Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Botnet Networking Security The Internet IT

Naming and Shaming "Bad" ISPs 79

Posted by Soulskill from the gettin'-called-out dept.
An anonymous reader writes "Brian Krebs takes a provocative look at ISP reputations, collecting data from 10 different sources that track 'badness' from a multitude of angles, from phishing to malware to botnet command and control centers. Some of the lists show very interesting and useful results; the ISPs that are most common among the various reputation services are some of the largest ISPs and hosting providers, including ThePlanet and Softlayer. The story has generated quite a bit of discussion in the security community as to whether these various efforts are measuring the wrong things, or if it is indeed valid and useful to keep public attention focused on the bigger providers, since these are generally US-based and have the largest abuse problems in terms of overall numbers."
This discussion has been archived. No new comments can be posted.

Naming and Shaming "Bad" ISPs More

Naming and Shaming "Bad" ISPs

Comments Filter:

  • Wow, I feel bad for ThePlanet.com (Score:5, Insightful)

    by jeffmeden ( 135043 ) on Saturday March 20, 2010 @09:05AM (#31549234) Homepage Journal

    These measurements might not be 100% accurate at identifying the root of each of the problem areas, but when an ISP is on all but one of the top ten lists, you have to start wondering what they are doing wrong. ThePlanet.com, what gives? Too many undereducated customers running infected servers? No top level detection and deactivation process in place? Seems like there are a lot of things missing.

    • Then again, this also says that the smaller ones are not really worse than the big ones. Which is kinda obvious.

      I think if you want to find the core of the problem, you have to follow the money. But I fear that that has already been done, and that it lead right back to the friends of the ones who were searching for it. (Big advertisement companies, big pharma, etc.) Which caused them to do nothing.

      My guess is that they use a straw-man company so they appear detached. I have seen this in Internet companies w

      • Except that they clog up the tubes and make business difficult for us smart folks.

        Not to mention that pissing off a spammer in control of a large botnet can be hazardous to your system when he decides to retaliate with a DDoS attack.

        So here we have the circle of spam:

        1. Spammers are huge and have massive resources at their disposal
        2. Only governments and large corporations have the resources to fight them
        3. The people pushing their wares through spammers have their friendly congress critters eating out o

  • I think it'a about the same all over (Score:5, Interesting)

    by agoliveira ( 188870 ) <adilson@adilson. n e t> on Saturday March 20, 2010 @09:06AM (#31549246)

    One of the largest ISPs in Brazil, Locaweb, is the main source of spam and malware I get and it's not only about numbers. They just ignore every single complain I've done.

    • Re: (Score:2)

      by antdude ( 79039 )

      How about taking legal actions?

      • The problem is that we don't have clear laws regarding spamming. There has been some legal actions base on analogies with older things but it's not a clear shot. I rather take it to the technical level and block their traffic and/or see what can I do to add them into some RBL.

  • ThePlanet (Score:5, Interesting)

    by Manip ( 656104 ) on Saturday March 20, 2010 @09:06AM (#31549248)

    It is a shame that ThePlanet is doing so badly. I've used them before for dedicated hosting and was very happy with the service I received. I will say that they are very "hands off" (which is generally good, but bad in this case). I think one has to remember that this is a chart of which ISPs are most responsive and active in stopping abuse originating from their network and not some kind of general review of the service they offer.

    That being said I think all the ISPs listed should be unhappy about appearing on these lists and should actively be trying to fix their reputation or risk getting blacklisted.

    • They should have entered RTBLs long ago. Maybe this should scare them enough so they start to pay attention to the complains they certainly get.

    • Re: (Score:3, Interesting)

      by sopssa ( 1498795 )

      Would you blacklist Google too? They are on the lists too. It's not the problem that they would be actively friendly towards such activity, it's that they're so big companies that they get abused.

      • If you report something to Google, they take action very quickly. It's just a pain to report to them, via web form, one URL at a time. When they are getting abused by criminals, it takes them a while to fix the ineffective captchas or to scan their docs/blogs for clones of ones that have already been reported a few hundred times. They do eventually get their act together. They really need a better system for accepting bulk submissions. Currently, they're on top of the Blogspot and Google Docs abuse. But w

    • It is a shame that ThePlanet is doing so badly.

      When I blocked ThePlanet, my silly traffic dropped noticeably. Every day, sometimes two or three times a day, I was getting hacked at from the ThePlanet IP range. Blocking them was a big relief.

