Slashdot Mirror
Confronting Address Space Hijackers
Tawn writes "There's a great story on SecurityFocus about hijackers taking over large allocations of IPv4 space with forged documents and false business fronts. Los Angeles County and some big multinationals have had /16's pulled out from under them in the last few months, and used to inject spam. ARIN and network operators are trying to get a handle on the problem. The owner of a webhosting company that wound up with L.A. County's /16 called it 'borrowed space,' and said he paid $500 for it to a guy he met online."
1) Start a fake business
2) forge some documents
3) steal more IPs than the whole of china has
4) sell to spammers
5) PROFIT!!!!
(note, ??????? step not required)
There is no god
Right... "borrowed". And that "guy I met in the van in the back alley" was just letting me "borrow" that plasma screen TV for $500.
I moderate "-1, Fool"
YOu know, as evil as this may be, Sitting on that quantity of Unused IP adresses is just as criminal. Perhaps Once they get the addresses back, they should consider selling or renting them out to raise some funds since California claims to be having budget problems. I'm sure some of these guys would be happy to put in a bid.
Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
How the hell can't you be a little suspicious of somebody offering you a Class C for $500 on the condition that you only use a small part of it? What, did it fall off a truck?
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
The owner of a webhosting company that wound up with L.A. County's /16 called it 'borrowed space,' and said he paid $500 for it to a guy he met online.
That's like getting stopped with a tractor trailer full of stolen goods and saying you bought it from some homeless guy on 82nd for 30 bucks.
Oh.. no it's not..
SCO employee? Check out the bounty
Judging by the article, LA county was using that /16 for internal routing only. I understand that they probably got it when it was easy to get, but do they really still need it? On that note, how much IP space that is allocated is actually in use? I heard something like 25%..
That Class A block that I bought on ebay from the guy from Nigeria who spammed me via SMS isn't legit? I better quickly cancel that wire transfer of money to his cousin, you know, the finance minister until I can check out his story about the president dieing in a plane crash and leaving all that money that he was going to invest in helping Quark get its native OSX version done.
I'd never heard of Enron before they started running TV ads about how they sub-rented "unused bandwidth" from multi-nationals during their off-hours.
It wouldn't surprise me that this is one scam that they would have tried to pull.
I don't know about the rest of the world, and IANAL, but I rather suspect that any member in good standing of the Communications Bar would be able to make a very strong case about willful interference with a communications system.
Next thing you know, they'll be lighting OPDF. (Other People's Dark Fibre)
It won't guarantee that this won't happen, but signed communications would help. Private keys can be stolen though, but I suspect that takes more effort. A public key should be included in the registry application, or with whois record, or in some other private DB at the registry. I guess this would be the opposite of PGP encrypted mail where the private key is used to decrypt rather than encrypt.
With the still-ongoing cases over domain theft and fraud, is it at all surprising that it's also active in areas like IP block assignments?
I get SPAM with faked reply-to, sent-by, and domain names. Most hacks against my systems are from IP addresses that don't resolve back to a valid domain.
The only shock here is that someone was dumb enough to think they could get a /16 for only $500.
I do not fail; I succeed at finding out what does not work.
There are a few posts about specific unused IP's being stolen, while the used ones went on working as normal... is that what happened, or did what's-his-name in Northern California take over the whole class C, similar to taking over a domain? If it was the latter, I'm surprised nobody's tried it before... given that it's really not extremely difficult to move a domain from one person to another, it can't be too hard to do the same for a block of IP's.
So is it certain IP's that weren't being used, or a large block of IP's that were just read internally from the servers and directed to where the servers thought they should go?
"It's better to have a gun and not need it than need a gun and not have it." ~ Christian Slater, True Romance
That this guy would end up in jail and that big guy in the cell next door merely "borrows" his ass for a pack of cigarettes.
That's like saying, "Fucktard6969 on IRC said that the software he's hooking me up with is legit"
The legwork involved in assuring that a block of IPs is legitimate should be fairly simple and part of the network administrator's job. We're not talking about end-users here, we're talking about networking professionals acting on behalf of a corporation. If they don't do their job properly they should be held responsible for that failure, especially when the transaction should raise suspicions as these would.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
What's the point of stealing IPs to spam? Haven't these guys ever heard of wardriving for IPs?
