heck that can even motivate them to get creative and encode IPs in a obfuscated pastebin, or stenographed in cat pictures in reddit, or noise mp3 in soundcloud... maybe having them rely on noip was good.... but again, i have no knowledge of the matter. maybe noip was being paid even after knowing it was for worms. who knows?
- wfjackson 12y ago
  > "look, i make billions while you make a few thousands, but please, go ahead and change your service because it is impacting my billion dollar windows sales and i can't be bothered to patching it on my product" How can they patch it in their product without turning desktop Windows into something like iOS or Windows Phone/RT? Even Android has a ton of malware so the notion that Windows is somehow more hole ridden than other platforms stopped being true starting about 10 years ago with their Secure computing initiative. If the user can install Firefox, they can install malware. If Firefox doesn't need to get permission from MS for their next version, Windows cannot distinguish between Firefox.exe and Codec_Flash_Shady.exe. Sandboxing will disable system level utilities. MS is capable of making secure OSes. How many viruses and trojans do the 3 Xboxes, Windows Phone and RT have? Even Windows Server is pretty secure(atleast as secure as Linux) unless the admins start browsing on it. Malware is a real threat to any popular OS unless third party apps are entirely blocked or restricted by the use of a approval based App Store. Windows gives much more control to the user, which is why many users are able to stay away from infections. And it's ironic that you're blaming MS here instead of the folks that propagate it(including a YC company https://www.techdirt.com/articles/20130115/17343321692/why-are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware-installer.shtml https://www.techdirt.com/articles/20130115/17343321692/why-a...) and people who install it(users). Remember the shitstorm that was raised against MS on here and elsewhere when they tried to secure users by preventing undetectable rootkits by enabling Secure Boot?
  - AnthonyMouse 12y ago
    Linux solved this problem almost twenty years ago. You have a package manager that does not contain malware and does contain 95% of the software any user would install on a regular basis, and you make the process of installing software outside of the package manager possible but not trivial. You download a binary and it doesn't have the execute bit set, and you don't get any kind of friendly thing that pops up to ask you if you want to set it. So the sort of person who can't distinguish between legitimate software and malware also can't figure out how to install the malware, but you don't prevent people who know what they're doing from doing what they want. The problem with Windows is that it has no package manager, so the default method of installing legitimate software is identical to the method of installing malware. The problem with Android is that the malware is in the app store. All you need is a known-good repository where you can get almost everything safely and people can spend most of their time. You don't then need to build a prison around it and trap everyone inside because most people will want to stay in the safe place. The people who want to (and can figure out how to) wander outside are the people who know what they're doing, and know to be suspicious of the things that conspicuously haven't been vetted by anyone else.
    - wfjackson 12y ago
      Package manager and repositories are not completely foolproof. http://www.zdnet.com/blog/hardware/how-much-more-malware-is-lurking-in-linux-official-repositories/8615 http://www.zdnet.com/blog/hardware/how-much-more-malware-is-... If Linux were to get as popular as Windows, the problem is going to way worse. Also, there's lot of Android malware that's installed from outside the app store, typically for piracy reasons which is another big malware vector on Windows.
      - AnthonyMouse 12y ago
        > Package manager and repositories are not completely foolproof. Nothing is completely foolproof. http://www.theguardian.com/technology/appsblog/2013/aug/19/ios-malware-apple-iphone-ipad-jekyll http://www.theguardian.com/technology/appsblog/2013/aug/19/i... > If Linux were to get as popular as Windows, the problem is going to way worse. Everybody says this but it doesn't make any sense. Are the repositories going to get more malware when there are more people and funding available to notice and report it? > Also, there's lot of Android malware that's installed from outside the app store, typically for piracy reasons which is another big malware vector on Windows. All the more reason why it wouldn't happen on Linux. Nobody really pirates LibreOffice or gcc.

jlogsdon 12y ago

> unlike, say, CloudFlare Care to elaborate?

