FCC Chair Calls On ISPs To Adopt New Security Measures 110
alphadogg writes "U.S. Internet service providers should take new steps to protect subscribers against cyber attacks, including notifying customers when their computers are compromised, the chairman of the FCC said Wednesday. Julius Genachowski called on ISPs to notify subscribers whose computers are infected with malware and tied to a botnet and to develop a code of conduct to combat botnets. Genachowski also called on ISPs to adopt secure routing standards to protect against Internet Protocol hijacking and to implement DNSSEC, a suite of security tools for the Internet's Domain Name System."
Re: (Score:1)
Re: (Score:3)
Torrents (Score:5, Interesting)
Re: (Score:1)
I doubt it. It would jack with MMOs as well. Games like WoW use BitTorrent in their update process for example. I doubt they want to piss off some big customers.
Re:Torrents (Score:5, Interesting)
I doubt they want to piss off some big customers.
If that's the only societal force that can spare us, then we're screwed. Big customers can be whitelisted or "undesirables" can be blacklisted.
I think what we need is to promote an awareness of just how important the Internet is, that screwing around with it for any reason other than good engineering is a bad idea. For example, the DNSSEC mandate is actually a sound idea and stands a good chance of working better than what we have now.
The moment an anti-malware system starts intentionally hindering many (or all) torrents is the moment it ceases to be a technical solution and changes into a political tool. You don't need to understand the technical details of how BitTorrent works to understand this. We need a general public that understands this, for the same reason we need to understand that "think of the children!" includes concern for what kind of authoritarian, regimented society we're leaving them to inherit.
I have to assume that any mandate to "protect against botnets" that could ever be construed to mean bans on entire protocols is going to be inevitably abused. Authoritarian types look for such "opportunities" just as businesses look for new markets. Power is just a different kind of currency.
Re: (Score:3)
We need a general public that understands this
Good luck.
What we need is a court system that understands this and a way to apply the First Amendment to the ISPs. If it is spun as censorship rather than as requiring people to know stuff, it stands a much better chance politically.
Re:Torrents (Score:5, Insightful)
First, we might need to promote an awareness of just what the Internet actually is. How it works and why.
We've got young people who don't recall a time before Internet, and don't know how and why it came into being and know nothing about it's potential. To many of them, it's just another shopping mall/arcade.
For my money, the Electronic Freedom Foundation is currently doing the best work in this regard, so I send them money. But it also takes those of us who do have some awareness of these things taking the time to explain it. To advocate for it. To protect it. We have to make sure our shared memories, our shared culture, survives.
There are a lot of powerful forces that would love to turn the Internet into the home shopping network on steroids. Into a one-way media outlet that tells us what's what. Into just another "cool" medium.
We have to use the power of our oral tradition and our written tradition to spread the word on a person to person level. One to one and one to many. We must fight on the blogs, we must fight in the comment sections, we have to fight on the streets and on the beaches, We must never surrender. (OK, I got a little carried away at the end there, but you get the idea).
Re: (Score:3, Funny)
1) Registar an organization called "Electronic Freedom Foundation"
2) ...
3) Profit!
Re:Torrents (Score:4, Funny)
Oh shit. I should have just said "EFF".
I should never drink and comment. Hell, last night I played my harmonica and it registered a .23
Re: (Score:3)
Re: (Score:2)
Man, the way I play, my harmonica is already a flamethrower. I have to register it as a lethal weapon in 26 states. Kim Wilson heard me and threw his harp in the lake. You heard of Little Walter and Big Walter Horton? Around Chicago, I'm known as Medium Walter.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Torrents (Score:4, Interesting)
More to the point, such legislation to disconnect "infected" machines implies that there is some standard for a "clean machine". And you can BET that "clean machine" model is based on known, locked down, PROPRIETARY operating systems, not someone running their own mods for a Linux distribution.
Re: (Score:3)
After all, if you aren't running Government and ISP Supported Operating Systems, you MUST be infected.
So if you run Linux, BSD, or any other "fringe" OS that isn't supported, you get disconnected.
Right?
Good Luck With That (Score:5, Funny)
404 Not Found
Re: (Score:2)
404 Not Found
Then you, like me, recognize the problem. Are you, like me, working towards a solution by educating anyone you encounter who wants to understand?
Anyone you can teach can also teach others; anyone they teach can teach others, and so on. It cascades. It grows exponentially.
You can have a much greater impact than you think. You, acting alone, can do that. Imagine what happens when lots of others have the same unwavering determination...
