The Internet's Bad Neighborhoods 77
An anonymous reader writes "Of the 42,000 Internet Service Providers (ISPs) surveyed, just 20 were found to be responsible for nearly half of all the spamming IP addresses — and some ISPs have more than 60% of compromised hosts, mostly in Asia. Phishing Bad Neighborhoods, on the other hand, are mostly in the U.S. Also, there is a silent ticking 'spam' bomb in BRIC countries: if India would have the same Internet penetration rate as the United States while keeping its current ratio of malicious IP addresses, we would observe 200% more spamming IP addresses worldwide. These are just few of the striking results of an extensive study from the University of Twente, in The Netherlands, which scrutinizes the Internet Bad Neighborhoods to develop next-generation algorithms and solutions to better secure networks."
How is this news? (Score:3, Insightful)
Anybody who's worked at a datacenter has known this for years and years. And comparing them to bad neighbors is correct... if we didn't consider scope and the medium. It's a lot harder to police something that's not in physical form and is transitional, and A LOT harder when it's in a country you don't have jurisdiction over. Sure you could block these ISPs and in a lot of cases it makes sense, if your website is national, then it can save a lot of pain, but it's not the end all solution to spam.
Re: (Score:3)
Re: (Score:3)
India was called Eastern Europe a few years back in regards to spam. The locations may change, the concept of a botnet remains the same. Obviously, spammers will find the least regulated, easily available ISP around.
Re: (Score:2)
Tracking sources of spam seems to be the best way to see where growth is happening in internet connectivity. Remember when South Korea was the source of all our spam? For no other reason that there were a lot of very fast internet connections popping up faster than they were being secured.
Re: (Score:2)
I was. India easily has the potential to quickly transform into the next "Nigeria" once their internet penetration gets large enough.
Combine millions of people in poverty with easy and less than honest ways to quickly swipe money from some "rich" foreigner?
We won't even get into their law enforcement practices.
Re: (Score:1)
1. Where does it claim that this is news? 2. This is still useful information for those who haven't worked at a datacenter for years and years. 3. The news element is that they are working at an algorithm based on this information.
Re:How is this news? (Score:5, Insightful)
Most of us don't work in datacenters.
I think this could easily become a huge issue. We are lucky that most phishing emails are of a very low standard and it's easy to spot the fakes.
I'm guessing that these developing countries don't take cyber crime to seriously at the moment, perhaps instead of governments pushing SOPA and and ACTA they could come up with agreements which will encourage BRIC nations to start cracking down on spammers before the problem gets out of hand.
Re: (Score:3)
And with enough resources they would... that's why the spammers pick them. But the problem is mobile, it moves from country to country, simply blocking IP blocks is a band aid solution.
Re: (Score:2)
And with enough resources they would...
China most defiantly has the resources, it just needs to put them in good use, instead of trying to block freedom of speech. Start putting pressure on ISPs that allow their networks to be abused. The spam might move between countries, but I assume the spammers themselves must be located somewhere.
Follow the money trail and start closing bank accounts.
Re: (Score:2)
Defiantly...?
I had the solution for virus/malware/spammers years ago: 6-12 of them each day hanging by their ankles naked in Times Square (or some other central location), on international tv for the duration; crowd can go to town on them from a short distance with verbal & organic 'substance' abuse of choice (just no serious/major physical damage allowed). I think within 6 months the problem would be down to 5-10% of the volumes it is now. :)
Re: (Score:2)
China most defiantly has the resources, ... Start putting pressure on ISPs that allow their networks to be abused.
I'm pretty sure that China's government doesn't care about the amount of spam being generated from their networks because the target of the spam is not their citizens, but rather people in other countries.
Re: (Score:2)
Re: (Score:2)
Not everybody should care either, all the sheeple have to do is not open emails with malicious attachments, or give their bank account number to a Nigerian prince. Move along.
The wrong side of the internet railroad tracks (Score:1, Funny)
Hey little girl...yeah, you...come on over here...want a favorable meta-moderation? /trenchcoat
Re: (Score:3, Informative)
How is Al-Jazeera a bad neighbourhood? I found them to be a useful source during the Egyptian revolution, it is a western-style news channel from Arabia. Just because they have been sent tapes from terrorists does not mean that they support them, just as the guardian getting leaks from wikileaks does not mean that they support wikileaks.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:3)
http://www.nirsoft.net/countryip/
Done!
I prefer to use: http://www.ipdeny.com/ [ipdeny.com] - YMMV...
Drone Strikes (Score:2, Funny)
Big surprise (Score:1, Insightful)
Other than the fact that something this obvious provided fodder for someone's PhD dissertation...
In summary the entire 245-page paper is an elaborate way of saying that blanket /24 IP range bans are an effective way of stopping spam. Oh, and that more people having computers connected to the internet in said "bad neighborhoods" will increase the amount of spam. Ladies and gentlemen, a new way to exclude developing nations from the Internet and look heroic while doing so.
