IIALP - Abuse Logging Protocol

that's cool! by grub · 2004-07-13 08:31 · Score: 5, Funny

which could then be queried to find out which IPs are luserish.

Interesting: 66.35.250.150 and 66.35.250.151 are the only entries. Truly uncanny AI.

--
Trolling is a art,

Re:that's cool! by Anonymous Coward · 2004-07-13 08:33 · Score: 1

Great links on this one. I mean there's absolutely nothing there, execept for a couple of guys whose phone numbers are going to get called a hundred times now.

For some record types the condensed records might be compressed
in a supported compression format for that template set.
A template set is a specification set for a template format for
a full and a condensed record pair.
Supported compression types will likely be added as new
technologies arise.

Encoding is necessary for SPAM reporting to keep the reports
small. For instance a an IP address is expressed in ASCII as
a 15 byte word. The IP address, converted to a binary number,
encoded to base 36, is represented by 6 ASCII characters.
Encoding types will need to be added over time as newer
technologies arise.
Re:that's cool! by strictnein · 2004-07-13 08:36 · Score: 4, Informative

Am I missing something? There seems to be absolutely nothing interesting to even look at for this site.

Web site for the Iowa Internet Annoyance Logging Protocol (IIALP) Working Group.
IIALP is pronounced: E'-alp.

A copy of the current IETF "Internet-Draft" which represents a work in progress for IIALP is here:
http://www.ietf.org/internet-drafts/draft-davey-ii alp-01.txt

RTF versions of all the internet-draft work in progress revisions are here::
http://www.abuselog.org/Documents/00/draft-davey-i ialp-00.rtf
http://www.abuselog.org/Documents/00/draft-davey-i ialp-01.rtf

Next Revision Peak Ahead:
Working on the sample templates and template root structure

Your comments are welcome, please email your comments to the email address shown below:
Make sure to include IIALP first in the subject line followed by the actual subject.

--
Casual Games/Downloads
Re:that's cool! by cdyson37 · 2004-07-13 23:15 · Score: 1

No, it's slashdot's:
# ping www.slashdot.org PING www.slashdot.org (66.35.250.151) 56(84) bytes of data. --- www.slashdot.org ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1009ms
Probably the firewall is dropping them. I suspect the .150 is another IP, but I don't have dig installed at the moment, so I can't check.
Re:that's cool! by cdyson37 · 2004-07-13 23:28 · Score: 1

That's interesting:
# dig www.slashdot.org ; <<>> DiG 9.2.3 <<>> www.slashdot.org ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18156 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.slashdot.org. IN A ;; ANSWER SECTION: www.slashdot.org. 2378 IN A 66.35.250.151 ;; Query time: 17 msec ;; SERVER: 212.23.8.1#53(212.23.8.1) ;; WHEN: Wed Jul 14 12:22:36 2004 ;; MSG SIZE rcvd: 50
But
# dig slashdot.org ; <<>> DiG 9.2.3 <<>> slashdot.org ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39116 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;slashdot.org. IN A ;; ANSWER SECTION: slashdot.org. 1973 IN A 66.35.250.150 ;; Query time: 16 msec ;; SERVER: 212.23.8.1#53(212.23.8.1) ;; WHEN: Wed Jul 14 12:22:59 2004 ;; MSG SIZE rcvd: 46
So slashdot.org and www.slashdot.org have different IPs - different machines? Rather odd way of load balancing.

I hope by jb.hl.com · 2004-07-13 08:32 · Score: 5, Insightful

There's some form of verification.

In and of itself, this could be very easily abused by, say, people with a grudge who want to essentially get someone else an internet death penalty.

--
By summer it was all gone...now shesmovedon. --

Re:I hope by BACbKA · 2004-07-13 08:35 · Score: 1

of course not. That would be addressed by IIALPALP (abuse logging proto of the abuse logging proto.) It is in the drafts. :)

--
VKh
Re:I hope by bsgk · 2004-07-13 08:47 · Score: 1

That's a dead link.
Re:I hope by Scoria · 2004-07-13 08:52 · Score: 1

Blacklisted, perhaps? ;-)

--
Do you like German cars?
Re:I hope by MobyDisk · 2004-07-13 08:57 · Score: 5, Interesting

This is very important. Slashdot periodically posts stories about RBLs that add people, but never remove them. As horrible as it is to think, I wonder if some sort of legislation (governmental, ICANN, or otherwise) is necessary to keep these systems fair.

I recently had Comcast shut down my port 25 access due to spam reports. Of course, they refused to tell me who reported me or what they reported, so even giving them logs of my outgoing port 25 access from a sniffer isn't enough for them to remove the mark from my record. (However, if I tell them I went to Windows update and ran a virus scanner they enable my access again. Nevermind that Windows Update doesn't do much on my Linux box. :-) )
Re:I hope by Scoria · 2004-07-13 09:03 · Score: 3, Interesting

Touché. PKI is probably applicable here.

If this group is merely validating complaints by including only those that have been submitted on many different occasions by unique hosts, then a malevolent individual could hypothetically establish a distributed network of compromised machines - perhaps by deploying an Internet worm - and then submit his false complaint, thus circumventing that precaution.

--
Do you like German cars?
Re:I hope by jfengel · 2004-07-13 09:12 · Score: 1

Wow. That really sucks. If I were Comcast, anybody who asks for port 25 to be opened is either a code jockey type, in which case you should open it, or the world's most brazen spammer, in which case he should be arrested.