Re: (Score:3)
Even if so, it's not problematic.
All this is (going by the summary - article's still loading) is notification. "Hey, we noticed your machine seems to be infected with a virus and is part of a spam-spewing botnet. Here's some links to antimalware that'll clear that right up". "Hey, we noticed a lot of traffic from spyware sending every keystroke back to totally-a-legit-site,cn, you might want to scan for that". "Hey, you seem to be torrenting massive files 24/7, here's some MAFIAA propaganda telling you to s
Comment removed (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
... maybe you should have a single message at the top about why the person's account is broken and who they have to call to get it fixed.
I already get lots of notifications that my computer is infected. But they don't make me waste time talking about it to some drone off in India or Malaysia who's just following a script. They give me a direct link to where I can download a tool to clean up my machine.
And most of them don't even want to charge me for this service. ;-)
Re: (Score:2)
Re: (Score:2)
Re:Torrents (Score:5, Insightful)
Re: (Score:2)
also lot's of fake anti malware software out there
Re:Torrents (Score:4, Insightful)
Even if so, it's not problematic.
All this is (going by the summary - article's still loading) is notification. "Hey, we noticed your machine seems to be infected with a virus and is part of a spam-spewing botnet. Here's some links to antimalware that'll clear that right up". "Hey, we noticed a lot of traffic from spyware sending every keystroke back to totally-a-legit-site,cn, you might want to scan for that". "Hey, you seem to be torrenting massive files 24/7, here's some MAFIAA propaganda telling you to stop copying those floppies".
The ISPs are really the only ones positioned to thwart attacks as well. For example, blocking an IP that appears to be port scanning or sending high rates of email. Or rate-limiting icmp packets to reduce the effectiveness of DOS attacks. Or perhaps help in backtracking and notify their clients that seem to be participating in DOS attacks or spamming. The slippery slope of course is that if we expect the ISPs to start inspecting and throttling traffic for good reasons, it's not much of a leap to start snooping and throttling for reasons less advantageous to the customers. Not much of a leap from, "Hey that web site you're visiting is hosting a zero-day driveby attack" to "Hey you shouldn't be looking at neekid girls".
Re: (Score:3)
The ISPs are really the only ones positioned to thwart attacks as well.
I disagree, the government goes after the botnets and shuts them down. They have all the needed logging and C&C data. Your best off letting the virus scanning companies deal with this and colloberate with the government where it makes sense.
For example, blocking an IP that appears to be port scanning or sending high rates of email.
What right does the ISP have to limit me from port scanning or sending bulk mail? I do both on a regular basis for legitimate reasons. Profiling is unacceptable. SMTP email is now worthless thanks to stupid algorithms with thinks every other legitimate message i
Re:Torrents (Score:5, Insightful)
I don't want the govt involved in the internet, and they have a crappy track record on dealing with botnets.
If you're port scanning multiple IPs, then you fit the profile of an attacker and need to be looked at. Bulk mail is another issue. It would be reasonable to notify customers that their computers are sending large volumes of email. If the customer isn't aware of it, then they just got a clue that they might be infected. Sending bulk mail, especially not using the ISPs relay, is often against the TOS.
I was talking about inbound as well as outbound. If your ISP sees someone port scanning through their address space looking for open ports, blocking them makes sense. It also makes sense to watch for users inside their space port scanning. It's no different than the cops stopping someone who is walking through the neighborhood checking the doors. Rate limiting stuff like icmp works just fine, as does ingress filtering stuff you shouldn't be seeing. If a connection is spewing 500 pings a minute for 10 minutes, it's pretty unlikely it's for a legitimate reason. Another example if dropping packets which appear to be from bogons. Or noticing clients that appear to be doing syn attacks or the like.
Really, it's not hard to detect computers acting badly.
Re: (Score:3)
If you're port scanning multiple IPs, then you fit the profile of an attacker and need to be looked at
Are you sure? How many IPs/ports make you suspicious? Who decides?
It's no different than the cops stopping someone who is walking through the neighborhood checking the doors.
Where I live people are constantly going door to door selling crap... For all I know they could just be checking doors... Do I get to call the police whenever I see someone making their rounds down the block?
If a connection is spewing 500 pings a minute for 10 minutes, it's pretty unlikely it's for a legitimate reason.
Lets see MTR to a destination with 20 hops default refresh rate of 1 second. After a minute you just spewed 1200 pings. OMFG call the police!!
Re: (Score:3)
If a connection is spewing 500 pings a minute for 10 minutes, it's pretty unlikely it's for a legitimate reason.
