Slashdot Mirror
Naming and Shaming "Bad" ISPs
An anonymous reader writes "Brian Krebs takes a provocative look at ISP reputations, collecting data from 10 different sources that track 'badness' from a multitude of angles, from phishing to malware to botnet command and control centers. Some of the lists show very interesting and useful results; the ISPs that are most common among the various reputation services are some of the largest ISPs and hosting providers, including ThePlanet and Softlayer. The story has generated quite a bit of discussion in the security community as to whether these various efforts are measuring the wrong things, or if it is indeed valid and useful to keep public attention focused on the bigger providers, since these are generally US-based and have the largest abuse problems in terms of overall numbers."
call it what you like, it's all around us.
never a better time to consult with/trust in your creators. the lights are coming up all over now as well.
And New Jersey is responsible for crack problems in inner cities, because so much crack is transported on I95.
Would of been a first post, but my ISP slows down the packets to keep us poor colored folk's down.
These measurements might not be 100% accurate at identifying the root of each of the problem areas, but when an ISP is on all but one of the top ten lists, you have to start wondering what they are doing wrong. ThePlanet.com, what gives? Too many undereducated customers running infected servers? No top level detection and deactivation process in place? Seems like there are a lot of things missing.
One of the largest ISPs in Brazil, Locaweb, is the main source of spam and malware I get and it's not only about numbers. They just ignore every single complain I've done.
Scientia est Potentia
It is a shame that ThePlanet is doing so badly. I've used them before for dedicated hosting and was very happy with the service I received. I will say that they are very "hands off" (which is generally good, but bad in this case). I think one has to remember that this is a chart of which ISPs are most responsive and active in stopping abuse originating from their network and not some kind of general review of the service they offer.
That being said I think all the ISPs listed should be unhappy about appearing on these lists and should actively be trying to fix their reputation or risk getting blacklisted.
You take the good. You take the bad. You take them both, and there you have Net Neutrality.
Net Neutrality. When the world never seems to be living up to your dreams, and suddenly you're finding out Net Neutrality isn't all about you.
I bet every ISP wants to be a Superior Carrier of Utmost Magnificence ;-)
Why would anyone (home user/corporate etc) care about any of that? It doesn't make their network/access any less safe. People go for cost, then performance. If I can get a good deal from an ISP, why do I care about how many follow customers are incapable of managing their systems?
So as by far the biggest abuse problems (botnets, spam, ...) are coming out of the USA since many years, maybe it is time for other countries to black whole USA based addresses. Just stop routing their packets until they become good net citizens.
I don't know how many reports I have seen pointing to the USA as the biggest spam source. It's time to do something about it. Only if there are some consequences will they ever change their behaviour.
The big hosting providers ALL have the same attitude when you contact them about abuse:
"WE aren't doing this, that is one of the customers of one of our resellers, we won't do anything, talk to the reseller."
Of course, the reseller says "Screw you, they are paying us good money and you aren't."
Softlayer is a VERY good example of this: a Softlayer hosted site has repeatedly been spamming the Wine Developers mailing list for their crap. I have personally emailed Softlayer about it on more than 10 separate occasions, and have heard ZERO back from them. They don't care (even though their site claims they are aggressively anti-spam - BULLSHIT! words are cheap, actions are not, and Softlayer HASN'T ACTED!)
The spam problem isn't complicated to solve, it is actually pretty simple to solve (though not EASY to solve!) - just follow the "shit flows downstream" principle. If a host is doing bad things, look up who owns the network they are on, and MAKE IT THAT ENTITIE'S PROBLEM to solve it. However the problem is solved - be it "Hey, your server's infected" "OOPS fixed now sorry!", be it "We have blocked outgoing connections from your system until you fix it.", be it "Boss axed me an' Nunzio to has a talk wit ju about youses' server...." - doesn't matter as long as the problem gets solved. If it DOESN'T get solved, then the network owner becomes the problem entity, and you move to their hosts.
