Dealing with abuse

slowservers

As some of you know, I also run SporeStack. It's a no-KYC service where you fund a token with cryptocurrency and launch servers on DigitalOcean or Vultr.

The past month I've had a surge in abuse. One of my tactics for dealing with abuse has been to raise the minimum token buy-in. For some time, it's been $100. To slow things down, I set it to an absurdly high $1,000. Even $100 keeps legitimate users away, let alone $1,000!

Then someone paid $1,000 for a brand new token to launch 250 masscan servers.

If losing $1,000, or nearly that, isn't enough to deter abuse, what is?

I ended up shutting down signups for it. One customer suggested a invite type of system. I am not sure.

Do you think there would be any demand for something like that? Is it just not a sustainable model at all?

At the moment, I'm feeling pretty done with it. I hate making money off of malicious use, and I think the scope of malicious use on SporeStack has been far greater than I ever realized.

ascicode

Currently thinking, if you selled freestacks for money.

tentor

I think what you lack is not higher paywall but spending cap, so that no reputation tokens can only get a few (or only one) cheapest servers.

sumo

Would the new karmagate features on les help? It does reduce privacy a little. maybe you can combine that with as tentor mentioned, gate the spending caps.

treesmokah

Add a region where its allowed
Clearly there is a demand for it, and scanning isn't illegal in most countries. Bitlaunch has done it similar with their own regions.

tentor

@treesmokah said:
Add a region where its allowed
Clearly there is a demand for it, and scanning isn't illegal in most countries. Bitlaunch has done it similar with their own regions.

That's certainly a way to deal with crowd abusing e.g. DigitalOcean/Vultr instances for port scan that SporeStack resells but that's not an ultimate solution for all other kinds of abuse if we are to follow same logic and apply it to "DMCA" ignorance, malware distribution and botnet C2 - these also have quite a huge demand.

I do think that if someone is willing to waste $1k for a something "not that legally troublesome" like port scan, there will be even more money in far less legal activities involved. Therefore I would guess that abuse issue is not caused only by scanning incidents like one mentioned in the OP.

friendlyguy12d

Cybercrime is now a real job. the abuser can get 250-500k ransom by finding and exploiting unprotected dbs/computers etc. that assymetry makes paying 1k usd reasonable.

slowservers

@tentor said:
I think what you lack is not higher paywall but spending cap, so that no reputation tokens can only get a few (or only one) cheapest servers.

I have some rate limits in place, but I tied them to lifetime deposits as a "reputation." I think you are right that an association with age is wise as well. I was kind of going for that with lifetime deposits, but a $1,000 lifetime brand new token can appear safer than a 2 year old token trickling in funds for a server or two. I don't think that's effective.

In this case with the 250 masscan servers, it would have been helpful. I think 250 is actually the limit I have for $1,000 lifetime deposits.

This is rare, though. I can't recall so many malicious servers all at once. Usually, it's 1-10 servers on the token that are causing trouble, when ratelimits wouldn't help.

slowservers

@sumo said:
Would the new karmagate features on les help? It does reduce privacy a little. maybe you can combine that with as tentor mentioned, gate the spending caps.

I would certainly feel more confident letting people on LES than completely random people, if there was demand for it.

@treesmokah said:
Add a region where its allowed
Clearly there is a demand for it, and scanning isn't illegal in most countries. Bitlaunch has done it similar with their own regions.

Yes, in some places it is, but I don't want to make money on that. It's like a system. They scan with some nodes. They filter down to types of hosts and technologies, then they have the most malicious acts on servers that they know will get taken down asap. The C2 nodes sit quietly in the corner on other infrastructure. I think it's roughly a three-way split like that between different accounts, providers, etc.

@friendlyguy12d said:
Cybercrime is now a real job. the abuser can get 250-500k ransom by finding and exploiting unprotected dbs/computers etc. that assymetry makes paying 1k usd reasonable.

Yikes, I see. That is crazy if true. I haven't looked into what it looks like on their end.

aphs

set pps limits to point where regular traffic ok masscan is limited to so slow they

slowservers

@aphs said:
set pps limits to point where regular traffic ok masscan is limited to so slow they

I can't do that with reselling. There's a lot of advantages to hosting instead of reselling for this sort of thing.

aphs

@slowservers said: I can't do that with reselling. There's a lot of advantages to hosting instead of reselling for this sort of thing.

Are you selling for example a vultr vm 1:1 passed through, not reselling like renting a hypervisor?

ghostvps

Same model here (DO and OVH, with token-based accounts), so this one hits close. I'm sorry things got to this point.

On my end, there haven't been any abuse reports so far. But with a $1 minimum, if that kind of traffic moved around, I'd obviously be a cheaper and easier target. So I don't take "no reports yet" as a sign that I'm safe.

I agree with tentor that a spending cap makes more sense than forcing a bigger upfront payment. I'll add a default limit for new tokens: max 3 servers until the account has been around for a while or has some payment history. A $1,000 deposit shouldn't mean someone can spin up 250 servers on day one.

@slowservers did the masscan instances trigger abuse tickets from DO right away, or did you catch them first?

dbadude

just block all outgoing traffick, offer a tor proxy server for outgoing traffick.