Slashdot Mirror

← Back to Stories (view on slashdot.org)

NETI@home Data Analyzed

Posted by timothy on from the sharpen-your-knives dept.

An anonymous reader writes "The NETI@home Internet traffic statistics project (featured in Wired and Slashdot previously) has a quick analysis on the malicious traffic they observed. It's a rough world out there." Perhaps not suprising, but still disheartening, the researchers find among other things that a large portion of typical end-user traffic consists of malicious connection attempts.

155 comments

  1. But did they find intelligent life? by miracle69 · · Score: 5, Funny

    That's what we need to know.

    --
    Linux - Because Mommy taught me to Share.
    1. Re:But did they find intelligent life? by Anonymous Coward · · Score: 1, Funny

      no, but at least they're pretty sure there are no intelligent life in the bosses' office.

    2. Re:But did they find intelligent life? by eobanb · · Score: 5, Funny

      Well, they found people with a bunch of Windows Services on and all their ports open. Does that answer your question?

      --

      Take off every sig. For great justice.

    3. Re:But did they find intelligent life? by Anonymous Coward · · Score: 0, Troll

      and all their ports open

      Excellent. But are they female?

    4. Re:But did they find intelligent life? by netcrusher88 · · Score: 4, Funny

      Coming soon: NETI@home discovers sentient penguins and daemons... "Penguins were seen to be working alongside daemons, cultivating apples and mischievously breaking windows..."

      --
      There's an old saying that says pretty much whatever you want it to.
    5. Re:But did they find intelligent life? by Anonymous Coward · · Score: 0

      That's the most beautiful thing i've ever read on slashdot.

  2. Considering.. by Renraku · · Score: 4, Insightful

    Considering these malicious programs aren't following any kind of 'standard' to reduce bandwidth utilization when checking over entire subnets of IPs that have been checked by 100000x other copies of the virus, it doesn't suprise me one bit.

    It would be like setting up a massive feedback loop on a mail server. When user X gets message X, he passes message X to user Y, who upon receiving message X sends it back to user X.

    --
    Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
    1. Re:Considering.. by Nos. · · Score: 2, Interesting

      Oh, so there should be a central hub where the virus/worm can talk to other copies of itself. Any place it could talk to itself would quickly be located and shutdown. Besides, I don't think the writers of these kinds of programs are really concerned with your network utilization.

      Most of the malicious type traffic I'm seeing lately (aside from SPAM) is ssh worms trying to log into my boxes. Most boxes are set to only allow ssh from a few IPs or subnets, but I have one that I block class A's anytime I see a worm trying to get in. I've got about 1/2 the IP space blocked right now.

      It would be like setting up a massive feedback loop on a mail server. When user X gets message X, he passes message X to user Y, who upon receiving message X sends it back to user X
      I remember a Banyan mail system I worked with. In the event that you set up a vacation (while I'm out) type mail minder and we're near your mailbox limit, it was possible to start and endless loop of a mailbox full notifications (mailbox full notifications were allowed even if the limit was reached).

    2. Re:Considering.. by TheOtherChimeraTwin · · Score: 2, Funny
      Considering these malicious programs aren't following any kind of 'standard'

      Not true! For example, they follow RFC 3514

    3. Re:Considering.. by Thing+1 · · Score: 1
      Oh, so there should be a central hub where the virus/worm can talk to other copies of itself. Any place it could talk to itself would quickly be located and shutdown.

      Not if it's on freenet...

      --
      I feel fantastic, and I'm still alive.
  3. RBL of infected/malicious sites? by nizo · · Score: 4, Interesting

    Does anything like this exist already? It would be nice if I could filter, say, ssh traffic coming from "known" naughty sites, and report sites that portscan me, though probably I should look at using smartcards or something more secure at this point. I can't just restrict the ssh port at the firewall, since people could be coming in from pretty much anywhere because of travel to remote sites. Aside from complaining to upstream providers (which so far has yielded zero responses) when I see people banging away at ssh, I don't see much else I can do.

    --
    I Am My Own Worst Enemy
    1. Re:RBL of infected/malicious sites? by 14erCleaner · · Score: 2, Informative
      It would be nice if I could filter, say, ssh traffic coming from "known" naughty sites

      From the abstract of their paper:

      Finally, we look at activity relative to the IP address space and observe that the sources of malicious traffic are spread across the allocated range.

      So the answer is no, you can't filter effectively for bad sites.

      --
      Have you read my blog lately?
    2. Re:RBL of infected/malicious sites? by Nos. · · Score: 2, Interesting

      It might be worthwhile to look at setting up some sort of a webbased authentication system that would dynamically allow an IP address or subnet for a certain amount of time. Block everything, but if your customer/employee/whatever needs in, they can authenticate via a webpage which would then update your firewall rules.

    3. Re:RBL of infected/malicious sites? by delirium+of+disorder · · Score: 4, Insightful

      Why can't you restrict access to ssh from the firewall? One solution could be port knocking. You only let your firewall open up ssh after a series of connections on pre-defined parts are made. So say you choose "233 457 69 876 2094 576" to be your "password". You would make a client that would connect to those ports in that order and only after that initiate an ssh connection on port 22.

      --
      ------ Take away the right to say fuck and you take away the right to say fuck the government.
    4. Re:RBL of infected/malicious sites? by Anonymous Coward · · Score: 0

      Just move the SSH service to a non standard port. The SSH scan zombies you're referring to only scan on port 22.

    5. Re:RBL of infected/malicious sites? by BannedfrompostingAC · · Score: 1

      A great idea, but I have an even better one: you can instead secure your network and servers to ensure that no malicious connect attempts succeed! No blacklists to maintain, no fuss!

    6. Re:RBL of infected/malicious sites? by glesga_kiss · · Score: 3, Informative
      There are some. This site has several different blocklists, such as ad-hosts, anti-p2p bodies, spyware companies, hackers, trackers, trojans etc. The link above lists what's available. Sure, the lists aren't 100% acurate, but they are a lot better than nothing.

      Very highly recommended. With the case of p2p, it's good to keep your head down. It's the tall ones that get their heads chopped off...

      They also have software to convert the lists to various formats for use in different firewalls. iptables fans should check out "linblock". Beware though, a large list can take an hour to parse on your typical recycled firewall box, but the tool merges the ranges to keep the tables as short as possible.

    7. Re:RBL of infected/malicious sites? by _iris · · Score: 1

      As far as I understand, the main reason more worm-cleaning worms aren't written is that the people who would write them find it unethical to 1) infect any machine and 2) clog more networks with the scanning the "good" worms would need to perform. This list could be used to get around #2.

    8. Re:RBL of infected/malicious sites? by nologin · · Score: 1
      Unfortunately, very few providers actually filter traffic leaving their network, which means someone could easily spoof their IP address. If someone can bang away at your firewall with a spoofed IP address, your firewall will cut off the traffic from the fake source AND the real one.

      Also, a lot of zombies on the net sit on dynamically addressed machines. The next time a zombie connects to the net, your RBL won't block him since he will be coming from a different address.

    9. Re:RBL of infected/malicious sites? by gilgongo · · Score: 1

      SpamCannibal is a very satisfying way of ripping the rug from from infected hosts.

      A bit controversial, mind you, but I'd like to see it incorporated in some projects like IPCop, for example.

