Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
The Internet Your Rights Online

Confronting Address Space Hijackers 334

Posted by timothy from the insert-sound-effects dept.
Tawn writes "There's a great story on SecurityFocus about hijackers taking over large allocations of IPv4 space with forged documents and false business fronts. Los Angeles County and some big multinationals have had /16's pulled out from under them in the last few months, and used to inject spam. ARIN and network operators are trying to get a handle on the problem. The owner of a webhosting company that wound up with L.A. County's /16 called it 'borrowed space,' and said he paid $500 for it to a guy he met online."
This discussion has been archived. No new comments can be posted.

Confronting Address Space Hijackers More

Confronting Address Space Hijackers

Comments Filter:

  • PROFIT! (Score:4, Funny)

    by rkz ( 667993 ) on Wednesday June 11, 2003 @03:01PM (#6173997) Homepage Journal
    1) Start a fake business

    2) forge some documents

    3) steal more IPs than the whole of china has

    4) sell to spammers

    5) PROFIT!!!!

    (note, ??????? step not required)
    • China actually has all the space they need for now, because their censorship-happy government and several quasi-monopolistic telecom providers have kept a pretty tight control on the internet's growth there. The "Great Firewall of China" that enforces web and email censorship can keep most internet users (particularly home and small business users) behind NAT or make them use IPv6 space or whatever, and most of the people who need real Internet access are businesses that don't need much space for the outsi

  • Uh huh, yep (Score:5, Funny)

    by Hamstaus ( 586402 ) on Wednesday June 11, 2003 @03:01PM (#6174004) Homepage
    Right... "borrowed". And that "guy I met in the van in the back alley" was just letting me "borrow" that plasma screen TV for $500.

  • Hijackers? (Score:5, Interesting)

    by stanmann ( 602645 ) on Wednesday June 11, 2003 @03:01PM (#6174008) Journal
    YOu know, as evil as this may be, Sitting on that quantity of Unused IP adresses is just as criminal. Perhaps Once they get the addresses back, they should consider selling or renting them out to raise some funds since California claims to be having budget problems. I'm sure some of these guys [slashdot.org] would be happy to put in a bid.

    • Re:Hijackers? (Score:2, Redundant)

      by secolactico ( 519805 )
      they should consider selling or renting them out to raise some funds

      Can they do that? As I understood, ARIN only lets you sub-allocate ip space to entities you provide service for (say, downstream ISPs, etc). So unless the county becomes an ISP, I don't think this is feasible. It's been a while since I last dealt with ARIN (bending over backwards to obtain an extra /19) so this might not be the case.

      Sitting on that quantity of Unused IP adresses is just as criminal.

      Agreed. They should return all

      • Re:Hijackers? (Score:4, Informative)

        by shamino0 ( 551710 ) on Wednesday June 11, 2003 @04:11PM (#6174763) Journal
        Agreed. They should return all the unused IP space for re-allocation.

        It's not that simple.

        The way I understand it, you can't just give back some of your addresses. You have to give back the entire block and then go through the whole lengthy application process to get a new block. Which means there will be a significant amount of time during which you have no addresses. And when you finally do get them, you'll have to renumber your network, because you won't get back addresses from the block you gave up. And if ARIN decides that you don't actually "need" as many addresses as you want to keep, you're SOL.

        And if your network grows, you have to go through all the red tape of justifying your request for another/larger block.

        The fact that you did the internet a service by surrendering a lot of unused addresses in the first place doesn't figure into thesedecisions.

        For anybody who has a legacy class-B (or even class-A) block, it just doesn't pay to go through all the work, only to find yourself screwed in six months when you find that your new allocation wasn't big enough.

    • Amen to that, so many IP addresses are wasted. MIT, for example, has a /8... Somehow I doubt they are using over 16,000,000 IP addresses...

      • Re:Hijackers? (Score:5, Funny)

        by TheCrazyFinn ( 539383 ) on Wednesday June 11, 2003 @03:25PM (#6174259) Homepage
        Considering that at MIT, Pop machines and Coffee Makers have IP's, they just might be using a reasonable amount of their /8

        • Hah. It's been a while since a slashdot post actually made me laugh out loud ;)
        • Ya' can always tell the Mass/Upstate NY people, they say POP when we all know it's SODA! :)
      • But what if you want every node of each of those Beowulf clusters to have its own public IP address? :)

        It's like having "Emergency Pants."

        "You never know."