    • I guess the hands-off approach is necessary when you have tens of thousands of servers rented out for cheap. When some IPs have been tainted, there should be more pressure on the server owners to get rid of the bad users and get them off the lists.

      I've had some customer sites with Hostnine, who use ThePlanet servers. It's pretty bad, because you have no choice of IPs. You'll get a random IP from the location you choose (a few US locations, Singapore, England), and it's a lottery. Most people don't win. Mail

  • Network neutrality (Score:5, Funny)

    by BadAnalogyGuy ( 945258 ) <BadAnalogyGuy@gmail.com> on Saturday March 20, 2010 @09:07AM (#31549258)

    You take the good. You take the bad. You take them both, and there you have Net Neutrality.

    Net Neutrality. When the world never seems to be living up to your dreams, and suddenly you're finding out Net Neutrality isn't all about you.

  • I bet every ISP wants to be a Superior Carrier of Utmost Magnificence ;-)

  • Laughable (Score:4, Insightful)

    by Threni ( 635302 ) on Saturday March 20, 2010 @09:20AM (#31549328)

    Why would anyone (home user/corporate etc) care about any of that? It doesn't make their network/access any less safe. People go for cost, then performance. If I can get a good deal from an ISP, why do I care about how many follow customers are incapable of managing their systems?

    • Because if they do, we would have a lot less of malware and spam therefore more resources available. Isn't that obvious?

    • Re:Laughable (Score:5, Insightful)

      by Antique Geekmeister ( 740220 ) on Saturday March 20, 2010 @09:48AM (#31549488)

      Because it does make your network less safe. Having the script kiddies, the spammers, and the harvesters active on your subnet exposes you much more directly to their abuses, and to the likelihood that your logs will be cluttered with the attacks from their servers. It also gets _you_ added to email blacklists and routing table blackholes, because your customers may be tired of the abuse from your network and find it far simply to simply block you.

      The expense of a more reliable and secure server is an issue. But there's nothing like the self-righteous DDOS attacks that have occurred against networks that serve abusers to clutter the traffic of even innocent clients: it imperils the service for legitimate, paying customers. Cases like "agis.net", who hosted the Cyberpromo spammers before a DDOS against them finally got them to take action, make a fascinating study in the risks of hosting abusers. Conversely, xinnet.com in China is happy to host spammers: with the size of their service and the limited choices available to consumers in China, they're effectively immune from prosecution or attack.

    • Why should corporations care? Two words "litigation exposure." A bot-net living in your network takes down an e-commerce site for day. They will see you in court. Good luck with that "don't blame me, blame my ISP" defense.

      I think that kind of "not my problem" thinking is what is driving the current cloud computing craze. Corporations seem to think that they can side step the accountability hassle if they outsource IT to the cloud [toolbox.com]. Good luck with that too.

      • I don't think someone could sue you (legitimately) and have a case just because somebody else on your ISP's network was spewing viruses or other attacks. If it was running on your own in-house network that you control, it would be a different story. But someone can't be held responsible for what their ISP allows in other areas of the network they have no control over.

        • IANAL but my guess here is if the attack is coming from the IP of the server(s) where your app is running, then you could listed as a defendant. If you are sharing a server or have a VPS account, then you are still not patching the OS of that machine so it is vulnerable to getting infected and caught up in a bot-net. Even with dedicated machines, an incorrectly patched firewall or security appliance could leave your machines vulnerable.

        • That never stopped the RIAA from suing innocent bystanders...

    • because when the IP address block that was assigned to your IP is blacklisted, you won't be able to do shit except switch ISPs, then switch all your DNS entries (if you're a corp user) or hang out all day waiting for your new cable/dsl/whatever tech to show up to plug in your shiny new cable/dsl/whatever modem. That's why you would care about it.

  • time for a division (Score:2, Insightful)

    by Anonymous Coward

    So as by far the biggest abuse problems (botnets, spam, ...) are coming out of the USA since many years, maybe it is time for other countries to black whole USA based addresses. Just stop routing their packets until they become good net citizens.

    I don't know how many reports I have seen pointing to the USA as the biggest spam source. It's time to do something about it. Only if there are some consequences will they ever change their behaviour.

