Bulletproof Hosting: Ecosystem and Registry-Based Approaches Pierre Tholoniat∗1,2, Ian Chai†1, Amira Dhalla1, Damin Jung1, Stephen Owusu1, and John Sakellariadis1 1Columbia University 2Ecole Polytechnique February 22, 2020 Abstract establishment of a global registry that builds on pre- vious successful models, to unite and extend existing Bulletproof hosts are domain or web hosting legal, policy, and technical efforts. providers that allow customers to host illegal or ma- licious content on their servers. In this paper, we use a cross-disciplinary approach to tackle this issue from 1 Introduction a technical, legal and policy perspective. The problem is emblematic of the issues that Bulletproof hosting facilitates both petty and sophis- plague traditional methods of regulating the global ticated crime, in addition to the distribution of illicit commons. Both legal and policy regimes operate content. While there is a wide variety of bulletproof within national boundaries, while hosts and perpetra- hosting services (BPHs), this paper focuses only on tors operate trans-nationally with agility, paying lit- those hosting providers that enable the most “toxic” tle regard to national borders and bureaucracy, there- content types: child exploitation, malware, exploit fore stymieing enforcement efforts. While there have kits and C&C components. been successes, hosts still exploit legal and policy la- The paper proceeds in three sections. First, we of- cunae around the world. From the technical perspec- fer a brief background on bulletproof hosting and tra- tive, traditional content blocking methods, such as ditional solutions, and argue that solutions should be- IP blacklisting or DNS blocking, are no longer suffi- gin with targeting high-toxicity hosts. The following cient to contain bulletproof hosts. We expose chal- sections emphasize the problems and possible solu- lenges raised by modern networking, such as cloud tions to BPHs from a unique perspective: combining services, encryption or distributed architectures, and that of policy, technology, and law. From a policy we show the interest of technical methods such as perspective, we explore the evolution of BPHs over SNI filtering, machine learning over encrypted traf- the last ten years in order to justify and explain the fic or peer-to-peer traffic analysis. We also underline need for new solutions. The technical section empha- technical difficulties that BPH registries face, such sises the need for high-fidelity attribution that avoids as accountability issues, privacy leaks, identification collateral damage, and it offers a roadmap for how to and prescription problems. accomplish this. This section concludes by explor- We study registry-based solutions and propose the ing several further technical strategies to maximise the effectiveness of the registry. From a legal per- ∗ [email protected] spective, we cover existing approaches, and cover an †[email protected] array of solutions which would be natural and effec- 1 tive extensions of the current regime. Ultimately, we ing providers, bulletproof hosts do not impose strict advocate voluntary ’soft-law’ approaches to minimise policies about what type of content clients can host. space for BPHs, and the strengthening of interna- Many hosts also enable their clients to evade interna- tional law and cooperative norms, both of which will tional and domestic law enforcement by hiding their be necessary to capitalise on an international registry. infrastructure, ignoring take-down requests, or ex- We end with highlighting the value and feasibility of ploiting jurisdictional loopholes. Both legal and pol- such a registry, in addition to recommending a variety icy regimes operate within national boundaries, while of lower-level solutions for mitigating the availability hosts and perpetrators operate trans-nationally with of BPHs. agility, paying little regard to national borders and An online registry could be used to identify, verify, bureaucracy, therefore stymieing enforcement efforts. and track abusive hosts across the globe. It builds While there have been successes, hosts still exploit le- on the model of previous work and similar registries, gal and policy lacunae around the world. This is em- such as Spamhaus, Green of Team Cymru, StopBad- blematic of the issues that plague traditional methods ware, and apwg.org. In addition, collective action of regulating the global commons. by private and public sectors globally is required to Not all bulletproof hosts are created equal. Bullet- tackle the problem. We study these and the model of proof hosts differ with regards to the types of content the IAEA as an example of a successful international they are willing to host; their complicity with illegal organisation that is predicated on collective action. activity; their reliance on abusive content to turn a Like the IAEA, the agency would be neutral and in- profit; popularity; price and quality of their services; vested with the authority to investigate complaints geolocation; and primary jurisdiction. For example, brought by