Pierre BourdonOct 29, 2024

On my blog: One weird trick to get the whole planet to send abuse complaints to your best friend(s)

https://delroth.net/posts/spoofed-mass-scan-abuse/

Summary of my adventures from last evening, as read in this Mastodon thread: https://mastodon.delroth.net/@delroth/113387965977159983

#infosec #networking #tor

delroth's homepage - One weird trick to get the whole planet to send abuse complaints to your best friend(s)

delroth's homepage
Show threadPierre Bourdon

Update: I got an email from Hetzner's legal team today saying they came across my blog post (nice!). Paraphrasing:

- They're monitoring and understand that there is no actual abuse being done from these Tor relays getting spoofed.
- They emphasized that they do not routinely take action on this kind of abuse complaints, and that's why they forward them without requiring reply/action from the customer.

Love hearing this, and I'm actually impressed by Hetzner's response! Major props.

Oct 30, 2024 at 3:06pmWeb
Show threadPierre BourdonNov 5, 2024

New update: the CTO from "watchdogcyberdefense.com" has been in my emails, and I can only summarize our exchanges by my current feeling of "wow there should be an exam to be allowed to send more than N abuse complaints/day".

To quote from them: they're seeing "1.3 billion attacks logged in the past 24h", they claim IPs are infected because VirusTotal says so, and they're trying to make a deal with me where if I iptables OUTPUT DROP their network they'll stop sending abuse complaints to Hetzner.

Show threadPierre BourdonNov 6, 2024

My post to nanog made it out of the mod queue, so this is my latest attempt to get some awareness about this abusive company to the internet community: https://mailman.nanog.org/pipermail/nanog/2024-November/226499.html

Hopefully it will reach a few more people working in NOCs and abuse departments? Who knows.

Show threadrobrykNov 6, 2024
@delroth I'm curious how soon they will send an abuse complaint to themselves or their provider (assuming they have more than one).
Show threadJeroen BaertNov 6, 2024
@delroth good writeup!
Show threadgudenauNov 5, 2024
@delroth Wouldn't that do absolutely nothing and be something they couldn't validate?
Show threadPierre BourdonNov 5, 2024
@gudenau yes and yes, want to be CTO as well?
Show threadgudenauNov 5, 2024
@delroth Eh, I'd probably do a bad job with actual duties they are supposed to do.
Show threadA ManzerNov 5, 2024
@gudenau @delroth But here's the thing: Delroth could do it, and they'd still be getting flooded, so they'd just assume he did it wrong. They'll trust the malicious source of the traffic (to tell the truth about its IP) more than they'd trust Delroth (who's obviously an incompetent sys admin. /s)
Show threadendrift 🏳️‍⚧️Nov 5, 2024
@gudenau @delroth and nothing of value would be lost
Show threadSamantha RoseNov 5, 2024
@delroth You should propose alternative of having their ISP/upstream put those rules in place on the company’s link. Would immediately fix the problem making everyone happy.