These guys really need some serious technical help...
(Yes, not meant seriously for those law/spam enforcement types out there!)
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
a couple of weeks ago. Not this particular article, but a little write-up with some nice links (rejected, of course).
Links:
In your face hijacking
Current list of possible bogus bgp routes
Oh, well.
ARIN and their members made this problem for themselves. If legit space was easier to get - you currently need to prove you have 16000 hosts. Then people would be more traceable and accountable.
Spammers are now in a very tight spot in that their address space gets blacklisted faster than ever before so they have to keep changing - at the same time they're still making good money to use to bribe people (by paying way more for bandwidth than is normal) into taking their BGP advertisments for space of dubious origin.
The old swamp space is never going to be reclamed just because legally it would be such a pain to do so - it would make more lawyers rich, without solving the problem because there will always be space left that can be hijacked if only for a shorter and shorter time.
Simon
IPv6 may alleviate the current IP scarcity and the worldwide divide that it creates, but till that kicks in(and it doesn't look like it will anytime soon), ARIN et al need to take a closer look at this IP hoarding. Till that happens, this hijacking of IP space might be a good solution for ISPs in China, India, etc.
You can buy 10.x.x.x from me if you like - only $0.01 per IP address
I have a whole bunch of 10.0.0.0/8 address spaces for sale. :)
Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
maybe he wasn't stealing them for spam, maybe he had alot of computers and just wanted to comply with his states Super-DMCA ???
I had the same reaction. From the article:
"There's anything up to 100 of these blocks out there on the loose," estimates Richard Cox.
Where can I get one? I was just saying to myself the other day, 'my 15-system home network REALLY needs some routable address space.' And my bonus check for this quarter just came in... what great timing!
You may disagree, but to be blunt, you're wrong. -tgd
This problem will grow with more address space. Though the value of individual addresses will diminish in the future with IPv6, it is important to keep virtual property lines clear. This needs to be handled now. Exceptions made are only going to lead to problems in the future.
Perhaps we ought to go to what we had with DNS domains back before Verisign privatized: you create a PGP public key and register it when you get your block, and from there on out any requests to change information about that block are only valid if they're signed with that key (or after some very stringent checks if you claim you've lost the key). That'd make it more difficult for hijackers to change the registration information.
Considering that at MIT, Pop machines and Coffee Makers have IP's, they just might be using a reasonable amount of their /8
"You've got an invalid haircut" -Warren Zevon - Life'll Kill Ya
The Brooklyn Bridge, the New York Sewer system.
Send me a check for $500 and they will be yours!
It isn't a lie if you belive it.
Sitting on that quantity of Unused IP adresses is just as criminal.
;)
I do agree with you here, but... ever heard about natural selection ?
IPv4 addresses have been designed in a time when there were at most a dozen people expecting IP to be used by more than a million users in the future. Just like the w2k bug (failed to) prove, old things should eventually die so that new ones can take the free slot. Yup, just like spammers should die so that other people may use those IP slots, but I digress.
IPv6 is here and would resolve the problem. This requires a huge switch however, and people won't be ready for it unless natural selection proves IPv4 hopelessly doomed.
So let spammers accumulate IPv4 addresses just a little more
Karma cannot be described by words alone.
That's pretty odd how someone can just hijack a /16 like that. A /16 is a lot of IP addresses, not really easy to sort of overlook it. Usually something that big is already allocated by the users ISP and announce via BGP. I wonder how these guys were able to go behind the BGP allocations and announce it on there own. I know most ISP's won't allocate a block of IP addresses if it is already being advertised by another peer.
Dan
I don't think you understand. Spammers hijack the netblocks because network admins block email (and sometimes all) traffic from known spam IP addresses and netblocks. The spammers steal someone else's netblock to spew out their garbage. Then it's up to the rightful owners of the netblock to clear the collateral damage to their own networks and the spammers move on.