Re: (Score:1)
a new way to exclude developing nations from the Internet and look heroic while doing so.
When the main activity of an entire nation's TLD seems to be crimninal activity, what're we supposed to do? Bend over and grab our ankles? OH! Anything to avoid being falsely called "racist"!
That is what you get with RIRs (Score:3)
>> This is the draft agenda for the RIPE 66 meeting...
> No agenda item about defining (or refining the definition of) "abuse"?
Nope.
> I'd like to just reiterate my view that all other activities of this WG
> will be utterly fruitless until such time as a reasonable, rational, and
> generally accepted definition of "abuse" is in hand.
I genuinely don't think it will be useful to spend time on this.../snip
Re: (Score:2)
Is this for real?
How is any unsolicited email NOT abuse?
Either it comes from someone with a legitimate reason for emailing, or it is a mailing-list with an opt-out that works. The rest is abuse 100% of the time. This is not hard to figure out.
Re: (Score:1)
You're playing with the guy's words. You should quote the whole message, which makes a lot more sense (although I still don't agree with it):
Re: (Score:3)
Twente's Top Twenty Troublesome ISPs (Score:2, Funny)
Missed headline opportunity
Those aren't the phishers you're looking for (Score:5, Informative)
Those aren't the phishers you're really worried about. There seem to be about ten "usual suspects" we keep seeing on our phishing reports. The low-end ones are trolling for Habbo Hotel accounts. A few notches up are phony logins for bank accounts (PayPal and HSBC are popular targets. New this week: Swedish tax refunds. And, for some reason, several new phish sites for AOL 9.0 accounts.) We track these, but they're more of a nuisance than a real threat.
The ones to worry about are better targeted and are of better quality. Those are aimed at corporate login info. Those won't be seen by broad-based phishing detection services because they're only sent to people who might have those logins. So they tend not to be blacklisted.
Break it down per capita (Score:5, Interesting)
Brazil: 196,655,014 people (World Bank)
Russia: 141,930,000 people
India: 1,241,491,960 people
China: 1,344,130,000 people
that's 2,924,206,974 people total.
world population: 6,973,738,433 people, so BRIC countries are 41% of the total in population.
FTFA:
Of the 42,000 Internet Service Providers (ISPs) surveyed, just 20 were found to be responsible for nearly half of all the internet addresses that send spam.
so I take it "nearly half" is between 40% and 50%, but less than 50%. If it's over 41%, then what we are looking here is some form of distribution of 'nuisance' that is related to the actual population and it probably shows normal distribution.
Is this really a surprise?
Re: (Score:1)
It doesn't have to be the same penetration to achieve 40-50% total usage, obviously there are fewer Internet users in India as proportion of population than in USA, however these are total numbers that matter here.
World Internet Users and Population Stats [internetworldstats.com] - by looking at this data one can sort of see why nearly half of the 'nuisance' comes from BRIC countries.
Re: (Score:3)
Re: (Score:3)
Yes, and when "China hacks US companies" we never see how many hacks on that company came from non-China addresses. If 1/100th of the attacks are Chinese in origin, why aren't we invading the US to stop the other 99/100, or wherever they are coming from?
Hacking attempts have different severity levels associated with them. Putting them all in the same bucket as if they were all equivalent would be disingenuous. Besides, no one rational is saying that we should be invading China over this. Also currently, if a hack is severe enough, and coming from the US, the police/FBI goes after them.
It seems to be an irrational nationalistic play, not an evaluation of risk and reasoned response to a threat.
That could be true. I'm not saying that it is, or that it is not. Personally, I just don't know.
Do you know? How do you know? Is this your field?
Re:Break it down per capita (Score:4, Insightful)
As such, I would take the official numbers to be lies, until proven otherwise. Why? Because I have enough personal real-world experience in security to validate the implied raw numbers and invalidate the conclusions. That's why they'll never tell us enough to make up our own minds. Someone like me could prove in 5 minutes that all the conclusions are lies. So we only get false generalizations and, for all we know, 99.44% of Chinese attacks are false flag. Much like the claims that "an IP doesn't identify a person" in the copyright cases, the US is asserting that an IP from China is the government or an agent thereof. It could be a private Chinese citizen, or, more likely, someone from Russia or the US that runs a botnet.
Two reasons (Score:2)
There are two reasons why we are seeing this in the news.
First, it's because China is currently a main economic "enemy" to a lot of western economies when it comes to "jobs" and "quality". These are mainly economy based attacks where trade secrets are the main target. Some are politically based, some are military intel based, but the majority is about economic advantage.
The second reason is that China is hardly trying to disguise that it's a large, government organized and funded group of hackers that is d
Re: (Score:2)
First, it's because China is currently a main economic "enemy" to a lot of western economies when it comes to "jobs" and "quality". These are mainly economy based attacks where trade secrets are the main target. Some are politically based, some are military intel based, but the majority is about economic advantage.
