Slashdot Mirror
Zombie Report By ISP
twitter writes "Information Week has a summary of a report by Prolexic detailing Zombie activity by ISP, country and population statistics. AOL, the largest provider, had the most zombies but lower rates than others. Fourth largest Earthlink was not in the top 20. The information is gathered from hundreds of customer sites." From the article: "Weinstein went on to say that Prolexic's numbers were actually good news for AOL. 'It's a demonstration that the tools we provide are keeping members safe. Our very aggressive actions -- we provide anti-virus, anti-spyware, and firewall services to our users -- make them measurably safer than those on other ISPs.'"
AOL spins the report as good news because they claim a low rate of 0.54% zombie machines per million subscribers...yeah but...
They are basing that on 21.7 million total subscribers. I wonder what their rate would be if they only counted broadband subscribers?
The NSA: The only part of the US government that actually listens.
That the AOL users are zombies.
RTFA again for the best results.
Now, perhaps we can start putting some pressure on the bad ISPs to clean up their networks on the basis of their successful peers.
I'm really sick of everyone in the world looking down on me as soon as they find that my IP is on a Comcast block.
What do we want?
Brains!
When do we want them?
Brains!
AOL, the largest provider, had the most zombies
Sometimes jokes just write themselves...
There is nothing more practical than a good abstract theory.
we provide anti-virus, anti-spyware, and firewall services to our users
BUT WAIT! There's more!
If you act now, we'll throw in ANOTHER anti-virus service at no extra charge! All this for only 89.95!
Okay, I'm not supposed to do this, but I'll personally add another EXTRA anti-spyware monitoring system AND take off 50 bucks from the retail price!
All this and more for only 3 easy payments of 39.95!
So AOL has lower rate than some others. Doesn't really matter - since they have the most zombies in absolute numbers, blocking AOL from your IP range will give the most bang for the block anyway.
Trust the Computer. The Computer is your friend.
1. Participation in Distributed Denial-of-Service attacks
2. EATING BRAINS
End users just *don't care*. This is why there are botnets. Because, although their owned boxen are f-ing with the rest of the internet, it doesn't affect them - a selfish luser attitude, why should they bother virus/trojan scanning their boxen?
I wish ISPs (victims and hosting) would hold the lusers responsible for this - I think criminal negligence would be an appropriate charge. I for one look after my gentoo linux boxen and keep them patched.
No amount of firewalls, switching to Mac or Linux, or anything else will stop people from having their computers taken over at the end of the day. Stupid users will always find a way to get infected dispite the best protection available.
Operating a computer should be like operating heavy machinary. You need to pass a test that says you're qualified to do it. Don't want to take the time to learn how to properly use a computer and avoid being just another zombie PC sending me emails about lowering my car payments or free nude pics of celebrities? Then don't use a computer at all.
If you think this is a little irrational, just remember that the financial damages caused by computer viruses are probably in the billions of dollars every year. Imagine how much trouble could be prevented.
The other thing about AOL's dialup service is that they buy modems from local ISP's in areas where they don't operate central hubs. I used to work for one such ISP that contracted to AOL. We were very proactive about protecting customers, etc.
So a lot of the AOL crowd having good numbers may very well be local ISP's that are taking good care of their own customers, and just happen to contract out to AOL on the side
-everphilski-
You know those underlined bits in the summary at the top of this page? They're called hyperlinks, and you can click on them... try clicking on the second one.
aol should read this...
They had the most zombies but a lower rate than others. They spin this as good.
But according to the post, Earthlink (the fourth largest provider) wasn't even in the top 20, implying that their zombie percentage is far lower than AOL's.
retrorocket.o not found, launch anyway?
Here you go
The Prolexic Zombie Report
Life is like a web application. Sometime you need cookies just to get by.
Comment removed based on user account deletion
...and this is how it ends up.
Although, there are some AOL users I wouldn't mind being gobbled up, I hardly need to sit on my roof with a minigun and grenade launcher.
For the love of G-d, we must do something now!
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
The actual report is at:
http://www.prolexic.com/zr/
--saint
So (making #s up) if AOL is 10% of all attacks, and 100 million machines, they have .1 percent per million. But if Joe's ISP has 5% of all attacks, and only 5 million machines, they have 1.0 percent per million.
AOL has twice as many attacks total, but compared to their user base Joe's rate is ten times as high.
Warning: Apple/Nintendo fangirl. Likes her electronics cute & cuddly. May be rabid.
"That's three or four times as many attacks per million subscribers," Weinstein argued. "The numbers show that AOL members are significantly less likely to have been compromised by a zombie. This is actually good news for our users."
Picture that you're a script-kiddie botnet owner looking for more zombie systems. You have a program that someone provided to you that scans netblocks for systems vulnerable to hundreds of various buffer overflow attacks. You get to pick what netblocks the scanner runs on.
Which would you pick:
1. AOL dialup netblocks, where the user's average 48 K/bps connection takes an average of 1 minute to scan and provides you with a wimpy 48 K/bps of DDoS power
2. Comcast Cable Modem netblocks, where the user's average 384 K/bps upstream bandwidth takes an average of 6 seconds to scan and provides you with a beefy 4,000 K/bps downstream DDoS power.
The numbers quoted above should be accurate enough to get the point. AOL hosts take far longer to compromise and provide far less "bang for the buck". No wonder they're compromised a smaller percentage of time.
I'm a big tall mofo.
Except that it wasn't just an appliance, was it? It was a bug ridden piece of manure that was delivered with known defects, to people who by and large don't have the wherewithal to work around those defects.
This is Microsoft's fault, plainly. Not the poor bastards who were taken in.