Look at this:
Spam supporting ISP ServInt is announcing routes for the netblock containing this IP: 203.25.208.131
traceroute shows that IP being handled by ServInt in Mclean, VA, USA.
That netblock belongs to:
inetnum: 203.25.208.0 - 203.25.223.255
netname: GREENWAY-AU
country: AU
descr: BRISBANE QLD
descr: AUSTRALIA 4000
For those who aren't ccna: /16 = netmask 255.255.0.0
255 addresses x 255 networks - 2 (network and broadcast) = 65023 IP addresses
That's a whole hunka lotta internet...
Karma: Chameleon (mostly due to the fact that you come and go).
You forgot toasters. I have a full LAN of all sorts of toasters waiting for IPv6.
"You know, it'd be a shame if something were to happen to that subnet..."
Arm DNS Registrars with guns and tazers
Ask users to take off shoes before mass e-mailing
Round up geeks and other suspicious technical people as 'persons of interest' to secure undisclosed locations...
Wait, these guidelines are from Homeland Security.
Mod Karma -1: I sed bad wurds. If I cep my mouf shut, I wud be at riyses.
Jerry: Today on our show, we have people who have stolen IP addresses to send SPAM. Why did you do it Larry?
Larry: Jerry, it's an addiction I have. I just feel the need to tell everyone that by sending money to my friend in Nigeria, they can get a stimulating diplomia and have investment opportunities in appendage lengthening. Is that so wrong? Audience boos.
Jerry: Not everyone agrees with you. Let's bring out a system administrator whose IP you hijacked.
SysAdmin: Appears from backstage. Upon seeing Larry, rushes him fists raised. You stupid #$@&! I'll kill you! I'll kick your fsking @$$! Throws chair. Is restrained by large bald stagehand. You stole my IP! I'll get you!
What's a cursory web search? Beats me. I do know, however, what a dictionary.com search is.
But what if you want every node of each of those Beowulf clusters to have its own public IP address? :)
It's like having "Emergency Pants."
"You never know."
It's really a symptom of a monoploy economy for IP address blocks. No one is keeping the distributor honest, so market inequities do not get resolved. Hoarding can then exist.
But honestly, is a large enough fraction of the user community going to be upset enough to change this? Probably not. Right now, businesses seem more than willing to shell out for a small CIDR address space, and NAT the internal addresses. Until there's a customer revolt, there's no reason for a monopoly to be overthrown.
DaimlerChrysler (Mercedes Benz is a nameplate, not a company) is most assuredly a US company, it's also a German company.
/8 via Chrysler (Which was heavily involved with DARPA at the time IP was being rolled out, primarily for the M1 Abrams program).
And I'd suspect that they got the
But unlike many of the IT companies, they have a reduced need for IP space. BBNPlanet, AT&T, PSINet are all providers, and IBM and HP (As well as Compaq) both maintain huge semi-private networks.
"You've got an invalid haircut" -Warren Zevon - Life'll Kill Ya
Serveral ways.
(1) Official, legit way: become a member (fees required) of your RIR (Regional Internet Registry or something similar). Apply for assignment of unallocated space. Example is this fee schedule from APNIC
The downside here is that you can't get (and pay for) just a few addresses.
(2) Common, legit way: sign up for some kind of service package with an ISP and ask for however many IP addresses you want. You generally pay monthly or annually based on your service agreement and number of IP addresses.
The downside here is that those IP addresses aren't really yours. Your ISP just let's you use them and handles the routing for you. In some cases, you ISP doesn't even 'own' them... their upstream just lets them use the IP addresses.
(3) Hijack them. (a) start announcing bogus routes and hope no one notices very soon. (b) Hijack a RIR (ARIN, RIPE, APNIC, etc) tech/admin handle for an unused or under utilized netblock and then start announcing routes (you're a little more likely to be trusted this way).
Don't know if it legit or not but here is one on Ebay now :) Hurry and get your own 65535 addresses!