    • Re:Hijackers? (Score:5, Insightful)

      by koh ( 124962 ) on Wednesday June 11, 2003 @03:25PM (#6174265) Journal
      Sitting on that quantity of Unused IP adresses is just as criminal.

      I do agree with you here, but... ever heard about natural selection ?

      IPv4 addresses have been designed in a time when there were at most a dozen people expecting IP to be used by more than a million users in the future. Just like the w2k bug (failed to) prove, old things should eventually die so that new ones can take the free slot. Yup, just like spammers should die so that other people may use those IP slots, but I digress.

      IPv6 is here and would resolve the problem. This requires a huge switch however, and people won't be ready for it unless natural selection proves IPv4 hopelessly doomed.

      So let spammers accumulate IPv4 addresses just a little more ;)

    • Re:Hijackers? (Score:2, Insightful)

      by borroff ( 267566 )
      It's really a symptom of a monoploy economy for IP address blocks. No one is keeping the distributor honest, so market inequities do not get resolved. Hoarding can then exist.

      But honestly, is a large enough fraction of the user community going to be upset enough to change this? Probably not. Right now, businesses seem more than willing to shell out for a small CIDR address space, and NAT the internal addresses. Until there's a customer revolt, there's no reason for a monopoly to be overthrown.

  • A little curious. (Score:5, Funny)

    by Sheetrock ( 152993 ) on Wednesday June 11, 2003 @03:02PM (#6174012) Homepage Journal
    How the hell can't you be a little suspicious of somebody offering you a Class C for $500 on the condition that you only use a small part of it? What, did it fall off a truck?

    • Re:A little curious. (Score:5, Funny)

      by loucura! ( 247834 ) on Wednesday June 11, 2003 @03:04PM (#6174038)
      You mean you've never found a Class C in the middle of the street? I guess I should stop selling those things... but $500 buys a lot of beer...
      • I don't know of a single ISP that will route a single class C anymore. The routing tables are just too full to handle small blocks like that.

        I've got a legal class C that I got way back in 1991 or '92. I use it for my internal network, but it's worthless to me for the net at large...

        BWP
        • Upstreams will grandfather you if you're ancient- we have 8 /24s that all get announced. Granted, we're working on renumbering but that's a lot of people to call- a multi year backburner project. New allocations, however, won't be announced unless they're a /20 or bigger... (thats 4,096 IP addresses in a row)

      • Re:A little curious. (Score:5, Funny)

        by Tumbleweed ( 3706 ) on Wednesday June 11, 2003 @03:41PM (#6174429)
        > but $500 buys a lot of beer...

        Dude, you PAY for beer? I heard that there's a 'Linux' beer that's free...you should check it out.

    • Re:A little curious. (Score:4, Interesting)

      by tigress ( 48157 ) <rot13.fcnzgenc03@8in.net> on Wednesday June 11, 2003 @03:29PM (#6174307)
      Sorry to be anal, but classful routing hasn't been used (by clueful people) for years now. Even then, a /16 would be the equivalent of a "B" class. Also, remember that the classes were limited to certain ranges, such as A-classes being 1.* to 127.*, B being 128.* to 191.* and so on. Anything dividing a classful block into something smaller would be a so called "subnet" (ever wondered where that name came from?).

      Unfortunately, a certain networking hardware company still insists on teaching classful addressing, despite CIDR having been available for something like ten years now.

      • Re:A little curious. (Score:5, Informative)

        by PurpleFloyd ( 149812 ) <`zeno20' `at' `attbi.com'> on Wednesday June 11, 2003 @05:00PM (#6175335) Homepage
        Classful routing terminology is still a useful form of shorthand. If you tell me that MIT has a Class A block, I know immediately that they have a network space the size of Asia, but if you tell me they've got an 8 bit block, I have to pause and think about it for a half second.

        As for Cisco teaching classful addressing, that's justifiable. If the terminology is still in use among network folk, Cisco isn't doing a good job if they certify people who don't know how to communicate with their peers. Also, I can tell you that the CCNA exam did have several CIDR questions on it. Certifying someone as a network tech means testing all the knowledge they should know to do their job well. Since classful routing is still in the wild, network techs should know how to deal with it.

  • Someone he met online... (Score:4, Interesting)

    by mingot ( 665080 ) on Wednesday June 11, 2003 @03:02PM (#6174019)
    The owner of a webhosting company that wound up with L.A. County's /16 called it 'borrowed space,' and said he paid $500 for it to a guy he met online.

