Attacks/Breaches
Guest Blog // Selected Security Content Provided By Sophos
What's This?
7/7/2014
12:10 PM
Maxim Weinstein
Maxim Weinstein
Security Insights
50%
50%

Microsoft, No-IP, And The Need For Clarity

The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.

By now, Microsoft's court-approved takeover of No-IP has been widely discussed. The intent was to stop malware and other cybercrime, but the effect was much broader, causing many legitimate domain names to go offline for several days.

Microsoft has faced a lot of criticism about this, some of it well deserved. The company has been accused of overreaching, of acting as a vigilante, and of not cooperating with the security community. No-IP has also claimed that Microsoft never reported the abuse or requested No-IP's cooperation before acting. These are all legitimate concerns. But there's also another issue at play here: We have no clear expectations for how intermediary service providers like No-IP should behave and no transparency on how they are behaving.

No-IP is not the first service provider to be abused by criminals. Popular free email services like Gmail, Hotmail, and Yahoo Mail have all been abused for years. So have blogging services like Google's Blogger, domain name registrar and registry operators like Verisign, and web hosting companies like GoDaddy. There's a general sense that ethically, and perhaps legally, these providers should ensure that they're not facilitating -- or profiting from -- their customers' malicious behavior.

But what, exactly, does this mean in practice? To what degree should (or can) the service providers vet customers before allowing them to sign up? How actively (and potentially intrusively) should the providers monitor their customers' use of the services to look for abuse? How thoroughly should they investigate when a third party reports abuse, and what is the standard of "proof" the provider requires before acting? And what is the appropriate action when abuse is discovered? A warning? Temporary suspension of service? Immediate termination of the account?

Even if we had answers to these questions, how would the security community (or a court, if necessary) decide whether a provider was acting in accordance with the expectations?

One option would be some sort of abuse reporting clearinghouse, coupled with a set of community-developed standards or best practices. The clearinghouse, or those doing the reporting, could monitor service providers' response to abuse reports. The data could be made publicly available, providing transparency into the extent of and the response to abuse at specific providers. Service providers like No-IP would get clear guidance for how they are expected to act. They would also have a level playing field, because all service providers would be held to the same standards. Prosecutors and civil claimants (like Microsoft or the Federal Trade Commission) would have clear evidence to support a case of negligence on the part of a service provider. And, with a little publicity, the market would likely pressure lax service providers to step up their game.

Who would bring together disparate viewpoints to create and publish standards and operate an abuse clearinghouse? It could be a governmental agency, though with the global nature of the Internet and the bureaucratic nature of government, I'd rather see a nongovernmental not-for-profit organization take on a project like this. I'm biased toward StopBadware, a spinoff of Harvard University's Berkman Center for Internet & Society that I used to lead and continue to help direct as a board member. In its early years, StopBadware played a similar "neighborhood watch" role with bad software applications. With the right support from the Microsofts of the world, it would be well positioned to do the same with service provider abuse.

Regardless of who makes it happen, the solution to the abuse of intermediary service providers is increased cooperation and transparency, not controversial one-off takeovers by individual private companies.

Maxim Weinstein, CISSP, is a technologist and educator with a passion for information security. He works in product marketing at Sophos, where he specializes in server protection solutions. He is also a board member and former executive director of StopBadware. Maxim lives ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.