Slashdot Mirror
After Links To Cybercrime, Latvian ISP Cut Off
alphadogg writes with this Network World story, excerpting "A Latvian ISP linked to online criminal activity has been cut off from the Internet, following complaints from Internet security researchers. Real Host, based in Riga, Latvia was thought to control command-and-control servers for infected botnet PCs, and had been linked to phishing sites, Web sites that launched attack code at visitors and were also home to malicious 'rogue' antivirus products, according to a researcher using the pseudonym Jart Armin, who works on the Hostexploit.com Web site. 'This is maybe one of the top European centers of crap,' he said in an e-mail interview. 'It was a cesspool of criminal activity,' said Paul Ferguson, a researcher with Trend Micro."
The questions that should be asked is "Are they closing in on the criminals who set up these sites?"
Surely with all the information they can get from this rogue ISP they can track down the wankers who run them.
It pays to be obvious, especially if you have a reputation for being subtle.
Perhaps the malice these researchers feel towards Latvia is similar in some way to the anger the RIAA feels towards filesharers?
Latvia? You're taking things out of context. This is not about Latvia in general, this is about a Latvian ISP responsible for a shitload of spam and botnets. You're free to replace Latvia for any country you wish and it wouldn't make a difference. Also I think it's fair to say that RIAA only serve their interests, whilst spam and botnets concern anybody who uses internet.
I am the lawn!
So you'd prefer to be subjected to DDoS attacks, have your E-mail account hacked and used to send spam, be phished for your credit card details all in the name of Net Neutrality?
These are harmful activities. Harmful to people, REAL PEOPLE. It is the definition, at least in my eyes, of what crime is: serious irreversable harm to a person or people.
Botnets sending out DDoS attacks make the Server Admin's job harder. Whatever site it is running becomes locked, likely losing the business revenue they can never get back.
Hacked Email accounts cause headaches for the person who's account was compromised, it causes headaches for those who recieve it, especially if it came from a white-listed friend, as it means wading through them and deleting them manually rather than have them caught by the filter. And again, most importantly, it makes the server admins job harder, as they have to devise work arounds and filters for Spam.
And the most serious of all? Phishing for card details. Serious Monetery loss from an individual - they may be able to get it back, but not without a serious fight (My card got skimmed at a shop once, they managed to spend £700 before the bank stopped the card. It was a week before a new card was sent out, and 2 months before I got the money back)
A whole industry has arisin around fighting these criminals. We're in a Broken Window situation and the only way to stop it is not to fix the window, but to remove the person throwing the stones.
It pays to be obvious, especially if you have a reputation for being subtle.
This is maybe one of the top European centers of crap,'
The server 216.178.38.116 is an American server known to have loads of crap too! I hope they also could get it!
Ubuntu is an African word meaning 'I can't configure Debian'
It's almost certainly against the contract terms that Real Host signed with their upstream provider. Net neutrality has nothing to do with this issue; this isn't packet injection or traffic shaping or anything like that. This is simply disconnecting a client who is in breach of contract and criminal law. In effect, blocking them (as you personally advocated).
Do you honestly think it should be the responsibility of the rest of the world to deal with these attacks, just because they are sent over the Internet?
There's no place I could be, since I've found Serenity...
The "powers that be" didn't shut them down. Their upstream provider did.
Take this analogy:
--start-bad-analogy--
I let you watch TV at my house. But, most of the time you are there, you leave trash and shit everywhere, and fail to clean up after yourself.
So, after enough complaints from my other guests, I decide to kick your ass out.
--end-bad-analogy--
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
...it's a cesspool of crap.
the other kinds are ok.
This space available.
I thought xenophobia was a fear of virtualised environments?
AT&ROFLMAO
A real problem here is that if upstream providers do this sort of thing, there is no limit to their power. We're not talking about any court action, any due process or any other legal nicity. We are talking about vigilante action and mob rule.
The idea of "net neutrality" pretty much can be agreed upon that upstream providers do not cut off users for actions that violate the laws of some jurisdiction on their own. Now this may not be a good idea, but if your ISP is prevented from cutting you off for downloading pirated music and movies then a rogue ISP better not be cut off for hosting botnet control centers and phishing web sites. Sorry, you can't have it both ways.
Of course the real problem is that there is no force of law that can successfully prosecute folks like this. They might even be violating laws in their home country - but how do law enforcement agencies conduct a highly technical investigation when they have no facilities. Not only that, but the whole idea of the Internet makes it extremely difficult to conduct investigations without effectively wiretapping and requires the cooperation of a high level provider. It is difficult to see how such an investigation can be conducted by anyone without lots of resources and financial backing. And cooperation of providers, often at their own expense.
No, prosecution of such crimes as are alleged on the Internet is very difficult without either inside information (usually bragging) or evidence collected for other court actions. For example, the ISP is sued for lack of tax payments and the servers are seized as part of discovery, which then uncovers further evidence.
No I think this vigilante action is short lived and not in the best interests of people vitally concerned with the freedom of action on the Internet. Of course, freedom of action implies freedom to commit crimes on the Internet, like copyright violation and phishing.
The summary is quite wrong, though I do not blame the submitter. All English and Russian language sources that I can find state that supposedly Real Host, an ISP, got cut off. That is not actually so.
Real Host is some company that is running fraudulent operations and other crap, making use of the Zeus botnet. Real Host rented servers from Junik, which is an ISP. They're a small ISP connected upstream via the Latvian branch of Telia. And the story now is that Junik cut off Real Host's access and revoked the servers they rented. Real Storm itself doesn't appear to be linked to Latvia in any real way. They use an address in Kazakhstan as the legal address from where the IP blocks are leased, the botnet itself is being linked to a Russian group of hackers. And they chose Latvian servers to rent, which doesn't make them a Latvia-based group.