Slashdot Mirror
Distributive Worm Blocking
wdebruij writes "According to
this source (unfortunately in dutch), a number of dutch ISPs are bundling their forces to fight the spread of worms. The technology, called virbl, blocks all accesses from IP addresses from which at least 2 worms were sent for 24 hours, naturally excluding known large email servers. Background info on the project can be found at the developers' project site. So, does anyone have useful remarks on why this may succeed or fail? It appears to me as a simple to implement yet powerful, albeit stopgap, solution."
Here is progress - still I imagine many companies will leave things as they are just to avoid having to deal with irate calls to the helpdesk, and carry on broadcasting viruses to the world. Collective defense is fine until it costs money.
I making this up completely, but will this lead to denial of service attacks using ip spoofing techniques?
How's this for a DOS...
Attacker signs up for an account with Foo ISP, and then intentionally sends five virus-attachment e-mails to Bar.com. Foo's e-mail servers are suddenly blocked from communicating with Bar.com... and any legit business can't be transacted by e-mail.
The same people who complain when their ISP is blocked for sending spam will (no doubt) complain that this blocks their constitutional right to run an infested box on the Internet--complete with examples of how innocent people will be hurt by this. (Hmm, how about DHCP dynamic addresses?)
One line blog. I hear that they're called Twitters now.
how do users then download the patches to deal with the infection? Not everyone on the internet is computer literate; will the ISPs provide some help to these people?
It does say that they "exlude known large email servers" so presumably it would be hard to take out an ISP. But it sounds like you could DHCP-hop your way through a an address bank and make things pretty miserable for someone.
Am I part of the core demographic for Swedish Fish?
Technology such as this reduces the value of virus-created owned boxes. The creators of viruses that want to create spam-spewing machines would find their spam spewer useless. During the infection phase, the virus-spreading emails would get the infected box tagged and blocked. During the usage phase, the virus-creator/spam sender would find that the owned box is useless because all the messages get blocked.
This tech does not preclude malaciously-motivated viruses, but it does reduce the profit potential of creating spam networks.
Two wrongs don't make a right, but three lefts do.
Are you serious? The guy was fired just for letting a foreign laptop connect to your network? Seems a bit extreme.
Didn't Spamhaus recently launch the pretty much the same service called the XBL?
"The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits." -- http://www.spamhaus.org/xbl/index.lasso
The only thing I thought was weird about the Dutch system was: "An IP address gets listed after receiving at least 2 viruses".. I think that may be a typo as the system scans some email and grabs the ip from the headers if a virus/worm/trojan is found. But if it's not a typo, any email address that receives 2 viruses it gets listed (regardless of infection) is a pretty sucky system.
"I can't send a file to my friend or even get to some website, whats wrong with my PC?"
"You been virusing people, sending spam and being a git."
"No I haven't..."
I don't want to be that tech support guy because this is will happen and often.
--- [Insert intresting Sig here]
And what about small, relatively unknows isps? They will suffer for sure.
If this could be done, then all you would have to do against spam AND worms would be to use that great whitelist, and accept mail only from those "exlude known large email servers". v
No, just the people trying to send mail directly from DHCP addresses, which are frequently blocked anyway. Hopefully this would put more pressure on ISPs to find and disconnect their infected customer before they poison more addresses for a day or two.
One line blog. I hear that they're called Twitters now.
zero infections with no anti-virus suite running on the machine at all.
And how exactly do you know there have been zero infections.. without a virus scanner? Or is the machine not connected to the 'net?
DJ kRYPT's Free MP3s!
Sorry to hear if you're on a dynamic IP address: be prepared for intermittent connectivity to peers in said networks running this technology.
I don't think this is a good solution, anyway. The better solution is for ISP's to use SNORT or something else to real-time detect _outgoing_ viruses and worms from their own customers, and in response, send email to the customer warning them.
This has a number of benefits: i.e. it actively works towards the source of the problem, not just "blocking" the problem out.