Lets see MTR to a destination with 20 hops default refresh rate of 1 second. After a minute you just spewed 1200 pings. OMFG call the police!!
Yeah, and this reminds me that in several discussions on this topic, I've commented (or seen others comment) that various so-called "security experts" like to classify pings as attacks. This almost always gets pooh-poohed by other readers. But we just saw a /. reader claim that 500 pings per minute (about 8/sec) qualifies as an attack.
I've often found that it puts things into perspective to mention that many of the claims of "attacks" that you read about are in fact counting ICMP packets. This is a go
Re: (Score:2)
Instead of nitpicking the numbers I pulled off the top of my head because they might interfere with your particular invented legitimate activity, how about recognizing that outliers in usage patterns often correspond to malicious activity? Maybe 500 pings/minute is a bad example, but certainly that's not the norm for an average customer. How about an ISP noticing that 100 IPs within their address space are sending the exact same http query to a particular website at a very high rate? Surely even you guy
Re: (Score:2)
Instead of nitpicking the numbers I pulled off the top of my head because they might interfere with your particular invented legitimate activity, how about recognizing that outliers in usage patterns often correspond to malicious activity? Maybe 500 pings/minute is a bad example, but certainly that's not the norm for an average customer.
I'm not only nitpicking your examples. I'm nitpicking the underlying concept. The hueristics have all been tried with SMTP and not only has it failed to stop spam but it has made email unreliable and unusable in the process. I prefer not to see the same errors repeated in the name of network management.
The reason for failure is your advasary is a living thinking human being with a brain just like yourself. Every action you take to detect a problem can and will be countered by moderating the system so tha
Re: (Score:2)
BTW, what possible reason could you have for doing traceroute with a refresh rate of 1 second?
Your question is really the core issue... The person designing the rules makes the value judgement based on their limited knowledge and as a result things break and people become unhappy because the rule maker turns out to not be as smart as their self image. If you think I'm nitpicking.. the real world is absolutely relentless... Ask the people who wrote mtr why they did it. It is often used to evaluate transient or long term metrics about the network path..per-hop latency, packet loss. I assume it is to keep from having to wait forever to see what is going on and where.
No the network engineers will simply look at the existing traffic patterns to determine what is normal for their network. Really, I have lots of experience in this area, and it's not difficult to spot the outliers from the norm. I'm not saying blindly block every little suspicous thing (in fact, often the best response is to let an active intrusion continue so you can gather more info). I'm talking about flagging and reacting to the obvious. In some cases the appropriate response might be blocking the
Re: (Score:2)
Just reading all the comments i would say its you who overvalue you smarts. Spam filtering and profiling DO work. ISPs do notice spammers and shut them down. Are you saying the problem is to hard so we shouldnt bother trying? Are saying there is no value to antivirus even though it effectiveness is reduced by clever attackers?
I still get spam, and many times a week messages go missing to the ether. It reduces volume but does not solve anything.
I'm saying the network is the wrong place to do something about it. The intelligence is not in the core it is at the edge... Where the intelligence is is where you have the most options to address the problem.
The concept of anti-virus is fundementally flawed. It is useful but the underlying issue of how untrusted code was allowed to execute in the first place is the root problem. Unti
Re: (Score:2)
Why would you say IPv6 makes ports scanning irrelevant. Getting rid of IPv4 natting increases exposure for most home users as it removes a layer of protection and the probers are now hitting their machines directly instead of bouncing off a nat router.
SPI and NAT do the same thing and have the same security properties. The ONLY difference is that SPI does not mangle packets.
The address space of a single /64 prefix is 4 billion times the size of the entire IPv4 Internet. A probe has no chance in hell in finding any client in the first place unless they manually configure a vanity address. This is much better than the current system where viruses can easily scan the entire global address space in a matter of minutes.
Re: (Score:2)
No the network engineers will simply look at the existing traffic patterns to determine what is normal for their network. Really, I have lots of experience in this area, and it's not difficult to spot the outliers from the norm
YES. Not all problems can be resolved within your administrative domain. Sometimes coordination with other operators is required.
I am in total awe of your ability to easily detect a request to a C&C server disguised as a request to an AD server.
It is easy to detect belligerent zombies or anything else sending garbage at line rate. It is however impossibly for everyone but yourself to detect zombies designed to secretly leak only user CC/BANK PAN and high value corporate data.
It is not the ISP
Re: (Score:2)
Most issues are best mitigated by countermeasures at the edge where the most intelligence resides. The ISP should be treated as a common carrier and only act when the integrity of their network is at risk.