Yes, if it's a military attack, we might ignore it. If profits are threatened, we must stir the populous into a frenzy. It doesn't even have to be true, the effect of the propaganda campaign will still help secure profits.
The second reason is that China is hardly trying to disguise that it's a large, government organized and funded group of hackers that is doing this. If Japan, Korea, Russia and China would each be getting large amounts of spear fishing hacking attempts that all originate from the IP addresses of the Pentagon, it would be all over the news as well
How would China conceal something they aren't involved in? And are they really tracing them back to the Chinese military? I've not seen documentation of that, usually they end up tracking it down to some guy in his home, they assert him to be a military operation, or something like tha
Re: (Score:2)
Nowhere does it say the 20 ISPs responsible fr 41% of the spam are the only ISPs for the BRIC nations. Neither does it say they were all from BRIC nations.
If these assumptions of yours are invalid, and I suspect they are - only 20 ISPs for all of Russia and India? Really? - then your figures are comparing apples and chocolate cake.
Re: (Score:2)
Re: (Score:2)
Population != number of people with access to the Internet.
ovh dedicated servers (Score:2)
the "article" was very uninformative.
but lately on an opensource project blog lots of spam comes from "ovh dedicated servers" subnets. while it probably indicates doing well, it is not appreciated... blocked off a few subnets from them.
Re: (Score:2)
That's because you live in a Bad Documentation neighborhood.
OVH, yup (Score:2)
Yup OVH is close to #1 spam source here. Good luck reaching their abuse desk. Another nasty one is Dimenoc. Spamcop seems to become more and more pointless as more and more abuse@ addresses bounce. Furthermore, in my experience, more and more ISPs start using their own forms for reporting... Handling abuse costs time, time = money; it's a whining geek versus a paying customer. And as long as they can get away with it, they prefer the latter (and hence make it very hard for the former to contact them).
Re: (Score:2)
I really want to punish the customer that put me there but they give me 0 information, no mail to abuse@, even on request. Or they say: You were on the list, but now you are not (ergo: problem solved). I disagree here: It is not solved until I got the spammert. They just don't care that valid email does not arrive. Sometimes eve
Re: (Score:2)
Re: (Score:2)
hinet.net (Score:2)
Running your own gateway that does actual logging is an eye-opening experience. There are a phenomenal number of jerks out there...
Schwab
Final solution (Score:4, Interesting)
Clearly the only solution is to only let the world's biggest telecoms provide Internet to people.
I would gladly take an Internet with some "bad neighborhoods" over a completely safe Internet provided by entirely by AT&T/Comcast and a handful of megacorps who are also involved in creating content.
The Internet/Media/Industrial Complex loves to tell us scary stories about how dangerous an "open" Internet can be. Apparently, the Internet, like the "free market" is only good if they can control it.
Just sell us some bandwidth and I'll look out for my own safety, thanks very much.
Re: (Score:3)
Re: (Score:2)
"Clearly the only solution is to only let the world's biggest telecoms provide Internet to people."
Straw man. It's a perfectly reasonable solution to weed out the "bad neighbours" rather than ban all smaller ISPs.
Thanks a whole hell of a lot (Score:2)
And yet, the article neglects to tell us the names of those 20 ISPs.
It makes you wonder what they're really trying to accomplish with this "study". If they cared about people being safe in the Internet, they could start by telling us exactly where the "bad neighborhoods" are.
Re: (Score:2)
Re: (Score:2)
http://doc.utwente.nl/84507/1/thesis_G_Moura.pdf
Unsecure servers but not the real source (Score:1)
Re: (Score:2)
When did spam become evil? (Score:1)
Spam is how these people make money. By blocking spam, you're denying them their revenue.
Block some (Score:1)
Block it (Score:2)
Simple fix: If the list of ISPs really is that short, just block their prefixes in the core infrastructure and announce this. This way the genuine customers would flee and the ISPs would wise up and kick the spammers. Once unblocked the genuine customers would return (or stop fleeing).
If we're talking about zombie armies doing direct-to-MX spamming, just block that port 25 outbound dammit! - It's a painfully simple fix for any ISP-sysadm. If a zombie cannot spam it's a lot less interesting. If it's located
Patroling the Internet (Score:2)
Humans in general and spammers in particular are very inventive. Automated filters alone are no match for spammers.
The same way, as any attempt to guard prisoners without human guards turned out to be a failure. Prisoners lure dogs, map mines, penetrate electric schemes of perimeter fences, etc.
It makes sense for website owners to participate with a human effort in paroling of the Int
Enough ignoring the sources! (Score:2)
I am *so* tired of China! China! China!
I work for a federal contracttor at a US gov't non-military agency. Yeah, we get our daily dose of Chinese trying to break in with ssh... but we get as many or more from:
- the Netherlands
- Brazil
and well below that, Italy, Turkey, Hungary, Kazakhstan, etc.
Do something about Brazil and the Netherlands, guys!