Attacks/Breaches
Guest Blog // Selected Security Content Provided By Sophos
What's This?
7/7/2014
12:10 PM
Maxim Weinstein
Maxim Weinstein
Security Insights
Connect Directly
RSS
E-Mail
50%
50%

Microsoft, No-IP, And The Need For Clarity

The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.

By now, Microsoft's court-approved takeover of No-IP has been widely discussed. The intent was to stop malware and other cybercrime, but the effect was much broader, causing many legitimate domain names to go offline for several days.

Microsoft has faced a lot of criticism about this, some of it well deserved. The company has been accused of overreaching, of acting as a vigilante, and of not cooperating with the security community. No-IP has also claimed that Microsoft never reported the abuse or requested No-IP's cooperation before acting. These are all legitimate concerns. But there's also another issue at play here: We have no clear expectations for how intermediary service providers like No-IP should behave and no transparency on how they are behaving.

No-IP is not the first service provider to be abused by criminals. Popular free email services like Gmail, Hotmail, and Yahoo Mail have all been abused for years. So have blogging services like Google's Blogger, domain name registrar and registry operators like Verisign, and web hosting companies like GoDaddy. There's a general sense that ethically, and perhaps legally, these providers should ensure that they're not facilitating -- or profiting from -- their customers' malicious behavior.

But what, exactly, does this mean in practice? To what degree should (or can) the service providers vet customers before allowing them to sign up? How actively (and potentially intrusively) should the providers monitor their customers' use of the services to look for abuse? How thoroughly should they investigate when a third party reports abuse, and what is the standard of "proof" the provider requires before acting? And what is the appropriate action when abuse is discovered? A warning? Temporary suspension of service? Immediate termination of the account?

Even if we had answers to these questions, how would the security community (or a court, if necessary) decide whether a provider was acting in accordance with the expectations?

One option would be some sort of abuse reporting clearinghouse, coupled with a set of community-developed standards or best practices. The clearinghouse, or those doing the reporting, could monitor service providers' response to abuse reports. The data could be made publicly available, providing transparency into the extent of and the response to abuse at specific providers. Service providers like No-IP would get clear guidance for how they are expected to act. They would also have a level playing field, because all service providers would be held to the same standards. Prosecutors and civil claimants (like Microsoft or the Federal Trade Commission) would have clear evidence to support a case of negligence on the part of a service provider. And, with a little publicity, the market would likely pressure lax service providers to step up their game.

Who would bring together disparate viewpoints to create and publish standards and operate an abuse clearinghouse? It could be a governmental agency, though with the global nature of the Internet and the bureaucratic nature of government, I'd rather see a nongovernmental not-for-profit organization take on a project like this. I'm biased toward StopBadware, a spinoff of Harvard University's Berkman Center for Internet & Society that I used to lead and continue to help direct as a board member. In its early years, StopBadware played a similar "neighborhood watch" role with bad software applications. With the right support from the Microsofts of the world, it would be well positioned to do the same with service provider abuse.

Regardless of who makes it happen, the solution to the abuse of intermediary service providers is increased cooperation and transparency, not controversial one-off takeovers by individual private companies.

Maxim Weinstein, CISSP, is a technologist and educator with a passion for information security. He works in product marketing at Sophos, where he specializes in server protection solutions. He is also a board member and former executive director of StopBadware. Maxim lives ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2227
Published: 2014-07-25
The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) before 3.0.1 does not restrict access to the application, which allows remote attackers to bypass the Same Origin Policy via a crafted SWF file.

CVE-2014-5027
Published: 2014-07-25
Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via a query parameter to a diff fragment page.

CVE-2014-5100
Published: 2014-07-25
Multiple cross-site request forgery (CSRF) vulnerabilities in Omeka before 2.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) add a new super user account via a request to admin/users/add, (2) insert cross-site scripting (XSS) sequences via the api_key_...

CVE-2014-5101
Published: 2014-07-25
Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_nick, (3) TPL_email, (4) TPL_year, (5) TPL_address, (6) TPL_city, (7) TPL_prov, (8) TPL_zip, (9) TPL_phone, (10) TPL_pp_email, (11) TPL_authn...

CVE-2014-5102
Published: 2014-07-25
SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.