So tell 'em you've upgraded your operating system (true enough) and hopefully whatever typo screwed you in the first place won't happen again.
Re:I hope by jdreed1024 · 2004-07-13 09:52 · Score: 3, Interesting

As horrible as it is to think, I wonder if some sort of legislation (governmental, ICANN, or otherwise) is necessary to keep these systems fair.
I recently had Comcast shut down my port 25 access due to spam reports. Of course, they refused to tell me who reported me or what they reported, so even giving them logs of my outgoing port 25 access from a sniffer isn't enough for them to remove the mark from my record.
And for starters, we could use some legislation requiring cable companies to treat all customers equally, regardless of how much they're paying. If you have a business account for cable modem service, they'll forward you reports of spam or other abuses (ie: port scanning from your machine), and they'll bend over backwards to help you, and if you say "there is no way this is my machine", they'll actually accept it on the first try and push the complainant to give more details or more proof.
(yes, I know legislation for that will never work, but it's most unfortunate that end users can get screwed more easily just because they're paying less. I mean, the power company won't ignore your report of a blackout just because you don't keep your lights and A/C on 24 hours a day)

--
There is no sig, there is only Zuul.
Re:I hope by Ayaress · 2004-07-13 10:19 · Score: 3, Informative

My DSL company did something simmilar to me, although it was pure dumbass, and not malice on anybody's part. I'm on a dynamic IP system, so every time I disconnect and then reconnect, I have a different IP. Never causes much problem, since I don't do anything at home that would require me to have a static IP. Anyway, the local police made a big bust on a guy selling child pornography on a webserver in the back room of his office (the guy's a pediatrician). The police got a good couple hundred IP addresses from logs. Most of them were out of their jurisdiction, so they sent them on to somebody else. But a half-dozen or so were right here in town. They go to the ISPs, and try to get the names of the users behind said IPs. My ISP was more than happy to cooperate on something like this, so they had somebody look up the logs and figure out who had such-and-such address at the time stated (it was something like 4 AM on a Teusday). Anyway, it comes up with my name. I had some pretty awkward conversations with police, neighbors, parents, etc for a while until I get a call one day. The dumbass ISP must have entered the wrong search query or something, because as it turned out, that was my IP at 4AM on a Teusday - just a month earlier.
Re:I hope by wkcole · 2004-07-13 10:33 · Score: 2, Insightful

This is very important. Slashdot periodically posts stories about RBLs that add people, but never remove them. As horrible as it is to think, I wonder if some sort of legislation (governmental, ICANN, or otherwise) is necessary to keep these systems fair.

There is a pair of ID's on DNSBL technical details and best practices which seems to me more than enough. Actual law would be hopelessly unenforced window-dressing (see the millions of spamming zombies around the USA? Every one is a federal felony in progress. Where's Johnny Ashcroft on that crime???) or (worse) an excuse for the worst elements of law enforcement(see above)to selectively harrass people who are really only engaging in free speech and protection of private property. Blacklists don't block mail, people using blacklists block mail. No one is forced to use any blacklist with a mail system they own or to buy services from a mail system that uses any specific blacklist. If you don't like the way your mail provider does spam filtering, find another provider or run your own mail.

I recently had Comcast shut down my port 25 access due to spam reports.

That's interesting, because Comcast claims that they recently cut off port 25 to ALL of their residential customers. That's for the best, given that they were completely unwilling to actually police their network for misuse in any serious and specific way. Are you sure you were not just part of that blanket closure?
Re:I hope by spells · 2004-07-13 10:36 · Score: 1

And for starters, we could use some legislation requiring cable companies to treat all customers equally, regardless of how much they're paying

You're new to the country aren't you? ;)
Re:I hope by KIDputer · 2004-07-13 11:34 · Score: 1

Remember it is a protocol not a law. What you do with it is your resposibility. It will be a great tool to see Internet abuse records without an act of congress needed or without large administrative efforts.
Re:I hope by ElForesto · 2004-07-13 11:39 · Score: 1

I think the worst of those RBLs is the Blars one. The guy is a pompous ass who has serious attitude problems. I already had to spend hours getting our newly-assigned IP off of a dozen other lists, and they had fully-automated systems to verify that my system wasn't a spamhouse. He doesn't even accept removal requests without payment! Sounds like a blackmail scheme to me. I basically figured that I shouldn't need to worry about someone like that, but that kind of disregard for the social contracts of the Internet disturbs me greatly.

--
There is a difference between "insightful" and "inciteful" other than spelling.
Re:I hope by ElForesto · 2004-07-13 11:44 · Score: 1

I've got a better idea. Why not propose a standard abuse@domain way to report abuses? A human has to look over them anyway, and it's gonna be the ISP, so why should we make up some new scheme to capture the complaints? Just give me an abuse address and a responsive abuse department and I'm fine, thanks.

I'll take a human with soft skin over a machine that pretends to be smart.

--
There is a difference between "insightful" and "inciteful" other than spelling.
Re:I hope by aardvarkjoe · 2004-07-13 13:23 · Score: 1

As horrible as it is to think, I wonder if some sort of legislation (governmental, ICANN, or otherwise) is necessary to keep these systems fair.
And once again, restriction of free speech in the name of "fairness" rears its ugly head...
I recently had Comcast shut down my port 25 access due to spam reports.
The proper thing to do in this case is to stop patronizing Comcast -- or, alternatively, live with it, if it's not that important to you. Telling the government to handle it for you is generally not the way to go.

