Slashdot Mirror
Naming and Shaming "Bad" ISPs
An anonymous reader writes "Brian Krebs takes a provocative look at ISP reputations, collecting data from 10 different sources that track 'badness' from a multitude of angles, from phishing to malware to botnet command and control centers. Some of the lists show very interesting and useful results; the ISPs that are most common among the various reputation services are some of the largest ISPs and hosting providers, including ThePlanet and Softlayer. The story has generated quite a bit of discussion in the security community as to whether these various efforts are measuring the wrong things, or if it is indeed valid and useful to keep public attention focused on the bigger providers, since these are generally US-based and have the largest abuse problems in terms of overall numbers."
These measurements might not be 100% accurate at identifying the root of each of the problem areas, but when an ISP is on all but one of the top ten lists, you have to start wondering what they are doing wrong. ThePlanet.com, what gives? Too many undereducated customers running infected servers? No top level detection and deactivation process in place? Seems like there are a lot of things missing.
One of the largest ISPs in Brazil, Locaweb, is the main source of spam and malware I get and it's not only about numbers. They just ignore every single complain I've done.
Scientia est Potentia
It is a shame that ThePlanet is doing so badly. I've used them before for dedicated hosting and was very happy with the service I received. I will say that they are very "hands off" (which is generally good, but bad in this case). I think one has to remember that this is a chart of which ISPs are most responsive and active in stopping abuse originating from their network and not some kind of general review of the service they offer.
That being said I think all the ISPs listed should be unhappy about appearing on these lists and should actively be trying to fix their reputation or risk getting blacklisted.
You take the good. You take the bad. You take them both, and there you have Net Neutrality.
Net Neutrality. When the world never seems to be living up to your dreams, and suddenly you're finding out Net Neutrality isn't all about you.
Some of the ISP's in the list are huge hosting companies, namely ThePlanet, Layered Tech, Leaseweb, OVH.. You have no idea how big they are unless you've visited one of their data centers. They host millions of servers. How would they check it all? For that matter, who wants their data center staff snooping around in your server?
Being one of the largest hosting companies in the planet obviously brings in bad guys too.
Please. If you are a big company you need to be prepared to deal with larger portions of the same: good tools, good (and bigger) staff, a specialized security/response team. It's like any other company, One can't expect to run a large company with the same resources used in a small one.
Scientia est Potentia
I bet every ISP wants to be a Superior Carrier of Utmost Magnificence ;-)
Why would anyone (home user/corporate etc) care about any of that? It doesn't make their network/access any less safe. People go for cost, then performance. If I can get a good deal from an ISP, why do I care about how many follow customers are incapable of managing their systems?
I'm fairly certain that they have specialized security/response teams. The difference between small and big companies is that the big ones are known by everyone. Even if they have a prompt response team they can't pre-screen servers, and even snooping around in them would be illegal. Obviously the huge companies will be better known to everyone and hence get more customers, good and bad.
I do agree they are more targeted but that is a price they have to pay for their size and there are ways to investigate without snooping around one's servers. Also, what about the hundreds of complains I sent? I've never got one single reply.
Scientia est Potentia
Are they that bad?
So as by far the biggest abuse problems (botnets, spam, ...) are coming out of the USA since many years, maybe it is time for other countries to black whole USA based addresses. Just stop routing their packets until they become good net citizens.
I don't know how many reports I have seen pointing to the USA as the biggest spam source. It's time to do something about it. Only if there are some consequences will they ever change their behaviour.
The big hosting providers ALL have the same attitude when you contact them about abuse:
"WE aren't doing this, that is one of the customers of one of our resellers, we won't do anything, talk to the reseller."
Of course, the reseller says "Screw you, they are paying us good money and you aren't."
Softlayer is a VERY good example of this: a Softlayer hosted site has repeatedly been spamming the Wine Developers mailing list for their crap. I have personally emailed Softlayer about it on more than 10 separate occasions, and have heard ZERO back from them. They don't care (even though their site claims they are aggressively anti-spam - BULLSHIT! words are cheap, actions are not, and Softlayer HASN'T ACTED!)
The spam problem isn't complicated to solve, it is actually pretty simple to solve (though not EASY to solve!) - just follow the "shit flows downstream" principle. If a host is doing bad things, look up who owns the network they are on, and MAKE IT THAT ENTITIE'S PROBLEM to solve it. However the problem is solved - be it "Hey, your server's infected" "OOPS fixed now sorry!", be it "We have blocked outgoing connections from your system until you fix it.", be it "Boss axed me an' Nunzio to has a talk wit ju about youses' server...." - doesn't matter as long as the problem gets solved. If it DOESN'T get solved, then the network owner becomes the problem entity, and you move to their hosts.
