Attacks/Breaches
Guest Blog // Selected Security Content Provided By Sophos
What's This?
7/7/2014
12:10 PM
Maxim Weinstein
Maxim Weinstein
Security Insights
50%
50%

Microsoft, No-IP, And The Need For Clarity

The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.

By now, Microsoft's court-approved takeover of No-IP has been widely discussed. The intent was to stop malware and other cybercrime, but the effect was much broader, causing many legitimate domain names to go offline for several days.

Microsoft has faced a lot of criticism about this, some of it well deserved. The company has been accused of overreaching, of acting as a vigilante, and of not cooperating with the security community. No-IP has also claimed that Microsoft never reported the abuse or requested No-IP's cooperation before acting. These are all legitimate concerns. But there's also another issue at play here: We have no clear expectations for how intermediary service providers like No-IP should behave and no transparency on how they are behaving.

No-IP is not the first service provider to be abused by criminals. Popular free email services like Gmail, Hotmail, and Yahoo Mail have all been abused for years. So have blogging services like Google's Blogger, domain name registrar and registry operators like Verisign, and web hosting companies like GoDaddy. There's a general sense that ethically, and perhaps legally, these providers should ensure that they're not facilitating -- or profiting from -- their customers' malicious behavior.

But what, exactly, does this mean in practice? To what degree should (or can) the service providers vet customers before allowing them to sign up? How actively (and potentially intrusively) should the providers monitor their customers' use of the services to look for abuse? How thoroughly should they investigate when a third party reports abuse, and what is the standard of "proof" the provider requires before acting? And what is the appropriate action when abuse is discovered? A warning? Temporary suspension of service? Immediate termination of the account?

Even if we had answers to these questions, how would the security community (or a court, if necessary) decide whether a provider was acting in accordance with the expectations?

One option would be some sort of abuse reporting clearinghouse, coupled with a set of community-developed standards or best practices. The clearinghouse, or those doing the reporting, could monitor service providers' response to abuse reports. The data could be made publicly available, providing transparency into the extent of and the response to abuse at specific providers. Service providers like No-IP would get clear guidance for how they are expected to act. They would also have a level playing field, because all service providers would be held to the same standards. Prosecutors and civil claimants (like Microsoft or the Federal Trade Commission) would have clear evidence to support a case of negligence on the part of a service provider. And, with a little publicity, the market would likely pressure lax service providers to step up their game.

Who would bring together disparate viewpoints to create and publish standards and operate an abuse clearinghouse? It could be a governmental agency, though with the global nature of the Internet and the bureaucratic nature of government, I'd rather see a nongovernmental not-for-profit organization take on a project like this. I'm biased toward StopBadware, a spinoff of Harvard University's Berkman Center for Internet & Society that I used to lead and continue to help direct as a board member. In its early years, StopBadware played a similar "neighborhood watch" role with bad software applications. With the right support from the Microsofts of the world, it would be well positioned to do the same with service provider abuse.

Regardless of who makes it happen, the solution to the abuse of intermediary service providers is increased cooperation and transparency, not controversial one-off takeovers by individual private companies.

Maxim Weinstein, CISSP, is a technologist and educator with a passion for information security. He works in product marketing at Sophos, where he specializes in server protection solutions. He is also a board member and former executive director of StopBadware. Maxim lives ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Dark Reading Strategic Security Report: The Impact of Enterprise Data Breaches
Social engineering, ransomware, and other sophisticated exploits are leading to new IT security compromises every day. Dark Reading's 2016 Strategic Security Survey polled 300 IT and security professionals to get information on breach incidents, the fallout they caused, and how recent events are shaping preparations for inevitable attacks in the coming year. Download this report to get a look at data from the survey and to find out what a breach might mean for your organization.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Security researchers are finding that there's a growing market for the vulnerabilities they discover and persistent conundrum as to the right way to disclose them. Dark Reading editors will speak to experts -- Veracode CTO and co-founder Chris Wysopal and HackerOne co-founder and CTO Alex Rice -- about bug bounties and the expanding market for zero-day security vulnerabilities.