constituents. In so doing, it would fill the the following is an extract from an advertisement for capability and credibility gaps that undermine exist- one of the biggest BPHs, that was posted to a cyber- ing approaches to mitigating the availability of high crime forum[1]: toxicity BPHs. Through information sharing with constituent -Based in Asia and Europe. states, the private and non-profit sectors, and an in- -It is allowed to host: ordinary sites, door- house technical staff, the registry could wield the au- way pages, satellites, codecs, adware, tds, thority to verify and attribute abusive content. In ad- warez, pharma, spyware, exploits, zeus, dition, its activity would pressure non-compliant or IRC, etc. -Passive SPAM is allowed (you complicit entities to do a better job of self-regulation, can spam sites that are hosted by us). -Web while enabling well-intentioned but under-resourced spam is allowed (Hrumer, A-Poster . .) hosting services or jurisdictions to do the same. Fi- -Forbidden: Any outgoing Email spam, DP, nally, the registry could adjudicate cases brought by porn, phishing (exclude phishing email, so- member-states against the most malicious abettors. cial networks) Like the IAEA, its judgements could be used to val- idate or invalidate cross-border action in defense of There is a server with instant activation un- the global commons. der botnets (zeus) and so on. The prices will pleasantly please you! The price depends on the specific content!!!! 2 Bulletproof hosting Unfortunately, the wide variety of bulletproof hosts 2.1 Background can blur the distinctions between malicious entities and unwilling abettors of illegal activity. For exam- Bulletproof hosting refers to domain or web hosting ple, one of the individuals indicted for the banking providers that allow customers to host illegal or ma- malware known as Gozi was charged with conspiracy licious content on their servers. Unlike regular host- for his role in providing bulletproof hosting despite 2 resistant messaging applications, like Telegram Figure 1: Malicious content stored in bulletproof and Signal, have come to resemble bulletproof hosts and their corresponding toxicity. hosts. Both applications use elaborate techniques to sidestep DNS, IP, and DPI blocking [5]. Likewise, civil liberties organizations, such as the Hermes Cen- ter for Transparency and Digital Human Rights [6], act as de facto BPHs by providing technical tools to help activists set up whistle-blowing sites. While disaggregating “good” hosters from “bad” hosters represents a serious concern, this paper’s fo- cus on the most toxic content means that it tends not to engage other civil rights and liberties issues, such as the protection of free-speech. Few would dis- agree with stringent measures being taken against child exploitation, malware, exploit kits, and C&C components, it is on these that we focus. 2.2 Technical Overview 2.2.1 Networking protocol stack having no knowledge of the malware itself [2]. Mali- At their core, these various bulletproof hosting ser- cious bulletproof hosts do not hesitate to exploit this vices are delivered by a physical or virtual server that uncertainty to avoid calls for greater oversight. They executes programs such as web services (for illegal on- argue that they do not know they are supporting line services), file services (in the case of file-sharing criminal activity or that they cannot monitor their or video hosting) or mail services (for spam). networks without violating the privacy of their cus- The role of a bulletproof host is to connect such a tomers, which they are unwilling to do. We find that malicious server to the outside world through the In- this argument is untenable, as evident from the con- ternet. The server is connected to the network of an tent and privacy policies of such content delivery net- Internet Service Provider (ISP) that associates the works as Cloudflare. Cloudflare terminated 5428 do- physical server with an IP address. The ISP’s net- mains over 8 years, but only after engaging the users work is interconnected with other ISP’s networks, in it found in flagrant violation of its anti-child sexual order to exchange packets through routing protocols. abuse material[3]. Finally, the server’s IP address is associated with a Given the diversity of bulletproof hosts and the domain name through a system of DNS, that consists unique challenges presented by each, this paper fo- of a hierarchy of domain name servers. cuses only on the most pernicious content hosters. To access a bulletproof-hosted service, a client (ei- To do so, it relies on a toxicity-based classification ther a malicious individual or a compromised ma- system developed by TrendMicro [4] (see Figure1). chine) will provide the host’s domain name to a DNS Here, toxic is defined as having strong negative ef- service to obtain the corresponding IP address, con- fects on others. Our paper focuses on solutions for nect to the server through its IP address and finally mitigating the availability of content with a toxicity exchange packets with the malicious machine.