      --
      "And the meaning of words; when they cease to function; when will it start worrying you?"
    10. Re:RBL of infected/malicious sites? by Anonymous Coward · · Score: 0

      How about this?

      http://dshield.org/block_list_info.php

    11. Re:RBL of infected/malicious sites? by garwain · · Score: 1

      I use a 3 part solution for SSH. 1) I use fairly strong passwords (unfortionatly, my users don't always) 2) I moved the SSH port so that the dang bots don't keep hitting me all the time filling my logs with garbage. 3) I implemented a small script that checks through the logs and sets up firewall rules. 3 failed PW attempts within 5 minutes will block that IP for 15 min, 5 failed in 1 hour blocks for 24 hours, 8 failed within 48 hours blocks for a week, and emails me, so I can take action. Works well providing people don't use the super obvious passwords like password or abc123... I had a dang bot installed on my server a month ago firing out shit as fast as it could. I caught it within a hour (thanks to another script that checks for background processes and CPU usage, but dang, it takes time to get yourself off black lists that take seconds to get on!

  4. More malware, slower computer and net connection.. by the_sidewinder · · Score: 1

    Hmmmm, must be time for a new computer and a better ISP

    --
    /. is not to be used by individuals with high blood pressure or a history of heart attacks
  5. Not necessarily a Bad Thing... by KC7GR · · Score: 3, Insightful

    ISPs could use this data to great benefit, if they'd put out some effort.

    Assuming that the statistics show which IP address ranges are the worst offenders for malicious traffic, the ISP(s) responsible could simply shut down the outbound connection(s) of the "problem" users until they de-virus their systems and KEEP THEM THAT WAY.

    Perhaps that will help to finally clue people in that having Internet connectivity is a privilege, not a right, just like driving. If you're going to enjoy an Internet connection you need to show some responsibility for making sure your own system isn't going to be a problem to others.

    I -still- think there should have been Internet user licenses, just like we have driver's licenses...

    Keep the peace(es).

    --

    Bruce Lane, KC7GR,

    Blue Feather Technologies

    1. Re:Not necessarily a Bad Thing... by eheldreth · · Score: 2, Insightful

      The problem is a large portion of those IPs are home users with dynamic addresses which means when if I am the next to get the IP my outgoing ports will be blocked because thelast person ran windows, er, I mean because they could not keep there pc's clean. And I am assuming the last part about internet usage licenses is troll baiting so I don't think I'll respond to that one.

      --
      The perversity of the Universe tends towards a maximum. - O'Toole's Corollary
    2. Re:Not necessarily a Bad Thing... by Anonymous Coward · · Score: 4, Insightful

      I'm pretty sure internet connectivity is neither a privilege nor a right. It's just a service, plain and simple. You pay ISP, they provide internet connectivity. You don't pay, you don't get internet. No rights or privileges involved.

    3. Re:Not necessarily a Bad Thing... by Anonymous Coward · · Score: 0

      In keeping with your driving analogy, what is really needed is some form of "vehicle" inspection system whereby computers are not allowed to "drive" on the internet until they pass inspection and must have that inspection renewed at regular(frequent) intervals

    4. Re:Not necessarily a Bad Thing... by Mr.Sharpy · · Score: 4, Interesting

      The ISP KNOWS the physical addresses of the cable/dsl modem a home user has. It's not like the ISP has no idea which ip addresses are home user or account is using at any given time. How do you think they can reliably (for the most part) identify people for the likes of the RIAA when they ask. Likewise, with modern hardware and software its a pretty trivial task for an ISP to turn your internet access down to a crawl or off with the click of a button. They can do this, they just don't want to.

      Maybe it would be a good idea to throttle the users down to a bare minimum and redirect all http traffic to a gateway page to tell them they have a problem with their computer they need to correct. It seems to work for wireless access points in hotels/airports/coffeeshops. Why can't big ISPs do the same thing?

    5. Re:Not necessarily a Bad Thing... by Anonymous Coward · · Score: 0

      In keeping with your driving analogy... it is more like you are trying to control speeding by inspecting cars.

    6. Re:Not necessarily a Bad Thing... by xgamer04 · · Score: 1

      One problem with your argument is that the Internet is more or less a public thing, originally funded by the US government. Another problem is the design of the Internet itself. Many different companies and people with different policies and wants/needs are giving the OK to be connected to each other, and this complicates things like "quality of service" and "acceptable use". There is more to it than just paying money.

      --
      When you look at the state of the world, how can you not become a radical, liberal anarchist?
    7. Re:Not necessarily a Bad Thing... by sznupi · · Score: 1

      If some ISP would be doing this, the customers would simply flew to another...

      --
      One that hath name thou can not otter
    8. Re:Not necessarily a Bad Thing... by Brushfireb · · Score: 2, Insightful

      Would you really want to piss of 40% of your client base in one swoop? Average joe doesnt care about thsi kind of crap, and he doesnt want his ISP forcing him to care either. He will cancel his account, and move to someone else, or he will drive up support calls by calling to complain about the change.

      Any ISP who puts something like what you described in place is likely to lose customers in a hurry. Hotels/Airports/Coffeeshops have transient, non-recurruing customers, or the customers are there for something else other than internet, so its not as big of a deal there.

    9. Re:Not necessarily a Bad Thing... by Kaptain+Kruton · · Score: 1

      If an ISP shutdown my outgoing connections, I would get a new ISP. Maybe ISP's can use this data to help them, but not the way you mentioned.

      You say that internet access is a privilege and not a right. True. But if I sign with an ISP and they do not disclose they they will block my access beforehand, aren't they breaking a legal agreement? In that case, do I not have a right to take legal action? If their contract does state they can shut down my connection, then fine. But in that case, I can switch ISP's if they decide to act upon that.

      And if you believe that people need internet access licenses, then you are just a moron trying to get a rise out of people on the message boards.
      -Kruton

    10. Re:Not necessarily a Bad Thing... by Anonymous Coward · · Score: 1, Funny

      its official. The internet sucks AND blows.

    11. Re:Not necessarily a Bad Thing... by Mr.Sharpy · · Score: 2, Interesting

      It seems like ISPs are going to have to make a choice between increased costs due to the insane amounts of traffic caused by spyware and malware, or the cost of the loss of some customers. The whole point of such a strategy is to notify the customer and help him correct the problem if necessary. Customers with problems that would be caught by the gateway page would probably call support anyway, wondering why their connections are so slow. If they're not calling, they're probably complaining quietly about the ISPs crappy service. Tools like the one this article covers can be used to reduce to a minimum the number of false positives identified by the ISP because they have a good profile of problem traffic.

      This should be an issue the industry should tackle together. Due the nature of broadband in most markets, these customers aren't really going to have many service alternatives either if they don't like the way their ISP is trying to help them help themselves. If the major players make it known that they won't let their customers unknowingly crush the internet under the load of their spyware and malware riddled boxen, it would go a long way to making a dent in the problem.

    12. Re:Not necessarily a Bad Thing... by Em+Adespoton · · Score: 1

      Tell me... how would packet shaping away the trojans/worms piss off their client base? Suddenly, everyone's network connection is much faster, and there are fewer ads/spam mails appearing. Seems to me 98% of their client base would *love* this.

    13. Re:Not necessarily a Bad Thing... by KC7GR · · Score: 1

      A "moron" eh?

      I'm sorry you feel that way. Are you saying, then, that people should NOT be held responsible for whatever spew their virus-compromised system sends out, regardless of how many problems it may cause other systems? That's what licensing would have done -- provide accountability.

      If you can suggest a better way to provide some sort of accountability, then please go right ahead and suggest something. I don't pretend to have all the answers, and name-calling is hardly productive.