    That's like getting stopped with a tractor trailer full of stolen goods and saying you bought it from some homeless guy on 82nd for 30 bucks.

  • This is why we need IPv6 (Score:5, Funny)

    by wfberg ( 24378 ) on Wednesday June 11, 2003 @03:03PM (#6174023)
    Oh.. no it's not.. </kneejerk>

  • Does LA county even need a public /16? (Score:5, Insightful)

    by realdpk ( 116490 ) on Wednesday June 11, 2003 @03:06PM (#6174053) Homepage Journal
    Judging by the article, LA county was using that /16 for internal routing only. I understand that they probably got it when it was easy to get, but do they really still need it? On that note, how much IP space that is allocated is actually in use? I heard something like 25%..

    • Re:Does LA county even need a public /16? (Score:5, Interesting)

      by Anonymous Coward on Wednesday June 11, 2003 @03:17PM (#6174192)
      Think that's bad?

      Eighteen companies currently hold Class A allocations: Apple, AT&T, BBN Planet, Computer Sciences, Compaq, Ford, Eli Lilly, GE, Hewlett-Packard, Interop Show Network, IBM, MIT, Mercedes Benz, Merck, PSINet, Prudential Securities, Stanford University and Xerox.

      Mercedes Benz needs 16777216 addresses??!!

      Oh wait, I shouldn't include the broadcast addresses .0 and .255.255.255, so that's only 16777214 addresses. My bad. Seems reasonable.

      • Re:Does LA county even need a public /16? (Score:5, Interesting)

        by crow ( 16139 ) on Wednesday June 11, 2003 @03:36PM (#6174386) Homepage Journal
        Note that that list is old, listing both HP and Compaq as having Class A networks. Does this mean that HP now has two class A blocks? Or is the list old, with much of that space having been reallocated?
      • Well, for IBM that's only about 55 IP addresses per employee, worldwide... Not entirely unreasonable.
      • BBN actually has 2 natural Class A addresses (4/8 and 8/8), which were transfered to GTE Internetworking, then Genuity, then to Level 3 during the acquisition. Very long story, but you kinda get to assign whatever you need when you get to be AS1 as well. Anyway, 4/8 is heavily divided up and assigned out to customers as well as being used for the internal network. During the integration by Level3, my understanding is that a lot of these will be renumbered into 4/8 from the Level3 blocks, just as Level3 w

      • Re:Does LA county even need a public /16? (Score:5, Insightful)

        by Yuan-Lung ( 582630 ) on Wednesday June 11, 2003 @04:11PM (#6174769)
        Does it make sense for some people to have multiple mensions while some others can't find a place to live?
        Does it make sense for a small group people to hug a huge chunk of the worlds, while the others starve?
        But hey, that's how the world works, for now and the foreseeable future, anyways.

      • Re:Does LA county even need a public /16? (Score:4, Informative)

        by crapulent ( 598941 ) on Wednesday June 11, 2003 @06:39PM (#6176207)
        What's even worse is when you look at how few actual web sites are actually hosted in those "legacy class A" spaces. I've heard that, for example, GM has tons of ancient robotics and other embedded applications that are running on hard coded IPs in their allocated space. Not that they're publicly visible, just that no one really ever considered a scarcity of IP addresses in the past.

        Here's a great link that shows where web servers are in relation to the various class A (/8) address spaces. [whois.sc] As you can see, they're mostly clumped in small zones, with a large majority of the IP space marked as either reserved or not in use for the "public" internet.

        To some degree I'd say the scarcity of IP addresses is somewhat manufactured. While you don't want to go willy-nilly allocating large blocks, at some point you have to recognise the genuine need and start unreserving some space. Also, some concensus should be reached on all those "legacy" blocks that aren't being used efficiently.

      • Some of those are ISPs or have good reasons (Score:4, Informative)

        by billstewart ( 78916 ) on Wednesday June 11, 2003 @07:09PM (#6176383) Journal
        Currently? Looks like Stanford gave theirs back in ~2000. About 60% of the Class A space is unused now.


        AT&T and BBN are ISPs, so they've got legitimate uses for large amounts of address space. (In AT&T's case, they got lucky, because while they were late getting into the ISP business, the Class A was a leftover from the Bell Labs Cray's Hyperchannel LAN, which for some reason had insisted on having a Class A network and couldn't be subnetted :-)


        The Interop Show Network has always been special. For you young folks out there (:-), Interop used to be an engineering conference where vendors actually tested interoperability and worked on implementation bugs, as opposed to being primarily marketing-related, and back in ~1990, not everything knew how to do variable-length subnetting or CIDR or whatever, and the show needed real internet addresses, not just RFC1918, because it was connected to the Real Internet.

