Noticed Welchie/Nachi in Your Bandwidth Bill, Yet?

Pinkboard Panther asks: "I have recently received my bill for Internet usage for last month and discovered it is 4 times higher than expected. Since there had been no increase in usage of the sites I run I had to search elsewhere for the exorbitant increase. Eventually I tracked it down to my firewall being bombarded with 20,000 ICMP Echo requests a minute from many different IP addresses. This adds up to $A10 per hour or $A240 a day. I still need to battle with my ISP over whether I should be paying for this. It seems that the Welchie/Nachi worm sends out pings to find what machines are out there before it moves onto deeper probes. I can't believe that I am the only site out there which is being attacked in this way. There must be lots of other sites out there who are affected this way. Maybe they just haven't received their bills, yet?"

Comments

hmm interesting...

[josepha48]

you get charged case someone else uses up your bandwidth by a worm... Well I'd threaten to sue, and then sue, but I think someone else here mentioned there is a class action lawsuit about this.

However they probably just see the ping using up your bandwidth and that is what they are looking at. I'd probably start loging all IP addresses that are pinging your server and then go after all these users. After all they are infected with this worm and until people who get on the internet start being responsible for keeping their machines firewalled, updates and locked down as much as possible from hackers these things will continue. Most of the MS worms could be prevented if people used zone alarm or black ice or another firewall product. Also most of the Linux and bsd exploits could be avoided if they setup firewalls and update their systems and kept on top of security.

No it is not your fault, so go after those who are using up YOUR bandwidth and sue them and make them pay. It is their irresponsibility and stupidity that are causing these problems.

Re:Black Ice

[Xenophon Fenderson,]

Maybe we were looking at different products. IIRC, BlackICE Defender had firewall functionality. The new version, now named RealSecure Desktop, shares IDS signatures with other RealSecure products and can do the whole "active response" thing, including blocking packets, sending TCP RSTs, etc. If you use the enterprise version, it is administered centrally using the ISS SiteProtector console software (which is why we're looking at it at $ORK).

In fact, I seem to recall being impressed with its application-specific firewalling over-and-above Zone Alarm Pro. But I've slept since then, and could be misremembering something.

Re:Standing class action law suit

[Anonvmous Coward]

"We were just commenting today on how there should be a standing class action law suit against Microsoft. We could not think of a real reason, be you seem to have one here. The loss of business and revenue, whether from your pocket or your ISP's pocket, mulitplied acorss many ISPs seems like a case to me "

Ugh. It's funny how morals here perform a complete 180 when there's an opportunity to get Microsoft into trouble.

Here's the simple fact: Microsoft didn't write the worm.

Now you can make the argument if you like that Microsoft was negligent. Just remember, that if you follow that logic, then Linux could find itself liable down the road. Some jackass comes up with an exploit, it causes trouble, and the Linux community is punished for it. Do you really want that?

I have other issues with this line of reasoning. If I walk into a hospital with a cellular phone and intentionally use it to jam equipment there, should Nokia be sued for it? What about the company who made the equipment? Considering that the disruption was caused malisciously (sp?), then the finger needs to be pointed at me.

I would strongly urge the Slashdot Community to be very careful about what you wish for, especially when it concerns punishment for Microsoft. It's fun to hate them and all, but the consequences they recieve could wind up biting you in the butt. Eolas comes to mind...

Re:Standing class action law suit

[torpor]

Now you can make the argument if you like that Microsoft was negligent. Just remember, that if you follow that logic, then Linux could find itself liable down the road. Some jackass comes up with an exploit, it causes trouble, and the Linux community is punished for it. Do you really want that?

Yes.

That would be fair. And, nevertheless, it would at least level the playing field in the new marketing dominion for the 21st century: responsibility.

People are sick and tired of things working 'just becase of a bug', and fundamentally - at least at the level of applications that are being written today - there's no really good reason for it. The technology and mindset required to prevent these sorts of wastes of computing resources existed in the 70's.

What the 'personal computer revolution' camp- you know, the one around the big Microsoft circus tents, crammed full of dopes- often seem to forget is that this 'virus' situation is truly a problem of the *Design* of the system. In other words, Windows allows and *provides a loyal service for* anyone who wants to create an environment in which processes can be run, globally, on everyones computer, unchecked.

Its not like they couldn't have done per-user application security at the filesystem level, say, in Windows95. Hell, Linux/*BSD/*etc. had it then. They could have done it, and enforced it by making it *default* setup. Hell, they could even have done ACL in Win95, for network services... thus preventing a legion of Visual Basic worms that used to make the rounds from shareware bonanza bbs's in the days before ftp ... but ... noooo ... they chanted the 'developer' mantra and used that as a justification to not ... quite ... make ... so ... much progress out of the Windows 3.1/9x/NT/2000/XP/Me/LH upgrade cashcow...

In my opinion, it can be demonstrated fairly clearly that through negligence on Microsofts' part - and their boneheaded desire to 'control^H^H^H^H^H^H^Hservice the entire market at all costs' - they have managed to deliver a product so faulty that it regularly, frequently, is a source of massive productivity loss.

Computer Viruses are so 80's. By now, 2003, we should not be having these problems with our computers.

(Some of us, actually, don't. I haven't had a single problem with a virus infection on my personal computing systems since, I guess it was the early days of DOS 3.1 ... which was the last time I ever attempted to use a Microsoft product in a production scenario.)