Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Guest Blog // Selected Security Content Provided By Sophos
What's This?
7/7/2014
12:10 PM
Maxim Weinstein
Maxim Weinstein
Security Insights
50%
50%

Microsoft, No-IP, And The Need For Clarity

The Microsoft vs. No-IP case highlights the need for clear standards of abuse handling and transparency on which service providers measure up.

By now, Microsoft's court-approved takeover of No-IP has been widely discussed. The intent was to stop malware and other cybercrime, but the effect was much broader, causing many legitimate domain names to go offline for several days.

Microsoft has faced a lot of criticism about this, some of it well deserved. The company has been accused of overreaching, of acting as a vigilante, and of not cooperating with the security community. No-IP has also claimed that Microsoft never reported the abuse or requested No-IP's cooperation before acting. These are all legitimate concerns. But there's also another issue at play here: We have no clear expectations for how intermediary service providers like No-IP should behave and no transparency on how they are behaving.

No-IP is not the first service provider to be abused by criminals. Popular free email services like Gmail, Hotmail, and Yahoo Mail have all been abused for years. So have blogging services like Google's Blogger, domain name registrar and registry operators like Verisign, and web hosting companies like GoDaddy. There's a general sense that ethically, and perhaps legally, these providers should ensure that they're not facilitating -- or profiting from -- their customers' malicious behavior.

But what, exactly, does this mean in practice? To what degree should (or can) the service providers vet customers before allowing them to sign up? How actively (and potentially intrusively) should the providers monitor their customers' use of the services to look for abuse? How thoroughly should they investigate when a third party reports abuse, and what is the standard of "proof" the provider requires before acting? And what is the appropriate action when abuse is discovered? A warning? Temporary suspension of service? Immediate termination of the account?

Even if we had answers to these questions, how would the security community (or a court, if necessary) decide whether a provider was acting in accordance with the expectations?

One option would be some sort of abuse reporting clearinghouse, coupled with a set of community-developed standards or best practices. The clearinghouse, or those doing the reporting, could monitor service providers' response to abuse reports. The data could be made publicly available, providing transparency into the extent of and the response to abuse at specific providers. Service providers like No-IP would get clear guidance for how they are expected to act. They would also have a level playing field, because all service providers would be held to the same standards. Prosecutors and civil claimants (like Microsoft or the Federal Trade Commission) would have clear evidence to support a case of negligence on the part of a service provider. And, with a little publicity, the market would likely pressure lax service providers to step up their game.

Who would bring together disparate viewpoints to create and publish standards and operate an abuse clearinghouse? It could be a governmental agency, though with the global nature of the Internet and the bureaucratic nature of government, I'd rather see a nongovernmental not-for-profit organization take on a project like this. I'm biased toward StopBadware, a spinoff of Harvard University's Berkman Center for Internet & Society that I used to lead and continue to help direct as a board member. In its early years, StopBadware played a similar "neighborhood watch" role with bad software applications. With the right support from the Microsofts of the world, it would be well positioned to do the same with service provider abuse.

Regardless of who makes it happen, the solution to the abuse of intermediary service providers is increased cooperation and transparency, not controversial one-off takeovers by individual private companies.

Maxim Weinstein, CISSP, is a technologist and educator with a passion for information security. He works in product marketing at Sophos, where he specializes in server protection solutions. He is also a board member and former executive director of StopBadware. Maxim lives ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.