      --

      Bruce Lane, KC7GR,

      Blue Feather Technologies

    14. Re:Not necessarily a Bad Thing... by rfunches · · Score: 1

      I would disagree that an ISP who forces a customer to deal with the problem would be "likely to lose customers in a hurry."

      Giving users the scary reality of viruses, malware, and other malicious code should motivate most to get the problem under control. The rest won't do anything about it, regardless of the risks or actions taken by ISPs, so they shouldn't be considered an issue.

    15. Re:Not necessarily a Bad Thing... by bit01 · · Score: 1

      Would you really want to piss of 40% of your client base in one swoop?

      No need to disconnect them initially. Just email with a warning and simple instructions on how to fix it, maybe linked to a web app to do the work. Most naive users are paranoid about viruses due to the media exposure and are happy to fix it if they are told how.

      ---

      Keep your options open!

    16. Re:Not necessarily a Bad Thing... by eheldreth · · Score: 1

      I agree that they could block traffic based on any number of things, I would suggest like you using the MAC, but this was not what the parent suggested.

      --
      The perversity of the Universe tends towards a maximum. - O'Toole's Corollary
  6. malicious traffic? by Virtual+Karma · · Score: 0, Offtopic

    malicious traffic? You mean computer virus is not a myth? Duh!

    --
    fuvoo: watch something
  7. In other news... by Anonymous Coward · · Score: 5, Funny

    Yeti@home has yet to yield conclusive results.

    1. Re:In other news... by WwWonka · · Score: 0

      Yeti@home has yet to yield conclusive results.

      Obviosuly the results of my in home Yeti program hasn't logged yet the hairy beast I woke with up with on Sunday morning post a drunken night at the bar.

      Although he/she and I did have a great time.

    2. Re:In other news... by Anonymous Coward · · Score: 0

      wow.

  8. Root of the problem by SamMichaels · · Score: 5, Insightful

    Ignoring all complaints about Windows, the root of the problem goes back to having access to the network in the first place. If ISPs would spent a few bucks on implementing passive traffic analyzers to search for the viral/trojan patterns and null route offenders, we'd clean things up pretty quick. Why do we have all these piracy probes going on to sue people and no infected probes going on to cut people's access?

    Now, stepping back to the Windows complaints...wouldn't the ISP turning off your access motivate you to get a BASIC education in computing and maintain your PC?

    To make an analogy, in most states you need to have your car inspected (and some require emissions inspection, too). PUBLIC roadways means you share it with other people...an unsafe car affects more than just you. When you're connected to the net, your PC affects everyone else. I'm not suggesting the ISPs make an inspection system or a law passes to force ISPs to monitor traffic, but the same logic applies....someone should be doing checkups and flagging the offenders.

    1. Re:Root of the problem by Wolf2989 · · Score: 2, Informative

      Ahh but herein lies the problem. As a previous employee of an ISP we'd be willing to bend over backwards to make a customer happy. This means NOT turning off their access when we detected a worm/trojan etc. Sure, we would null route their IP's if they were partaking in a DDOS or something, but a simple virus we'd *help* them by informing them. You don't make money in this world by shutting people off. I for one say null route them, but you have to think of it from a reality standpoint (Regardless of how askew that standpoint may be).

    2. Re:Root of the problem by Anonymous Coward · · Score: 0

      Actually, a number of ISPs do just that. I know somebody who it happened to, their computer had been zombie-fied.

    3. Re:Root of the problem by MankyD · · Score: 1

      Do you want to be the state-registered Computer Inspector? Note also that computers break down a lot faster than a car. Cars wear out over time, with some exceptions. Computers work (in theory) perfectly until one or two mistakes are made that bring the system to its knees - be it crash it, or zombify it, etc.

      I do entirely agree with the idea of passive analyzers and filters, as long as they don't inhibit legit traffic. Put the burden on the ISP in this case.

      --
      -dave
      http://millionnumbers.com/ - own the number of your dreams
    4. Re:Root of the problem by Politburo · · Score: 2, Insightful

      To make an analogy,

      You should have just stopped there. Analogies are fucking stupid. Car analogies even moreso. Just stop it.

      The reason why your analogy doesn't hold? Computers with viruses can't kill people. Cars with bad brakes can.

      someone should be doing checkups and flagging the offenders.

      If you want to pay for it, go right ahead. I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.

    5. Re:Root of the problem by YrWrstNtmr · · Score: 1
      If you want to pay for it, go right ahead. I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.

      How do you know? Are you connected through some different internet than the rest of us. Some magical place where a goodly percentage of the traffic isn't malicious?

      What if everything were all of a sudden faster, because there wasn't that stuff sucking up bandwidth?

    6. Re:Root of the problem by nagora · · Score: 2, Insightful
      Computers with viruses can't kill people.

      Oops! Someone hasn't noticed the number of trains and ships running Windows. No danger of a virus killing anyone there, then.

      I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.

      Someone also hasn't noticed the amount of effort that goes into protecting his system from zombie machine. Perhaps he thinks firewalls were a gift from unknown stellar travellers and spam filters require no effort to create and update.

      Perhaps someone is a troll.

      TWW

      --
      "Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
    7. Re:Root of the problem by EvilTwinSkippy · · Score: 4, Funny

      Amen to that. Car analogies have just plain run out of gas. People get too much mileage on them. They start more flamewars than a Pinto.

      --
      "Learning is not compulsory... neither is survival."
      --Dr.W.Edwards Deming
    8. Re:Root of the problem by Anonymous Coward · · Score: 1, Insightful

      Yeah, but what ISP was it? Was it a good ISP, like Speakeasy, a small local outfit, or one of the biggies who thrive on the "don't know any better" crowd?

      I know Speakeasy polices their network for open SMTP relays, because I see it in my server logs. I don't know if they actively look for zombied machines, but I can tell you that they've pretty quickly shut off the connections of customer machines on their network that I've brought to their attention when I've seen obvious worm-related connection attempts in my firewall logs.

      I also know that the bigger ones, like Comcast and Verizon, don't really give a shit about that kind of stuff. I've even had another large ISP flat out deny that the machine I was complaining about was on their network, despite the fact that I look up who owns netblocks in ARIN's database so I know where to direct my complaints.

      And the grandparent poster is exactly right about why they don't give a shit-- because if they cut off some idiot's access because his machine got owned, that idiot is more likely to find another ISP that won't cut off his access rather than learn how to properly admin his machine. The big ISPs would rather let all their customers lose bandwidth to a zombied machine than risk losing the money they make from the guy who owns that zombied machine.

    9. Re:Root of the problem by Dun+Malg · · Score: 1
      To make an analogy, in most states you need to have your car inspected (and some require emissions inspection, too). PUBLIC roadways means you share it with other people

      Here is an additional error in your analogy. PUBLIC does not simply mean you share it with other people. Rather, it means "Maintained for or used by the people or community". Internet access is not a public utility (to wit. ISP's vs. municipal broadband), it's more like a toll road. There's nobody on the internet who doesn't directly pay to connect someone else. If I were able to build a network of roads on my own private property, I could allow rocket powered bicycles and require all people on my roads have cracked windshields and no license plates. Take a look at NASCAR races. Are those cars inspected and licensed? Internet? Same thing.

      --
      If a job's not worth doing, it's not worth doing right.
    10. Re:Root of the problem by stud9920 · · Score: 0

      Car analogies are the Canyonero of rethoric.

    11. Re:Root of the problem by glesga_kiss · · Score: 4, Insightful
      If ISPs would spent a few bucks on implementing passive traffic analyzers to search for the viral/trojan patterns and null route offenders, we'd clean things up pretty quick.

