Hacker News Reader

Comment by efitz | Hacker News Reader

Former AWS security here. Cloud operators are EXTREMELY interested in maintaining the reputation of their IP address space; I promise you that abuse complaints are taken very seriously, investigated and acted on.

View on HN

My dealings with Microsoft have been along the lines of we don't care, we don't investigate, we simply turn off reported accounts and play wack-a-mole. Our team was complaining from a decent sized Microsoft (a smaller state government, spending millions with Microsoft annually) and got that shoulder shrug of a response.

Same here.

AWS has acted upon similar reports in the past, Azure may have but the lack of comms and delays in seeing any action (if any) hasn't inspired confidence.

This is generally speaking the only good thing I have to say about GCP -- they communicate a lot. Don't love all of the other stuff, but I can trust them to get back to me.

From your own admission, they block accounts known to be abusive. I don't know how that's compatible with "don't care" and "don't investigate" - neither of which sounds like something Microsoft would plausibly tell you. What are you basing this impression on?

Microsoft blocking accounts that are the source of abuse reports doesn’t necessarily mean Microsoft has investigated for themselves the validity of those abuse reports. At least that’s how I interpret what the op was saying.

I would hope they did investigate too otherwise it’s too easy to DoS a valid customer with fake complaints.

For a lot of reasons, cloud providers will never tell you how they investigated or what they found out. Telling you only has downside - either they give away information about tools & techniques, or they leak PII of other customers, or you engage them in a protracted discussion which will suck time away from addressing other abuse complaints, etc. So you will never get detail. That doesn't mean that they didn't do anything, it just means that there is no upside for them to sharing details with you.

The past year I upgraded my firewall and exposed a plex port. My new firewall gives me notifications and automatically blocks connections to the plex server based on common signatures it knows about. None of my plex users complain or have issues.

A couple provides I sent abuse complaints to based on whois lookups responded with automated emails requesting the info in X-ARF format. It’s hard to get some cloud providers to respond to a random residential user.

A couple IPs were repeated “scans” by supposed security researchers with IPs out of Hawaii and France.

Intelligence agencies

Great, you've made me revisit my list of IPs and accidentally type one in my address bar. Whois says it's Palo Alto IP 205.210.31.169 and they hit me back within 60 seconds on port 60001. It is annoying they are trying to scan for vulns, but I will likely block all the ranges I can find.

If I find the sketchy Hawaii and French IPs I will post something.

Edit: Here you go:

https://academyforinternetresearch.org

  IP Location United States United States Honolulu Academy     Of Internet Research Limited Liability Company
  ASN United States AS400161 (registered Oct 22, 2021)
  Whois Server whois.arin.net
  IP Address 104.156.155.3


  NetRange:       104.156.155.0 - 104.156.155.255
  CIDR:           104.156.155.0/24
  NetName:        ACDRESEARCH
  NetHandle:      NET-104-156-155-0-1
  Parent:         NET104 (NET-104-0-0-0-0)
  NetType:        Direct Allocation
  OriginAS:       
  Organization:   Academy of Internet Research Limited Liability Company (AIRLL)
  RegDate:        2022-01-07
  Updated:        2022-01-07
  Ref:            https://rdap.arin.net/registry/ip/104.156.155.0
  
  OrgName:        Academy of Internet Research Limited Liability Company
  OrgId:          AIRLL
  Address:        #A1- 5436
  Address:        1110 Nuuanu Ave
  City:           Honolulu
  StateProv:      HI
  PostalCode:     96817
  Country:        US
  RegDate:        2021-10-15
  Updated:        2022-11-06
  Ref:            https://rdap.arin.net/registry/entity/AIRLL

Anyone know if these guys are legit?

The page is literally nothing but a few basic HTML tags. If I had an email to burn I would message them.

It seems they are running on Hivelocity a bare metal hosting provider.

What firewall do you use? I'd love to be able to automatically block bots immediately!

The Unifi Dream Machine Special Edition is what I use. I do not have any degradation with my gigabit internet unlike past Unifi products I have owned.

Snort is something I have looked at installing and playing with on a PFSense box.

https://www.snort.org

If the bot is running from a cloud instance then you can fairly easily block it using something like Zeek. For example: https://help.shodan.io/zeek-integration/4-blocking

You could also check if the remote IP has any open ports (ex. SSH) and block based on that as most regular visitors probably won't be exposing those types of services to the Internet.

If you are auto-generating outbound SMTP traffic with abuse complaints from a fully automated script, sent to the ARIN/RIPE/APNIC/LACNIC/AFRINIC POC email addresses of IP space holders because something portscanned your firewall, you are part of the problem, not the solution.

If I had a dollar for every person who has turned loose such a tool to shit up my abuse@ispname.com inbox...

That’s an interesting idea to automate my complaints.

I seriously doubt the Las Vegas “located” IP with Hong Kong addresses on their registration or Shanghai UCloud Information Technology Company IPs are scanning me for good reasons.

What do you think would happen if I run an older version of plex with a known vulnerability?

I mean, isn't that what shodan is for? Who would bother port scanning for that stuff?

Shodan is public. Chinese intelligence wants their version to be more detailed and not public.

If you're getting reports of port scanning from the same IPs over and over, they're probably bots and I'd think most ISPs would want to know.

The automated emails are usually in the same formats making them easy to filter and parse too.

My only experience with reporting spam sent from SES was a reply a few days later asking me about "additional information" that were all in my original message.

Reply on news.ycombinator.com