How to get the whole planet to send abuse complaints to your best friends

This type of issue can be incredibly annoying to deal with, because the legitimate answer to the abuse report (&quot;someone is spoofing my IP, it isn&#x27;t me, and the machine is not compromised&quot;) is the exact same excuse that a malicious actor would provide.<p>Then, as noted in the article, you&#x27;re trying to prove a negative to someone who doesn&#x27;t really care at all, which is borderline impossible.

&gt; The internet was broken 25 years ago and is still broken 25 years later. Spoofed source IP addresses should not still be a problem in 2024, but the larger internet community seems completely unwilling to enforce any kind of rules or baseline security that would make the internet safer for everyone.<p>Same with spoofed MAC addresses, email addresses, ARP messages, Neighbor Discovery, MitM TLS certificates ... It&#x27;s amazing anything works anymore :D

Back in the day I would scan for DrDoS reflectors in a similar way, no hosting provider wants to get reports for port scanning so the source address of the scan would belong to an innocent cloud provider with a reputable IP that reflectors would happily send UDP replies to. The cloud provider would of course get a massive influx of complaints but you would just say that you aren&#x27;t doing any scanning from your server (which they would verify) and they wouldn&#x27;t shut your service off. The server sending out the spoofed scan packets is undetectable so you&#x27;re able to scan the entire internet repeatedly without the typical abuse issues that come with it.<p>I&#x27;m not sure how often this happens in practice but tracing the source of a spoofed packet is possible if you can coordinate with transit providers to follow the hops back to the source. One time JPMorgan worked with Cogent to tell us to stop sending packets with their IP addresses (Cogent is one of the most spoofer friendly tier 1&#x27;s on the internet btw).<p>This is the first time I&#x27;ve heard of this being used to target TOR specifically which seems counterintuitive, you would think people sending out spoofed packets would be advocates of TOR. Probably just a troll, luckily providers that host TOR won&#x27;t care about this type of thing.

This is nothing new. A few years back, I implemented a very basic firewall rule: if I received a TCP packet with SYN=1 and ACK=0 to destination port 22, the source IP would get blacklisted for a day. But then I started getting complaints about certain sites and services not working. It turned out that every few days, I&#x27;d receive such packets from IPs like 8.8.8.8 or 1.1.1.1, as well as from Steam, Roblox, Microsoft, and all kinds of popular servers—Facebook, Instagram, and various chat services. Of course, these were all spoofed packets, which eventually led me to adjust my firewall rules to require a bit more validation.<p>So, I can assure you this is quite common. As a personal note, I know I’m a bit of an exception for operating multiple IP addresses, but I need the flexibility to send packets with any of my source addresses through any of my ISPs. That’s critical for me, and if an ISP filters based on source, it’s a deal-breaker—I’ll switch to a different ISP.

The “someone hates Tor relays” theory doesn’t sound worth the effort. This could be an entity running malicious relays, while also trying to unethically take down legitimate relays to increase the percentage of the network that they control.

&gt; Which means, if you just find one transit provider which doesn’t do BCP38 filtering… you can send IP packets tagged with any source IP you want! And unfortunately, even though the origins of BCP38 date back to 1998… there are still network providers 25 years later that don’t implement it.<p>What would it take to get enough network providers to start rejecting traffic from all ASes that don&#x27;t implement this, so that spoofing was no longer possible?

It&#x27;s a similar problem to swatting. It relies on authorities taking severe action against an unverified source of problems.<p>I suppose a difference is that they use unaffiliated parties to send the complaint, instead of contacting the authority directly.

It seems like systems shouldn&#x27;t report abuse (at least automatically) for single packet, no round trip, requests unless its reaching denial of service levels of traffic (and maybe these are). Like in particular for SSH there&#x27;s no way thats even a valid connection attempt until some sort of handshake has occurred.

This is the IP version of SWATting, patent trolls, framing an innocent person, or using DMCA takedowns to remove the competition. It&#x27;s basically weaponizing abuse-protection mechanisms to instead attack a target that is disliked. Interesting that the authorities can become a weak link here and be actively weaponized by unscrupulous actors to achieve their aims, but it&#x27;s not really a new phenomena.

There&#x27;s no <i>in-band</i> solution to this problem, but out-of-band solutions might exist! For example: (1) Notify the destination ISP that you&#x27;re receiving backscatter. (2) That ISP checks where the packets are coming from, and notifies <i>that</i> ISP. (3) Repeat step 2 until source is found. (4) Quarantine that part of the network until it behaves better.<p>At the end of the day, the internet is people.

How difficult would it be to highjack this attack by sending these packages to everyone, so that providers like hetzner would get swamped with abuse emails? This way the attack would not work anymore. Either the honeypots would stop sending abuse emails, or the providers would filter those out.

This is likely a very naive question, but how did the spoofer know his IP was participating as an internal Tor node? From what vantage point can that be seen? I imagine internal Tor nodes must know to connect to each other, so it must propagate through Tor. Is the attacker also a Tor node? Is it trivial to map all Tor hosts?

gah, I remember once when I was working at a company, and we got an email complaining &quot;stop hacking my systems!&quot;<p>in the end, we had a load-balancer at .1 balancing a bunch of backend servers.<p>the complainer would have traffic to .1 that the load balancer would receive. Thing is, old or stale connections would drop out of the load balancer mapping table, and eventually the backend server connection would not get mapped, and the guy would get traffic direct from the backend server real ip address.<p>the traffic was actually generated by the customer, but these &quot;unrelated&quot; backend servers looked like they were hacking him.

This appears to be the website of the person(s) responsible: <a href="https:&#x2F;&#x2F;r00t.monster&#x2F;" rel="nofollow">https:&#x2F;&#x2F;r00t.monster&#x2F;</a><p>They have posted several screenshots of discussions among people affected on various channels, including Mastodon and the official #tor-relays channel on IRC.

Site seemed to be hugged when posting this comment, so:<p><a href="https:&#x2F;&#x2F;archive.is&#x2F;Eb7TI" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;Eb7TI</a>

The way scrolling is implemented on that page is absolutely abhorrent.

Abuse reports are marketing messages at this point.

This is pretty clever