      Bollocks.

      The aren't running a network in their parents basement you know. Their networks are massive, with nodes LITERALY spanning thousands of miles. The volume of traffic they deal with is HUGE. They use cutting-edge routers just to keep up with the demand.

      How on earth do you do traffic analysis on that level? You might be able to catch some of the more obvious spammers, but how do you differentiate (on the IP level) between: a) a residential user b) a commercial user who maildrops willing customers c) a zombie d) a community group or e) blah. Blocking someone based on traffic is not possible, unless you want to lose your valid customers.

      What they should do is be more responsive to complaints. If a customer of theirs is a zombie spambot or acting as a stepping stone for some script kiddie, they should have their connection suspended until it is remedied. But they can only do this based on a complaint.

      Besides, what's the profit in spending any resource on the problem in the first place? Until that is affected, they won't care about it.

    12. Re:Root of the problem by telecsan · · Score: 1

      Not to mention the electricity blackout in the eastern US a couple years ago...more than a couple elderly persons expired due to lack of air-conditioning caused (in part) by 'My Doom(tm)'.

      Besides, you're paying for the spam/virus bandwidth in your monthly fees. Which is more expensive, bandwidth or forcing spyware-checks?

    13. Re:Root of the problem by Anonymous Coward · · Score: 0
      What they should do is be more responsive to complaints. If a customer of theirs is a zombie spambot or acting as a stepping stone for some script kiddie, they should have their connection suspended until it is remedied. But they can only do this based on a complaint.

      And when activist idiots submit false claims to get net access shutoff to people/companies they don't like? I've gotten "hacking" complaints from idiots after someone visited their public web site, and you want to give them the power to disrupt my business?

    14. Re:Root of the problem by That's+Unpossible! · · Score: 1

      The reason why your analogy doesn't hold? Computers with viruses can't kill people. Cars with bad brakes can.

      Let me introduce you to California, my friend. Your car must pass SMOG tests, and if you don't pass, you will be paying for repairs so that it does pass.

      If your car doesn't pass, will it kill someone? Probably not. There goes your reasoning.

      ISPs could easily end most viral outbreaks with outbound scanning of port 25 traffic. Sadly, they won't do this until they start getting sued over it.

      --
      Ironically, the word ironically is often used incorrectly.
    15. Re:Root of the problem by Buran · · Score: 1

      If you piss off 5 more people who get infected by the machine that is spewing viruses and spam, and they all leave, then what? You just lost 5 customers by not "bending over backwards to make them happy" by removing the source of the hack attempts/spam that is causing them trouble.

      --
      i am a soviet space shuttle
    16. Re:Root of the problem by Anonymous Coward · · Score: 0
      ...and null route offenders

      There's no need. I recently monitored connection attempts on my PC for 48 hours. I was getting, on average, one every 2 seconds and almost every connection attempt was to one of the Windows ports: 135-139 and 445.

      ISPs merely need to block these ports. This is easy to implement and won't impede anyone's internet access.

      Of course, ISPs aren't doing this for politico-legal reasons: they (quite reasonably) don't want to accept any responsibility for the traffic on their networks.

    17. Re:Root of the problem by Politburo · · Score: 1

      Let me introduce you to New Jersey. We have the same shit, so I knew this counter-argument would arise.

      State vehicle emission tests are done as a result of the Clean Air Act which requires the States to meet what are known as the National Ambient Air Quality Standards (NAAQS). The reason some states don't have emission tests is because their air quality does not yet exceed the NAAQS.

      In any case, a health argument can still be made to justify pollution reduction. While one car out of emission spec will not kill anyone, millions of cars out of spec will have a detrimental public health effect, mainly the increase of ground-level ozone, which affects asthmatics and others with respiratory problems during the summer.

    18. Re:Root of the problem by Politburo · · Score: 1

      Oops! Someone hasn't noticed the number of trains and ships running Windows. No danger of a virus killing anyone there, then.

      Red herring. Give me one example of a fully operational system (read: not that 7 year-old Navy test that everyone parrots) that has had a problem. In any case, Windows is a desktop OS and should not be used in these situations to begin with.

      Perhaps he thinks firewalls were a gift from unknown stellar travellers and spam filters require no effort to create and update.

      Well, my firewall is pretty much a gift from aliens. It's a little box i bought at the store and stuck inbetween my computer and cable modem. Wow, lots of work there!

      Spam filters? Well I get my email for free from providers like Yahoo and Google.. pretty much spam-free. If they're spending money implementing spam filters, they aren't passing the cost on to me.

      Perhaps someone is a troll.

      Yeah, I don't subscribe to the idea that computers and operators should be licenced.. I must be a troll.

    19. Re:Root of the problem by nagora · · Score: 1
      It's a little box i bought at the store and stuck inbetween my computer and cable modem.

      So, in contradiction to what you said in your post, you not only ARE willing to pay but you did in fact pay for protection.

      TWW

      --
      "Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
    20. Re:Root of the problem by Wolf2989 · · Score: 0

      Obviously you've never ran an ISP. 5 pissed off customer (And i'm not talking dialup, i'm talking DS1 and higher type) equals a lot of bad press.

    21. Re:Root of the problem by Politburo · · Score: 1

      The firewall also serves as a wireless access point/router/NAT. In fact, those are its main functions. The firewall functionality is merely an added bonus, and with NAT is really just icing on the cake.

      Also, here's what I said: "I am not willing to pay for such a system." Where 'such a system' was a system of licensing computers and/or operators. However, I'm sure you knew this, so fuck off already.

  9. In a few minutes... by vectorian798 · · Score: 4, Funny

    ...they will realize that there isn't anything more malicious than the traffic from Slashdot.

    1. Re:In a few minutes... by Anonymous Coward · · Score: 0

      bet that's gonna make a big fat line on port 80

  10. Standards for viruses? by MarkByers · · Score: 4, Insightful

    You can't impose a standard upon viruses. What will you do if a virus doesn't follow the standard? Find the author and punish them unless they fix it and release a new version that fully supports the standard?

    The only way viruses will ever get standards is if the authors agree that they will get a considerable benefit by working together. I can't see that happening.

    --
    I'll probably be modded down for this...
    1. Re:Standards for viruses? by Anonymous Coward · · Score: 0

      Are you serious? He wasn't saying that viruses should follow standards. He was kind of being sarcastic, saying "considering that they don't follow standards." Meaning that hey, this isn't surprising considering that virus writers don't set out to be thoughtful and conserve bandwidth, they actually couldn't care less. They set out to break things. But regardless, witty retort... And who the hell modded this 5 Insightful??? WTF?

    2. Re:Standards for viruses? by Anonymous Coward · · Score: 0
      What will you do if a virus doesn't follow the standard? Find the author and punish them unless they fix it and release a new version that fully supports the standard?

      No, just refuse to download their virus until they comply.

  11. Comment removed by account_deleted · · Score: 2, Insightful

    Comment removed based on user account deletion

  12. malicious? by delirium+of+disorder · · Score: 2, Informative

    I've only scimmed the paper, but from the looks of it, a lot of not all that harmful trafic could be labeled "malicious", for example nmap port scans. I use them all the time, not to find valunerable services, but for more general sysadmin stuff.

    --
    ------ Take away the right to say fuck and you take away the right to say fuck the government.
    1. Re:malicious? by Anonymous Coward · · Score: 0
      I've only scimmed the paper, but from the looks of it, a lot of not all that harmful trafic could be labeled "malicious", for example nmap port scans.