What do you define as the edge? The DSL/Cable/Satellite modem in the end users home? Are you trusting the average home user to set that up securely and police themselves? Certainly the consumer grade end routers could benefit from a little more brains and some IDS capabilities, but from a design perspective an independent IDS on each drop is far less effective that placing them in key locations at the aggregate or closet switches. I'm proposing that the "edge" be a few steps closer to the ISP and let
Re: (Score:2)
What do you define as the edge?
The peer.
The DSL/Cable/Satellite modem in the end users home? Are you trusting the average home user to set that up securely and police themselves?
Yes. If this is not realistic the answer is to provide the user with necessary tools and or education to make it realistic.
I simply don't accept your notion that the ISPs have no responsibility to police their networks and should do nothing to protect their customers. If they get good information about a user on their network actively attacking someone, I don't want them to say "it's not my problem".
I simply don't accept your notion the ISP should post a full time 24x7 safety officier in each room of a household where networked computers reside. Please enough with the strawmen.
They are common and/or contract carriers, whereas ISPs are not. You might want to brush up on the legal aspects of that, as the ISPs have been lobbying to NOT be considered common carriers as that imposes additional regulations on them.
Whatever makes non discrimination work works for me. I would rather see common carrier than the decay of a competitive market ultimatly enable discriminatory practices with location based degregat
Re: (Score:2)
Yeah. That's a great idea! That way, when I do penetration tests on my websites I will just get kicked right off! Thanks for your help, man!
Re: (Score:2)
Yeah. That's a great idea! That way, when I do penetration tests on my websites I will just get kicked right off! Thanks for your help, man!
If penetration testing means you have to port scan your web site, then you're not doing it right. You should already know what ports are open if you or your hosting company have any clue. Running dumb tools like Retina, Nessus, etc really don't show you the true vulnerabilities on a website anyway. THey can't show you crappy programming that doesn't validate inputs and leaves you open to sql injection, or permissions issues on files.
Re: (Score:2)
Re: (Score:2)
I don't host my own website, and neither do many on my customers. I guess it never occurred to you that one reason to port scan is to find out if a hosting company has a clue. I'm one of those funny guys that isn't satisfied with calling customer service and asking hey, do you guys have a clue? and then just accepting their answer.
Yeah, I get the whole trust but verify thing. I realize there are legitimate reasons to port scan a single IP or do things that could be viewed as an attack, such as verifying a firewall config. It's all about defining appropriate thresholds and using them to flag malicious activity. Port scanning whole class B subnets at a time, or your machine running port scans 24x7 would probably be on the wrong side of that threshold. We could spend all day pointing out fringe cases, but 99.9% of an ISPs customers a
oh, great, that's all I need... (Score:3)
a popup in Iceweasel saying "Attention! Your computer is compromised!" then some spiel about IE9 and no antivirus...
oh, wait, now where have I seen this before [spywarevoid.com]? (link for information only! Do the clicky on "free scan" links at your own risk!)
Re: (Score:1)
a popup in Iceweasel saying "Attention! Your computer is compromised!" then some spiel about IE9 and no antivirus...
oh, wait, now where have I seen this before [spywarevoid.com]? (link for information only! Do the clicky on "free scan" links at your own risk!)
I don't know how. But. The idiots that come up with this crap have to be forced to sit behind a 12 yr old, bound and gagged, to understand what they intend. If they die of a stroke from the effort, at least it's one less idiot.
Re: (Score:3)
I've seen it before. In case you're not brave, I'll explain.
I'm sitting in front of a LINUX BOX, using Iceweasel, a LINUX BROWSER. Suddenly this popup appears telling me my LINUX BOX has been compromised, tells me I'm running IE9 (ohreali?) on Windows XP (ohreali?). It further tells me, with the help of an "automatic detection tool", that my computer is infected with 100...200...14,000+ WINDOWS viruses (ohreali?). For just $29.99, this amazing tool will "remove all infections in seconds!" (ohreali? Maybe it
nothing better to do....... (Score:2, Insightful)
Of course, ISPs' employees have nothing better to do than to notify ~90% of their customers their computers have malware. It boggles my mind the ideas that people come up with (sopa/pipa/acta, logging all connections, etc.) and try to implement about monitoring the Internet with little or no thought to the logistics or funding of their stupid ideas.....
