Hacker News Reader

Comment by tzs | Hacker News Reader

> And there was no prior warning to noip.com -- they woke up one day and their domains were seized. They only found out why after the fact -- and, given the nature of free Dynamic DNS services, it's very unlikely noip.com was even aware that a botnet was using their services (the justification for the seizure).

No-ip was DEFINITELY aware of it. OpenDNS published an article in April 2013 identifying no-ip as the top used provider for malicious use [1] and a representative from no-ip posted a comment on that article which proves that no-ip was aware of it.

Cisco published a similar article on February 11, 2014 [2]. We know that no-ip was aware of this because they posted a comment in response, and posted a blog entry about it at their site [3].

[1] http://labs.opendns.com/2013/04/15/on-the-trail-of-malicious...

[2] http://blogs.cisco.com/security/dynamic-detection-of-malicio...

[3] http://www.noip.com/blog/2014/02/12/cisco-malware-report/

View on HN

You seem to be missing the point.

They (noip.com) had zero pre-warning of a domain seizure. Regardless of any literature you dig up from years ago that states some botnets use Dynamic DNS services such as noip.com, it does not mean they had warning they were about to be seized. Others have commented that the court order forbid anyone, including Microsoft, from informing noip.com prior to the seizure.

It should be noted, that most/all "cloud" services likely have some sort of illicit behavior being conducted through them... Ec2, Azure even, etc. Botnet's use the same services me and you do... that does not for even a second make noip.com responsible for the botnet's actions.

You wrote: "it's very unlikely noip.com was even aware that a botnet was using their services (the justification for the seizure)".

The links I cited show that this is incorrect. No-ip was aware.

"We would like to be on the record to state that at No-IP, we have a very strict abuse policy. Our abuse team is constantly working to keep the No-IP system domains free of spam and malicious activity...We provide a valuable service for free, but because of this, it is common for users to abuse our service. Our abuse team is amazing and they are usually pretty quick to shut them down, but sometimes a few can slip through the cracks".

No-ip was aware of the potential and had an abuse team to deal with such cases. They were also aware of other experts finding their abuse team wanting. But that doesn't seem to be enough evidence to suggest they were partly culpable in any particular case. Perhaps there were examples of particularly galling incompetence in their abuse team, or the abuse team tipping off fraudsters but otherwise informing them seems to be the most reasonable and responsible action.

> abuse team

Every domain provider must have an abuse team or at least an address to send abuse notices too [http://who.is/whois/cloudapp.net/], that PR statement from No-IP states no facts or figures of many abuse notices they combat - which I would cite if my abuse team actually did stuff "look how amazing our team is - we had x,000's requests and took down x00 of malicious hosts just last month."

"The report noted many domains that the Cisco Security Team thought were abusive. We have not received any report from Cisco about any domains, or any supporting information. If Cisco wished to report abuse, they could have easily contacted our Abuse Team at abuse@no-ip.com."

It seems odd that people aren't reporting this there, or if they are reporting it there, are not documenting that.

Reply on news.ycombinator.com