      At least you admit you don't know what you are talking about. :-) From the paper:

      The source of the scanning was a machine used to help secure the net- work and so was altruistic. Therefore, we do not consider these scans to be malicious in nature.
    2. Re:malicious? by WillAffleckUW · · Score: 1

      I've only scimmed the paper, but from the looks of it, a lot of not all that harmful trafic could be labeled "malicious", for example nmap port scans. I use them all the time, not to find valunerable services, but for more general sysadmin stuff.

      If you had RTFP, you would have noticed they actually tracked a lot of that down and counted it as benign, not malicious, since they could ID the IP at their university.

      --
      -- Tigger warning: This post may contain tiggers! --
    3. Re:malicious? by larytet · · Score: 1

      IP scan is one of major parts in Rodi network. Rodi peers penetrate NATs/Firewalls and find each other using IP scan and port scan. see http://larytet.sourceforge.net/btRat.shtml

  13. Flow observation conclusions... news u can use by GPLDAN · · Score: 3, Interesting

    It's good to know the IP addresses of machines active searching dark IP space. If you can see those statistics in real time, you have useful information.

    ISPs are already starting to work together on this type of information. If an ISP sees malicious worm spreading behavior, it can upload the offending IP into a global db that all ISPs can use to block at their borders.

    Again, the authors conclusions are that nothing beats having a nice dark block to trigger alerts.

    1. Re:Flow observation conclusions... news u can use by EvilTwinSkippy · · Score: 1
      Again, the authors conclusions are that nothing beats having a nice dark block to trigger alerts.

      I resemble that remark. (Mmmmm, three class C's...) Benefits or working for an organization who got on the net back when Arin was handing out blocks like candy.

      --
      "Learning is not compulsory... neither is survival."
      --Dr.W.Edwards Deming
  14. Next Step? by merlin_jim · · Score: 3, Insightful

    Modify the Neti@Home client to do dynamic blacklisting?

    The biggest problem in Intrusion Detection Systems (buzzword for firewalls with more intelligence than a typical rule-based firewall) is that metrics gathering is occuring at a specific site, making it difficult to discern malice intent from dropped packets or bad coding.

    Any time the central server sees a certain threshold of malicious attempts from a single IP, it adds it to a short term blacklist... Make the term length just slightly longer than the reporting period so if it persists it'll remain on the list but if it stops, the IP is cleared in short order.

    --
    I am disrespectful to dirt! Can you see that I am serious?!
  15. DSL/modem/router by FidelCatsro · · Score: 4, Insightful

    Its insane the ammount of bandwidth this is sucking up (i remember a time when virus's and worms were relativly well programed, still as bad but less collaterol dammage).
    I would like to see more ISP isntead of suplying basic DSL modems with those overpriced sign up deals but instead a proper firewall/router/Dsl modem.
    This would save us all alot of pain in the long run .

    --
    The only things certain in war are Propaganda and Death. You can never be sure which is which though
    1. Re:DSL/modem/router by Anonymous Coward · · Score: 0

      good lord man, learn how to spell

    2. Re:DSL/modem/router by Anonymous Coward · · Score: 0

      Simple awnser , i already know how . Im just lazy :P and like iritating people like you..

    3. Re:DSL/modem/router by Anonymous Coward · · Score: 0

      BEE-IN BOF STUPPID AN STONE MEANZ EYE KIN TYPO ANYTING AN KEPT ME SELPH-ESTEAM. KNOT 2 SELPH -- REMEMEMBER 2 AD DIS GUYZ 2 ME KISSMAS KARD LISTZ
      aaa aaaaa aaaaa aaaaaaa aaaaa aaaaaaa
      aaaa aaaaaaaa aaaa aaaaaaaa aaaaaaaa
      aaaaaa aaaaa aaaaaa aaaaaa aaaaaaaaa
      aaaaaaa aaa aaaaaaaa aaaa aaaaaaaaaa

  16. Summary? by Anonymous Coward · · Score: 0

    Can someone post a resume of TFA with nice color graph? As a average /. user there is no way I will read something longer than 3 lines. Abbrev. more than welcome.

  17. Spyware? by fox9397 · · Score: 1

    To collect data, Internet users must volunteer to run the software package on their end hosts. Once the package is installed, the NETI@home client will collect net- work statistics from the end host and periodically send a report back to the NETI@home server. Volunteer by downloading the NETI@home toolbar with new "we are watching you" emoticons

    1. Re:Spyware? by enosys · · Score: 1

      Or is it researchware

  18. Time to drag out this old chestnut by This+Old+Chestnut · · Score: 4, Funny

    "Those willing to give up a little security by using a little obscurity deserve neither security nor root privileges".

    -Benjamin Franklin

    1. Re:Time to drag out this old chestnut by Anonymous Coward · · Score: 0

      In the interest of open security practices, please send me all your private keys. Keeping them secret is simply a obscurity measure, which, as we all know, doesn't work.

    2. Re:Time to drag out this old chestnut by SavvyPlayer · · Score: 1

      Sophisticated troll.

    3. Re:Time to drag out this old chestnut by StikyPad · · Score: 1

      You're right, let's stop keeping passwords secret. You first.

      --
      https://www.eff.org/https-everywhere
  19. Cheap access means unsafe computing by jfengel · · Score: 4, Interesting

    Sadly, while some customers might get motivated to learn something, others would just be motivated to switch ISPs. Which costs the ISPs money, which means that they won't do it.

    At least such is their thought process as often presented. I suspect it's bad cost-benefit analysis; if your dumber customers leave, it's probably a net win for you. Smarter customers mean less bandwidth (at least, they don't act as spam zombies maxing out the bandwidth) and fewer tech support hours explaining how to fix the cup holder.

    The big players (AOL, Comcast) are the best targets for this logic, but they live for those left-side-of-the-bell-curve customers. They're the "default" ISPs that people get because they're so readily available, so they get all the customers who don't know better. (Hell, I don't know better; I use Verizon for my DSL but I don't let them do anything but provide me bits.)

    So AOL and Comcast are in a bit of a bind; they don't want these customers, but they don't want to lose them, either. I think that they're probably going to have to use gentle persuasion to say, "Hey, it looks like you've a spam zombie. Please call your cousin's best friend to clean the crap off your computer again and give you a stern talking-to. And please stop downloading Bonzi Buddy."

    1. Re:Cheap access means unsafe computing by Abel29A · · Score: 1

      In Norway the leading ISP has started with a similar scheme. They do passive searches on traffic from customers - if anything gets flagged as viral or malicious they will cut access to sending email, or even to transmit data at all. Then a email is sent to the customer explaining the problem and he can then call Tech Support to get it fixed.

      This is mostly considered a benefit since it helps the customer in keeping his PC operational. My father lost access to sending mail for a couple of days after getting flagged for spreading virii - in his case it was a false alert and they quickly lifted the ban. So it isnt a failproof system but its a first step.

      Of course if my ISP did something similar I'd be outraged :)

      --
      "If Pac-Man affected us as kids, we'd be running around in dark rooms, munching pills and listening to electronic music"
    2. Re:Cheap access means unsafe computing by That's+Unpossible! · · Score: 1

      Sadly, while some customers might get motivated to learn something, others would just be motivated to switch ISPs. Which costs the ISPs money, which means that they won't do it.

      Another thing that will cost the ISPs money? Lawsuits. Class action lawsuits from people that experience damages from zombie PCs and virus infected spew-factories that could EASILY be shutdown by an ISP with a minimal effort of outbound scanning.

