Slashdot Mirror
Australian ISPs Asked To Cut Off Malware-Infected PCs
bennyboy64 writes "Australia's Internet Industry Association has put forward a new code of conduct that suggests ISPs contact, and in some cases disconnect, customers that have malware-infected computers.
'Once an ISP has detected a compromised computer or malicious activity on its network, it should take action to address the problem. ISPs should therefore attempt to identify the end user whose computer has been compromised, and contact them to educate them about the problem,' the new code states. The code won't be mandatory, but it's expected the ISP industry will take it up if they are to work with the Australian Government in preventing the many botnets operating in Australia."
if the Australian definition of 'malware' is 'bittorrent'
ISPs should just provide internet access not police and monitor traffic.
Don't make me choose between the internet and bonzibuddy.
This is actually a good idea. Sadly, it's another step in the direction of moderated, government approved, unable to opt-out internet.
Rogers, here in Canada, has been practising this for a few years now, and will notify and disconnect computers that are sending network packets that match known malware. I think it's an automated process, too.
It's sort of funny, there was once a time when someone set the DHCP lease length too short, and several customers wrongly got blasted off the internet as they had been "infected".
Screw the rules, I have green hair!
A couple of years ago, a major ISP in Finland had a somewhat similar system. They wouldn't allow infected computers to take any other network access than HTTP and they redirected all HTTP traffic to a page saying "you're infected" and providing short instructions on how to fix it. It seems that they're not doing it anymore, but I don't know the reason.
I've contacted ISP's about their customers attempting to "hack me" because they were infested with Code Red and Nimda and for some reason my Apache server on Linux looked incredibly tasty. They of course proceeded to ignore me and not even to contact their customers.
The preceding post was not a Slashvertisement.
Want to put a stop to malware/botnets? This is it. If a simple email/phone call asking "are you using irc/running your own mail server?" gets a response of "I don't know what irc is!", shut them down until they can clean out their machines, hell, even give them help, such as redirecting them to an isp sponsored AV or something (and no, i'm not talking enforcing it like some schools do with clean access or other network admission control.) Doing this sensibly could very seriously take a bite of out a lot of the problems on the 'net today.
My (Australian) ISP has been doing this at least for spam relays for a few years now. If they detect you are being used to spam they cut all your traffic and redirect port 80 to a page telling you what has happened and giving you links to AV tools and an automated traffic checker that will unblock you once you have dealt with the malware. Two of the guys I live with got infected and so I have personal experience dealing with the system. To me it seems like a perfectly sensible and responsible reaction to a serious problem. IMO any ISP not doing this is an irresponsible netizen.
To me it is like your CC company notifying you of suspicious charges or the phone company asking why your mobile is suddenly making hundreds of calls from Azerbaijan. It not only stops the current problem but if people are actually notified that they have a problem they are far more likely to take steps to protect themselves in the future.
========
CINC, 4th Penguin Legion
I know when I was living on campus at a state university my computer was caught in one of their malware scans. I was running Linux and had firewalled ping requests among other things. Their scanning system automatically assumed if a computer did not respond to ping it was infected.
If you cut off all the Malware-Infected PCs, only Macs will be left. (ok, maybe some linux boxen).
*ducks*
My otherwise stellar ISP has a "shoot first, ask no questions security policy"
It is frustrating to lose access to my home server while at work and not be able to do any troubleshooting because I need physical access to the machine.
It is quite maddening to finally get home, verify that there is nothing wrong on my end, call up support and (eventually) find out that I've been deliberately disconnected because of a security problem that doesn't exist.
EVERY country needs to be doing this, and not making it voluntary either. Any problem on the internet affects everyone connected to it. Cutting off PCs in one country has limited effect in isolation. Considering botnets are an exclusive Windows problem, Microsoft should be forced to pay for the scheme too. It's their mess after all.
I'm curious about how MS will respond to this if it comes into being. On one hand they'll lose a large number of users, after all, does anyone outside the MS camp really believe that it's not gonna be 100% infected Windows PC's that will be affected? What will MS do?
Will they offer discounted or free vouchers for repairs, upgrades etc? How many of these machines will be unlicensed? Will they pay to fix unlicensed copies of Windows if the owners either have no money to spend on a sticker with a number on it? In the current economic climate you can't blame them. Is a subsidy to clean the PC worth the ISP's time and hassle knowing it'll be infected again by the end of the week at the latest, and they'll have to repeat the same warning and threat of disconnection all over again. Will they provide paid anti-malware software? Who pays for all of this? Will they provide training for Windows users to at least give them a chance of having a few months online without a letter?
This would reflect badly on MS in any free press, even having to be the only ones to offer fixes is embarrassing enough. Given that MS control the mainstream media it'll go unnoticed as far as PR is concerned, but it's yet one more thing eating into their profits at a time where they're struggling.
The alternative is to lose a large number either to Linux, or off the internet altogether. Anyone who's had the internet for a while knows what it's like when it goes down for a few hours, will those people really decide the internet is not worth it?
I'm guessing the great philanthropists and all round nice people at MS are busy lobbying at every level to stop this from happening or at least water it down (notice the ISPs are being "asked" not "told"). They need to keep market share by any means necessary, ideally without spending a cent on it. The rest of the world can suffer as long as MS's interests are not hurt.
Given that Windows has all the security of a paper tank in a thunderstorm this will be hilarious to see the workload the scheme entails, and over time the number of Windows PCs in Australia still connected because they're NOT infected. They will drop like flies. Give it a few years and it'll be a Windows free zone.
It should be illegal to speak in public without some formal education in psychology and rhetoric.
Some kind of attitude test might be a good idea too.
Truth arises more readily from error than from confusion. -Francis Bacon
Because such a cure would be worse than the disease; we don't need nor want that much bureaucracy.
It is a much better practice to use a "walled garden"[1] to give them a very limited access to the net until they have cleaned up their infection. I have seen examples of this used to give the customers access to anti-virus software and Windows update only, in addition to a set of web pages that explains why they have limited access (and how to get out of it).
This is a much better solution than just blocking the customers access to the net.
If you are disconnected for being malware infected, exactly what WILL be the process for being reconnected, assuming you aren't just black listed for life as an internet persona non grata? Will it be some byzantine bureaucratic DMV-like red tape nightmare with hundreds, even thousands of people showing up every day as botnets simply infect more and more systems to make up for those it lost during the morning disconnect purge?
Do you really want a government bureaucrat picking through your hard disk deciding what is malware and what isn't? Would the government even have technicians capable of determining whether your linux install is malware or not?
Give me Classic Slashdot or give me death!
Does any one that actually lives here in Australia truly believe that, oh, let's say, HELLSTRA, sorry, TELSTRA or Optus is actually going to sacrifice profit in order to stop malware? These folks offshore everything and anything they can to cut costs and increase profits - they structure their support systems as much as possible to deter supporting the end-user. I personally believe that unless the Feds step in and put the hard word on the ISP's, they're going to ignore this as much as possible - or make a show of hitting those using torrents or other file-sharing applications just to "make a show" of it all. IMHO, mind you...
YankDownUnder Veni, Vidi, volo in domum redire