Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Guest Blog // Selected Security Content Provided By Sophos
What's This?
7/7/2014
12:10 PM
Maxim Weinstein
Maxim Weinstein
Security Insights
50%
50%

Microsoft, No-IP, And The Need For Clarity

The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.

By now, Microsoft's court-approved takeover of No-IP has been widely discussed. The intent was to stop malware and other cybercrime, but the effect was much broader, causing many legitimate domain names to go offline for several days.

Microsoft has faced a lot of criticism about this, some of it well deserved. The company has been accused of overreaching, of acting as a vigilante, and of not cooperating with the security community. No-IP has also claimed that Microsoft never reported the abuse or requested No-IP's cooperation before acting. These are all legitimate concerns. But there's also another issue at play here: We have no clear expectations for how intermediary service providers like No-IP should behave and no transparency on how they are behaving.

No-IP is not the first service provider to be abused by criminals. Popular free email services like Gmail, Hotmail, and Yahoo Mail have all been abused for years. So have blogging services like Google's Blogger, domain name registrar and registry operators like Verisign, and web hosting companies like GoDaddy. There's a general sense that ethically, and perhaps legally, these providers should ensure that they're not facilitating -- or profiting from -- their customers' malicious behavior.

But what, exactly, does this mean in practice? To what degree should (or can) the service providers vet customers before allowing them to sign up? How actively (and potentially intrusively) should the providers monitor their customers' use of the services to look for abuse? How thoroughly should they investigate when a third party reports abuse, and what is the standard of "proof" the provider requires before acting? And what is the appropriate action when abuse is discovered? A warning? Temporary suspension of service? Immediate termination of the account?

Even if we had answers to these questions, how would the security community (or a court, if necessary) decide whether a provider was acting in accordance with the expectations?

One option would be some sort of abuse reporting clearinghouse, coupled with a set of community-developed standards or best practices. The clearinghouse, or those doing the reporting, could monitor service providers' response to abuse reports. The data could be made publicly available, providing transparency into the extent of and the response to abuse at specific providers. Service providers like No-IP would get clear guidance for how they are expected to act. They would also have a level playing field, because all service providers would be held to the same standards. Prosecutors and civil claimants (like Microsoft or the Federal Trade Commission) would have clear evidence to support a case of negligence on the part of a service provider. And, with a little publicity, the market would likely pressure lax service providers to step up their game.

Who would bring together disparate viewpoints to create and publish standards and operate an abuse clearinghouse? It could be a governmental agency, though with the global nature of the Internet and the bureaucratic nature of government, I'd rather see a nongovernmental not-for-profit organization take on a project like this. I'm biased toward StopBadware, a spinoff of Harvard University's Berkman Center for Internet & Society that I used to lead and continue to help direct as a board member. In its early years, StopBadware played a similar "neighborhood watch" role with bad software applications. With the right support from the Microsofts of the world, it would be well positioned to do the same with service provider abuse.

Regardless of who makes it happen, the solution to the abuse of intermediary service providers is increased cooperation and transparency, not controversial one-off takeovers by individual private companies.

Maxim Weinstein, CISSP, is a technologist and educator with a passion for information security. He works in product marketing at Sophos, where he specializes in server protection solutions. He is also a board member and former executive director of StopBadware. Maxim lives ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13991
PUBLISHED: 2020-09-24
vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
CVE-2020-15160
PUBLISHED: 2020-09-24
PrestaShop from version 1.7.5.0 and before version 1.7.6.8 is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in 1.7.6.8
CVE-2020-15162
PUBLISHED: 2020-09-24
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
CVE-2020-15843
PUBLISHED: 2020-09-24
ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client\, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal\. The folder permissions allow "Full Control" t...
CVE-2020-17365
PUBLISHED: 2020-09-24
Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially craf...