      --
      Ironically, the word ironically is often used incorrectly.
    3. Re:Cheap access means unsafe computing by jfengel · · Score: 1

      I'm surprised we haven't seen that lawsuit yet. I'd guess it's because the lawyers don't think it will make them money.

      (Even so, eventually you'll find some lawyer willing to take the case. He'll treat it as a lottery ticket: low odds but a big win.)

      So why don't they think it'll win? I'm not a lawyer, but I suspect that the defense will run, "Look, we just carry the bits. If you don't like the bits I send you you're free to set your router to drop 'em on the floor. It's not our job to censor our customers."

      I'm not sure it would fly, but my guess is that the lawyers would tell you that the risk is too low to justify a lawsuit.

      Still, maybe you can make yourself a bunch of cash by becoming primary litigant on one one these. It should be easy to find a lawyer; check the news for all those companies with bogus class-action suits against them. Pick one at random. I'm not saying your suit would be bogus; I'm saying that there seem to be a class of lawyers who don't care.

    4. Re:Cheap access means unsafe computing by ramblin+billy · · Score: 1


      Hey, I know it's below the /. radar, but the big ISPs ARE doing something about the malware problem. The focus of the current round of competing commercials is 'free' add on services like spam blockers and anti-virus. They know most users won't spend the time and effort to secure their machines so they are going to do it for them. Of course that pretty much dismisses any change of privacy from your ISP. I guess the ISPs figure if you'll lay back and spread your legs for viruses you'll do it for them as well. I believe MS is using this same philosophy, as illustrated by the changes in their default system behaviors. The average user has proven that he won't patch and update, so now the system just does it for him. Pretty much the same for maintenance. Too bad it takes a year from launch for us to figure out how to turn all that shit off.

      Off topic...so Seti@home is a big giant antenna aimed at outer space that captures data and sends it to computers across the planet...wonder what kind of firewall they got on that thing?

      billy - who welcomes our benevolent new cyber-overlords

  20. Intelligent life? On the internet? Ha! by Tropaios · · Score: 0

    hahahahahahaha
    lmfao
    rofl :D
    ttyl

  21. proposal by ocularDeathRay · · Score: 3, Funny

    I would like to submit this proposal for your review. I am seeking funding for a new research project. Please grant me the funds needed so that I can deploy rain sensing equipment to every residence in the Seattle area.

    This project will record 3 years of data and prove once and for all whether or not it actually rains in seattle.

    sincerely,
    Kelly H.
    Head research scientist
    Darington Univeristy of Heretics

    --
    Obama is a twitter sock puppet
  22. Boy! If only we could only.... by notherenow · · Score: 0

    ...use this info to better the world, and not just bitch about it in verious blogs...

    --
    We all dance, we all sing.
    -The Streets
  23. The Most Illegible Graphs. Ever. by dohboy · · Score: 3, Funny

    Shouldn't there be a butt-ugly histrograph warning?

    1. Re:The Most Illegible Graphs. Ever. by UnknowingFool · · Score: 2, Funny
      Shouldn't there be a butt-ugly histrograph warning?

      This is /. Pretty is for Windows users. [ducks]

      --
      Well, there's spam egg sausage and spam, that's not got much spam in it.
    2. Re:The Most Illegible Graphs. Ever. by twostar · · Score: 1

      Why? No one RTFA anyway.

      Apparently no one told the authors the second thing anyone reading a paper does is skim over the graphs and tables. I had flashbacks to a lecture from a lab professor about making clean clear graphs after trying to decode those cryptic plots.

    3. Re:The Most Illegible Graphs. Ever. by Anonymous Coward · · Score: 0

      No, then you wouldn't have anything to complain about ;) Actually, the white on black was chosen due to black and white publishing requirements and modern printer design.

    4. Re:The Most Illegible Graphs. Ever. by whitehatlurker · · Score: 1
      Not only ugly, but they aren't particularly useful. They really need to read Tufte.

      The number of the port molested isn't really a good ordinate.

      --
      .. paranoid crackpot leftover from the days of Amiga.
  24. Don't use SSH password authentication by SIGBUS · · Score: 4, Insightful

    You really should be using RSA or DSA keys instead of passwords. Hardly a day goes by that my systems don't get at least one script-kiddie SSH password guessing scan. Since I'm requiring keys for authentication, they're wasting their effort; if someone manages to crack a public key, we have far worse problems than password guessing.

    --
    Oh, no! You have walked into the slavering fangs of a lurking grue!
    1. Re:Don't use SSH password authentication by suitepotato · · Score: 1, Insightful

      You really should be using RSA or DSA keys instead of passwords

      Exactly right. It's almost trivial even under Windows to do it. Two factor should have been a standard years and years ago but as long as people can have four to eight digit passes which are easy to break, we keep seeing problems that shouldn't be there.

      Anyone notice that PGP has passphrases of quite possibly insanely large size? It's hard to remember some farked and leeted phrase chosen to confound brute force and guessing when you have ten different ones. It is not hard to remember verbatim a passage from your favorite book. What's the mathematical difficulty in breaking a password with over one hundred digits? I can type a forty digit pass right 99.9% of the time if it is a passage of meaning to me.

      Combine strong passwords and two-factor and you eliminate the bulk of these amature breakers from contention. Now if only end-users couldn't do their work for them by running their trojans from e-mail attachments and bouncing pop-up windows. "Win a compromised box! Click now! Crackers are standing by!"

      --
      If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
    2. Re:Don't use SSH password authentication by sys49152 · · Score: 1

      I've only recently started worrying about this regarding my own hosted server (i.e. not corporate, just little ol' me.) I have no problems creating certs and configuring sshd, but my reading suggests that sshd will accept certs fine, but if they're not presented it will fallback to password mode. Is my understanding correct? I'd rather have it not ask for passwords at all. Any pointers?

    3. Re:Don't use SSH password authentication by XanC · · Score: 1

      In /etc/sshd.conf, you can tell SSH which authentication methods to use, and in what order. Simply remove password from the list, and no more password authentication!

    4. Re:Don't use SSH password authentication by lars_stefan_axelsson · · Score: 1
      but my reading suggests that sshd will accept certs fine, but if they're not presented it will fallback to password mode. Is my understanding correct? I'd rather have it not ask for passwords at all. Any pointers?

      On a UNIX ssh server (Open/Fsecure) look into the "PasswordAuthentication" parameter in sshd_config. Setting this to "no" will prevent password authentication to proceed. Check with '-v' to ssh; it will tell you what authentication methods that can proceed. Haven't played with a Windows sshd server version in a while so I don't know about that. I'd be surprised if it didn't allow the same parameter to be set though.

      --
      Stefan Axelsson
    5. Re:Don't use SSH password authentication by not-real-sure · · Score: 1

      I agree. I block SSH access to my network. In order to ssh to my FC3 box you have to come in over IPsec VPN. Encryption is the only way to secure your network.

      --
      My Doom. The gift that keeps on giving
  25. I agree! by Anonymous Coward · · Score: 0

    What really ought to happen is that lusers who don't secure their boxen should be held liable for all the damage they cause through their reckless irresponsibility.

    Especially if their boxen have virii!

  26. Randomly Generated Topics? by qwp · · Score: 1

    This paper looks almost exactly like
    one of the randomly generated research papers
    i got from that MIT research groups website..
    (Questions...)

    I passed the randomly generated paper around campus to a bunch of C.S. kids and they all bought it without thinking.. Quite amusing...

    1. Re:Randomly Generated Topics? by Interrupt18 · · Score: 1

      While I recognize that the paper represents legitimate research, it does bear an uncanny resemblance to those produced by the automatic paper generator, right down to the axis labels.