  • It's not my problem, my customer is doing this! (Score:5, Insightful)

    by wowbagger ( 69688 ) on Saturday March 20, 2010 @09:48AM (#31549486) Homepage Journal

    The big hosting providers ALL have the same attitude when you contact them about abuse:

    "WE aren't doing this, that is one of the customers of one of our resellers, we won't do anything, talk to the reseller."

    Of course, the reseller says "Screw you, they are paying us good money and you aren't."

    Softlayer is a VERY good example of this: a Softlayer hosted site has repeatedly been spamming the Wine Developers mailing list for their crap. I have personally emailed Softlayer about it on more than 10 separate occasions, and have heard ZERO back from them. They don't care (even though their site claims they are aggressively anti-spam - BULLSHIT! words are cheap, actions are not, and Softlayer HASN'T ACTED!)

    The spam problem isn't complicated to solve, it is actually pretty simple to solve (though not EASY to solve!) - just follow the "shit flows downstream" principle. If a host is doing bad things, look up who owns the network they are on, and MAKE IT THAT ENTITIE'S PROBLEM to solve it. However the problem is solved - be it "Hey, your server's infected" "OOPS fixed now sorry!", be it "We have blocked outgoing connections from your system until you fix it.", be it "Boss axed me an' Nunzio to has a talk wit ju about youses' server...." - doesn't matter as long as the problem gets solved. If it DOESN'T get solved, then the network owner becomes the problem entity, and you move to their hosts.

    The only hard part is bringing some form of negative consequences to bear upon the network owners - you either need a law (and then you have a hard time dealing with systems outside your law's reach - all you can do is place the problem on the point of demarcation to your jurisdiction), or you need something with a wider reach, like publicity.

    (and to all you morons about to copy and paste the "spam solutions form" - that meme is old enough to drink and vote, let it die already, OK?)

    • I agree.

      Anyone in the chain that becomes aware of spam going through their tubes and yet does diddly about it becomes an accessory.

  • Ohhhhh Please! (Score:3, Interesting)

    by FlyingGuy ( 989135 ) <flyingguy@gm a i l .com> on Saturday March 20, 2010 @10:10AM (#31549600)

    We all demand huge bandwidth, huge amounts of storage and we want it for 19.95 a month.

    Do you wonder why everything is over sold? I mean, really do you?

    How much does a really sharp *nix admin.engineer cost annually?

    Even with really good tools how many physical boxes can on guy keep watch over? How about when each box is hosting 300 accounts, or running 10 VM's? What would anyone guesstimate? Maybe each box is only hosting 30 accounts? I mean the numbers start to add up.

    Lets say just for sake of argument that a really good admin can handle the care and feeding of 100 servers. That guy costs you 60K a year benefits and all. You need three shifts because you run 24/7 so that is 180K right there. Lets say you have 10,000 servers do now we are taking 100 guys * 3 shifts so 300 admins * 60,000.00 per year. So payroll just for the admins is 18 million a year and we have not given anyone the weekend off, so that number is a bit low.

    You have not yet paid for all the hardware or your bandwidth bill. So right now at 19.95 a month you need about 900,000 customers.

    Uhmmm for some reason those numbers just don't pencil. So thats why ISP's have to oversell everything AND turn a blind eye to a lot of things.

  • I am a bit doubtful (Score:3, Interesting)

    by Sycraft-fu ( 314770 ) on Saturday March 20, 2010 @10:10AM (#31549602)

    The reason being that when I look at our firewall logs or when we happen to get a system compromised, the US is way underrepresented. The US accounts for a very large portion of the Internet still, and we are located in the US so you might expect to see most attacks from there. However the majority are RIPE or APNIC addresses. You can also see it in things like Conficker infections. If you look at the graph of what got hit how bad (http://www.confickerworkinggroup.org/wiki/uploads/ANY/conficker-all-2009-small.png) you see that RIPE and APNIC are again way overrepresented in relation to the whole.

    Now I've not done a scientific study on this, I'll admit, but I do have a reasonable data set and it just doesn't match with what I've seen.