        Auto companies have been an early developer of networking technology - there was all that ISO MAP/TOP stuff in the Mid-80s, and they were one of the big players in getting IPSEC to be a practical technology where equipment from multiple vendors actually interoperated as opposed to a custom thing for spooks and occasional banks. (That also affected the Crypto Export Regulations Wars of the 90s.) At least in the US, automobile manufacturing isn't really done by big monolithic integrated companies which could use 10.x intranets - it's done by a wide mesh of manufacturers of parts, subassemblies, components, random little job shops, etc., as well as the big companies that stamp out metal and assemble it into cars, rather like the computer and software industry except with a lot more metal shipped around, and they need registered address space to be able to talk to each other cleanly. I'm not sure that Mercedes needs all that space, but the industry certainly does.

        As of December 2001, the biggest hog of Class A addresses was the US government, including the military and its friends like Halliburton. Also Eli Lilly had a Class A then...

    • Re:Does LA county even need a public /16? (Score:5, Informative)

      by HaeMaker ( 221642 ) on Wednesday June 11, 2003 @03:28PM (#6174301) Homepage
      Allocaitons are made for organizations that need globally unique IP addresses, not necessarily connected to the Internet.

      IBM owns 9.0.0.0/8, none of it is connected to the Internet. They use globally unique addressing in their internal network for private connections to other organizations, without fear of collisions.

      This is typically no longer done and the IANA recommends you use a random range from private IP space from now on, except in rare cases.

  • Wot, you mean that ... (Score:4, Funny)

    by binaryDigit ( 557647 ) on Wednesday June 11, 2003 @03:06PM (#6174060)
    That Class A block that I bought on ebay from the guy from Nigeria who spammed me via SMS isn't legit? I better quickly cancel that wire transfer of money to his cousin, you know, the finance minister until I can check out his story about the president dieing in a plane crash and leaving all that money that he was going to invest in helping Quark get its native OSX version done.

  • Sounds like something Enron would do... (Score:3, Insightful)

    by Anonymous Coward on Wednesday June 11, 2003 @03:07PM (#6174064)
    I'd never heard of Enron before they started running TV ads about how they sub-rented "unused bandwidth" from multi-nationals during their off-hours.

    It wouldn't surprise me that this is one scam that they would have tried to pull.

    I don't know about the rest of the world, and IANAL, but I rather suspect that any member in good standing of the Communications Bar would be able to make a very strong case about willful interference with a communications system.

    Next thing you know, they'll be lighting OPDF. (Other People's Dark Fibre)

  • Signed communications to the registries (Score:5, Interesting)

    by Malc ( 1751 ) on Wednesday June 11, 2003 @03:07PM (#6174071)
    It won't guarantee that this won't happen, but signed communications would help. Private keys can be stolen though, but I suspect that takes more effort. A public key should be included in the registry application, or with whois record, or in some other private DB at the registry. I guess this would be the opposite of PGP encrypted mail where the private key is used to decrypt rather than encrypt.
    • Typically, namespace admins offer you three choices for changing the owner:
      • PGP/GPG-signed request
      • Other form of authenticated request
      • Plain, unauthenticated e-mail, snail mail or fax


      Methinks it's time for option 3 to go, and options 1 and 2 to be combined.


      Either that, or can someone give me a Class C to play with? I promise not to spam anyone.

    • Unfortunately, your proposal is completely irrelevant. In the cases I know, the communication channel between the ISP and ARIN was not compromised. The ISP just sent bogus data, acting on forged customer requests.

      There isn't any cryptographic protocol that can solve such a problem, and that's why S-BGP and other "secure" BGP successors are almost completely irrelevant. Cryptography is not the answer to all attacks.

  • Fraud is common (Score:4, Insightful)

    by msobkow ( 48369 ) on Wednesday June 11, 2003 @03:08PM (#6174076) Homepage Journal

    With the still-ongoing cases over domain theft and fraud, is it at all surprising that it's also active in areas like IP block assignments?

    I get SPAM with faked reply-to, sent-by, and domain names. Most hacks against my systems are from IP addresses that don't resolve back to a valid domain.

    The only shock here is that someone was dumb enough to think they could get a /16 for only $500.