Re: (Score:1)
While ISP employees may have better things to do than notify their customers that they have malware, it is very likely they have a number of automated systems intended to detect and counteract such threats (and should be working on procuring/developing such a solution if not), at which point the majority of notifications can be automated, which in addition to saving staff time, can help reduce OTHER ISP staff time expended dealing with load balancing massively oversubscribed pipes when those same systems ar
Re: (Score:2)
Hmm. I'd think termination of their contract, if their machine is caught attacking one of my DNS servers through neglect. I'd take the fiscal hit willingly.
Mind you, the logging used to diagnose who, exactly, is attacking my servers is different from the kind of logging that SOPA / ACTA would mandate (it cannot be modified / re-purposed to fits their needs).
How would they know you have a virus (Score:4, Insightful)
Re: (Score:3)
Virus that make outbound connections to command and control etc can be spotted.
Re: (Score:2)
Re: (Score:2)
Still possible to spot them, VPN's have to terminate somewhere, tricky routing as in overlay networks still need to eventually connect to command and control. Remember this need not be perfect if it just notifies the end user that they might have an issue rather than automatically blocking them.
Re:How would they know you have a virus (Score:5, Insightful)
Unfortunately the issue of inspecting traffic is a tricky one, etc, etc.
Re: (Score:2)
They don't have to see the infection itself, just the symptoms. Frankly, ISPs could probably give a damn about viruses. It's botnets that are the problem. If they see traffic from your IP directed towards a known botnet command node then they can probably assume your machine was compromised.
Unfortunately the issue of inspecting traffic is a tricky one, etc, etc.
Perhaps if it were done by a piece of hardware that had no other function than that of reading headers.
Re:How would they know you have a virus (Score:4, Informative)
My brother's windows 7 box started running slow two weeks ago, but other than that there was no sign of a problem. He attributed it to ageing hardware and kept it on. Within 24 hours the ISP called him and told him he had a serious malware infection. They sent him an exe (apparantly they knew exactly what was wrong), and it fixed it perfectly.
This shocked me, because usually I love to hate the local ISP, but you have to admit, that is some good service. So I guess I would draw the line at being able to identify a specific problem. If it is just suspicious traffic patterns, innocent until proven guilty.
Re:How would they know you have a virus (Score:4, Insightful)
Re: (Score:2)
Good question, I just checked. The exe was emailed from an address at the ISP's domain. Not sure how hard that is to fake, but I would have trusted it too.
However, after reading the rest of this thread, I think I have changed my mind. Malware control is a job for OS developers, and in extreme cases the police. The ISP really shouldn't get involved.
Re: (Score:2)
My brother's windows 7 box started running slow two weeks ago, but other than that there was no sign of a problem. ... Within 24 hours the ISP called him and told him he had a serious malware infection.
I got a call a few years ago from my ISP, telling me that there was a "virus" in my machine. The person calling described it, and I told him the name of the malware. He was a bit surprised by this, and I asked when they'd first seen it. It turned out that it was six months earlier, but they'd just got around to handling it. I asked him if they'd seen any evidence of it in the past few months. After a bit of a pause, he said they hadn't. I told him that I'd found it myself about six months ago, and it
Re: (Score:2)
Not so much. The machine which is being attacked typically has a competent admin who will capture the IP addresses of the attackers (assuming the packets are not forged), who can then forward the addresses to his / her upstream network provider. Directly contacting the ISP of the afflicted machines would require some extra work, but is possible.
No inspection of traffic is needed.
Don't want your protection (Score:3)
I don't need your stinking protection, I've been doing just fine since 1993.
Now excuse me while this strange web site forces my browser to full screen and scans my Linux Box for viruses...
Re:Don't want your protection (Score:5, Interesting)
Now excuse me while this strange web site forces my browser to full screen and scans my Linux Box for viruses...
I recently started getting calls to our home phone number (which is a silent number mind you) from those lovely "Hey, I'm calling from Microsoft to say that you need to install this program to fix your computer..." folks in some nasty call centre. While I do have a few windows machines around, the majority are also linux. I find it strangely pleasing following their instructions, but seeing how long I can drag out the fun for - not pressing the right things, getting them to repeat the instructions over and over again, trying to get them to hang up. My current record is 21 minutes, while they are peddling crap, you got to hand it to them - they really are patient when trying to snarf your money.