--

How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
Re:I hope by KIDputer · 2004-07-13 14:23 · Score: 1

Because the IIALP protocol uses templates which are different for each type of abuse, they can be somwhat self verifying. e.g. if you fill in all the blanks and you have permission to submit to the IIALP server you are affiliated with, IIALP only logs it does not block, when you use IIALP to block , YOU would need to verify the validity of the records as well as use the white list and black list features which are both global and template specific.
Re:I hope by KIDputer · 2004-07-13 14:33 · Score: 1

The IIALP log files have a TTL value that auto-expires the logs based on the specifications which are unique for each abuse type. The TTL is specified by the root servers for each template (abuse) type. So they won't end up on a list for a year unless the TTL is 1 yr. And remember it is only a log not a block list, if you choose to block based upon the logs, then that is a separate issue. The TTL may be different if the real-time flag is set on the abuse log entry vs. if the real-time flag is not set. The TTL can be set to a different greater value than the Root IIALP server for a specific abuse type but it cannot be set less than the root server. TTL and other template artifacts are passed down the hiearchy from the Root IIALP servers, to the Subordinate IIALP servers and finally to the Rougue and Subscription Based IIALP servers.
Re:I hope by KIDputer · 2004-07-13 17:48 · Score: 1

A pre-emptive DDOS protection mechamism needs further work and is in the plan to be implimented soon.
Re:I hope by KIDputer · 2004-07-13 17:52 · Score: 1

I agree, I do not like blacklisting, blacklisting is a last resort for short-term problems.
Re:I hope by Bloody+Pulp · 2004-07-13 21:17 · Score: 1

I agree that the Blars RBL is a very high collateral damage list since it lists netblocks and not single IP addresses. Blars maintains the RBL himself and so there are no automated methods of adding or removing IP addresses. It is definitely not a list a service provider should be using for blocking email.

Also, if your "newly-assigned IP" was already on "several dozen" other lists then your service provider probably doesn't have a very strong anti-spam enforcement policy. As well, your service provider probably still has spammers on their network and your IP address might be added to RBL because of those spammers.

It might be a good idea to switch to a provider that isn't listed on so many RBL's and has a stronger anti-spam enforcement policy.
Re:I hope by NoOneInParticular · 2004-07-13 21:34 · Score: 2, Interesting

You seem to misunderstand, the grandparent asks if it is necessary that the government needs to put restrictions on "banning free speech", not on "free speech" itself. The way internet abuse is handled currently, it is not unimaginable that in the not so far future you can effectively kick someone of the internet with one anonymous phonecall to a non-accountable agency, with the victim not having any recourse than to switch providers. Rinse, lather, repeat.
However, if your version of "free speech" includes the freedom to prevent speech (such as Comcast is doing), then we're at the end of the discussion I think.
Re:I hope by wkcole · 2004-07-14 02:38 · Score: 2, Insightful

And for starters, we could use some legislation requiring cable companies to treat all customers equally, regardless of how much they're paying.

That is a sure way to legislate that they charge everyone the same price and offer exactly one level of (lousy) service.
Re:I hope by aardvarkjoe · 2004-07-14 02:45 · Score: 2, Insightful

My version of free speech includes the freedom to publish a list of IPs -- because I think they are spamming, or for any other reason. That infringes on nobody's right to speech. Unfortunately, most people seem to think that "free speech" means "speech I agree with."
Incidentally, this is seperate from Comcast's right to use their private equipment as they see fit -- which is what blocking ports based on spam reports is.

--

How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
Re:I hope by KIDputer · 2004-07-16 19:13 · Score: 1

I know tell them you left your lunch sack too close to your computer keyboard and the bananna fell out and triggered the RETURN key and you acidentally abused the hell out of the 10 million people on the Internet for 10 minutes Tuesday at 4PM. Oops the darn banannas!

I troll slashdot by Anonymous Coward · 2004-07-13 08:33 · Score: 1, Funny

Should I log myself?

Trolls untied!

DHCP and MAC by CaptainPinko · 2004-07-13 08:35 · Score: 4, Interesting

How will this work with DHCP where the IP address is not constant at all. How about using the MAC address of the card? At least it's something that can't be cheaply replaced (I get a different IP everytime I log on) or at least not by the majourity of people.

--
Your CPU is not doing anything else, at least do something.

Re:DHCP and MAC by Feyr · 2004-07-13 08:38 · Score: 4, Informative

how about the fact that you can't see the MAC address past the first hop? or the other that MAC addresses aren't (and don't need to be) garanteed to be globally unique?
Re:DHCP and MAC by djh101010 · 2004-07-13 08:38 · Score: 5, Interesting

Yeah, because the MAC address is so hard to change. ifconfig on some systems can do it, and a D-Link router can assume any MAC you'd like it to.
Re:DHCP and MAC by Space+cowboy · 2004-07-13 08:39 · Score: 1

Your MAC address doesn't make it out onto the internet, AFAIK. The MAC is used to deliver packets on the same ethernet segment.

Simon

--
Physicists get Hadrons!
Re:DHCP and MAC by ak_hepcat · 2004-07-13 08:39 · Score: 3, Informative

Your MAC address can be spoofed.

It's also only 'guaranteed' unique on the local broadcast segment. In quotes, because somebody could spoof yours and receive all your traffic.

Sure, you could log it. It's just not as secure an identifier as you think it is.

--
Support FSF: Stop thinking with your wallet, and think with your imagination. (cc/non-commercial)
Re:DHCP and MAC by happyfrogcow · 2004-07-13 08:40 · Score: 1

the bin of $7 ethernet cards at any used computer store seems cheap enough if your in a hurry.
Re:DHCP and MAC by Guus.der.Kinderen · 2004-07-13 08:41 · Score: 2, Informative

In any case, your DHCP assigned IP will be extracted from the same pool of IP's. If tracked, this project might at least pinpoint service providers that don't do enough to prevent abuse.
Re:DHCP and MAC by JThundley · 2004-07-13 08:42 · Score: 1

MAC addresses are changed simply with one common command.
You aren't a Linux user, are you?
I wrote the command into my startup script ever since my college banned my laptop's MAC address.
Re:DHCP and MAC by Short+Circuit · 2004-07-13 08:43 · Score: 1

Well, you could implement a method for ISPs to publicly associate IPs with user IDs. I don't think it's a good idea, though, as vigilante action seems too likely.

