Slashdot Mirror

← Back to Stories (view on slashdot.org)

Distributive Worm Blocking

Posted by CmdrTaco on from the anyone-speak-the-dutch dept.

wdebruij writes "According to this source (unfortunately in dutch), a number of dutch ISPs are bundling their forces to fight the spread of worms. The technology, called virbl, blocks all accesses from IP addresses from which at least 2 worms were sent for 24 hours, naturally excluding known large email servers. Background info on the project can be found at the developers' project site. So, does anyone have useful remarks on why this may succeed or fail? It appears to me as a simple to implement yet powerful, albeit stopgap, solution."

6 of 162 comments (clear)

  1. Zegnar by Zegnar · · Score: 5, Insightful

    Here is progress - still I imagine many companies will leave things as they are just to avoid having to deal with irate calls to the helpdesk, and carry on broadcasting viruses to the world. Collective defense is fine until it costs money.

  2. Frea Speach! by AndroidCat · · Score: 5, Insightful

    The same people who complain when their ISP is blocked for sending spam will (no doubt) complain that this blocks their constitutional right to run an infested box on the Internet--complete with examples of how innocent people will be hurt by this. (Hmm, how about DHCP dynamic addresses?)

    --
    One line blog. I hear that they're called Twitters now.
  3. This is a sensible thing to do but.... by Sox2 · · Score: 5, Insightful

    how do users then download the patches to deal with the infection? Not everyone on the internet is computer literate; will the ISPs provide some help to these people?

  4. Re:Dutch DOS by AndroidCat · · Score: 5, Insightful

    If you can IP spoof with a TCP/IP connection, you could do a lot more damage than a DoS attack.

    --
    One line blog. I hear that they're called Twitters now.
  5. Re:a new denial of service attack by pedantic+bore · · Score: 5, Insightful

    It does say that they "exlude known large email servers" so presumably it would be hard to take out an ISP. But it sounds like you could DHCP-hop your way through a an address bank and make things pretty miserable for someone.

    --
    Am I part of the core demographic for Swedish Fish?
  6. Spamhaus by AndyFewt · · Score: 5, Insightful

    Didn't Spamhaus recently launch the pretty much the same service called the XBL?

    "The Spamhaus Exploits Block List (XBL) is a realtime database of IP addresses of illegal 3rd party exploits, including open proxies (HTTP, socks, AnalogX, wingate, etc), worms/viruses with built-in spam engines, and other types of trojan-horse exploits." -- http://www.spamhaus.org/xbl/index.lasso

    The only thing I thought was weird about the Dutch system was: "An IP address gets listed after receiving at least 2 viruses".. I think that may be a typo as the system scans some email and grabs the ip from the headers if a virus/worm/trojan is found. But if it's not a typo, any email address that receives 2 viruses it gets listed (regardless of infection) is a pretty sucky system.