webiron requesting to block several /24 subnet
Hello, I received an abuse email today from my hoster (several emails from webiron in one email), typical automated abuse emails, not much information. However, they request, if the origin IP is a Tor exit, to block the full /24 subnet. As they also state, they will not provide the full IP of there customer and request to block the exit to the /24. Any thoughts on this? I don't like to block the whole /24, just because one idiot using one of the IPs is using some snake oil service like webiron, the collateral damage is to big in my eyes. All other IPs in the same range will be blocked as well. Why should I even care about blocking such IPs given by webiron? In my opinion the blocking is useless from my side and in the worst case the users of webiron will block my exit node IP. Would it be better for the tor network if I'd block the IPs? Is there any bad consequences if I don't for the Tor network? Let me know your thoughts. The services URL is https://www.webiron.com, don't need to go there, I didn't because such services are just useless. Better use fail2ban or something similar. Greeting yl
Hello yl, I also got some reports from WebIron. I also made some thoughts about blocking Tor from reaching some parts of the internet and if it's agains the ethics of tor. I think that blocking the destination for two weeks by an reject rule satisfies the "victim" and your hoster thus helps preventing the exit node from being shut down. For me, this is the best solution for this situation. I also ask my hoster for the mail addresses of the abuse reporter and write a little statement why he got attacked and what tor is and why I running a relay. Mostly the abuse reports from WebIron reports about WordPress login bruteforce attacks. I then try to explain how the "victim" can prevent such attacks by setting up allow/deny rules in their webserver software and a pre-setted basic authentication. I mostly get positives responses. ~Josef Am 20.10.2015 um 21:51 schrieb yl:
Hi, 2015-10-21 22:23 GMT+02:00 teor <teor2345@gmail.com>:
Would you mind putting the statement on the wiki or posting it to this list?
It might help other exit operators to respond to these kind of abuse reports.
+1. Can somebody point me to this? I have just received a notification from my ISP that they will suspend my service in 72 if I do not act over a complaint that is a webiron automated report. I have already replied with the standard answer (this was my first action since at the beginning my ISP mentioned a generic complaint, now they forwarded the webiron mail) I would like some indications for a more dedicated answer. Blocking IP ranges is out of question, of course. Thank you, Cristian
Hi Christian, sorry, I marked that message as "Todo" but forgot :-) My replay to my provider is: ----------------------------------------------------- Hello Martin, I've blocked the whole /24 (originally the target IP range is inside a /16 but this would be too much) to prevent further traffic. I would remove the block round about in one or two months. Can you please provide me the e-mail address so I can apologize and explain the situation to the reporter? Thanks, Josef ----------------------------------------------------- If I were you I would not mind blocking the destination for a short time. ~Josef Am 16.11.2015 um 11:52 schrieb Cristian Consonni:
2015-11-16 12:46 GMT+01:00 Josef 'veloc1ty' Stautner <hello@veloc1ty.de>:
sorry, I marked that message as "Todo" but forgot :-)
Thank you. This is very helpful!.
Ok, so you did block a range for a limited period. I will need to learn how to do that. I will try to use this episode to push again with my ISP for SWIP reassingment (which they do offer, but at a cost). Ciao, Cristian
Maybe something to add because I ran into a mistake: ExitPolicy is a first match szenario. The reject rules for abuse reports and stuff has to be the first one, afterwards your accept rules and then a reject *:*. For exampe my current policy is: ExitPolicy reject 5.133.182.0/24 # WebIron report ExitPolicy reject 80.14.2.87/16 # [Ticket ID: 960950] ExitPolicy reject 37.247.48.0/21 # #214673 ExitPolicy reject 62.67.194.130 # [Ticket ID: 869382] ExitPolicy accept *:53 # DNS ExitPolicy accept *:80 # HTTP ExitPolicy accept *:8080 # HTTP ExitPolicy accept *:443 # HTTPS ExitPolicy reject *:* ~Josef Am 16.11.2015 um 13:01 schrieb Tim Wilson-Brown - teor:
My hosting provider also go these requests. Their terms of service requires that I will answer something to acknowledge I got that. I just answer "ok, I'll handle it" and that's it. The reverse lookup of my nodes points to a hostname that shows the Tor text. The host name is tor4thepeople1.torexitnode.net so I'm quite sure they know that. I don't do anything beyond that and agree with AMuse that they can easily handle that without bugging the operators. On Mon, Nov 16, 2015 at 2:02 PM Tim Wilson-Brown - teor <teor2345@gmail.com> wrote:
2015-11-16 13:21 GMT+01:00 Eran Sandler <eran@sandler.co.il>:
Same here.