You know, I've talked to AOL on the phone alot, and I have to agree with this article...it does seem that a high percentage of people working for AOL are zombies.
Don't take life so seriously. No one makes it out alive.
Too bad AOL's spyware and firewall don't block the spyware that is AOL inherently... Here is how my AOL experience has gone.. 1. Install AOL software 2. Realize AOL software stinks and sends out all kinds of info back to AOL that I dont want them to have. 3. De-install AOL software. 4. De-install AOL software again after it reloads. 5. De-install AOL software again after it reloads. 6. Use a thermite grenade on my box because AOL angers me.
News Reporters Make Tasty Polar Bear Treats!
Remember: most zombies involved in a DDoS attack are simply opening a connection, sending a malformed request then closing the connection. They aren't playing FPS games or downloading porn, so high bandwidth isn't really required. What is required is a vast diversity in IP address so that the firewall and server are overwhelmed trying to process every incoming request.
The "Average Joe" user isn't able to monitor their own PC for spyware, virus, or bot activity. I worked for my school's student computer repair group and I'd have to say 90% of the issues we had were related to viruses that were passed through AIM and email and spyware choking the systems to a halt. The other 10% were legitimate hardware or software issues (such as Windows imploding on itself or a NIC going bad).
Our school even gives out "free" (as in hidden in our tuition costs) copies of Norton (really Symantec, but I don't want to give up the old name) AV that takes care of many spyware threats and the vast majority of virus threats. The IT department also highly recommends that students use Spybot S&D or AdAware to remove and prevent spyware from getting a hold of their computers.
Most students just didn't care enough to worry about using the anti-virus and spyware tools that were provided to them. I've even been told by numerous people that running the tools makes their computers slow and they don't want to have it be slow when they are playing Snood.
The only way my school was able to successfully fight virus/bot activity on the network and prevent the entire campus from being taken over is to block users with "suspicious" activity (too many emails in a short period of time or too much outbound bandwidth in a short period of time were two tests that I knew of) from using the network until they can demonstrate that their computers are fully repaired.
The IT department used that technique to successfully stop Blaster and many of the other worms that hit our campus before too many computers were affected. Though it's "rule with an iron fist" at its best, it worked and made the network much safer for the rest of the population.
Without my school running things like this, it would have just been a matter of time before most of the computers on campus were taken over.
The blurb says Earthlink is not in the top 20. Mindspring, listed as 17th most infected, is Earthlink.
I don't understand the report, but that graphic is way cool. Can I get a black light poster of that?
What is really needed is a system that performs automatic blacklisting based on a report-confirm-block scheme. That is, a customer or a bottom-level ISP becomes the target of a DDoS attack. It reports the IPs of each attacker to its service provider, which reports to its service provider, and so on, up. If an IP address corresponds to an ISP that receives a report, then the ISP examines the traffic originating from that IP address locally (as locally as possible, to distribute the load so no one routing device gets overloaded), determines whether the traffic constitutes participation in a DDoS attack, and if it does, blocks the IP locally.
:)
Eventually some of the reports will reach backbone providers. At the top, IPs are reported to peers, which then route the reports back down to the local ISPs, who confirm the report and block the IP address locally. The problem then shifts to the end user, who must take responsibility for his or her machine and keep it secure.
Obviously, compliance is an issue, but this can be solved by having a higher-level provider begin blocking lower level subnets if the lower-level ISP does not comply with the mitigation request.
This scheme is in every ISP's interest, since backbone providers can reduce traffic and thus costs (carrot incentive) while smaller ISPs must comply or be blacklisted (stick incentive).
Now all we need is for a smart person to write up an RFC.
Actually, AOL's "ISP" is AOL Transit Data Network (ATDN), a related company. They're a "tier 1" provider, and they communicate directly with other tier 1 providers: AT&T, MCI, Level(3), Verio, GBLX, C&W, Verizon, etc. They're the guys who own the big continent- and ocean-spanning fiber optic networks.
"ISP" usually refers to something more customer-facing than the tier 1 providers.
Just like AOL, Earthlink has been making a huge push into broadband services.
Remember, traditional AOL service is dialup too? No difference between Earthlink and AOL in this respect. Both are dialup providers that have begun a push into broadband service, and in Earthlink's case, even mobile phone service. (Earthlink is an MVNO that resells Verizon and Sprint service.)
retrorocket.o not found, launch anyway?
For me, the links don't show as underlined
why, are you using AOL?
*ducks*
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
Yeah, because no one runs their own mail servers. Wait, I do, and I know many people that have mail and web servers on cable and DSL connections. That's what the Internet is about, you know, being able to connect to other people any way you want.
That being said, some of the things we do is attempt a tit-for-tat connection to an email server... if someone tries to send us mail, we ask if they accept mail, and if so, there's a good chance that they've got a legit server. That cuts down on a ton of bad connections.
My blog. Good stuff (when I remember to update it). Read it.
Sure, it's part of the answer, but if you don't keep your software patched up to date no firewall will help you.
See, the point of being connected to the internet is to get email and access external resources. If you visit a web site that exploits your buggy browser, your firewall won't help you. If you click on an email that exploits your buggy mail client, your firewall won't help you.
The primary means of infection for the most prevalent malwares is email. Firewalls don't prevent you from receiving email.
That being said, you still should have a firewall. But keeping your OS and apps patched is even more important.
Even patching+firewalling won't save you if you are stupid enough to run binaries from untrusted sources. A virus checker can help out with that, but it won't save you from brand-new virii.
And if you add up the other domains Earthlink owns, it's even higher in the list...
m ains/index.jsp
http://webmail.atl.earthlink.net/wam/supported_do
-- Terry