I mean, sure, so guy A pisses off guy B in a chatroom or online game, so guy B sets his zombies to DDOS guy A's IP. (That's happened to me, as guy A.) Change that to "guy B sets his zombies to DDOS guy A, whatever his IP may become".

And then there's privacy issues, where someone may decide to deal with the problem in person.

Sure, some vigilante actions seems OK. Spammers' getting their names, addresses and phone numbers published comes to mind. But extend that to some jerk who hates you because you got him banned off his favorite server for, say, inappropriate language.

--
tasks(723) drafts(105) languages(484) examples(29106)
Re:DHCP and MAC by silas_moeckel · 2004-07-13 08:44 · Score: 1

Gee because all DHCP addresses are allready pretty much listed as suspicious. Beyond that it's so so trivial to change a MAC address on any modern gear.

--
No sir I dont like it.
Re:DHCP and MAC by Pieroxy · 2004-07-13 08:50 · Score: 1

Yeah, but he still have a point: IPs are much worse that MAC addresses in that regard. Logging IPs to identify anything is a silly idea.

--
Write boring code, not shiny code!
Re:DHCP and MAC by DAldredge · 2004-07-13 08:53 · Score: 1

And if you knew what you where talking about you would know that the MAC address isn't guranteed to survive the first hop thru a router.
Re:DHCP and MAC by Theatetus · 2004-07-13 08:54 · Score: 1

Routers don't forward the MAC addresses of the communicating nodes. That's the beauty of a stacked protocol like TCP/IP.

--
All's true that is mistrusted
Re:DHCP and MAC by Kenja · 2004-07-13 08:56 · Score: 1

Not true. IP addresses have to be unique. Not true of Mac addresses.

--

"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Re:DHCP and MAC by Orick · 2004-07-13 09:09 · Score: 1

The basic problem being that MAC and individual IP addresses can be changed on a whim in many networks, how about just a general indicator/record for netblocks?

People could complain about an IP, but have the complaints automatically assigned as knocks against the ARIN the IP falls in.

Core BGP routers could be set to a particular threshold level of complaints, after which they'd drop their routes to that ARIN for a set period of time, in some sort of back-off protocol.

Of course, this doesn't solve the distributed zombie client complaint record generating problem, but I can't be expected to have all the ideas....
Re:DHCP and MAC by JohnGalt00 · 2004-07-13 09:14 · Score: 1

The timestamp of the abuse is recorded in the abuse log. The ISP of the reported abuser can look up who had a given DHCP address at a given time. I think they already have to keep these kinds of logs.

You're right though that reporter probably only has access to the IP of the abuser. If the abuser is a website, you obviously have the domain name. If we're talking about comcast zombies, you'd either need the abuser's ISP's cooperation, or the complaint gets applied to the ISP's entire subnet.

A possible solution would be to have the abuser's ISP cooperate so you could say "I have a complaint with the machine at x.x.x.x, give me a unique ID for them" maybe their ISP username plus the ISP's domain name i.e. johnnyblackhat.comcast.net for them to put in the log. If the abuser's ISP won't help, just report the ISP's subnet and let the ISP's honest customers bitch about the complaints (or leave for a better provider).

An interesting thing about this proposal is that the heirarchical nature helps identify problems, in that problems with a large number of users on an ISP can become problems for the ISP. If each reported abuse inflicted one abuse point on the user, a black hole server could add a virtual tenth of an abuse point to the ISP itself for each reported abuse. Spammer ISPs could be indentified and blocked very quickly.
Re:DHCP and MAC by Pieroxy · 2004-07-13 09:52 · Score: 3, Interesting

They have to be unique, but they can be dynamic!!! I don't know of any Mac address that could be dynamic (Well, you can always write a little daemon that changes the Mac address of your router/nic, but you'd have to write it). So in that regard, identifying people by their Mac address makes more sense that by their IP. But I agree that both make a pretty weak identification anyways.

--
Write boring code, not shiny code!
Re:DHCP and MAC by void* · 2004-07-13 11:10 · Score: 1

While it is true that ethernet addresses don't have to be unique worldwide, only within a broadcast domain, they are supposed to be unique.

The card manufacturers are given prefixes to use in the MAC of cards they make, and are supposed to not manufacture two cards with the same MAC. In practice, it happens, and you can usually just set a MAC address anyway. This is just a bit of trivia, however, in regard to why the MAC cannot be used for this purpose.

The reason the suggestion to use a MAC address won't work is because the MAC address should never leave the broadcast domain. It has nothing to do with whether or not MAC addresses are or should be unique. You're basically saying an effect (The MAC addresses never leaving a broadcast domain allows MAC addresses to, in practice, be duplicated in seperate broadcast domains) with the cause of another effect (The MAC addresses never leaving a broadcast domain means the MAC is unavailable to use in the manner suggested). Two effects, one cause, but you're saying one effect is the cause of the other effect. That's like making a shot in pool, where the cue ball hits two other balls simultaneously, yet the other two balls never contact each other, and saying 'the four ball dropped in the left corner pocket because the three ball dropped in the right corner pocket' - the balls dropped in the pockets they dropped in because the cue ball hit them, not because the other ball fell in the other pocket.

