[TOOLS-DEVELOPMENT] Mailman subscribe attacks - Cloudflare

[Glen <[e-mail]>]

All -

As previously noted, one of the reasons we've been unable to just directly
block the hosts which are participating in the Mailman attack is because of
our use of Cloudflare.  Because we are behind Cloudflare, all incoming
requests appear (to our IP stack) to be coming from Cloudflare (which,
technically, they are.)  Cloudflare does pass the remote IP address in a
transaction header, but firewalls can't do anything with that.

When we began using Cloudflare, we expected that they would detect and
block attacks of this type.  Their apparent inability to do so, combined
with their lack of responsiveness, increases the difficulty we face in
dealing with these attacks.  As I have mentioned previously, we have
reached out to Cloudflare for help with this on several occasions - we have
explained the situation to a number of Cloudflare representatives - and we
have never received any response or guidance from them at all.  Just
yesterday, Russ connected me to a new Cloudflare person - I responded to
that immediately, but have not heard back from them at all as of yet.  I
have high hopes that this new contact will work with us, but I mention this
again so that you're all aware that we're trying to work within this system.

Meanwhile, working independently, one of my engineers has discovered that
there may be an automated way to submit IP bans to Cloudflare.  He is
currently running this down to determine whether such a thing actually
exists, and whether its implementation is feasible.  Since we have had no
communication or support response from Cloudflare, we are, in essence
guessing, but we are pursuing this possibility in the hope that we can
better fight off the attack in this way.

Of course, this is not an ideal solution either:  as additional hosts
become compromised, the "ban list" will grow.  And, once banned, we will no
longer know if a particular host is still compromised and/or attacking us,
so we will have no way to know if we should "unban" that host.  I do not
see this as a permanent solution either, but I wanted to make the
leadership and tools teams aware of this new possibility, so you all are in
the loop as we continue to fight this attack.

As pointed out on some threads - we still hope for a more comprehensive,
high-level solution to problems of this type, at some point in the future.

As always, any questions, let me know.

Best regards,
Glen
Glen Barney
IT Director
AMS (IETF Secretariat)