Re: (Score:2, Funny)
I commend you patience. The last one I got went like this -
*ring ring*
(indian voice)"Hello sir, Microsoft has been doing a survey of your area and"
"No they haven't"
"yes they have, and we have found a higher than normal incidence of viruses in your area"
"No, they haven't, you're a liar"
"No sir I am not lying. Our records show that you have a computer attached to the internet"
"Right, you've got me out of bed at 9am on a saturday and lied to me three times in the course of ten seconds. F*CK OFF AND DIE YOU EVI
Re: (Score:3)
I'm not very friendly if you get me out of bed in the morning at the weekend. In retrospect that may have been overly nasty.
No it wasn't.
Customer Contact (Score:5, Insightful)
Back in the late '90s that's how we worked at ISPs. If we notices weird traffic on an account or were getting spam complaints, we'd call up the customer. If we couldn't get a hold of them we would disable the account until they called. Some kid pumping out Make Money Fast emails, we'd call mom and have a chat.
Then all the local ISPs got bought up by telco and cable companies. The price didn't go down, just the service.
I'm glad I'm still on one of the last local Mom&Pop ISPs in the area, when I call support I get a guy that actually has enable to the routers. It costs about $15/month more but I'm willing to pay for the service I get.
Re: (Score:3)
... when I call support I get a guy that actually has enable to the routers. It costs about $15/month more but I'm willing to pay for the service I get.
I would gladly pay more than $15 extra for that level of support.
My ISP has had a problem with what I suspect is a fibre media converter that is causing high packet loss with packet sizes 1350 to 1500 bytes. My friends and I who live in town all set our MTU manually to about 1300 to avoid the problem, but everyone else in town using this ISP is stuck with websites that time out randomly for no reason, web pages that fail to load randomly, etc.
I tried to explain to support that they need to run a ping siz
Re: (Score:3)
I tried to explain to support that they need to run a ping size sweep on their router so they can see the packet loss but they guy seriously fired up a windows command prompt from his support machine and ran ping with the default arguments to my home IP address, said all 5 packets were okay, and that nothing was wrong.
1. The default # of packets for windows' ping is 4 (as far as I can recall)
2. Sometimes you have to ask to speak to another support tech until you get escalated to someone who has the ability to understand you.
If that fails, you can always try complaining on social media or launching an executive e-mail carpet bomb
Re:Customer Contact (Score:4, Interesting)
Indeed. Cox, a cable ISP in the US, was silently re-writing DNS TTLs from whatever value the authoritative nameserver had set to 30 seconds. It didn't matter if it was a long-lived NS record or a short-lived dynamic DNS entry, everything got changed to 30 seconds. Even the entries for the root nameservers were cached for 30 seconds, increasing their load.
When I had their service and this was affecting me I wrote to their customer support and prefixed the message with a "This is a specialized technical issue about Cox's DNS servers and is not addressable by customer support staff. Please forward this to the systems/network administration folks." The message included a quick summary of the problem, results of dig tests on both Cox's and third-party resolvers, etc.
I got a response two days later saying "We're sorry you're having difficulty setting up your wireless router. You might find the instructions at $URL helpful..."
After that point, I stopped bothering and switched to Google Public DNS. Google's nameservers respected TTLs, didn't do the SiteFinder interception of non-existent domains, and actually had better performance.
Re: (Score:2)
mod parent up. I've got a mod point left, but had to add my own longwinded comment below, that is perhaps better expressed via the parent comment. I.e. yeah, forcing new software on ISPs and unexplained how its going to be written and deployed is a bad idea. But making lazy ISPs, or rather, ISPs that don't want to scare away their consumers, tell the customer when existing software they are running has detected a known malware traffic pattern, seems like a really good idea. And forcing DNSSec support on
what? (Score:1)
I expected something so silly spewed from a technology ignorant, grandpa Senator. But the chairman of the FCC?!
Stuff like this makes me wonder if democracy works.
Re: (Score:2)
I expected something so silly spewed from a technology ignorant, grandpa Senator. But the chairman of the FCC?! Stuff like this makes me wonder if democracy works.
Sure, it works. The FCC's head is a political appointee, and he was appointed by the president that the majority (of the Electoral College ;-) voted for. In a democracy, job holders are decided by voting, not by requiring credentials. If the voters want someone competent, they'll vote for someone competent. If they want a president who appoints competent people, they'll vote for a president who's interested in competence.
(Not sure if I should include a ;-) here ...
One Has To Wonder About Motivation (Score:5, Insightful)
I mean, when you consider that as a practical matter, an ISP is (or at least should be) just a common carrier, like a telephone company. In fact the FCC originally -- and even very recently -- wanted to classify ISPs as common carriers. Which would preclude any monitoring. So what's up with all these monitoring ideas?
Are they maybe just trying to get some kind of monitoring in place, so that they can expand it later?
