Distributive Worm Blocking

wdebruij writes "According to this source (unfortunately in dutch), a number of dutch ISPs are bundling their forces to fight the spread of worms. The technology, called virbl, blocks all accesses from IP addresses from which at least 2 worms were sent for 24 hours, naturally excluding known large email servers. Background info on the project can be found at the developers' project site. So, does anyone have useful remarks on why this may succeed or fail? It appears to me as a simple to implement yet powerful, albeit stopgap, solution."

Comments

Re:Not gonna work!

[RidiculousPie]

Did you even think about reading the article?

The program provides a list of ip addresses to block email from. It doesn't only target dutch isp customers email, it allows email from known virus offenders to be blocked.

Also in the faq for the program, a dutch ISP can apply to be whitelisted.

So how does this constitute locking down their customers?

In addition, do ISPs want virus spreading customers?

Re:That's not security, that's stupidity.

[[Lizard]]

Ehm, not really, the system also uses a whitelist on which the mailservers of normal ISPs are listed.
Furthermore a bot-created smtp will trigger the protection quick enough so it won't be able to send much. Personally I doubt it will backfire, but maybe there's some place for improvements, time will tell.

(When I have some free time I'll try to translate the article in readable english :)

We use a similar concept @ work

[jsav40]

Infected machines are locked out of the network entirely. Getting the machines reconnected is a fairly lengthy process and users have become *much* more interested in allowing field techs to patch machines since the lockdown process was initiated. We push patches out remotely so only 5% or so of the machines ever need to be manually patched. We also scan our subnet daily for vulnerable machines and proactively patch any machines that turn up that way. Personal laptops were a problem (briefly) but after an incident at another location where the offfending user was terminated folks have gotten the message that it is not OK to attach non company owned computers to the network.

Translation for non-Dutchies

[mrjb]

Chello en Tiscali top-spreaders of viruses
A database with infected pc's is the foundation of an ambitions project that should reduce the flood of virus emails
A number of Dutch providers is currently testing a worm blocker based on an extensive database of infected pc's. This file has been kept up-to-date since 2 weeks ago by BIT, a provider for businesses. In this database, amongst other things, is visible from which IP address which virus is being spread.

Other providers can use this database to inform their own customers that their computer is infected and bothering other people, explains Alex Bik of BIT. Self-propagating viruses (worms) are causing more and more trouble, both to private users and providers.

BIT itself has been using the automatic blacklist-system since last week, to protect their customers against the ever growing stream of virus mails. By now, a large number of Dutch [internet] providers, including XS4ALL, Zonnet and IS Internet Services, also have access to the data.

Port 25

In its database, BIT keeps track from which IP addresses virus mails are sent. This sending [of emails] often takes place directly via port 25 from infected computers. As soon as more than 2 infected emails arrive at BIT within 25 hours, the IP address is blacklisted for 24 hours. However, the ip-addresses of mail servers of known providers are not added to the database.

Chello tops the list

The list shows that other providers, too, can benefit from the blacklist. Customers of Chello, Tiscali and @home top the list of major virus spreaders (over 1000 virus emails). The topper is an ip-address at Tiscali, from which as much as 12000 sober G-mails have been sent.

In total, Chello leads with over 27000 sent virus mails with the 25 main 'spreaders', followed by Tiscali (almost 23000), @home (almost 20000), Wanadoo (over 14000), HCCnet (almost 13000) and Planet [internet] (almost 12000).

We're doing something similar

[bigberk]

So, does anyone have useful remarks on why this may succeed or fail?

The WPBL is a very similar effort, using distributed spam sightings to block IPs. We focus on spam, while virbl specializes in viruses. I think they'll have good success provided their method of virus detection is very accurate. In our case, statistical bayesian-like filters help us get accurate spam sightings.