Vincent Canfield, administrator of the mail service and hosting reseller cock.li, discovered that his entire IP network was automatically listed in the DNSBL UCEPROTECT due to port scanning from neighboring virtual machines. Vincent's subnet was placed on Level 3, where blocking occurs based on Autonomous System numbers and encompasses entire subnets that have repeatedly triggered spam detection for different addresses. As a result, the provider M247 disabled the announcement of one of his networks in BGP, effectively suspending service.
The problem is that the proxies servrar UCEPROTECT, which pretends to be open relays and logs attempts to send mail through them, automatically adds addresses to the blocklist based on any network activity, without verifying the establishment of the network connection. A similar method of blacklisting is also employed by the Spamhaus project.
To get on the blocklist, it is enough to send one TCP SYN packet, which could be exploited by malicious actors. In particular, since two-way confirmation of the TCP connection is not required, it is possible to spoof and send a packet indicating a fake IP-adresser and initiate the blocking of any host. By simulating activity from multiple addresses, it is possible to escalate the block to Levels 2 and 3, which perform blocking by subnets and Autonomous System numbers.
Level 3 was originally created to combat providers that encourage malicious activity by clients and do not respond to complaints (for example, hosting services specifically created for hosting illegal content or servicing spammers). A few days ago, UCEPROTECT changed the rules for being listed on Levels 2 and 3, leading to more aggressive filtering and an increase in the size of the lists. For instance, the number of entries in the Level 3 list grew from 28 to 843 Autonomous Systems.
För att motverka UCEPROTECT har idén om att anvÀnda spoofing av adresser vid skanning med IP-adresser frÄn UCEPROTECT:s sponsorer föreslagits. I slutÀndan inkluderade UCEPROTECT adresser frÄn sina sponsorer och mÄnga andra oskyldiga i sina databaser, vilket skapade problem med leveransen av e-post. Bland annat hamnade CDN-nÀtverket för företaget Sucuri pÄ blocklistan.
KĂ€lla: opennet.ru