  27. Re:More malware, slower computer and net connectio by Anonymous Coward · · Score: 0

    And I'm sure it was meant to be spelled properly...

  28. neti samples by cdgeorge · · Score: 1

    From what I've seen the real challenge would be to find significant samples. I don't imagine crackers would go for the neti software.

  29. If you build it, they will portscan by suitepotato · · Score: 1

    Been to Borders and seen the honeypot books on the shelves amongst the rest of the become-a-security-guru-in-$29.95-easy-steps books?

    Does it prove or disprove simple A==B logic to note that these incidences of spyware and insecurity are growing at the same time as adoption of Linux variants? Just musing on the "l33t win script kiddie finds Linux religion" phenomenon I've been seeing lately.

    Anyhow, this does suggest further that security is where it is at for the future skillset of interest at interview time.

    --
    If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
  30. Maybe analyze their own network trafic? by tratten · · Score: 1

    It can't be good to have a 8731x1276 GIF as a logo on their first page, especially when being slashdotted.

    1. Re:Maybe analyze their own network trafic? by WillAffleckUW · · Score: 1

      It can't be good to have a 8731x1276 GIF as a logo [gatech.edu] on their first page, especially when being slashdotted.

      Reminds me of a friend who works at Adobe, trying to get us to post a large PDF for our web page, when all we needed was a small 4k JPEG.

      People who don't grok that half the Net has limited bandwidth don't deserve to ever use the Gigabit Internet we use here at universities, IMHO.

      If it doesn't need formatting, sending it in clear text.

      --
      -- Tigger warning: This post may contain tiggers! --
  31. April 27th-30th? by Dwonis · · Score: 1
    Look at that "Daily usage for April 2004" graph...

    Apparently this site will be linked to by Slashdot in two days, but it hasn't been yet...

    1. Re:April 27th-30th? by jabber-admin · · Score: 1

      $year++

    2. Re:April 27th-30th? by BrianPan · · Score: 1

      More like $look++

  32. No thank you by Anonymous Coward · · Score: 0

    Just what we need more monitoring of traffic. Let's make a passive monitor that looks for phrases like "Terror", "WMD", "Bush sucks", "Bit-Torrent", "porn", etc. That way we can snoop on dissidents and turn off their internet connection making America a safer better place.

    1. Re:No thank you by Anonymous Coward · · Score: 0

      Don't be a fucking moron. If a Home computer is DDOSing another, it should be shut off from the network. Otherwise, you're just lacking common sense. Dumbshit.

  33. Re:Do they care? by Anonymous Coward · · Score: 0

    Problem is Windows for all it's flaws is an OS. Gentooo is an experimental buggy strain of a thing called Linux which is a plaything of hobbyists and masochists and which has no application or meaning for 99% of people in everyday life.

  34. Big deal. by pschmied · · Score: 1

    I've been doing neti at home for several days trying to shake a sinus infection brought on by allergies. :-)

    It remains to be seen if I'll find positive results.

    -Peter

    --
    . Penguins Surely Ca
  35. Neti? by TeknoHog · · Score: 1

    I've been using neti for years to improve my nasal bandwidth. I had no idea they made it into a distributed.project...

    --
    Escher was the first MC and Giger invented the HR department.
  36. Bad coding; Malice intent. by Anonymous Coward · · Score: 0

    "difficult to discern malice intent from dropped packets or bad coding."

    Bad code is full of malice, intended or not. (blubster, for example)

  37. Recent Worms DO organize to manage utilization by billstewart · · Score: 3, Informative
    Most of the interesting recent viruses *do* have some level of organization to reduce duplication of effort, and the postulated "Warhol Worms" designed to take over the entire Internet in 15 minutes would need to do so, because otherwise they're not as effective. Some of them pre-scan the net to find a list of vulnerable machines to infect first, and then haul around parts of the list. Others partition the address space quasi-deterministically (e.g. Phase 1 scans all of the valid /8 address spaces until it's infected some machine in each one, Phase 2 scans all of the 256 /16 address spaces within its /8 until it's affected one in each, Phase 3 scans all of the 256 /24 addresses within its /16, Phase 4 scans all the 256 addresses within its /24.

    Code Red II implemented a randomized variant on this: "1/8th of the time, CodeRedII probes a completely random IP address. 1/2 of the time, CodeRedII probes a machine in the same /8 (so if the infected machine had the IP address 10.9.8.7, the IP address probed would start with 10.), while 3/8ths of the time, it probes a machine on the same /16 (so the IP address probed would start with 10.9.)" It means the worms don't have to keep track of phases, but it gets similar effects, and while there is more chance of overlap, it's not too high until the worm's infected most of the net, and the added random searches help make up for machines that didn't successfully infect their netblocks due to firewalls or failures or simple slowness.

    At least one worm that took this sort of approach had a bad random number generator, so it kept hitting the same territory too hard and missing other wide-open spaces, which protected a few parts of the net from infection.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
    1. Re:Recent Worms DO organize to manage utilization by patio11 · · Score: 1
      Here is the original paper about Warhol Worms. While it makes an excellent sales pitch for AV companies, and a good "wow, scary technological Y2K-type problem on the horizon" for Newsweek or Wired, I don't think we'll ever see one in real life.

      The big reason is the sheer vastness and varied topology of the Internet. Try running a massively distributed application sometime and get a real life education in exactly how theoretical the guarantee of data transfer between two machines picked at random is. My organization ran a 1,300 PC computer grid in our prefecture and was unable to get effective performance out of 300 of the machines due to them being isolated from the rest of the network, due to causes ranging from internal firewalls, misconfigured routers, and packets that vanished into the ether for no particular reason.

      The other biggie is, of course, computational "biodiversity", which didn't hamper our application (which we were able to recompile for every type of machine on our grid) but which would bite a worm, Worhol or not, in the posterior. For a Warhol Worm you need to have a infection vector which works without user intervention, which in practice means a buffer overrun in a network service, and there is no implementation of any network service running on over 50% of the Internet (you'd think Windows would have a few, right? Nope, saved by the MS marketing department's decision to develop a million flavors of the same OS).

      Now, outside the context of the Warhol Worm, I think F/OSS is actually going to make the biodiversity problem worse, not better. Take a look at the attack on Mozilla earlier this year through the shared JPEG library. Widely used "best of breed" OSS libraries *will* be targetted as they gain significant installed bases (which is happening very rapidly with the upswing of corporate support to OSS).

      --
      Help poke pirates in the eyepatch, arr.
  38. List of Zombie Blocklists (+ other Bad-Site-BLs) by billstewart · · Score: 2, Informative

    Spamlinks's list of Zombie Blocklists also has other types of block lists on that page (RBLs, Open Proxy blocklists, Known Spammer blocklists, etc.).

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  39. Capped Bandwidth by Anonymous Coward · · Score: 0

    Why not use the bandwidth cap software that's already in place and target those who consistently hit the limit. You'd sure as hell get most of the clueless wonders to either clean up their systems or cut-em off at the neck. As to whether the could do it? Sure can. Most ISP's have something useful in their TOS that allows them to do this for any cause. In this case you're eithe abusing the service and could then be forced to upgrade to a more expensive plan or cut off

    Now wouldn't Clueless Bob just love to get a bill for a $gazilla bucks due to exceeding his bandwidth allotment? He'd either clean his system or find a new ISP and I don't care which route he takes as he'd no longer be a problem on my service.