    • Re:Fraud is common (Score:3, Insightful)

      by gorbachev ( 512743 )
      "The only shock here is that someone was dumb enough to think they could get a /16 for only $500."

      He wasn't dumb at all. He knew exactly what he was doing, i.e. stealing IP space so that he could send his porn spam and host the porn sites at IP space that wouldn't easily track back to him.

      It's just that, in typical spammer fashion, he lied to the reporter who called him about it. And in typical reporter fashion, the reporter believed him without verifying the facts.

      Proletariat of the world, unite to kill

  • Whole block, or specific ones? (Score:3, Interesting)

    by Matrix272 ( 581458 ) on Wednesday June 11, 2003 @03:08PM (#6174083)
    There are a few posts about specific unused IP's being stolen, while the used ones went on working as normal... is that what happened, or did what's-his-name in Northern California take over the whole class C, similar to taking over a domain? If it was the latter, I'm surprised nobody's tried it before... given that it's really not extremely difficult to move a domain from one person to another, it can't be too hard to do the same for a block of IP's.

    So is it certain IP's that weren't being used, or a large block of IP's that were just read internally from the servers and directed to where the servers thought they should go?

  • It would only be fair.... (Score:4, Funny)

    by Anonymous Coward on Wednesday June 11, 2003 @03:08PM (#6174088)
    That this guy would end up in jail and that big guy in the cell next door merely "borrows" his ass for a pack of cigarettes.

  • what a riot (Score:2, Funny)

    by Anonymous Coward
    and said he paid $500 for it to a guy he met online."

    That's like saying, "Fucktard6969 on IRC said that the software he's hooking me up with is legit"

  • I've got an easy solution to THIS one... (Score:5, Interesting)

    by Greyfox ( 87712 ) on Wednesday June 11, 2003 @03:10PM (#6174111) Homepage Journal
    Charge the recipients of the space with fraud, theft of property and services and possibly forgery as well and send them to jail for a long time. They in effect comissioned the theft of that space and should be held responsible.

    The legwork involved in assuring that a block of IPs is legitimate should be fairly simple and part of the network administrator's job. We're not talking about end-users here, we're talking about networking professionals acting on behalf of a corporation. If they don't do their job properly they should be held responsible for that failure, especially when the transaction should raise suspicions as these would.

    • The legwork involved in assuring that a block of IPs is legitimate should be fairly simple and part of the network administrator's job.

      But the guy selling the block already has plenty of documentation that verifies his story; that's how he got the addresses transferred to him in the first place. Are you saying every admin that wants to buy a couple of addresses needs to do more work than the company routing the traffic just to verify everything is legit?

      • If you're just paying "some guy" through paypal, YES! That's the internet equivalent of buying equipment out of the back of a van. No responsible corporate acquisitions person would do that without more checking. Why should acquiring IP addresses be any different?

        I'm not saying that Joe Average Windows User should have to do research to make sure that the IP he's using from his ISP is legit. I'm saying that the network administrator for that ISP should. It should be pretty easy to check to see when the IP

  • The point? (Score:5, Funny)

    by _Sharp'r_ ( 649297 ) <sharper@@@booksunderreview...com> on Wednesday June 11, 2003 @03:10PM (#6174112) Homepage Journal
    What's the point of stealing IPs to spam? Haven't these guys ever heard of wardriving for IPs?

    These guys really need some serious technical help...

    (Yes, not meant seriously for those law/spam enforcement types out there!)

  • I submitted this... (Score:5, Informative)

    by robslimo ( 587196 ) on Wednesday June 11, 2003 @03:11PM (#6174123) Homepage Journal
    a couple of weeks ago. Not this particular article, but a little write-up with some nice links (rejected, of course).

    Links:
    In your face hijacking [merit.edu]

    Current list of possible bogus bgp routes [cidr-report.org]

    Oh, well.

  • Legit IP space should be easier to get (Score:5, Interesting)

    by sjhwilkes ( 202568 ) on Wednesday June 11, 2003 @03:12PM (#6174136)
    ARIN and their members made this problem for themselves. If legit space was easier to get - you currently need to prove you have 16000 hosts. Then people would be more traceable and accountable.

    Spammers are now in a very tight spot in that their address space gets blacklisted faster than ever before so they have to keep changing - at the same time they're still making good money to use to bribe people (by paying way more for bandwidth than is normal) into taking their BGP advertisments for space of dubious origin.