I don't do anything beyond that and agree with AMuse that they can easily handle that without bugging the operators.
I understand this and it would also be my first line of reaction. However, I am a new exit node operator (my node as been active as an exit only for 5 and half now) and I have to understand how my ISP reacts to this kind of things. For instance, after the report (which clearly says " Automated Message" on top of it, btw) they have sent me an email *and* called me on the phone (I just spoke with their customer tech support, they keep reminding me that everything that happens on that machine is my responsibility). They told me that they offer SWIP reassigment at an additional cost and only if buy dedicated servers and dedicated IP. I will speak with their commercial help desk to understand the costs. For the moment I will keep a low profile and I will block the mentioned IP range for a month. Then let's see if I can talk to my ISP and get the SWIP reassignment. C
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I'm currently in the middle of a somewhat heated e-mail debate with their vice-president. Pasting the e-mails below would be indelicate, but their position is that the Tor network is responsible for the abuse it generates and should take measures to prevent/block malicious traffic. They also state that according to their measurements, 99% of the traffic coming out of Tor is hostile, and they're going to release a report on the matter soon. On my side, I've been arguing that 99% of bad traffic absolutely doesn't imply 99% of bad users, since brute-force attacks generate a massive amount of requests (i.e. that 99% of bad traffic may be generated by 1% of the users for all we know) - and therefore I'm unwilling to punish all of them because of an unruly few. Besides, blocking whole /24 subnets seems overkill to me, and they have yet to prove that they have the authority to speak for all the IPs they are requesting. I suggested that site owners who wish to block Tor traffic do so using the DNSRBL, to which they replied that "hundreds of millions of site owners who barely know how to do e-mail" shouldn't be asked to configure their servers - or indeed do anything to protect themselves because that's victim blaming. They add that "what we have coming next in tackling abuses will make your heads spin :)" and conclude that I'm an arrogant bastard (mildly paraphrasing here). So as far as I'm concerned, I'll just discard anything I receive from them in the future. I've told my hosting provider that their automated e-mails should be disregarded, and they are okay with that. - -- JusticeRage On 16/11/2015 13:52, Cristian Consonni wrote:
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWSd87AAoJEEDp8Kj16odU8VIP/iEUQIHmWnxZT9c/cNgjEnD5 a8OG7/zT7mvyZ+NTQaNFIo2S7q/xFUVolwxF96JPrdu+ttFSzF1j728504nvZlQm 5axWDR3vFVrY8e9TPnQiExA7J4d4z2TVGQT6J2rI8o3X7+IJgdOFWulxdrbTqgTV kp1T1acP+lVEa5pUo+hEJGECQpYP9RUyrHs8ySkKFrdgE4RRPCaNvDsDQpjv5S70 1QcVvU1mppHmbFLoskvtIKa7PlOL/bvN0H2uJBm8wblDASxg5YFBeZU5xpQbHz28 GHvwxtGrEqL/ilMnkrEYDB8113UCVXV9sIZ1P+ZvXillKsJcalhMgJTVZE8+Rkov 62xRsZXvCfWZ/47gse/HddYgot3NOK/pCbl70McwnJzS7BDpXiGVbMD2xH2qtghD BZVsPyln3Gkky3Jzo8r8u7Hi0Z6XP4iKIzNBMuRTKJ8SZiP1A4gCH0ITP1kUugzY 