--

Code or be coded.
Re:DHCP and MAC by rfc1394 · 2004-07-13 12:31 · Score: 1

How about using the MAC address of the card? At least it's something that can't be cheaply replaced
I have a Linksys wireless router with (4 wired ports) between the computers in my household and our DSL connection. All internet traffic goes through the router; all the computers on the internal network have non-routable 192.168.1.x IP addresses assigned to them by the router using DHCP. I can connect to the router's management interface just as if it were a website by using its default 192.168.1.1 address on this internal network, give the username amd password and I'm in.
There are 7 regular tabs and an orange "advanced" tab. On the 6th tab of the "Advanced" tab is a tab called "Mac Addr. Clone" that if I click on it, it provides a group of boxes where I could enter six two-digit hex numbers, click on the apply button, and the router will present whatever I put in there as its MAC address.
So to change the MAC address I present to the world would take me, oh, 10 seconds. Time cost is negligible, monetary cost is zero.

--
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
Re:DHCP and MAC by Trejkaz · 2004-07-13 12:35 · Score: 1

That would be fantastic. Just like how I was trying to get an important email to someone earlier this week, and the IP blocks of all three of my sending mail servers were all blocked by some indiscriminate anti-spam relay.

--
Karma: It's all a bunch of tree-huggin' hippy crap!
Re:DHCP and MAC by KIDputer · 2004-07-13 14:51 · Score: 1

I do beleive you are missing the scope of IIALP here. Layer 2 and layer 3 network abuse templates could both be created. Usually layer 2 network abuse is cause by poor administration of the network, but because it concerns you it will be given some more thought as we move forward. IIALP can have an infinite number of abuse template types, for each type of abuse be it Layer 2 or 3. But as the name applies, the Internet is layer 3, so IIALP is primarily a layer 3 tool. Having said that, there is already in the works a template for phone abuse, and abusive phone numbers. There are plans for IM abuse templates which can contain info/stuff from layers 3-7. There is also a template in the works for abusive domain names which are not even in the network stack they just are mapped via DNS to layer 3 IPV4 addresses. The things that get logged are predominately IP addresses but can also be domain names, and phone numbers. There are 2 things at play here, the abuse log template which determines what info is collected and what is passed upstream from the collected information and there can be an infinite number of templates which describe the abuse and its logging format. The other part is the (IAHT) Identifying Asset Holder Type, this specifies the thing that is "owned" on the Internet which is abusing people, such as an IP address, phone number, or domain name, there can also be an infinite number of IAHTs defined as well. The protocol has these 2 open ended features so as not to be obsoleted by IPV6 or Internet 2 etc...

Hmmmmm...... by theJerk242 · 2004-07-13 08:35 · Score: 1

a site for the development of a generalized protocol for logging internet annoyances and abuses

I wonder if slashdot will ever use this, for controlling the trolls and ACs?

--
Red Bull gave me wings and I flew into the ceiling fan.

Re:Hmmmmm...... by WormholeFiend · 2004-07-13 08:49 · Score: 1

I guess your subnet has never been banned wholesale by slashdot before...

that or you're being facetious.
Re:Hmmmmm...... by Brandybuck · 2004-07-13 09:19 · Score: 1

Hell, Slashdot banned my entire class B network...

--
Don't blame me, I didn't vote for either of them!

what about DHCP by bdigit · 2004-07-13 08:36 · Score: 3, Insightful

so what about all the people out there who get their ip from a DHCP server. Someone can be abusive and then within a given time have a new ip and some poor old grandma is now with this lusers old ip is flagged as an internet mischief.

Re:what about DHCP by Monkelectric · 2004-07-13 09:02 · Score: 1

Yep, adelphia cable seems to base your IP address on your MAC address. If I need to change my IP address I just change my routers MAC address, sometimes my subnet even changes.

--
Religion is a gateway psychosis. -- Dave Foley

That list'll get long quick by Neil+Blender · 2004-07-13 08:37 · Score: 4, Interesting

Our firewalls get port scanned many times daily. Our weblogs are filled with this kind of garbage:
63.189.X.196 - - [12/Jul/2004:16:31:04 -0700] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ x

I could probably contribute a thousand IPs from last month alone.

Re:That list'll get long quick by the_mad_poster · 2004-07-13 08:47 · Score: 1

And they're probably all 14 year old dweebs on a dial up connection that changes IP everytime the idiot gets called by his mother.

This is a stupid idea and, if they're serious, the people who are proposing it are stupid for doing so.

--
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Re:That list'll get long quick by Janek+Kozicki · 2004-07-13 08:54 · Score: 1

Our firewalls get port scanned many times daily. Our weblogs are filled with this kind of garbage: 63.189.X.196 - - [12/Jul/2004:16:31:04 -0700] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ x

yes, I have it too. wtf is that?

--
# #\ @ ? Colonize Mars #
Re:That list'll get long quick by Neil+Blender · 2004-07-13 08:57 · Score: 1

[12/Jul/2004:16:31:04 -0700] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ x

yes, I have it too. wtf is that?

It's an attempt to exploit an IIS vulnerability.
Re:That list'll get long quick by Anonymous Coward · 2004-07-13 09:00 · Score: 1, Informative

yes, I have it too. wtf is that?

Looks like script kitties and/or worms that are running a known buffer-overflow to me.
Re:That list'll get long quick by Neil+Blender · 2004-07-13 09:04 · Score: 1

What was the point in masking the attacker's IP address?

Thats plain silly. Why are you protecting them?

For the same reason this type of thing will never work. This could be coming from a worm or virus on some unsuspecting housewife's laptop. You going to go 'own' them?
Re:That list'll get long quick by matth · 2004-07-13 10:22 · Score: 1

See if I care.... I believe when you signed the TOS (for most ISPs) you agreed to some clause which said you agree to not let others use your account (except maybe in your immediate family) and you agree to be held responsible for any actions that are done through your account..
correct me if I'm wrong but did that spammer NOT come through your account?
ok thought so.. bye bye housewife you just violated the AUP/TOS.
Re:That list'll get long quick by mr_rarr · 2004-07-13 11:13 · Score: 2, Informative

yes i was also getting this. It's nothing to worry about if you're not using windows. It's the IIS WebDAV exploit.