Re:One Has To Wonder About Motivation (Score:4, Interesting)
I have to wonder why government keeps coming up with schemes that essentially require monitoring by the ISP.
Governments cannot abide anyone but themselves with secrets.
Are they maybe just trying to get some kind of monitoring in place, so that they can expand it later?
Yes. It's like the amphibian in the pot. Turn up the heat gradually and it will remain even after the water is boiling.
Re: (Score:1)
Because it's logical that a Service Provider provide for the integrity of the service and the safety of it's customers.
Just like it's logical that AT&T 'protect' me from the illegal use their network POTs network... unless it's the Gubment that's breaking the law, of course.
make it opt-in and I will (Score:3)
There seem to be a lot of negative comments about this, and perhaps some with subtle good reason. But I really like the idea, if it's implemented as opt-in, and boils down to "if any existing software run by the ISP believes that my computer is running known malware based on known traffic patterns, send mail to either or both of the email address and physicial address I registered during the opt-in process". To me this sounds analagous to the security breach notification laws corporations are subject to in some jurisdictions, and I believe those are generally a good thing as well. Without them, you get the status quo, which is things like Nortel knowing they were compromised for years, and just not caring. I actually think this is likely the status quo at all major organizations. I mean really, do you think if microsoft/google/etc found out that major fractions of their internal infrastructures had been owned by foreign government X for the last 5 years, that without laws they would ever _do anything about it_ if the attackers were friendly enough to just be sucking data about their engineering and customers, and not actually impacting the day to day monetary business? I'm pretty sure what would happen in such a case would be some management screaming at some overworked internal security folks. And then the internal security folks would either brush the problem under the rug, or get fired when they explained exactly how many resources it would take to remotely adequetely stop the espionage threat from government X. Bottom line- forcing by law companies to notify their customers when existing software discovers exploits seems like a really good idea to me. Yes, there will be some resulting pressure to just turn off their internal checks, but honestly, that doesn't bother me at all if when those internal checks were finding things, they weren't going to bother telling the customers anyway. In fact, my optimistic hope, which I think is quite reasonable, is that when the actual scope of these things is forced into the public view, that the horrendous security practices responsible, will actually get remedied in the right ways. I truly don't get why there is so much resistence here to this idea- fundamentally (as I described above, i.e. not mandating new software be run, but just that if existing software already running thinks a customer is owned by hackers, that they take the trouble of notifying the customer.
Wow... (Score:1)
This needs to be shot down before it can take its first breath.
It will NEVER happen (Score:3)
1. Most importantly: Figuring out who is infected is a huge amount of work. We'd need to scope out millions of dollars in project work to design a system to detect who has a problem, processes for creating tickets for people to notify them, hire people to do all of this work, then maintain this entire elaborate system every time we make a change to our network, our repair structure, etc... Even if the government funded a system, every ISP's internal structure is totally different. It would never work for more than 1. They'd have to fund every ISPs program individually, and the ISPs would suck up that funding like vampires and have little to show for it in the end.
2. To notify the customer automatically you'd need to either A: send them an email, which about 98% of your customers don't use the email address you gave them or B: Redirect them via your DNS server to a warning page. But if they aren't using your DNS that's not going to work, and the people writing the malware/bots will figure that out and either block your warning page, or more simply change the customers DNS server to googles or something and your entire system is useless.
3. When we do notify these people what is the very first thing they are going to do? Call the ISP. What is a virus? How did they get it? When are we going to fix it for them? Well they got it on our internet, they never had viruses when they had dialup... It's an hour long call at least. That just cost the ISP $20 and the customer is going to hang up and do nothing.
4. It's of absolutely no benefit to the ISP to do anything like this. So what if the customers are infected? They have the internet, malware doesn't hurt the ISPs network unless the ISP itself is the target witch is rarely the case. Even if one of the ISPs customers is the target they just adjust a few routers and the problem goes away. The customer is blissfully unaware of their problem and paying their bill. You don't mess with that. And yes, customers really are stupid enough to think the malware they have had for years and didn't know about, but were suddenly notified of when they signed up for your service, came from you.
5. Almost every ISP in the united states sells some sort of malware/antivirus package now. You're asking them to subvert their own product. Good luck getting that past product development.