    The old swamp space is never going to be reclamed just because legally it would be such a pain to do so - it would make more lawyers rich, without solving the problem because there will always be space left that can be hijacked if only for a shorter and shorter time.

    Simon
    • So, what is the right way to deal with this problem?

      I'd like to setup a redundant internet connection across multiple ISP's for my data center (colo isn't an option for medical data), but, as far as I can tell, I need to get a large netblock to get a BGP advertisement. I don't need a large netblock, though, I just need the redundancy.

      I could have one of my ISP's do a classless CIDR thingy for me, but then I'm back to depending on an ISP's connection, sorta defeating the point of having the redundant conn

  • LA County needs a whole class B subnet? (Score:3, Interesting)

    by HornyBastard77 ( 667965 ) on Wednesday June 11, 2003 @03:13PM (#6174148)
    Just what is a single county doing with 65,534 IP addresses in the first place?

    IPv6 may alleviate the current IP scarcity and the worldwide divide that it creates, but till that kicks in(and it doesn't look like it will anytime soon), ARIN et al need to take a closer look at this IP hoarding. Till that happens, this hijacking of IP space might be a good solution for ISPs in China, India, etc.

    • Re:LA County needs a whole class B subnet? (Score:5, Interesting)

      by capnjack41 ( 560306 ) <spam_me@crapola.org> on Wednesday June 11, 2003 @03:26PM (#6174274)
      My old university has all of 149.150.x.x. There's about 10,000 students & faculty, and each machine used to occupy a single public IP. Now, they have several private VLAN's (10.x.x.x), so now only every building has an IP (well, a few addresses). So between regular Internet access, plus servers, etc., there's probably a couple hundred IP's in use...out of 65534! Aces.

      I'd also like to know if companies like IBM, GE, and such really use all of their class A's; or of the US DoD really uses their multiple class A's (at least 3 that ARIN would let me check before they started denying my frequent requests -- that's at least 50 million addresses)

      • My university (which I don't represent here, include stddisclaimer.h etc) has a Class B, but we actually use almost all of it..

        because Australia pays so much for internet traffic, everything must be accountable for, so each student who wants internet access has a dialup with a static ip, and each desktop machine has a world routable static ip from the class B (which is in turn routed internally into class A and CIDR blocks)

        And Apple uses it's 17.0.0.0/8.. it has hundreds of offices around the world thousa
    • That's not uncommon for groups that got IP space in the 80's. Back in the days of classful routing, one got a /16 if one had more than 254 and less than 16534 hosts on their network.

      I know a hospital in Toronto that had a /16 hanging off a 128k ISDN link up until recently.

    • A single county with over 9.6 million people living in it. That requires a huge amount of civil services, and hence a lot of computers.

    • Re:LA County needs a whole class B subnet? (Score:2, Informative)

      by Anonymous Coward
      TCP/IP was designed to be end-to-end, so the recommendation for many years was to assign "real" addresses to all internal hosts. Nobody was really thinking of firewalls, NAT, etc -- the future was Every Host On The Internet.

      You can't accuse someone of "hording" when they were following ARIN's recommendations.

  • I'll go one better (Score:4, Funny)

    by SquadBoy ( 167263 ) on Wednesday June 11, 2003 @03:14PM (#6174157) Homepage Journal
    I have a whole bunch of 10.0.0.0/8 address spaces for sale. :)
  • maybe he wasn't stealing them for spam, maybe he had alot of computers and just wanted to comply with his states Super-DMCA ???

  • Only the beginning (Score:3, Insightful)

    by globalar ( 669767 ) on Wednesday June 11, 2003 @03:15PM (#6174172) Homepage
    This problem will grow with more address space. Though the value of individual addresses will diminish in the future with IPv6, it is important to keep virtual property lines clear. This needs to be handled now. Exceptions made are only going to lead to problems in the future.

  • Possible solution (Score:4, Informative)

    by Todd Knarr ( 15451 ) on Wednesday June 11, 2003 @03:20PM (#6174224) Homepage

    Perhaps we ought to go to what we had with DNS domains back before Verisign privatized: you create a PGP public key and register it when you get your block, and from there on out any requests to change information about that block are only valid if they're signed with that key (or after some very stringent checks if you claim you've lost the key). That'd make it more difficult for hijackers to change the registration information.

