Schneier on Security

Impossibly Stupid • November 20, 2019 12:34 PM

@Clive Robinson

Russia plans to shut it’s self behind what will become another “Great China Firewall” supposadly as a test in the very near future.

Good. All I ever see coming from them (and about 50 other countries, including Iran) on my servers is wave after wave of attack. My life would get easier if they completely cut themselves off. Western countries should respect their wishes to disconnect from the Internet. Would any Americans even notice if a reciprocal firewall was put in place for these nations?

Since then there have been ever increasing signs that national governments want rather more autonomy than they have been given.

They don’t want that autonomy for good reasons, though. The common MO here (and usually throughout history) is that people want to split off because they want to do bad things that are harmful to the social well being. It would be shocking to see the resurgence of a healthy patriotism.

Impossibly Stupid • November 21, 2019 5:30 PM

@Clive Robinson

If the Russian Government blocks packets originating in Russia getting out how do you see that as a defence?

Uh, how do you not? Someone who used to be able to attack you with impunity now no longer can. Sounds like a pretty solid defensive move to me.

Because it is not defending anything Russian inside it’s blocking perimiter is it?

It is, to the extent that external agents are also likely attacking Russian assets. But that’s not my main concern.

It is in effect either imprisoning Russian criminals inside the Russian jurisdictional networks which does not solve the criminal problem, only “bottles it up”.

Again, and? Who else is better equipped to deal with criminals but those who have jurisdiction over them? Let Russians solve Russian problems; isn’t that what autonomy is all about?

Or it effectively blocks those non Russian criminals who are currently using Russian jurisdictional networks to hide their point of origin.

Again, good. Nobody should be running an insecure network. Nobody should expect some external admin to be able to effectively police misuse of their internal network. It’s another Russian problem that Russians need to solve.

If you follow the logic of you calling it a “defence” through, you will see that you will not be “politically popular” in these days of stage managed cries of “It’s Russia wot dunit”.

I don’t care about any of that. Whether it’s Russia or one of the other 50 countries that seem to be major sources of attacks, or the one-off attack that came in today from 94.199.18.198 (can’t recall ever seeing a TJ country code in the logs before), I can’t be bothered to play politics or try to track it back any further to some shadowy “point of origin” organization.

Because implicitly you are saying that Russia is not the origin of the attacks, mearly a staging post and thus they are dropping off of the Internet to defend not just those inside their jurisdictional networks from attack by outsiders, but also their international name…

I’m certainly willing to give anyone the benefit of the doubt when it comes to failures in securing their network. But, then, they do have to admit those failures and take steps to correct them, and that’s something that I just don’t see happening anywhere from anyone.

I mean, it’s not like Amazon is buying up ads declaring to the world that their cloud hosts are being used to attack my (and countless other) servers. Every abuse contact I’ve dealt with in the past decade seems to have the mission not of ending abuse, but making excuses that allow them to keep cashing the abuser’s checks.

Let’s put it this way, if I were an attacker, I would already have a number of mitigation plans not just in place, but up and running and I would be slowly migrating my fake point of origin to some other jurisdictions networks.

Good. They should be bounced off the open Internet, too. You as an attacker should have to be working hard to keep being a terrible person. It’s sad civilization is degrading to the point where this is something that needs to be championed.

So whilst you might see the number of attacks from Russia decline, you will potentially see them rise from some other “apparent” point of origin.

Only if Russia (et al.) doesn’t care enough to police their network to expose the “origin” they see. Or, put another way, I have only once ever had an organization contact me to point the blame for abuse elsewhere. Everyone who isn’t the source is welcome to provide evidence of network traffic that demonstrates it. This is science and technology we’re talking about, not some hush-hush backroom political machinations.

But the reason I indicated it might actually be worse for you is that if forced to make one set of changes, the attackers might well make several changes… That is in effect “upgrading their attacks” which would mean you would be facing a changed landscape requiring you to make changes to your defence strategies as well.

That’s not worse, that’s better! I already have escalating countermeasures planned (and/or ready) to fight abuse. I’m not going to rush to use them, though, because an arms race is a waste of those resources. If it’s the attacker that is forced to spend first, that’s a win for me, especially when their efforts aren’t even enough to breach my current defenses. For example, it is endlessly amusing to see hosts scanning my web server for things like PHP exploits (I don’t use PHP, of course), because it means my system can automatically drop those insecure networks into the firewall, meaning they won’t be the source of any future attacks that I could possibly be vulnerable to.

As that is likely to be a “reactive not proactive” set of changes it implies that there will be a learning curve which might also give rise to a “window of opportunity” or advantage to the attackers.

While that could be the case, that is not my approach. For example, about 15 years ago I came up with some anti-spam techniques that allow me to track who leaked my email address and stop junk mail from even reaching my server; I still have two levels of escalation that are essentially left unused because spammers haven’t gotten more sophisticated in that time because “anti-spammers” have settled for hiding spam traffic as their “solution” to the problem. Likewise, while I can’t claim I have perfect security otherwise, I know for a fact that other fruits out there are hanging so much lower than mine that my risk of being a target is slim; it doesn’t worry me enough to keep me awake at night.

