How should ISPs notify customers about Bots (Was Re: DNS Hijacking

Mailman List Mirror (Read Only)
1

> "Some privacy advocates" will be upset with ISP's doing what Cox is doing.
> Maybe you missed that. If we assume that it is okay for Cox to actually
> intercept the IRC sessions of their users, we're wayyyy far into that
> mess anyways. I'm saying "do it right" if you're going to do it at all.

Would it be better if ISPs just blackholed certain IP addresses associated
with Bot C&C servers instead of trying to give the user a message. That
doesn't require examining the data content of any messages. The user just
gets a connection timeout.

Compared to hijacking DNS and intercepting sessions? Yes. Absolutely.
See, it isn't that hard to come up with better ideas.

> Personally, I'd prefer that they didn't do it, but that set of solutions
> is more complex.

So it is better for ISPs to do nothing, than attempt something that isn't
perfect.

Well, that's not what I said, now, is it. I did say that there's a set of
solutions out there to deal with that.

Thanks. I'll remember that the next time someone complains about
ISPs not caring about abuse or bots on networks.

Interestingly enough, some of us care. Some of us care enough to run clean
networks AND to make sure that what we're selling isn't compromised by
deliberate DNS hijackings and site redirections.

Hmm.

... JG

2

Would it be better if ISPs just blackholed certain IP addresses associated
with Bot C&C servers instead of trying to give the user a message. That
doesn't require examining the data content of any messages. The user just
gets a connection timeout.

Compared to hijacking DNS and intercepting sessions? Yes. Absolutely.
See, it isn't that hard to come up with better ideas.

That's what Verizon was doing. Guess what. People complained about it too.

Interestingly enough, some of us care. Some of us care enough to run clean
networks AND to make sure that what we're selling isn't compromised by
deliberate DNS hijackings and site redirections.

But do include things like patching servers to filter messages that contain certain strings which might accidently catch a legitimate message on occasion. People probably complain about those things too.

It sucks when you are the one that gets caught by a false positive. Unfortunately, every attempt at anti-abuse systems have experienced it
at one time or another. Probably even some of the things you've done
over the years trying to run a clean network has accidently made a mistake.