This is going to keep happening until Arin starts pushing Ipv6. The real problem is that currently getting Ipv6 costs money and doesn't get you very far. Look at it this way... currently a Ptla /32 costs $2500 a year. But people that have been sitting on Ipv4 blocks for years don't pay anything. I know of two Isp's that would like to offer Ipv6 the their customers but because they don't have their own Ipv4 netblocks they don't want to pay $2500 a year just so few of their customers have Ipv6. So instead of getting Ipv6 and moving away from Ipv4 they are forced to stay with Ipv4. I think that the situation is currently backwards to the way it should be. Arin ( and other Ipv4 providers ) should be charging next to nothing for Ipv6 netbocks ($100 or so) and slowly start charging for Ipv4 blocks each year. So for the first year charge $100 for each Ipv4 block (on top of any other fees). The second year the would charge 500 and the year after that 1000 and then 3000 and so on... Until we start charging more for Ipv4 address's than Ipv6 we will have people trying to hijack current Ipv4 netblocks... The more people that can get switched over to Ipv6 the sooner the better. If everyone was using Ipv6 this will no longer be a problem...
It's not that simple.
The way I understand it, you can't just give back some of your addresses. You have to give back the entire block and then go through the whole lengthy application process to get a new block. Which means there will be a significant amount of time during which you have no addresses. And when you finally do get them, you'll have to renumber your network, because you won't get back addresses from the block you gave up. And if ARIN decides that you don't actually "need" as many addresses as you want to keep, you're SOL.
And if your network grows, you have to go through all the red tape of justifying your request for another/larger block.
The fact that you did the internet a service by surrendering a lot of unused addresses in the first place doesn't figure into thesedecisions.
For anybody who has a legacy class-B (or even class-A) block, it just doesn't pay to go through all the work, only to find yourself screwed in six months when you find that your new allocation wasn't big enough.
This article raises an interesting point. When a spammer successfuly hijacks address space and uses it to send spam, his IPs are naturally going to appear on various blacklists before too long.
The problem isn't limited to blacklists, either. Bayesian spam filters will quickly learn to recognize Received-From headers bearing the stolen IPs. Collaborative hashing filters will also be affected, to a degree.
So...the spammer steals a subnet, uses it to spam for awhile, and then is either shut down or abandons his activities. He leaves behind a zone of "scorched earth" -- addresses that are effectively cannot host a mail transfer agent. It is now the job of the next legitimate recipient to clean up the spammer's mess. He might not even notice anything's wrong until half his emails have gone missing and the other have are bounced with mysterious messages. Having identified the problem, it is now up to him to track down various blacklists and get his addresses removed. The damage done to the Bayesian and collaborative filters simply cannot be undone. Mail will be lost.
To me, this is the real tragedy. Once an address block has been used for spamming, it's effectively ruined until someone inherits it and puts a great deal of time and effort into restoring its good reputation.
When some one can tell me how to get back my ICQ # 116117 AND keep it for more then 48 hours, I be impressed
Si vis pacem, para bellum! For evil to succeed good men need only do nothing!
Well, I use IMAP myself.
How would one LEGITIMATELY go about this. The article mentions grey market brokers, but how would one go about getting rid of an IP-block they actually own? Or can they even be legally transfered?
Roving Web-Teleoperated Robot
Whoever he is, he's got a LOT of bandwidth. Ping/trace it and see. They even had the audacity to create a server with MY username!!!
warez.texas.net
B
Executives at SCO, the RIAA, Amazon and other large companies sufered public embarrisment when it was annouced that IP was being stolen and they rushed home to see if they owned any of it to sue over.
Beep beep.
Unfortunately, your proposal is completely irrelevant. In the cases I know, the communication channel between the ISP and ARIN was not compromised. The ISP just sent bogus data, acting on forged customer requests.
No shit the channel was not compromised, but it was misused. So how do we solve the problem of determining if a message is authentic. *snaps fingers* I know! We use public key cryptography!
There isn't any cryptographic protocol that can solve such a problem, and that's why S-BGP and other "secure" BGP successors are almost completely irrelevant. Cryptography is not the answer to all attacks.
You are sadly mistaken. Cryptography is not just about obscuring the message, but also proving that the message is authentic.