And lastly, I want to re-iterate... the customer will DO NOTHING. They already know they have malware. Their computer runs like shit. They have habits that lead to them having malware. They bought their computer 10 years ago, their way of "fixing" it is using the Dell system restore disk that game with it that reverts it to the original unpatched version of XP. Then they install the pirated versions of autocad and photoshop they got from their brother-in-law 6 years ago, they sure are glad they kept all those CDs he burned... Then they go to bed, their teenage son gets up and surfs porn with IE6 from that fresh XP install, for a couple of hours. He erases the history... his tracks are covered.
Re: (Score:3)
It already happens. Time Warner and Comcast both have botnet detection. They put you a restricted walled garden until you take steps to remove it. There is no email and there is no hugely complex packet sniffing software. Its quite easy to detect such botnet traffic as such traffic is very predictable in nature. Your computer sending large amount of traffic to some known botnet location? Redirect all traffic to some basic HTML page with instructions. Customer does nothing and just lets it stay tha
Re: (Score:2)
Re: (Score:2, Interesting)
4. It's of absolutely no benefit to the ISP to do anything like this. So what if the customers are infected? They have the internet, malware doesn't hurt the ISPs network unless the ISP itself is the target witch is rarely the case. Even if one of the ISPs customers is the target they just adjust a few routers and the problem goes away. The customer is blissfully unaware of their problem and paying their bill. You don't mess with that. And yes, customers really are stupid enough to think the malware they have had for years and didn't know about, but were suddenly notified of when they signed up for your service, came from you.
*lol* - I'll second this: About a decade ago I saw a small business getting walloped by worm traffic to the point where it was suffering from the degraded link speed (firewall drops packets on the CPE side of the link, you see). I called the ISP and said "can you filter these ports, this traffic is getting heavy?" and the response was "no chance, once it enters the network we get billed from our upstream provider, so we need to deliver it somewhere so that we can charge for it" !
[And three cheers to the ca
Re: (Score:2)
And yes, customers really are stupid enough to think the malware they have had for years and didn't know about, but were suddenly notified of when they signed up for your [ISP] service, came from you.
Actually, under the proposed scheme, this isn't at all stupid; it would be the sensible approach. After all, the ISP has been officially and legally assigned the task of monitoring all the customer's IP traffic for malware. The fact that it's on my machine means that the ISP totally failed at their government-required task. They are clearly responsible, according to the law, and have allowed the malware to transit their part of the network. They should be responsible for fixing the damage.
If the ISPs
ISPs just say no (Score:2)
Although it seems like a great idea for ISPs to try and help customers in reality they won't do it. FBI recently tried to send notifications out to ISPs to notify their customers but their data was screwed up and 100% worthless.
ISP: (Calling john smith)..
JS: Hello
ISP: Hello, I'm from x and your computer is infected with y.
JS: No I will not install your malware you must be trying to scam me.
JS: I have no idea what you just said...don't call back.
JS: You allowed my computer to be infected?!?
JS: I have to pay
FCC chair should mind his own store first (Score:4, Insightful)
The FCC is currently mismanaging radio spectrum sales and partitioning. That is their primary function. Do that and once you're doing your ACTUAL job then worry about the internet which you in fact have no authority over.
The FCC seems to be trying to fail up. TV viewership is dying so they're trying to expand themselves into the internet. I get it. But first maybe they should sell off that radio spectrum and do their actual jobs.
Re: (Score:2)
The FCC is currently mismanaging radio spectrum sales and partitioning. That is their primary function. Do that and once you're doing your ACTUAL job then worry about the internet which you in fact have no authority over.
The FCC seems to be trying to fail up. TV viewership is dying so they're trying to expand themselves into the internet. I get it. But first maybe they should sell off that radio spectrum and do their actual jobs.
except for the fact that the original mission of the FCC was to regulate communications mediums by wire or radio. In the very beginning, their roots were traced to the FRC and they used the reasoning of spectrum scarcity to regulate radio waves, but it spread to broadcast and wire due to the pervasiveness of the medium. Like it or not, legal precedent is on their side until someone challenges it.
Re: (Score:2)
There is no scarcity of cable. And the industry being what it is can strangle the FCC where it stands if it makes a point of interfering.
The FCC really should concern themselves to their actual jobs which indifferent to their roots remains partitioning the radio spectrum and managing its use. If they can't do that much then they have no business touching the internet.
We won't put up with it.
Comcast already does this (Score:2)
Secure routing standards ? (Score:2)
What secure routing standards ? There are only secure routing practises, there are a few standards in development, starting with "Resource Public Key Infrastructure (RPKI)" but that is still very new and isn't yet broadly available by vendors.
Insider Trading? (Score:1)
Not only ISP's should (Score:1)
Theres also other security measures which could incre