The only hard part is bringing some form of negative consequences to bear upon the network owners - you either need a law (and then you have a hard time dealing with systems outside your law's reach - all you can do is place the problem on the point of demarcation to your jurisdiction), or you need something with a wider reach, like publicity.
(and to all you morons about to copy and paste the "spam solutions form" - that meme is old enough to drink and vote, let it die already, OK?)
www.eFax.com are spammers
And yet you still expect them to sell you hosting for 19.95 a month, provide you with basically unlimited bandwidth, unlimited storage,do not even THINK about deep packet inspection or traffic shaping and let you do most anything you want to do!
Sorry but your comment is laughable man. The old saying of, "Speed, Quality, Price" Choose 2 still applies.
Hey KID! Yeah you, get the fuck off my lawn!
He's not blaming the series of tubes, he's blaming the ISPs for harboring spammers, botnets, etc.
GP's not blaming I95, he's blaming states that manage a big chunk of it for harboring crack dealers, distributors, etc.
Neither states nor ISPs should be complacent about mischief within their borders, but the more traffic that passes though a state/ISP, the bigger that state/ISPs share of the problem will be.
True, but you also have to prepare a budget for it. You can choose the contracts for careless or even malicious customers who would not accept a more sane or secure overall environment, including spammers and l33t d00dz who insist that "the Internet is free!!!" and "why can't I run my own NFS/SMB/HTTP/SMTP/FTP/IRC/Bittorrent server, I paid my $19.99/month!!!!" And slapping them down and turning them away lowers your potential customer base: a lot of ISP's worry a lot about "market penetration", and rely on being the locally dominant player. Following up properly on complaints against those abuse customsers also takes serious engineering and legal reources, none of which generates revenue.
Conversely, some ISP's do well with the superior service being security aware can provide. They don't get overwhelmed by surprise Bittorrent or FTP deluges against hosted servers, they channel outbound SMTP through servers that require authentication so the spambots can achieve nothing without passwords and they disconnect machines spewing Windows worms around their local network. and they keep their routers up-to-date with security patches to avoid getting re-routed. Some of us appreciate the resulting protection, and pay for it in our monthly bill rather than in expensive internal engineering cleaning up the messes.
No, I'm not. I'm quite happy to pay more for quality. If you are willing to cope with this sort of crap, that's your choice but remember that the whole internet idea is about collaboration. If you put up too much crap, you will start to get blocked and your 19.95/month won't worth a dime.
Scientia est Potentia
We all demand huge bandwidth, huge amounts of storage and we want it for 19.95 a month.
Do you wonder why everything is over sold? I mean, really do you?
How much does a really sharp *nix admin.engineer cost annually?
Even with really good tools how many physical boxes can on guy keep watch over? How about when each box is hosting 300 accounts, or running 10 VM's? What would anyone guesstimate? Maybe each box is only hosting 30 accounts? I mean the numbers start to add up.
Lets say just for sake of argument that a really good admin can handle the care and feeding of 100 servers. That guy costs you 60K a year benefits and all. You need three shifts because you run 24/7 so that is 180K right there. Lets say you have 10,000 servers do now we are taking 100 guys * 3 shifts so 300 admins * 60,000.00 per year. So payroll just for the admins is 18 million a year and we have not given anyone the weekend off, so that number is a bit low.
You have not yet paid for all the hardware or your bandwidth bill. So right now at 19.95 a month you need about 900,000 customers.
Uhmmm for some reason those numbers just don't pencil. So thats why ISP's have to oversell everything AND turn a blind eye to a lot of things.
Hey KID! Yeah you, get the fuck off my lawn!
The reason being that when I look at our firewall logs or when we happen to get a system compromised, the US is way underrepresented. The US accounts for a very large portion of the Internet still, and we are located in the US so you might expect to see most attacks from there. However the majority are RIPE or APNIC addresses. You can also see it in things like Conficker infections. If you look at the graph of what got hit how bad (http://www.confickerworkinggroup.org/wiki/uploads/ANY/conficker-all-2009-small.png) you see that RIPE and APNIC are again way overrepresented in relation to the whole.
Now I've not done a scientific study on this, I'll admit, but I do have a reasonable data set and it just doesn't match with what I've seen.
I do agree they are more targeted but that is a price they have to pay for their size ... Also, what about the hundreds of complains I sent? I've never got one single reply.
Lets take this into another scenario. USA is the main source of spam on the Internet. Does this mean USA as a whole is bad?