Here's how the process works:
1. message is run through a digest
2. the digest is encrypted using the sender's private key against the recipient's public key (this is called the signature)
3. the message is sent with the signature attached
4. the recipient decrypts the signature to get the digest and performs the same digest operation on the message.
If the signature cannot be decrypted, or the digests do not match, the message cannot be authenticated.
Both parties must trust the other's public key, so they met in person and signed the other's key. before they performed any transactions. Afterwards, if they can successfully encrypt and decrypt messages to and from the other, the authentication mechanism above works.
In general, cryptography is used for authentication in all kinds of places. You know hash function is a type of cypher? Passwords are *nix systems are stored hashed. Every time you enter a password, the system runs it through a hash function (likely MD5) and compares that to what is stored on disk. MD5 sums are used to validate the authenticity of software packages. Of course, the list of sums is often authenticated as described above (using PGP/GPG).
So please, come up to speed on these things!
Join Tor today!
So, you're basically taking an anarchist view on this -- let the current system be destroyed, and the new one will arise to take its place.
But have you considered that the first step is rather painful?
I wonder how much of this kind of stuff would stop if we
1. blocked spam at the client based on content, not by blocking IP addresses
2. let people spam.
If we know who and where the spammers are and let them have their own little space in the world, and didn't outright reject talking to them, they wouldn't be doing this sort of thing. The biggest problem is that the cost to download is a large multiple of the cost to upload, since you can send to a whole lot of people in one shot, but there's an easy technical solution to that (don't let people send an email to 5000 people at your server in one shot).
Maybe it's time to treat them like the parts of the porn industry who works with filtering companies to identify them selves. Give them their own little sandbox to play in, don't threaten to shut them off, and then block them at the client side, or once they are in the mailbox, because what we are doing to fight them isn't working (as evidenced by my pile of spam despite all possilbe server side filtering techniques) and they are going to fight dirty if they can't have a chance fighting fair.
You may now mod this down.
Darthtuttle
Thought Architect
Actually it's 2^16-2=65532 usable addresses or sixteen bits minus one reserved netmask and one reserved broadcast address.
Unless you subnet it further, then you loose an additional netmask and an additional broadcast address for each subnet.
Unless there's another (more efficient) method I haven't learned.
--qtp
Read, L
I am network manager for a somewhat smaller-than-LA-County local govt, and we use exclusively RFC1918 address space on all our internal nets. We do use separate private class Bs (172.x.y.z) for each major building/campus-complex in our local govt network and separate class C's (192.168.x.y) for smaller buildings. We have but only two public routable class C nets that handle all our publicly-connected machines on separate physical networks, and only really use about one-third of that space, so yeah we are wasting *some* public address space, but due to physical location and upstream provider complications we have to do it that way.
I'm part of the IP Admin group of a large international ISP and have seen this firsthand. New customers routinely ask us to route space, and sometimes it's difficult to tell if it's theirs or not what with all the mergers, acquisitions and renaming of companies. There's definitely more scrutiny of these requests than there was a year ago.
A few months ago spammers started to hijack IP space that was registered to companies that are now out of business, which means that most likely nobody is going to notice what they've done.
After a while it's almost like getting squatters' rights - I've been using it and nobody else has a real claim to it, so it's mine.
AT&T and BBN are ISPs, so they've got legitimate uses for large amounts of address space. (In AT&T's case, they got lucky, because while they were late getting into the ISP business, the Class A was a leftover from the Bell Labs Cray's Hyperchannel LAN, which for some reason had insisted on having a Class A network and couldn't be subnetted
The Interop Show Network has always been special. For you young folks out there (:-), Interop used to be an engineering conference where vendors actually tested interoperability and worked on implementation bugs, as opposed to being primarily marketing-related, and back in ~1990, not everything knew how to do variable-length subnetting or CIDR or whatever, and the show needed real internet addresses, not just RFC1918, because it was connected to the Real Internet.