I added this in my httpd.conf just for fun ...

RedirectMatch permanent (.*)\/x90\/(.*)$ http://www.microsoft.com
Re:That list'll get long quick by KIDputer · 2004-07-13 15:04 · Score: 1

The port scan and real-time atributed log records IIALP template design is going to be a tricky and meticulous process to design. I guess the best way to put this is if IIALP were in use in lets say, zone alarm version xyz, novice Internet users always say, "what is all that stuff attacking my firewall." "Who are they?" well if Zone alarm was using IIALP, it could append a complaint quantity to the IP so as to show the novice user that this is not your neighbor trying to share files , but it is a malicious machine that has done this bad thing 14,768,953 times in 2 days. Probably has NIMDA or Code RED variants. At least then the guy knows it is not his neighbor and also knows not to let the traffic in because millions of other people have blocked that address as well. Maybe this is not the greatest example, but I personally would like to query AS numbers to find out the most abusive networks and IP addresses to see which companies and countries are failing in their job at network security and perhaps bring the light on the real problem which is a lack of knowledge, tools and $$$ to secure Internet connected networks everywhere.
Re:That list'll get long quick by Erik+Hollensbe · 2004-07-13 18:44 · Score: 1

You should send them to v4.windowsupdate.microsoft.com :)

yet another standard by UnderAttack · 2004-07-13 08:37 · Score: 4, Insightful

There are too many 'incidents exchange', 'intrusion detection', 'log', 'firewall log' standards to count. Many of them IETF drafts. IDMF has a little bit of traction. There is one format the music industry came out with to ease notifications of ISPs....

Do we need yet another "standard", or do we just need ISPs that are actually reading/handling any kind of abuse notice. Some are great about this, but others just route them to /dev/null.

--
---- join dshield.org Distributed Intrusion Detec

Re:yet another standard by Carnildo · 2004-07-13 08:46 · Score: 1

The nice thing about standards is that there are so many to choose from.

--
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
Re:yet another standard by Burdell · 2004-07-13 09:40 · Score: 1

Speaking as someone that handles abuse@, I'll say
that anything that standardizes complaint formats is a good thing (as
long as everyone uses it of course). I have written several tools to
automate abuse handling so that I can keep up with it (when "virus of
the week" hits or a spammer signs up with a customer's customer; these
aren't really preventable things), but that is time consuming. I'm
trying to handle (in at least a semi-automatic way) AOL's feedback loop,
SpamCop, DShield, SecurePipe, and myNetWatchman (which is way too many).

Another part of the problem with handling abuse is you can't really do
much spam filtering on abuse@; if you do, you'll filter out
legitimate spam complaints as well. However, since abuse@ is
accepted most everywhere, it gets a ton of spam.
Re:yet another standard by KIDputer · 2004-07-13 15:11 · Score: 1

IIALP is not an incident exchange format, but INCH is, IIALP is like dshield.org on steroids. The problem is a lot of the exchange attempts are too narrow and fail. dshield.org is great for port scans tracking. IIALP is more infinite because it is based on an infinite set of templates that get created for each new type of abuse, and mostly because it is a protocol not a website.

4/1 by rabel · 2004-07-13 08:38 · Score: 4, Interesting

The annoyance logs on a particular IIALP Server are condensed and forwarded up the IIALP hierarchy to central Root IIALP Servers for central annoyance queries.

Come on... this is a joke, right? After annoyance queries, we can move on to annoyance mining and then the troll database and the lousy-speller's database with new improved SQL (Soundex Query Language for the spelling-impaired).

Annoyance queries? Pshaw.

IOWA IALP by lintocs · 2004-07-13 08:38 · Score: 1, Flamebait

If I had known the first "I" was for "IOWA", I wouldn't haver clicked through on this one.

TVP by Anonymous Coward · 2004-07-13 08:43 · Score: 4, Funny

Tiny Violin Protocol.

127.0.0.1 by MosesJones · 2004-07-13 08:43 · Score: 3, Funny

Always appear to have the most crap on it of any system I see, the bugger is always falling over and its never the same site when I look back a few months later.

And why oh why does the owner of this "localhost" system insist on using non-standard ports all the time.

--
An Eye for an Eye will make the whole world blind - Gandhi

Re:127.0.0.1 by bitflip · 2004-07-13 10:55 · Score: 1

That's because I keep h4xoring it.

Signal to Noise ratio by Ex+Machina · 2004-07-13 08:45 · Score: 4, Insightful

I'm browsing the RFC, and it sounds like they're planning on having people's firewalls spit out IIALP messages in response to port scans, etc. In my opinion, this is a really bad idea! Worm activity, someone running a stupid automated scan against an entire class A (whoooops!) by mistake, or a port scan trying to locate a particular machine whose ip has changed (which I have had to do), etc need to be differentiated from actual malicious activities. I can see this being used by overzealous admins to try to drop ALL traffic at the firewall level from anyone *ever* who gets a complaint propagated to them via this. Also, does anyone really expect their STUPID!@!!@ .log TLD proposal to be accepted?!??!! Jeez, everyone knows that this will never go through. Why do people insist on changing DNS, creating namespace pollution or breaking some other protocol (SMTP for a lot of spam "spolutins") for every problem facing the net!

Re:Signal to Noise ratio by I+confirm+I'm+not+a · 2004-07-13 09:24 · Score: 1

Also, does anyone really expect their STUPID!@!!@ .log TLD proposal to be accepted?!??!!

Totally. We've been waiting since 1990 - 1990! for this, which seemed so great for so long, but sadly never was adopted.