Impossibly Stupid • November 22, 2019 4:32 PM

@Clive Robinson

By definition a defense is something you do to protect your self.

No, it isn’t. Perhaps your British definition of the word is as wacky as the spelling? A defense need not be active or personalized. A banking website’s encryption is a defense against my account being hacked. A distant levee may be a defense against my land being flooded. The airbag in my car is a defense against injury in an accident. There are countless ways I am defended that are not the result of any action on my part.

You have no control over what Russia does in the way of connecting or not connecting to the Internet. Likewise you have no control over what attackers do in response to what Russia does.

Immaterial. I have no control over mountains or oceans, but they are still barriers that defend me from potential attackers. I have no control over armies or navies, but some of them protect my rights just as certainly as others seek to take them away. Please think more deeply about the matter.

So like it or not politics is intruding like the proverbial camels nose.

It’s not an issue of love or hate. As I said, I simply do not care about those things. The actions I take against abuse do not rely on the abuser cooperating with me or even acting in their own best interest. Until the day comes when Russia (or Iran or any other foreign network) actually provides me something of value online, their connectivity or lack of connectivity is no concern of mine. As it stands, they are the source of attacks, and thus a net negative, and thus it is to my advantage if they self-select to withdraw from the open Internet.

@SpaceLifeForm

Consider: I’m a very large backbone network

But you are not. I’m pretty sure 100% of the attacks I have coming in are not operating at that high a level of compromise. I just don’t do anything that would draw enough attention to put resources in motion that result in rerouting major portions of the Internet to come after me. Save those fanciful notions for Bruce’s next movie plot contest.

Why do you believe that I can not control those tcp sessions?

Because your exposure in doing so would be too great for the rewards. Like I said, I see things like scans for PHP exploits. I see things like scans for Raspberry Pi’s connected to the Internet that are still using the default account password. Even if I were vulnerable to such attacks, all you’d end up getting ahold of is a basic server that is a cookie cutter copy of just about what every cloud provider is offering.

Why would you believe that I can not forge the source ip address, and because I can control the route, still want to believe the socket actually reflects reality?

I’ll believe it when I see it. At this point, I have no evidence that the routing of any random host like mine is being manipulated. When it has happened, it’s been on the scale of targeting the Google’s of the world, not just to make it look like a common dictionary attack on a low-end host falsely came from China (or wherever).

I can make your socket end look like my socket end came from *ANYWHERE*.

No, you can’t. Prove me wrong. Let me know which log file to look at.

Impossibly Stupid • November 28, 2019 10:31 AM

@SpaceLifeForm

Do you not see that *Appears* is the keyword?

Do you not realize that I specifically added that word to give your argument the best possible benefit of the doubt? Even in the fantasy world where the average script kiddie could spoof IP addresses widely and with ease, there is still no rational reason to consequently allow all abusive incoming traffic.

Just keep blocking. It won’t be long before your website gets no traffic.

If you think traffic from people trying to hack you is desirable, remind me to never hire you in any technical or non-technical capacity. The simple fact is I have had zero traffic of any kind coming from Iran that sought to benefit me in any way. China, also zero. Russia, go on and guess. It’s not like my list of 50+ countries was chosen at random!

Look, if you’re unhappy that you’re in a range that has been blocked, simply give me your IP address and I can manually remove it from the firewall. It may get automatically re-added, of course, if abuse starts occurring again. The root solution in that case is for you to demand your ISP properly police their network. Anyone who sees that as too big of a burden is better off not being on the open Internet.

Impossibly Stupid • December 1, 2019 4:33 PM

@SpaceLifeForm

But, if the TCP session can be spoofed, upstream of your server, then you can end up in an endless whack-a-mole.

That remains, as the saying goes, a big “if”. So big, in fact, that even these nation-states like Iran, Russia, and China think the better solution is to block their citizens from accessing the Internet at all. The reality is not your proposed scenario, and it’s an unscientific approach to act like it is.

Then, why not just block all of those netblocks? Instead of playing whack-a-mole?

Because I’m not a complete jerk. I follow evidence-based practices. It’s very easy to implement an automated process to escalate blocking when necessary, so I see no reason to preemptively cut off absolutely everybody. It also leaves open the possibility that someone reputable in one of those 50+ countries does want to do business with me, thereby rebalancing the equation in favor of their fellow citizens.

ISPs do not do anything wrt to watching ip traffic. They only care about money.

I’m do not expect anyone to increase their surveillance (nor would I particularly want to encourage that). What I expect is that they properly act on reports of abuse due to an attack. Ideally, that would also include compensating victims for the expenses incurred. But nobody is interested in doing that because, like you said, they care more about lining their pockets. That being the case, it costs me very little to just drop their network range into my firewall. Nobody commenting here has made a strong case for doing more work than that.

And realize that BGP is *NOT* secure.

I’ve already acknowledged that the Internet has many fundamental security issues. That doesn’t mean an unhealthy obsession of the unlikeliest attacks is anything other than paranoia. People are better served by rationally examining/addressing the vulnerabilities that are most likely to do them harm.