Also, I've heard that one of the large companies, HostGator, gets 1500 new customers every day and they catch around 500 of them being malicious/spammers (even with phone verification!). With that huge amount of customers, and the good-to-bad ratio, it's no surprise if some slip in.
I remember when ISPs used to seriously police their users, because there was the potential for them (the ISP) to get kicked off the internet, and have that stick. Network admins listened to complaints from other admins, and if they concluded that a given ISP wasn't keeping house and letting too many net.abusers on, they were considered a rogue ISP and cut off. The rogue net couldn't just call up another network access provider and get reconnected, because their reputation preceded them. I'm not saying I'd want to go back to that (even if it were possible), but as a believer in personal responsibility, I miss those days.
http://alternatives.rzero.com/
Big and cheap providers are on the top 10 lists of spam and malware? Really? Wow, I am surprised... NOT.
Let's be sensible for a moment and ponder: Why are ISPs hosting a lot of pages a main source of malware? Because they are a main source of traffic and webpages. It's like saying that there are more people in jail in the US than in, say, Andorra. Thus the US are much, much more violent and generally people there must be kinda leaning towards crime, right?
And cheap service means that they can not waste resources on hunting down malware providers. Hell, they can't even dedicate manpower to shutting them down, as long as they're not held accountable for it. Simple calculation: Cost of hosting malware C&C servers? Umm... a bit of traffic, compared to the rest probably not even noticable. Cost of hunting&squishing it? Putting manpower behind it. Do the economy math...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why should corporations care? Two words "litigation exposure." A bot-net living in your network takes down an e-commerce site for day. They will see you in court. Good luck with that "don't blame me, blame my ISP" defense.
I think that kind of "not my problem" thinking is what is driving the current cloud computing craze. Corporations seem to think that they can side step the accountability hassle if they outsource IT to the cloud. Good luck with that too.
Look, no matter how much we want ISPs to stop malware, botnets, etc. when they start doing that, they are going to start becoming more evil (as in giving out IP addresses and subscriber names, etc). Content-agnostic ISPs are -always- going to be better for the internet. Unless, you want throttling and your ISP to check for "pirated" content.
Taxation is legalized theft, no more, no less.
We've been doing something like this at SiteTruth for two years. We have the list of major domains being exploited by active phishing scams. This is simply a list of domains that are both in PhishTank (about 100,000 entries) and Open Directory (about 1.5 million entries). Today, 84 domains are in both. There's been a surge; it was 54 two days ago.
Domains are on this list for one of several reasons.
While this is to some extent a "blame the victim" approach, it's more effective than "phishing education" aimed at end users. Hundreds of webmasters have to be educated, not hundreds of millions of end users.
Companies like ThePlanet and OVH explicitly invite bad behavior via pink contracts, and refuse to do anything when you email abuse@them. However, I've not had experience in dealing with Layered or Leaseweb. FDC used to be on that list, but have actively engaged in monitoring abuse reports. However, ThePlanet is going the way of Atrivo, Foonet, and CI Host.
ATT, Limelight, NAC, and Akamai each dwarf all of those companies combined and don't even come close to the amount of abuse each of those providers unleash on the Internet. So, it's not about size.
The later ones you listed are content delivery networks (CDN). They're mostly used for static things like images. Besides that, signing up with them requires an established business and large up-front payments. Akamai's offices here in Stockholm are close to our place and we've done business with them, and it's nowhere near like just ordering a server from hosting company. Both of those reasons are why they probably don't have as much abuse.
LL will sign up anyone willing to pay, business or not, reputable or not. And while they may own a CDN, they also own a colo hosting facility, as does Akamai (whose CDN also handles dynamic content). The difference is that both of them will look at each order and attempt to figure out intent. Both also rapidly respond to abuse reports. That is why you don't see much abuse from them. Companies like ThePlanet (whose Dallas facility doesn't use AC for half the summer) outright ignore abuse complaints, whereas OVH knows full well what they're being used for, and won't act unless forced to by a court or pressure from uplinks.
Lol Sopssa with the ignorant comment as usual. Are you saying that big companies have to do a shitty job? Maybe they should scale their staff to match their revenue?
The reality is that these companies intentionally provide bad service and don't care about their spammy customers because turfing them costs revenue.
Darn, I guess I can never be employed at one of these places. No one would ever confuse me with "big".
i recommend peer guardian for some huge lists of malicious IP's
So driving costs up for these companies as well as the entire general public is OK? If it is fine for others to suffer loss of money why should content creators resent it? Gravy for the goose is gravy for the gander.
It's called letting the feds do their job and get a warrant if they trace illegal activity to a server in a data center.