:)

--
This is where the serious fun begins.
Re:Signal to Noise ratio by Slash+Privacy+Watch · 2004-07-13 10:04 · Score: 1

I'm browsing the RFC, and it sounds like they're planning on having people's firewalls spit out IIALP messages in response to port scans, etc. In my opinion, this is a really bad idea!

You don't know the half of it. Slashdot actually port scans every computer that posts anonymously looking for proxies. If this protocol went into affect, Slashdot would be at the top of the list, continually proxy scanning the hundreds of anonymous posters it gets per minute. If ISPs implemented it, no one would even be able to route to Slashdot.

Consider the effectiveness of Slashdot's own "excessive bad posting" filter, which (to overcome DHCP) has subnet-banned class C's all over the Internet, blocking hundreds of people from posting.

I'd say that just based on the examples give above, this kind of banlisting would be a false-positive-ridden nightmare scenario.
Re:Signal to Noise ratio by KIDputer · 2004-07-13 16:11 · Score: 1

Each abuse type has its own templte to minimize false positives. Obviously, the port scanning template will need to be very exact and there will need to be many types of port scan templates. IIALP does not block anything it can be used as another tool for watching your Internet backside.

Is it RFC3514 compliant? by JPriest · 2004-07-13 08:48 · Score: 3, Funny

We already have an RFC for the security flag in the IPv4 header (AKA "Evil Bit").

--
Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.

Re:Guess? by steveb964 · 2004-07-13 08:50 · Score: 2, Funny

while a *very simple* local caching system could solve easily the problem.

But then it would *hardly* be slashdot then, would it? ;o)

Good thing it's not in Kansas. by Anonymous Coward · 2004-07-13 08:50 · Score: 1, Funny

Oh, it'd still be created, it just wouldn't evolve.

So its going to be... by Anonymous Coward · 2004-07-13 08:59 · Score: 1, Funny

..a database of Slashdot users? /. effect beware! :p

Two words: by Anixamander · 2004-07-13 09:00 · Score: 3, Funny

Evil bit.

--
Do not taunt Happy Fun Ball(TM)

My first submission by IGnatius+T+Foobar · 2004-07-13 09:01 · Score: 2, Funny

I would like to submit my first abuse entry. The IP network 131.107.0.0/16 repeatedly pushes onto the Internet a combination of viruses (such as one called "Windows"), spyware (such as one called "Internet Explorer"), and hate speech (particularly against the Linux community).

All network administrators should blackhole this address space.

--
Tired of FB/Google censorship? Visit UNCENSORED!

Banned from the internet! by obli · 2004-07-13 09:01 · Score: 1

Soon a reality... how exciting...

Fatal flaw in environmental assumption by bourne · 2004-07-13 09:02 · Score: 5, Insightful

Having just skimmed the draft, there's a fatal flaw with this solution. To quote:

The idea is that no one person can make a big impact to the Root IIALP Servers but a million people all annoyed by the same SPAM can make a huge impact.

However, they don't seem to address the idea that one person controlling a million drones that send spam today... can control a million drones that submit IIALP reports about, say, cnn.com tomorrow, resulting in an DOS from all the sites that block based on the IIALP lists. They rely upon the reports of end-users, but do not take into account the fact that massive volumes of "end-user" machines are compromised and usable as drones for whatever nefarious uses their 0wner wants.

In short, their anti-spoof assumes individual malicious user endpoint hosts. If the malicious users on the Internet were limited to individual endpoint hosts, we wouldn't need solutions like IIALP!

Re:Fatal flaw in environmental assumption by rfc1394 · 2004-07-13 12:06 · Score: 1

However [] one person controlling a million drones that send spam today... can control a million drones that submit IIALP reports [] their anti-spoof assumes individual malicious user endpoint hosts. If the malicious users on the Internet were limited to individual endpoint hosts, we wouldn't need solutions like IIALP!
So use a "real person" validation [] like when [] they require you to tell them what the distorted word in the .jpg is

I liked what the first person said and I like your idea of using capchas to prevent fake reports. Of course, there are problems with captchas being fed to people for interpretation (some porno gateways are feeding other people's capchas as blocks for their sites and using the response to feed back to the supplier). There are ways to solve that problem (captcha timeouts, use of random checkboxes instead of text input boxes, etc.)

--
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
Re:Fatal flaw in environmental assumption by bourne · 2004-07-13 13:11 · Score: 2, Interesting
So use a "real person" validation technique... like when you sign up for free email and they require you to tell them what the distorted word in the .jpg is...

Three problems off the top with that...
1. Capchas don't work for spam, because spammers hook them to "free" porn pages to get people to solve them. Again, if it doesn't work to stop spam today, why would it work to stop the people who want to spam despite IIALP?
2. My mail server blacklists roughly 1000 hosts a day for attempting to send spam to or through it. Are you suggesting that the average user will validate themselves thousands of times a day? I think not. A system like IIALP is predicated on automated analysis of obvious 'attack' trends. If it needs a user, it'll never work (e.g., how many people view, understand, and care about ZoneAlarm popups? Not many).
3. IIALP must include the input of actual infrastructure - mail servers, web servers, routers, firewalls, etc. etc. - in order to help protect said infrastructure. It won't work if it only gets input from end nodes with no services. Such systems, by definition, already have an overworked, underpaid admin who is not going to have time to 'validate' his systems reports.
I have long thought about a system which has some similarities to IIALP, and have thought through some of the pitfalls. A system can be built which is based on the reports of nodes - but only if the nodes have credibility factors, strong encryption and non-repudiation, and the system is designed to cross-check and distrust node reports until throroughly corroborated. It should weight systems according to their uses, and it should have limited scopes (e.g., what's attack info on my network, may not be on yours).
Re:Fatal flaw in environmental assumption by KIDputer · 2004-07-15 17:37 · Score: 1

Excellent points well taken. DDOS and false reporting are being developed as we speak for IIALP. We are trying to include all simple to impliment and widly accepable methods for authentication and validity checking Its cool that people take the time to point out problems will no doubt help in the refinement of this IIALP work in progress. Keep an eye out the next revisions and please continue to dicect it for flaws. We plan to start an open source project for the server/client raw code. This way it can be in theory implimented for a very reasonable fee after people make it into bloatware .exe's.