    • The reason being that when I look at our firewall logs or when we happen to get a system compromised, the US is way underrepresented.
      .
      If you are looking at direct malicious activity, then you are quite correct. However, once you start looking at C&C servers and where they are (which you have to do somewhat indirectly), then you will find that many of them are indeed hosted on major ISPs in the US. So why would someone run C&C from US servers, but have the direct malicious action from outside the U

  • I remember when ISPs used to seriously police their users, because there was the potential for them (the ISP) to get kicked off the internet, and have that stick. Network admins listened to complaints from other admins, and if they concluded that a given ISP wasn't keeping house and letting too many net.abusers on, they were considered a rogue ISP and cut off. The rogue net couldn't just call up another network access provider and get reconnected, because their reputation preceded them. I'm not saying I'

  • Big and cheap providers are on the top 10 lists of spam and malware? Really? Wow, I am surprised... NOT.

    Let's be sensible for a moment and ponder: Why are ISPs hosting a lot of pages a main source of malware? Because they are a main source of traffic and webpages. It's like saying that there are more people in jail in the US than in, say, Andorra. Thus the US are much, much more violent and generally people there must be kinda leaning towards crime, right?

    And cheap service means that they can not waste reso

    • That's easy. Make providers concurrently liable for any abuse they knowingly facilitate.

      Giving them a complaint with logs puts them on notice, and then if they don't do jack shit about it afterwards they either don't give a crap, or they are directly profiting from it. Either way, they are facilitating the abuse by knowingly letting it happen.

      • Careful what you wish for. It's only a small step from "must act on complaints" to "must act on complaints about anything from anyone". Like, say, the RIAA complaining that they think they saw copyright infringment happening, and carpet bombing ISPs with such "complaints".

        • That is also simple.

          Assess penalties for frivolous complaints.

          I believe the DMCA already has a provision to that effect anyway.

  • Look, no matter how much we want ISPs to stop malware, botnets, etc. when they start doing that, they are going to start becoming more evil (as in giving out IP addresses and subscriber names, etc). Content-agnostic ISPs are -always- going to be better for the internet. Unless, you want throttling and your ISP to check for "pirated" content.
    • Actually, ThePlanet and SoftLayer are probably pretty good at responding to complaints about pirated content, because the people filing the complaints are doing so on law firm stationery and are prepared to get punitive damages against any firm which fails to take action... The people suffering harm from C&C servers are the people whose computers are infected and the people whose inboxes are full of spam. It's not a single wealthy copyright holder who can justify an expensive legal fight. In general, th

  • Major domains being exploited (Score:5, Informative)

    by Animats ( 122034 ) on Saturday March 20, 2010 @11:29AM (#31549988) Homepage

    We've been doing something like this at SiteTruth for two years. We have the list of major domains being exploited by active phishing scams [sitetruth.com]. This is simply a list of domains that are both in PhishTank (about 100,000 entries) and Open Directory (about 1.5 million entries). Today, 84 domains are in both. There's been a surge; it was 54 two days ago.

    Domains are on this list for one of several reasons.

    1. They had a break-in, and didn't clean it up. Generally, the sites with this problem for long periods are ones without effective contact information, so there's no easy way to tell them about their problem.
    2. They have an open redirector. [mitre.org] Those are rare now, but were common two years ago. Yahoo, eBay, and Microsoft Live all used to have open redirectors. After much nagging, and some press coverage, the big players have plugged that hole.
    3. They're a hosting service, especially a free hosting service. Free hosting services need to be very aggressive about checking themselves for exploits. The smarter players now read the PhishTank and APWG feeds automatically, to detect abuses of their own systems. Right now, "t35.com" is suffering from a massive attack, with 227 pages in PhishTank. Their problem is that they're being attacked by a program, but are cleaning up by hand. Every day they kick off hundreds of phishing pages, but they can't keep up. The previous site with the worst problems was "piczo.com" (some kind of social network/hosting service for teenage girls), but they've been gaining on the problem.
    4. They're an ISP There are a few ISPs with phishing sites they just never seem to kick off. Most of the active ones were kicked off long ago. In fact, other than ISPs which are also hosting services, we show only one entry in this category, and it's a DSL line on RoadRunner that redirects to a dead page.
    5. They're a "short URL" service. These are popular as a way to get phishing URLs past spam filters. The "short URL" services have become much more aggressive about kicking off phishing URLs over the last year.

    While this is to some extent a "blame the victim" approach, it's more effective than "phishing education" aimed at end users. Hundreds of webmasters have to be educated, not hundreds of millions of end users.

  • i recommend peer guardian for some huge lists of malicious IP's

Slashdot Top Deals

Put your Nose to the Grindstone! -- Amalgamated Plastic Surgeons and Toolmakers, Ltd.

Close