Vincent Canfield, a mail service administrator and reseller hosting for cock.li, discovered that his entire IP network was automatically blacklisted by the DNSBL UCEPROTECT due to port scanning from neighboring virtual machines. Vincent's subnet fell into Level 3, where blocking occurs based on autonomous system numbers and encompasses entire subnets from which spam detection systems have been triggered multiple times for different addresses. As a result, the provider M247 disabled the announcement of one of his networks in BGP, effectively suspending service.
The problem is that proxies szerverek UCEPROTECT, which pretend to be open relays and record attempts to send mail through them, automatically add addresses to the block list based on any network activity without checking the network connection establishment. A similar blacklisting method is also applied by the Spamhaus project.
To get on the blocklist, it is enough to send a single TCP SYN packet, which can be exploited by attackers. In particular, since there is no need for bidirectional confirmation of the TCP connection, it is possible to spoof the sending of a packet with a fake IP address and initiate the blacklisting of any host. By simulating activity from multiple addresses, it is possible to escalate the blocking to Level 2 and Level 3, which implement blocking based on subnets and autonomous system numbers.
Level 3 was originally created to combat providers that encourage malicious activities by clients and do not respond to complaints (for example, hosting services specifically set up for hosting illegal content or servicing spammers). A few days ago, UCEPROTECT changed the rules for being listed in Levels 2 and 3, leading to more aggressive filtering and an increase in the size of the lists. For instance, the number of entries in the Level 3 list has grown from 28 to 843 autonomous systems.
To counter UCEPROTECT, the idea of using IP spoofing from the sponsors' range during scanning has been expressed. As a result, UCEPROTECT added the addresses of its sponsors and many other innocent parties to its databases, causing email delivery issues. This included the CDN network of Sucuri.
Forrás: opennet.ru