Re:Cool by KevinKnSC · 2004-07-13 09:11 · Score: 1

Or just define dissenting opinion as an "annoyance", and then this system will cover that, as well.

Frontpage? by Anonymous Coward · 2004-07-13 09:17 · Score: 4, Funny

A site about (internet) abuse logging... made in Front Page?
(speechless)

Re:I troll slashdot OFF-Topic Reply -1 -1 -1 -1 -1 by i_r_sensitive · 2004-07-13 09:29 · Score: 1

I think your sig should be:

dyslexic trolls untie!

--
"Talk minus action equals nothing" - Joey Shithead, D.O.A.
"Talk minus action equals /." -

internet abuse == Verisign? by Kadmos · 2004-07-13 12:01 · Score: 1

Am I the only one who went to check if verisign was first on the list? :-P

Description wasn't quite right... by dcmeserve · 2004-07-13 12:16 · Score: 1

He meant:

... abuselog.org, a site for the development of a generalized protocol for logging internet annoyances and abuses to a set of central servers, which could then be DDOS'd all to hell and back by the perpetrators of said annoyances and abuses.

--
"Orthodoxy is unconsciousness" - Orwell

Re:Description wasn't quite right... by rfc1394 · 2004-07-13 12:42 · Score: 1

He meant:

... abuselog.org, a site for the development of a generalized protocol for logging internet annoyances and abuses to a set of central servers, which could then be DDOS'd all to hell and back by the perpetrators of said annoyances and abuses.

This needs to be moderated funny as hell. It unfortunately is quite true...

--
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
Re:Description wasn't quite right... by KIDputer · 2004-07-14 06:43 · Score: 1

If you can still say that 3 months from now I will be surprised. What you are reading right now is the scope of the project, all the mechanisms are not there yet to dispute. DDOS prevention is at the top of the list for requirements for IIALP. IIALP is in the todler stage and has just begun to walk, in three months after we get this this re-tuned by industry experts, you will not even see the kid run by you.
Re:Description wasn't quite right... by GnarlyNome · 2004-07-15 19:56 · Score: 1

"I'm being NIBBLED to death by CATS!" - L. Mollari
"I'm being NIBBLED to death by Ducks" - cletus Judd

--
Diplomacy is the art of saying "Nice doggie" until you can find a rock. Will Rogers

A shameless plug by mi · 2004-07-13 18:52 · Score: 1

stories about RBLs that add people, but never remove them.

My State KEeping Milter maintains temporary blocks and automaticly removes even the "permanent" bans, which are not triggered for a specified period of time....

--
In Soviet Washington the swamp drains you.

Re:A shameless plug by KIDputer · 2004-07-16 19:09 · Score: 1

Glad to hear that as I do not favor blacklists and bans and consider any form of Internet blockage as a last resort and temporary measure only to ensure the viability of the particular Internet resource under attack.

SPAM is a trademark of Hormel by alanxyzzy · 2004-07-13 23:56 · Score: 3, Informative

SPAM in all upper case is a trademake of Hormel, and refers to their pork luncheon meat product. They request that when the term is used to refer to unsolicited bulk e-mail, it is not capitalised.

IIALP allows for an infinite number of different types of annoyances to exist but has concise templates for common annoyances such as SPAM.

One cannot take entirely seriously anyone proposing a new method of fighting net-abuse, who is not aware of this fact.

Re:SPAM is a trademark of Hormel by KIDputer · 2004-07-15 17:50 · Score: 1

We will fix it in the next revision, sorry for the misunderstanding. I always write it as SPAM because it is a BIG problem and is a very LOAD way to say it.

Port Scanning is not offensive by Medievalist · 2004-07-14 02:37 · Score: 1

Port scanning is legitimate, harmless investigative activity (unless it is part of a Denial-of-Service attack, but that applies to all forms of connection anyway - obviously, you can be DOSsed with half-pings or even GRE packets).

Are you going to claim you never have to port-scan in order to solve a problem? C'mon, man, get a grip. Sometimes even end-users have a legitimate need to portscan! Log it and move on, the real bad guys don't stop with a simple port-scan.

Re:Port Scanning is not offensive by Neil+Blender · 2004-07-14 04:54 · Score: 1

Are you going to claim you never have to port-scan in order to solve a problem?

No. But I have never legitimately port scanned any network other than my own (ie work and home).
Re:Port Scanning is not offensive by Medievalist · 2004-07-16 02:41 · Score: 1

I have. And I've solved many problems for people by doing so; it's a valid investigative technique, and it's foolish to equate port-scanning with malicious intent.

Look at it this way: All the people that ever attempted to crack your security breathe air. Obviously, punishing people for breathing air makes no sense... just because it's a prerequisite activity to cracking your system does not mean that in and of itself it's a bad thing. Portscanning, same same.

Within the next few hours I will be portscanning two networks; one, a hospital, the other a medical ASV. They have connectivity problems they can't figure out, and I'm going to help them fix them. I don't intend to ask for permission from their IT hierarchy before I portscan them, and I don't expect them to give me any grief about it, because portscanning them will not harm them.

Re:Ah yes... by KIDputer · 2004-07-16 19:21 · Score: 1

You mean any further than it has already gone....oops it already went further since you posted this.

Slashdot Mirror

IIALP - Abuse Logging Protocol

106 of 173 comments (clear)