    • Other than the fact that this isn't going to fully solve the problem. If somebody configures devices (any IP-addressed devices of any kind) with IP addresses that don't belong to them, their routers will broadcast the fact that they're on the path that leads to that IP space to any upstream routers that are willing to listen. Hopefully, the ISP's routers will be smart enough to know that the IP address space doesn't belong there... However if you they trick either the ISP's staff or just the ISP's routers i

      • Re:Possible solution (Score:3, Informative)

        by Todd Knarr ( 15451 )

        Most of the big bandwidth providers don't just automatically accept any IP blocks you advertise. They want to know beforehand what blocks you'll be using. If you can't alter someone else's netblock registration to reflect your information, it makes it a lot harder to fake out the provider. Either you have to go to the trouble of forging all your documentation to look like the real owner or as soon as the provider you're trying to use checks the registration they'll see that the info for the owner of the blo

  • other items for sale: (Score:4, Funny)

    by JDizzy ( 85499 ) on Wednesday June 11, 2003 @03:25PM (#6174262) Homepage Journal
    The Brooklyn Bridge, the New York Sewer system.

    Send me a check for $500 and they will be yours!

  • interesting (Score:2, Interesting)

    by dbrummer ( 570956 )
    That's pretty odd how someone can just hijack a /16 like that. A /16 is a lot of IP addresses, not really easy to sort of overlook it. Usually something that big is already allocated by the users ISP and announce via BGP. I wonder how these guys were able to go behind the BGP allocations and announce it on there own. I know most ISP's won't allocate a block of IP addresses if it is already being advertised by another peer. Dan

  • Solution (Score:5, Funny)

    by LittleGuy ( 267282 ) on Wednesday June 11, 2003 @03:30PM (#6174327)

    Arm DNS Registrars with guns and tazers

    Ask users to take off shoes before mass e-mailing

    Round up geeks and other suspicious technical people as 'persons of interest' to secure undisclosed locations...

    Wait, these guidelines are from Homeland Security.

  • Confronting these hijackers - Daytime TV style (Score:5, Funny)

    by Torgo's Pizza ( 547926 ) on Wednesday June 11, 2003 @03:31PM (#6174339) Homepage Journal
    You know, sometimes I think the answer to "confronting" these pigs is to not use the courts, but use Jerry Springer.

    Jerry: Today on our show, we have people who have stolen IP addresses to send SPAM. Why did you do it Larry?

    Larry: Jerry, it's an addiction I have. I just feel the need to tell everyone that by sending money to my friend in Nigeria, they can get a stimulating diplomia and have investment opportunities in appendage lengthening. Is that so wrong? Audience boos.

    Jerry: Not everyone agrees with you. Let's bring out a system administrator whose IP you hijacked.

    SysAdmin: Appears from backstage. Upon seeing Larry, rushes him fists raised. You stupid #$@&! I'll kill you! I'll kick your fsking @$$! Throws chair. Is restrained by large bald stagehand. You stole my IP! I'll get you!

  • You too can have your own /16.. (Score:5, Interesting)

    by Elk_Moose ( 575881 ) on Wednesday June 11, 2003 @03:44PM (#6174463) Homepage
    Get Yours Now on Ebay! [ebay.com]

    Don't know if it legit or not but here is one on Ebay now :) Hurry and get your own 65535 addresses!

  • This is going to keep happening... (Score:3, Insightful)

    by cheetah ( 9485 ) on Wednesday June 11, 2003 @04:09PM (#6174739)
    This is going to keep happening until Arin starts pushing Ipv6. The real problem is that currently getting Ipv6 costs money and doesn't get you very far. Look at it this way... currently a Ptla /32 costs $2500 a year. But people that have been sitting on Ipv4 blocks for years don't pay anything. I know of two Isp's that would like to offer Ipv6 the their customers but because they don't have their own Ipv4 netblocks they don't want to pay $2500 a year just so few of their customers have Ipv6. So instead of getting Ipv6 and moving away from Ipv4 they are forced to stay with Ipv4. I think that the situation is currently backwards to the way it should be. Arin ( and other Ipv4 providers ) should be charging next to nothing for Ipv6 netbocks ($100 or so) and slowly start charging for Ipv4 blocks each year. So for the first year charge $100 for each Ipv4 block (on top of any other fees). The second year the would charge 500 and the year after that 1000 and then 3000 and so on... Until we start charging more for Ipv4 address's than Ipv6 we will have people trying to hijack current Ipv4 netblocks... The more people that can get switched over to Ipv6 the sooner the better. If everyone was using Ipv6 this will no longer be a problem...