Auto companies have been an early developer of networking technology - there was all that ISO MAP/TOP stuff in the Mid-80s, and they were one of the big players in getting IPSEC to be a practical technology where equipment from multiple vendors actually interoperated as opposed to a custom thing for spooks and occasional banks. (That also affected the Crypto Export Regulations Wars of the 90s.) At least in the US, automobile manufacturing isn't really done by big monolithic integrated companies which could use 10.x intranets - it's done by a wide mesh of manufacturers of parts, subassemblies, components, random little job shops, etc., as well as the big companies that stamp out metal and assemble it into cars, rather like the computer and software industry except with a lot more metal shipped around, and they need registered address space to be able to talk to each other cleanly. I'm not sure that Mercedes needs all that space, but the industry certainly does.
As of December 2001, the biggest hog of Class A addresses was the US government, including the military and its friends like Halliburton. Also Eli Lilly had a Class A then...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
No, its soda, and your argument proves it. Its called soda because it's made with soda water aka bicarbonate of soda, bicarbonate of soda is aka baking soda.
I guess none of you are old enough to remember when it was called "Soda Pop." Both "soda" and "pop" are simplifications of the longer term. "Pop" does tend to be used more in the east and midwest, and "soda" more on the west coast.
- There weren't firewalls or NATs to prevent local machines' addresses from being reachable by the Whole Internet, and
- there wasn't RFC1918 private address space until after the ARPANET was shut down, and
- Networks were always Class A, B, or C, and even if they were subnetted, it was still on class boundaries, and
- supernetting and CIDR didn't exist.
The Class A allocations are basically a pile of dinosaur bones, and most of the dinosaurs were either native to North America or else ate other dinosaurs that were.But yes, the early-adopter bias is a US bias, because before the work of people like CIX, the Commercial Internet Exchange, the ARPANET was a thing run by the US government, and you could only get on it if you were a US defense contractor doing appropriate kinds of work or a University that had some appropriate government-funded research, and there was an Acceptable Use Policy that said you couldn't do commercial activities that weren't related to the Government Work you were doing (though much of the interestingness of the Internet culture evolved because there was deliberately slack enforcement, especially on universities and non-commercial-related discussions.) The rest of us had UUCP, and Usenet, and X.25, and it wasn't until ~1990 that you could reliably use email for outside-your-company business without having to worry about whether you were violating the AUP.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Its called soda because it's made with soda water aka bicarbonate of soda, bicarbonate of soda is aka baking soda.
This is true if by "true" you mean "completely wrong." Soda pop is not made with bicarbonate of soda. You ever taste that stuff? There's a reason there is no "Arm & Hammer Cola." Yuk! Pop's made with CO2, plain and simple.
Some stuff that's made by fermentation, like root beer, get their CO2 from little critters, but it's still CO2.
ARIN has specific guidelines for returning address space and renumbering. Basically, they give you the space you can actually prove you need with some renumbering grace period afterwhich your original allocation is revoked.
Japan and especially Korea are more interesting cases, because they don't have the censorship problem, they've got a much much higher fraction of their population wired, and their telecom infrastructure is much more liberalized. And besides, you don't have to sell spammers Korean address space to M4K3 M0N3Y Fa$$T!! - you can sell them lists of broken relays and proxies :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"[he] said he paid $500 for it to a guy he met online."
That must be the same guy that sold me my penis enlarger.
IPv4, because of the gluttonous mismanagement of IP use and poor network planning (now and in the past) there appears to be a shortage of available IP addresses.
If all (Globally) Governments, Businesses, ⦠networks were private networks using proxy-servers (and/or firewalls) with NAT and the public/free domain (class A=10.x.x.x, Bâ¦, and Câ¦) IP addresses, then many private domain IP addresses would be freed up for distribution.
Example: The Mother of All Cable company using class-A public domain (10.x.x.x) (AKA: Private Network) IP addresses could create an unlimited number of 10.x.x.x large user networks ⦠have them all talk to each other across proxy-servers (and/or firewalls) with NAT using a few routable private IP addresses to identify a âoePublic Networkâ for the internet. Designing such TCP/IP networks for quality and speed would cost (a little) more and be (a little) more complex for management and configuration, but it would work and add a little overhead (packet/routing/â¦) burden to the available bandwidth.
This method could provide some additional (but minor) network security advantages â¦.
OldHawk777
Reality is a self-induced hallucination.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?