  40. Cable Modem Customer Lock-In is Stronger by billstewart · · Score: 1
    If you shut off a dial-up user, he might change ISPs or might (try to) clean up his act (with some level of failure, which is not surprising since he was sufficiently incompetent that he got infected in the first place.) If you shut off a DSL user, he also might change ISPs or might try to clean up. But cable modem services are harder to change - there's usually only one cable company serving a given end user, and changing to DSL is not always an option, so cable users are more stuck than other types of Internet users. Also, most people really *don't* want their machines to be used for malware, especially if you scare them about liability and kiddie pr0n and mean nasty lawyers and make it easy for them to figure out if it's their kid's game-playing box or the parents' unpatched Windoze machine.

    Some cable companies already do block internet use from known infected machines - typically by redirecting all their web pages to a "You're infected. Here's how to install anti-virus software and a hardware firewall" page, but sometimes by giving them very restricted Internet access (e.g. only retrieving ports 80/443 web pages and only sending/receiving mail on the ISP mailserver.)

    AFAIK, none of the cable companies have started switching their users's TVs to the "Anti-Virus Cleanup Channel" to *really* get their attention...

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  41. Adversarial Responses by Anonymous Coward · · Score: 0

    Okay, I've watched my active logfiles from time to time, and it's obvious when spam hits my mailserver to accounts that are long gone. I've then done an nmap of a few of these IP addresses, and found that they are usually Windows machines with ports still open. Now, what I would really like to do is to craft a program that exploits any ports they have, and change the boot sector of their hard drive that tells them their computer has a virus, and they should take it to some repair shop to get it cleaned up. Hell, even tell them they can use fdisk /mbr or whatever equivalent to get their computer back. My guess is these people wouldn't even be able to accomplish this. The computer stays offline, their data is safe, we are happy. Now, I'm not so sure about the legality of this. However, would it be legal if the computer in question is outside of the US?

  42. Blocking Forged Packets is Very Easy RFC2827 by billstewart · · Score: 1
    There's a Best Current Practices document BCP38 and a few RFCs, notably RFC2827, recommending that ISPs block IP packets with forged Source addresses from their network. It's easy to block them from end users, and while you can't totally block forged packets coming from other ISPs, you can block some of them (strict uRPF for your end users, loose uRPF for peering/transit, plus blocking packets or at least routes from outside that pretend to be from your non-dual-homed end users.) These are standard features of Cisco and Juniper routers, and presumably of other major router vendors.

    This doesn't prevent all network problems by any means, but it cuts down on lots of annoyances. You can prevent forged UDP packets and forged TCP SYN packets, so there are a number of attacks that don't work. (Forging TCP sessions was already much harder.) Forgery can still happen within a subnet, e.g. a packet claiming to be from 1.2.3.4 might be from some other machine at 1.2.3.0/24, but you can go find the right wire to look at, so you can trace problems reliably and add extra filtering/detection in the right place. Forgery can still happen on other ISPs that don't do spoof-proofing, but you can at least trace it if it's within your network and you can work with other ISPs to clean up their acts as well.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  43. PDF, ack by SamSim · · Score: 2, Insightful

    A PDF warning would be nice next time around, folks.

    --
    qntm.org
  44. AT&T Internet Protect traffic analysis system by billstewart · · Score: 1
    AT&T Internet Protect collects traffic headers from some large fraction of their network - the last figure I saw was about 12TB a day of headers (source/dest IP, protocol, source/dest port.) There's a certain amount of analysis they do in real-time, some more that gets fed to human analysts to try to make sense of, and the data's also there for later research. Some kinds of problems are obvious (e.g. port scans on TCP 17300 and TCP 1025 from Asia are heavy this week - 17300 is usually one specific virus, but lots of malware targets 1025), some are hard to tell from regular traffic (a zombie sending out small amounts of spam doesn't look much different from regular email use), and some look weird but really only make sense later (the Slammer worm happened soon after they started collecting headers for research purposes - there were a couple of spikes on udp1434 during the week before the worm finally took off, which appear to either be test runs or fizzled launches.)

    Needless to say, it's a rather specialized database system, designed for problems on the order of "record all the event data needed for phone bills"; you're not going to run it on MYSQL in your basement. And it's not a complete sample of headers, much less message bodies (AT&T carries about 2 Petabytes/day of traffic), but it's an interesting start for detecting many kinds of weirdness. There are other ways to collect lots of traffic - routers mainly do packet counters of various sorts, so you're only getting aggregates rather than details, but they're good for other kinds of problems.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  45. So Yeti@Home isn't for you? by billstewart · · Score: 1

    So you're now pouring water in your nose. There's also been some possibly relevant marketing research done by Golgafrinchians about "Do people want fire that can be fitted nasally?". But Yetis? Probably not what you need.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
    1. Re:So Yeti@Home isn't for you? by pschmied · · Score: 1

      Ha!

      Blocked sinuses? No problem! Just as a carefully contained fire can clear a forest choked with dense undergrowth, so too can fire cleanse your sinuses of all manner of ills.

      Just one problem. What color should it be?

      -Peter

      --
      . Penguins Surely Ca
  46. Collecting packets by bytehd · · Score: 1

    so who "owns" these packets?
    Sounds like echelon in a new suit.

  47. In Defense of AOL by TFGeditor · · Score: 1

    I am not an AOL customer, have never been, never will be (at least, not by choice), but I am glad AOL is there to serve the unwashed masses. Because a huge portion of their customer base is, shall we say, "uninformed," AOL has taken a number of measures to protect them (and their network) from malicious traffic. Based on anecdotal observation, it seems to be working.

    Because hundreds of people have my "public" email address in their address books, I recive dozens (sometimes hundreds) of virues per week whenever there is an outbreak. However, I cannot recall the last time I received one from an AOL user.

    I receive hundreds of (filtered) spam messages daily, but again, cannot recall receiving any from an AOL machine. (This based on source IP address, not the forged FROM line.)

    On the flip side, 30-40 percent of spam comes from zombied Comcast and RoadRunner accounts (most from Comcast). The rest come from non-North American IP addresses.

    Like I said, limited anecdotal observation, but it appears to me AOL is doing something right, and is the perfect ISP for the "uninformed" user.

    Considering the size of their customer base, imagine how much more junk/malicious 'net traffic there would be without AOL.

    --
    Ignorance is curable, stupid is forever.
  48. Re:In Defense of AOL by jfengel · · Score: 1

    I've seen the same thing, anecdotally. I don't know what it is AOL does to keep its users from infecting the world. I've never heard of somebody being told "we're closing your AOL account until you clean up."

    Some of it must be filtering (blocking viral messages before they hit the user) on incoming mail. They may even be censoring outgoing mail. As for other worms, like sasser, I suspect they blocked the relevant ports long before XP SP2 came out.

    But that's supposition. I'd love to know for sure.

  49. Anyone get this working on OS X? by Oracle+of+Bandwidth · · Score: 1

    Has anyone managed to compile this on OS X? I am trying but I get 4 errors on line 469.

  50. Re:In Defense of AOL by Anonymous Coward · · Score: 0

    I believe they do block ports, yes. Anicdotal evidence suggests that when a dude asked me how to hack, and I pointed him to sub7 so I could get back to C++ coding, it refused to work giving the symptons of a firewall port block.

  51. Slashdot generates "malicious" traffic too by Ilgaz · · Score: 1

    My firewall figures slashdot checks my ports for open proxies and bans it for 20 hours, I added slashdot to my trusted networks because of it.

    If I didn't know it/ ignorant etc, I would see 100s of port scans from a huge , evil T class machine.

    Oh btw CmdrTaco, don't hack my machine :)