Rasbora (u/Rasbora) - Readit News

Rasbora commented on How to get the whole planet to send abuse complaints to your best friends delroth.net/posts/spoofed... · Posted by u/scd31

Rasbora · 10 months ago

Back in the day I would scan for DrDoS reflectors in a similar way, no hosting provider wants to get reports for port scanning so the source address of the scan would belong to an innocent cloud provider with a reputable IP that reflectors would happily send UDP replies to. The cloud provider would of course get a massive influx of complaints but you would just say that you aren't doing any scanning from your server (which they would verify) and they wouldn't shut your service off. The server sending out the spoofed scan packets is undetectable so you're able to scan the entire internet repeatedly without the typical abuse issues that come with it.

I'm not sure how often this happens in practice but tracing the source of a spoofed packet is possible if you can coordinate with transit providers to follow the hops back to the source. One time JPMorgan worked with Cogent to tell us to stop sending packets with their IP addresses (Cogent is one of the most spoofer friendly tier 1's on the internet btw).

This is the first time I've heard of this being used to target TOR specifically which seems counterintuitive, you would think people sending out spoofed packets would be advocates of TOR. Probably just a troll, luckily providers that host TOR won't care about this type of thing.

Rasbora commented on Cloudflare servers don't own IPs anymore so how do they connect to the internet? blog.cloudflare.com/cloud... · Posted by u/jgrahamc

Rasbora · 3 years ago

Whenever I see the name Marek Majkowski come up, I know the blog post is going to be good.

I had to solve this exact problem a year ago when attempting to build an anycast forward proxy, quickly came to the conclusion that it'd be impossible without a massive infrastructure presence. Ironically I was using CF connections to debug how they might go about this problem, when I realized they were just using local unicast routes for egress traffic I stopped digging any deeper.

Maintaining a routing table in unimog to forward lopsided egress connections to the correct DC is brilliant and shows what is possible when you have a global network to play with, however I wonder if this opens up an attack vector where previously distributed connections are now being forwarded & centralized at a single DC, especially if they are all destined for the same port slice...

Rasbora commented on Ask HN: Does Hacker News still do in person meet ups? · Posted by u/people_not_bots

tptacek · 3 years ago

It does if you want it to. These have always been privately organized. If you set one up in Chicagoland, let me know.

Rasbora · 3 years ago

There are dozens of us!

Rasbora commented on IPv4 Turf War ipv4.games/... · Posted by u/mogery

Rasbora · 3 years ago

I had an almost identical idea to this website a while ago but never acted on it, props to the dev.

Here is how you win the IPv4 games, in order of most to least effective:

1) Have a large online following that is willing to visit your claim link or a page where you can embed an iframe / img / etc that points to your claim link.

2) Pay to use someone else's (consensual) botnet by paying a residential proxy service, this is the approach I just used and it cost me a few dollars for access to a massive amount of distributed IPv4 space.

3) Abuse cloud / serverless offerings as far as they will go, unlikely to win more than a few blocks this way.

4) Own IPv4 space.

Other less ethical approaches: possibly exploit the system by sending a XFF header the developer forgot to block (probably just checking socket address so unlikely to work here), spin up a Vultr VPS in the same DC and probe for a way to connect with a local address, hijack BGP space, run your own botnet, I'm reminded of an old exploit in WordPress XMLRPC...

From what I can see the current rankings are just me and mike fighting for the same proxy space (the vote goes to the most recent visit per IP), and everyone else falls into buckets 3 & 4.

Rasbora commented on IPv4 Turf War ipv4.games/... · Posted by u/mogery

mike_d · 3 years ago

This is really awesome. Finally a game I am good at.

Rasbora · 3 years ago

Coming for your crown >:D

Rasbora commented on I ran the worlds largest DDoS-for-Hire empire and Cloudflare helped rasbora.dev/blog/I-ran-th... · Posted by u/Rasbora

everyone · 3 years ago

I don't think the author's argument makes sense.

Cloudflare's position is that they are neutral and will provide their services to anyone and everyone. They do not make those value judgements deciding who deserves their services or not.

The fact that they thus provide their service to booters isn't a flaw in Cloudflare's argument, in fact it's consistent with their position.

The author is implying that Cloudflare should independantly make that value judgement against a booter, rescind their services from the booter, thus allowing other booters to take that booter down? That's ridiculous. All the booters should be dealt with by some legal authority.

EDIT: So according to some comments cloudflare sometimes does decide independantly to rescind their services from some users? That would make them inconsistent in that case. The authors argument, that the solution to booting is more booting, still doesnt make sense tho imo. It's like the solution to too many guns is more guns.

Rasbora · 3 years ago

I would agree with you, however please take a look at a statement from CloudFlare earlier today: https://news.ycombinator.com/item?id=32707821

"Our decision today was that the risk created by the content could not be dealt with in a timely enough matter by the traditional rule of law systems."

Booter services have been using CloudFlare for the better part of a decade, sure individual services come and go but the trend is persistent. So for booter services a decade is enough time for the rule of law to make the decision but another type of controversial platform follows it's own arbitrary timeline, and I would argue that is setting the most dangerous precedent of all, especially when the 'risk' created by a particular type of content doesn't outweigh any potential financial incentives.

Rasbora commented on Ask HN: Where to meet people who are interested in building a company together? · Posted by u/swman

Rasbora · 3 years ago

If you're going to post a thread like this, leave an avenue for people to get in contact with you...

Rasbora commented on IPv4 Address Auctions auctions.ipv4.global/... · Posted by u/gmays

derefr · 3 years ago

As the CTO of an API SaaS who sees a lot of promotion fraud on our service (i.e. bots attempting to sign up for thousands of free-tier accounts, because enough free-tier API-keys lashed together ≡ the capabilities of one paid-tier account), I see fraudulent sign-ups coming from IP addresses reallocated by these auction providers all the time. Addresses sold on IPXO (https://www.ipxo.com/) are seemingly especially bad for this.

If there was a big list of all reallocatable / not-permanently-allocated IP ranges, I'd willingly — gleefully! — just dump it into Cloudflare as an IP blocklist for our website / registration flow. And there'd be zero fear in my mind of getting any false positives or user complaints by doing so.

After all, none of these reallocatable ranges are ever purchased by residential/commercial broadband ISPs; those customers would much rather solve their IPv4 problems permanently, by doing either IPv6 enablement or CGNAT, than solve them for only the next 1024 customers, by buying a piddly /22 — especially at an unpredictable, un-budget-able price!

And for registrations, any IP other than ISP IPs doesn't matter. IaaS IP? Bot. VPS IP? Bot. Colo IP? Bot. "Internal-use" IP? Bot. if someone's traffic isn't coming from an IP address owned by an ISP, then for purposes of registration, it's not good traffic, 99.999% of the time†. Those IPs are perfectly fine when it comes to actual requests — obviously, your application backend using our API is a "bot" in some sense — but your application backend shouldn't be going to our website and filling out a sign-up form. :)

(† The other 0.0001% are people using "workstation in the cloud" services. But people using those are used to being treated as second-class Internet citizens when trying to do web browsing from their cloud workstation; and they already know the solution is always to switch back to their real computer's web browser for anything requiring IP reputation.)

Rasbora · 3 years ago

I am here to answer your prayers: https://rasbora.dev/blog/detecting-residential-proxy-network...

While my tool is just a proof of concept, it can easily be scaled up to run checks on a sign up form to prevent bad actors from abusing the system.