  • This article raises an interesting point. When a spammer successfuly hijacks address space and uses it to send spam, his IPs are naturally going to appear on various blacklists before too long.

    The problem isn't limited to blacklists, either. Bayesian spam filters [paulgraham.com] will quickly learn to recognize Received-From headers bearing the stolen IPs. Collaborative hashing filters [sourceforge.net] will also be affected, to a degree.

    So...the spammer steals a subnet, uses it to spam for awhile, and then is either shut down or abandons his activities. He leaves behind a zone of "scorched earth" -- addresses that are effectively cannot host a mail transfer agent. It is now the job of the next legitimate recipient to clean up the spammer's mess. He might not even notice anything's wrong until half his emails have gone missing and the other have are bounced with mysterious messages. Having identified the problem, it is now up to him to track down various blacklists and get his addresses removed. The damage done to the Bayesian and collaborative filters simply cannot be undone. Mail will be lost.

    To me, this is the real tragedy. Once an address block has been used for spamming, it's effectively ruined until someone inherits it and puts a great deal of time and effort into restoring its good reputation.

    • This is sad. :-(
      But! On the flip side. Can I buy a block of "scorched" IPs for cheap? To maybe host gaming servers? Lots of good profit making ways to use IPs; that don't include email.

      Point me in the right direction; I'm ready!
    • Bayesian spam filters will quickly learn to recognize Received-From headers bearing the stolen IPs.

      Duh, they just as quickly UNLEARN those same addresses when the sewage stops spilling. Bayesian classifiers have NOTHING to do with "scorched earth" network blocks, and never have.

      The real problem is private access_db blacklists that someone tosses an address into, and forgets about it. The next guy that takes his admin job doesn't even know it's there.

  • BIG Deal! (Score:3, Funny)

    by JohnnyGTO ( 102952 ) on Wednesday June 11, 2003 @04:15PM (#6174825) Homepage
    When some one can tell me how to get back my ICQ # 116117 AND keep it for more then 48 hours, I be impressed

  • Selling a subnet? (Score:4, Interesting)

    by Hayzeus ( 596826 ) on Wednesday June 11, 2003 @04:54PM (#6175261) Homepage
    How would one LEGITIMATELY go about this. The article mentions grey market brokers, but how would one go about getting rid of an IP-block they actually own? Or can they even be legally transfered?

  • In related news... (Score:5, Funny)

    by Realistic_Dragon ( 655151 ) on Wednesday June 11, 2003 @04:56PM (#6175297) Homepage
    Executives at SCO, the RIAA, Amazon and other large companies sufered public embarrisment when it was annouced that IP was being stolen and they rushed home to see if they owned any of it to sue over.

  • Stop (Score:3, Interesting)

    by darthtuttle ( 448989 ) <meconlen@obfuscated.net> on Wednesday June 11, 2003 @05:31PM (#6175679) Homepage
    I wonder how much of this kind of stuff would stop if we

    1. blocked spam at the client based on content, not by blocking IP addresses

    2. let people spam.

    If we know who and where the spammers are and let them have their own little space in the world, and didn't outright reject talking to them, they wouldn't be doing this sort of thing. The biggest problem is that the cost to download is a large multiple of the cost to upload, since you can send to a whole lot of people in one shot, but there's an easy technical solution to that (don't let people send an email to 5000 people at your server in one shot).

    Maybe it's time to treat them like the parts of the porn industry who works with filtering companies to identify them selves. Give them their own little sandbox to play in, don't threaten to shut them off, and then block them at the client side, or once they are in the mailbox, because what we are doing to fight them isn't working (as evidenced by my pile of spam despite all possilbe server side filtering techniques) and they are going to fight dirty if they can't have a chance fighting fair.

    You may now mod this down.

  • i've seen this firsthand (Score:3, Interesting)

    by Tancred ( 3904 ) on Wednesday June 11, 2003 @07:02PM (#6176336)
    I'm part of the IP Admin group of a large international ISP and have seen this firsthand. New customers routinely ask us to route space, and sometimes it's difficult to tell if it's theirs or not what with all the mergers, acquisitions and renaming of companies. There's definitely more scrutiny of these requests than there was a year ago.

    A few months ago spammers started to hijack IP space that was registered to companies that are now out of business, which means that most likely nobody is going to notice what they've done.

    After a while it's almost like getting squatters' rights - I've been using it and nobody else has a real claim to it, so it's mine.

Slashdot Top Deals

Kleeneness is next to Godelness.

Close