Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite
1

I'm building a template for use when sending "abuse" notifications to ISPs, hosting providers, etc., for when attacks originate from their netblock.

Are there examples of templates used for this purpose that have been well designed or vetted or which otherwise reflect what is advisable/inadvisable to include in these notifications?

Put another way:

  • What information should be included in such a notification
  • What information should not be included in such a notification
share|improve this question
This could vary quite a lot between organizations depending on their OpSec and where their data comes from. – adric Oct 12 '12 at 22:23
@adric That's sort of the point -- determining what sort of data is useful or necessary without being sensitive. Just how much information do you give; that sort of thing. Clearly the recipient is going to want at least the attacker's IP and the time, so that can be correlated with their own logs. But what else? – tylerl Oct 12 '12 at 23:24
Not what you want to hear, but I suspect the folks you'll be trying to send the info to have a large and growing black hole where they'll store your data. In other words, try something more likely to be effective. I have no idea what that may be. – ddyer Oct 13 '12 at 23:50
@ddyer actually datacenters tend to take abuse notifications seriously. Compromised servers cost them very real dollars, and notifications from outside tend to be one of the primary ways they find out which accounts need to be suspended. – tylerl Oct 14 '12 at 15:40
the servers which are being abused pay attention, but the sources of the abuse are impossible to reach. After all, your abuser is their paying customer. The OP was a victim planning to complain to the perp. – ddyer Oct 14 '12 at 19:29
show 2 more comments

3 Answers

up vote 5 down vote accepted

It should contain all the necessary information about the attack and what action you would like them to take. Some key information would include:

  • IP address of the host performing the attack
  • The type of attack or activity coming from that host
  • The details of your server(s)
    • This could include the IP address/es of the server/s being attacked
  • Ask them to investigate the incident and report back to you
  • If the attack was damaging then tell them how it has affected you

They may take some time to respond to you so just be patient.

share|improve this answer
For a template, I think it's hard to autogenerate the damage that was done. – Luc Oct 12 '12 at 23:07
1  
Timestamps, including an explicit mentioning of the timezone, GMT preferred – Hendrik Brummermann♦ Oct 17 '12 at 7:35
up vote 2 down vote

Personally I think it is impossible to design a template that meets the need of all abuse reporting scenarios. So I would advise developing a tool to take care of querying the user (internal/external) the required information based on type of abuse and the type of details required to be sent or expected to be received.

Having said that here is a kick start on something that can be built into a template:

template.abuse:

Date/Time of abuse       : {<date/time format>}
TimeZone                 : [<pick-list>]
Contact Name             : {<free-form>}
Contact Email(s)         : {<free-form>}
Wish to remain anonymous : [Y|N]
Contact Business         : {<free-form,expected:name of business if relavent>}
Contact Business Address : {<free-form,expected:address of business if relavent>}
Type of abuse            : [<pick-list, e.g.:
Open relay/Proxy/NNTP
Phishing report
Virus or Worm
Offensive material
Copyright
Network attack
Spam
Port scan
>
                           //
#import(Type of abuse)     // <-- imports fields relevant for the type of abuse
                           // e.g. "Virus or Worm" -> template.virus_or_worm
                           // see below...

]    
Additional Notes         : { free-form,e.g.:
Ports Scanned
Bulk content details
Etc.
}

template.virus_or_worm:

Source of Abuse          : {<free-form,expected: IPs, email addresses, usernames, etc>}
Evidence                 : {<free-form,expected: logs, emails, etc>}

Important thing to take away is that it is not a good idea to have a generic template for 'everything' as users end up selecting things they 'believe' the labels on the form mean rather than their intended meaning.

And interactive tool (web-app/form or otherwise) that aids the user while allowing them to select "Other type of abuse" where the abuse is not specifically listed would allow for a more relevant information to be collected/sent thereby reducing unwanted problems.

See also small beginnings: Exhaustive list of abuse notifications that organizations get

share|improve this answer
up vote 4 down vote
+50

I agree with the general details that Hammo has already outlined, though I'd reccomend that you look at the full requirements of the proposed Abuse Reporting Format (ARF) for inclusion in your automated messages. ISPs recieve a large volume of messages, and by following this standard (or proposed standard as it is) will more likely allow effective processing of your messages.

http://datatracker.ietf.org/wg/marf/charter/

http://en.wikipedia.org/wiki/Abuse_Reporting_Format

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.