NETI@home Data Analyzed 155
An anonymous reader writes "The NETI@home Internet traffic statistics project (featured in Wired and Slashdot previously) has a quick analysis on the malicious traffic they observed. It's a rough world out there." Perhaps not suprising, but still disheartening, the researchers find among other things that a large portion of typical end-user traffic consists of malicious connection attempts.
Considering.. (Score:5, Insightful)
It would be like setting up a massive feedback loop on a mail server. When user X gets message X, he passes message X to user Y, who upon receiving message X sends it back to user X.
Not necessarily a Bad Thing... (Score:4, Insightful)
Assuming that the statistics show which IP address ranges are the worst offenders for malicious traffic, the ISP(s) responsible could simply shut down the outbound connection(s) of the "problem" users until they de-virus their systems and KEEP THEM THAT WAY.
Perhaps that will help to finally clue people in that having Internet connectivity is a privilege, not a right, just like driving. If you're going to enjoy an Internet connection you need to show some responsibility for making sure your own system isn't going to be a problem to others.
I -still- think there should have been Internet user licenses, just like we have driver's licenses...
Keep the peace(es).
Root of the problem (Score:5, Insightful)
Now, stepping back to the Windows complaints...wouldn't the ISP turning off your access motivate you to get a BASIC education in computing and maintain your PC?
To make an analogy, in most states you need to have your car inspected (and some require emissions inspection, too). PUBLIC roadways means you share it with other people...an unsafe car affects more than just you. When you're connected to the net, your PC affects everyone else. I'm not suggesting the ISPs make an inspection system or a law passes to force ISPs to monitor traffic, but the same logic applies....someone should be doing checkups and flagging the offenders.
Standards for viruses? (Score:4, Insightful)
The only way viruses will ever get standards is if the authors agree that they will get a considerable benefit by working together. I can't see that happening.
Comment removed (Score:3, Insightful)
Re:Not necessarily a Bad Thing... (Score:2, Insightful)
Re:RBL of infected/malicious sites? (Score:5, Insightful)
Next Step? (Score:4, Insightful)
The biggest problem in Intrusion Detection Systems (buzzword for firewalls with more intelligence than a typical rule-based firewall) is that metrics gathering is occuring at a specific site, making it difficult to discern malice intent from dropped packets or bad coding.
Any time the central server sees a certain threshold of malicious attempts from a single IP, it adds it to a short term blacklist... Make the term length just slightly longer than the reporting period so if it persists it'll remain on the list but if it stops, the IP is cleared in short order.
DSL/modem/router (Score:5, Insightful)
I would like to see more ISP isntead of suplying basic DSL modems with those overpriced sign up deals but instead a proper firewall/router/Dsl modem.
This would save us all alot of pain in the long run .
Re:Not necessarily a Bad Thing... (Score:4, Insightful)
Re:Root of the problem (Score:3, Insightful)
You should have just stopped there. Analogies are fucking stupid. Car analogies even moreso. Just stop it.
The reason why your analogy doesn't hold? Computers with viruses can't kill people. Cars with bad brakes can.
someone should be doing checkups and flagging the offenders.
If you want to pay for it, go right ahead. I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.
Don't use SSH password authentication (Score:5, Insightful)
Re:Root of the problem (Score:3, Insightful)
Oops! Someone hasn't noticed the number of trains and ships running Windows. No danger of a virus killing anyone there, then.
I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.
Someone also hasn't noticed the amount of effort that goes into protecting his system from zombie machine. Perhaps he thinks firewalls were a gift from unknown stellar travellers and spam filters require no effort to create and update.
Perhaps someone is a troll.
TWW
Re:Root of the problem (Score:1, Insightful)
I know Speakeasy polices their network for open SMTP relays, because I see it in my server logs. I don't know if they actively look for zombied machines, but I can tell you that they've pretty quickly shut off the connections of customer machines on their network that I've brought to their attention when I've seen obvious worm-related connection attempts in my firewall logs.
I also know that the bigger ones, like Comcast and Verizon, don't really give a shit about that kind of stuff. I've even had another large ISP flat out deny that the machine I was complaining about was on their network, despite the fact that I look up who owns netblocks in ARIN's database so I know where to direct my complaints.
And the grandparent poster is exactly right about why they don't give a shit-- because if they cut off some idiot's access because his machine got owned, that idiot is more likely to find another ISP that won't cut off his access rather than learn how to properly admin his machine. The big ISPs would rather let all their customers lose bandwidth to a zombied machine than risk losing the money they make from the guy who owns that zombied machine.
Re:Don't use SSH password authentication (Score:1, Insightful)
Exactly right. It's almost trivial even under Windows to do it. Two factor should have been a standard years and years ago but as long as people can have four to eight digit passes which are easy to break, we keep seeing problems that shouldn't be there.
Anyone notice that PGP has passphrases of quite possibly insanely large size? It's hard to remember some farked and leeted phrase chosen to confound brute force and guessing when you have ten different ones. It is not hard to remember verbatim a passage from your favorite book. What's the mathematical difficulty in breaking a password with over one hundred digits? I can type a forty digit pass right 99.9% of the time if it is a passage of meaning to me.
Combine strong passwords and two-factor and you eliminate the bulk of these amature breakers from contention. Now if only end-users couldn't do their work for them by running their trojans from e-mail attachments and bouncing pop-up windows. "Win a compromised box! Click now! Crackers are standing by!"
Re:Root of the problem (Score:5, Insightful)
Bollocks.
The aren't running a network in their parents basement you know. Their networks are massive, with nodes LITERALY spanning thousands of miles. The volume of traffic they deal with is HUGE. They use cutting-edge routers just to keep up with the demand.
How on earth do you do traffic analysis on that level? You might be able to catch some of the more obvious spammers, but how do you differentiate (on the IP level) between: a) a residential user b) a commercial user who maildrops willing customers c) a zombie d) a community group or e) blah. Blocking someone based on traffic is not possible, unless you want to lose your valid customers.
What they should do is be more responsive to complaints. If a customer of theirs is a zombie spambot or acting as a stepping stone for some script kiddie, they should have their connection suspended until it is remedied. But they can only do this based on a complaint.
Besides, what's the profit in spending any resource on the problem in the first place? Until that is affected, they won't care about it.
Re:Not necessarily a Bad Thing... (Score:3, Insightful)
Any ISP who puts something like what you described in place is likely to lose customers in a hurry. Hotels/Airports/Coffeeshops have transient, non-recurruing customers, or the customers are there for something else other than internet, so its not as big of a deal there.
PDF, ack (Score:3, Insightful)