nothxbro 12y ago
A quick search shows exactly what he means. No elaboration necessary. http://www.webhostingtalk.com/showthread.php?t=1235995 http://www.webhostingtalk.com/showthread.php?t=1235995 http://www.organicweb.com.au/17240/internet/cloudflare-security-review/ http://www.organicweb.com.au/17240/internet/cloudflare-secur... http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...
- jlogsdon 12y ago
  Thanks, what I searched for didn't really bring anything up.
- lucb1e 12y ago
  In all 3 links this is the only relevant part I've been able to find regarding them being malicious: > Heck, if the DDoS for hire services protect themselves against DDoS attacks by using CloudFlare then CloudFlare must be damn good! So they protect their customers from DDoS attacks. All of them. I see nothing bad in this. Saying they shouldn't is like saying a government should put all criminals together in a village and then have them perform criminal activity on each other. The link to Kreb's is basically the same: people protecting themselves. Should CloudFlare play for judge and ban people that do not violate their terms? Because I'm sure they boot people that perform illegal activities on their network or otherwise harm their network from within, but I can see why they don't proactively take down any website mentioning "we offer DDoS attacks". Like I said before, that person A kills another person doesn't mean that another person may kill person A, at least not within our current laws. Even if it did, is CloudFlare the one who should be calling the shots? Finally your first link is someone complaining to CloudFlare about LOIC (or related perl scripts launched from VPSes) and cloudflare responds that they see no harmful traffic and that logs or other details should be attached. Merely saying "hey I'm having trouble" has never gotten anyone further in resolving issues. That's why we have logs so that CloudFlare can check their own logs to see what happened. Perfectly reasonable. So yeah elaboration is necessary. I do not see why CloudFlare is harmful.

efiftythree 12y ago

I use their service and am a bit concerned that I've not heard about this until now and taking a look at their blog/website I see no information about this.

kbar13 12y ago
i believe everything I see in uncited hacker news comment threads too.
- efiftythree 12y ago
  Which part of this is un-cited? The article linked is fairly conclusive evidence that this is in fact a real thing.
devicenull 12y ago
Why would you expect them to be talking about this?

eastdakota 12y ago

At CloudFlare, we have a Trust & Safety team dedicated to dealing with the abuse of our network. We sit in front of more than 2 million sites. The vast majority of them are not controversial (the site you're reading this on, for instance), but some are not. The majority of the abuse requests we receive are DMCA requests, but we get other reports as well. Dealing with these requests is a hard problem because a large number of the abuse requests we receive turn out to be attackers trying to get the origin IP in order to circumvent our protection. As I've blogged about before (http://blog.cloudflare.com/thoughts-on-abuse http://blog.cloudflare.com/thoughts-on-abuse), we've designed an abuse system that attempts to act as a proxy: passing abuse requests to the customer and their host without exposing the customer's origin to attack. Malware is one of the situations where we'll actually take content down because it is, per se, harmful. However, we also don't think terminating the customer who has malware hosted on their site is a good solution. Since we're a proxy, terminating the customer doesn't remove the malware from the Internet but instead just kicks the problem down the road to the host. Instead, we developed a system that replaces the infected URLs with a warning page to protect users. This has the ancillary benefit when a site is being used for botnet command and control of allowing us to gather data on machines that make up the botnet. This data is fed back into our system in order to better protect our customers and we're talking other organizations about a way of responsibly sharing this data. Our Trust & Safety team works with trusted malware reporters regularly, including the team at Microsoft that handled the no-ip.com takedown. We will continue to adjust our process to walk the careful line between ensuring our network isn't causing per se harm while, at the same time, avoiding the risk of becoming a censor. Matthew Prince / Co-founder & CEO, CloudFlare

pktgen 12y ago
My own comments about your company are based on what I described in https://news.ycombinator.com/item?id=7880514 https://news.ycombinator.com/item?id=7880514. Would you care to respond to my statements in that post?
- devicenull 12y ago
  And without your usual comment of "the attack traffic is not from our network, so it's not our problem".

rdl 12y ago

Hey pktgen: I'm new at CloudFlare, but I'd be really interested in chatting with you (or grabbing a beer) to hear if there's something we could do better. Contact info in my profile. I'll be at Defcon and HOPE too if that's easier. (Free speech vs. keeping the overall network safe is a hard decision. I think all pro-privacy and pro-liberty services have had to answer this question -- same thing happened with cypherpunks list, HavenCo, Freenet, various payment systems, etc.)

pktgen 12y ago
Thanks, I'm also interested in having a chat with you about it, so I'll take you up on that offer in a bit. :)
- rdl 12y ago
  (Offer is open to anyone who ever has security/privacy/etc. issues w.r.t. CloudFlare. I like talking to people about security and "Internet politics", either at conferences or at home.)