5abhGJFxcFQkeOGN2RaWaV1j80mblXsdMGhSo2E+0mdhxFWt595soNXtx37FPh27 jyHtxyfLOAtTva73RsaiaAahNvTPcEGXXpzl0cBIflNNVW4qn91NtwVXh6hYNX9L rwfEgJOBYqBEElqe1XVvuUb8X6sUWXuuoIsG45OwiyFMBeXxEgfs6+eFLjsQVmvx s9eNG7HyFIw/1Pncmtgp =QKxP -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I'm currently in the middle of a somewhat heated e-mail debate with their vice-president. Pasting the e-mails below would be indelicate, but their position is that the Tor network is responsible for the abuse it generates and should take measures to prevent/block malicious traffic. They also state that according to their measurements, 99% of the traffic coming out of Tor is hostile, and they're going to release a report on the matter soon. On my side, I've been arguing that 99% of bad traffic absolutely doesn't imply 99% of bad users, since brute-force attacks generate a massive amount of requests (i.e. that 99% of bad traffic may be generated by 1% of the users for all we know) - and therefore I'm unwilling to punish all of them because of an unruly few. Besides, blocking whole /24 subnets seems overkill to me, and they have yet to prove that they have the authority to speak for all the IPs they are requesting. I suggested that site owners who wish to block Tor traffic do so using the DNSRBL, to which they replied that "hundreds of millions of site owners who barely know how to do e-mail" shouldn't be asked to configure their servers - or indeed do anything to protect themselves because that's victim blaming. They add that "what we have coming next in tackling abuses will make your heads spin :)" and conclude that I'm an arrogant bastard (mildly paraphrasing here). So as far as I'm concerned, I'll just discard anything I receive from them in the future. I've told my hosting provider that their automated e-mails should be disregarded, and they are okay with that. - -- JusticeRage On 16/11/2015 13:52, Cristian Consonni wrote: -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWSd8xAAoJEEDp8Kj16odUctUP/0NE9nQxrPTYSN8U9Nfh62MU B477cKqMvmtwFkKECED4yd50zQ/vKjYyBOc6Ml8Rp7cNvnjpKJvmYCt8230Ikz/k 79+atBPxdcKVdpqY8KxodM9DaQtVxHf0MzBsJra/uyCrdn153wmnCepWqjhfXmv1 J2x7QeBtOskpW61FnTKQlc/5WQYJSXhZ5niw84MpjJA4Er9g134m++Y0Asd8VGye D2zFcOxT9D/nwMX8tBQlQe+gglAjx/2GBwXL/SkCs7237ZQyA7XkghPOdAD2WPZl wosfx+VJ3w9K862J79yW05OoO76hrT0lNMOohOH+84uImlznrnmjGsNkCdjR7VkV vslaCT/gmvJI+7CdiaXwly8G0JspbJfK9al9/pevXdNR4jPwRgcM8mbF0YExnUPZ Uvil6qLYgVjQ2e1PpoDr5tIOo1dK5zgIMtum+hFLiCAARmBUUVzP1egASW+wh2xO +Uug+hyRyqoK1CtxtluDrgyAGVBL4a+DG89XZCcfrzrO+DRXz1ca2ZblYVS8IBfz 2kUqWqnVl1MVXS/9Ggoa9ZJbwahx6W4RgBeUFlBcYkLYe8wNyHfy2LkzKmDAx3Jk HfgxCDdFM4R5jhjJeypbVphYZOfOPMlGk1JncaTsZch3j9g1aWYyj14i1pKLpWlZ zzB/bSaiBoeb0CIqrfDL =SkQB -----END PGP SIGNATURE-----
The TOR directory of exit nodes is readily available for ISP's and website operators to apply in their filters. I don't see why them putting the onus on tens of thousands of exit operators to exit-block THEIR addresses is in any way reasonable. On 2015-10-20 12:51, yl wrote:
Links: ------ [1] https://www.webiron.com [2] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
++ 20/10/15 13:57 -0700 - AMuse:
I do agree with the gist of your message. However, I wish you could say there are 'tens of thousands of exit operators'. :) -- Rejo Zenger E rejo@zenger.nl | P +31(0)639642738 | W https://rejo.zenger.nl T @rejozenger | J rejo@zenger.nl OpenPGP 1FBF 7B37 6537 68B1 2532 A4CB 0994 0946 21DB EFD4 XMPP OTR 271A 9186 AFBC 8124 18CF 4BE2 E000 E708 F811 5ACF Signal 0507 A41B F4D6 5DB4 937D E8A1 29B6 AAA6 524F B68B 93D4 4C6E 8BAB 7C9E 17C9 FB28 03
Dear yl, just a few words from the abuse helpdesk of a larger tor-exit-node... TL;DR: we ignore those requests. they don't even reach a human. While we do handle most genuine/honest/helpful and especially all non-automated abuse reports very diligently. Pointless nagging services like webiron however are automatically rejected before they reach our abuse inbox. It seems that we are not the only ones who deem their mass mailings as spam, as evident from the spamhaus listing below: Oct 20 03:34:54 mail smtpd: NOQUEUE: reject: RCPT from abuse-reporting.webiron.com[23.91.17.162]: 554 5.7.1 Service unavailable; Client host [23.91.17.162] blocked using sbl.spamhaus.org; http://www.spamhaus.org/sbl/query/SBLCSS; from=<###@abuse-reporting.webiron.com> to=<abuse@###> proto=ESMTP helo=<abuse-reporting.webiron.com> Oct 20 03:34:54 mail smtpd: disconnect from abuse-reporting.webiron.com[23.91.17.162] Oct 20 19:49:51 mail postfix/smtpd: NOQUEUE: reject: RCPT from unknown[23.239.20.29]: 554 5.7.1 <###@abuse-reporting.webiron.com>: Sender address rejected: Access denied; from=<###@abuse-reporting.webiron.com> to=<abuse@###> proto=ESMTP helo=<abuse-reporting.webiron.com> We had similar problems with report@redsnitch.net and most notably with clean-mx.de which seems to be a confused single individual (Mr. Recher) sending out not very helpful mass mailings. Repeated contact attempts by mail and on his apparently 24/7 reachable mobile number (included in every of his mails) did not convince him to stop. If you also get these and are annoyed with that, try to give him a call, he seems to like feedback and was ok with getting a call at an odd time. Also on our inbound-deny-list is a regex match for /^(.*)fail2ban(.*)$/ to a rather recent phenomenon. Some people out there apparently are of the opinion that it is a reasonable choice to use the ugly crutch that is "fail2ban" instead of deprecating password based authentication for ssh. To make things worse, these days this ill-conceived piece of software includes an option to advertise itself to other people. automatedly. via mail. *sigh* Cheers
You're technically correct (the best kind) but I wanted to point out that Fail2Ban is a really useful tool for a lot of login protocols which are NOT SSH and which are still subject to frequent brute-force attempts. HTTP BASIC and IMAP(s) both come to mind as something I configure fail2ban to watch for me, neither of which have a strong key-based auth system to configure and disable passwords. Still, configuring fail2ban to email people is really stupid. So I'll give you that with no argument. On 2015-10-21 04:21, tor@as250.net wrote:
Links: ------ [1] http://www.spamhaus.org/sbl/query/SBLCSS [2] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
participants (12)
-
AMuse -
Cristian Consonni -
Eran Sandler -
Josef 'veloc1ty' Stautner -
Josef Stautner
-
JovianMallard -
JusticeRage -
Rejo Zenger -
teor -
Tim Wilson-Brown - teor
-
tor＠as250.net -
yl