The only hard part is bringing some form of negative consequences to bear upon the network owners - you either need a law (and then you have a hard time dealing with systems outside your law's reach - all you can do is place the problem on the point of demarcation to your jurisdiction), or you need something with a wider reach, like publicity.
(and to all you morons about to copy and paste the "spam solutions form" - that meme is old enough to drink and vote, let it die already, OK?)
www.eFax.com are spammers
We all demand huge bandwidth, huge amounts of storage and we want it for 19.95 a month.
Do you wonder why everything is over sold? I mean, really do you?
How much does a really sharp *nix admin.engineer cost annually?
Even with really good tools how many physical boxes can on guy keep watch over? How about when each box is hosting 300 accounts, or running 10 VM's? What would anyone guesstimate? Maybe each box is only hosting 30 accounts? I mean the numbers start to add up.
Lets say just for sake of argument that a really good admin can handle the care and feeding of 100 servers. That guy costs you 60K a year benefits and all. You need three shifts because you run 24/7 so that is 180K right there. Lets say you have 10,000 servers do now we are taking 100 guys * 3 shifts so 300 admins * 60,000.00 per year. So payroll just for the admins is 18 million a year and we have not given anyone the weekend off, so that number is a bit low.
You have not yet paid for all the hardware or your bandwidth bill. So right now at 19.95 a month you need about 900,000 customers.
Uhmmm for some reason those numbers just don't pencil. So thats why ISP's have to oversell everything AND turn a blind eye to a lot of things.
Hey KID! Yeah you, get the fuck off my lawn!
The reason being that when I look at our firewall logs or when we happen to get a system compromised, the US is way underrepresented. The US accounts for a very large portion of the Internet still, and we are located in the US so you might expect to see most attacks from there. However the majority are RIPE or APNIC addresses. You can also see it in things like Conficker infections. If you look at the graph of what got hit how bad (http://www.confickerworkinggroup.org/wiki/uploads/ANY/conficker-all-2009-small.png) you see that RIPE and APNIC are again way overrepresented in relation to the whole.
Now I've not done a scientific study on this, I'll admit, but I do have a reasonable data set and it just doesn't match with what I've seen.
I remember when ISPs used to seriously police their users, because there was the potential for them (the ISP) to get kicked off the internet, and have that stick. Network admins listened to complaints from other admins, and if they concluded that a given ISP wasn't keeping house and letting too many net.abusers on, they were considered a rogue ISP and cut off. The rogue net couldn't just call up another network access provider and get reconnected, because their reputation preceded them. I'm not saying I'd want to go back to that (even if it were possible), but as a believer in personal responsibility, I miss those days.
http://alternatives.rzero.com/
Big and cheap providers are on the top 10 lists of spam and malware? Really? Wow, I am surprised... NOT.
Let's be sensible for a moment and ponder: Why are ISPs hosting a lot of pages a main source of malware? Because they are a main source of traffic and webpages. It's like saying that there are more people in jail in the US than in, say, Andorra. Thus the US are much, much more violent and generally people there must be kinda leaning towards crime, right?
And cheap service means that they can not waste resources on hunting down malware providers. Hell, they can't even dedicate manpower to shutting them down, as long as they're not held accountable for it. Simple calculation: Cost of hosting malware C&C servers? Umm... a bit of traffic, compared to the rest probably not even noticable. Cost of hunting&squishing it? Putting manpower behind it. Do the economy math...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why should corporations care? Two words "litigation exposure." A bot-net living in your network takes down an e-commerce site for day. They will see you in court. Good luck with that "don't blame me, blame my ISP" defense.
I think that kind of "not my problem" thinking is what is driving the current cloud computing craze. Corporations seem to think that they can side step the accountability hassle if they outsource IT to the cloud. Good luck with that too.
Look, no matter how much we want ISPs to stop malware, botnets, etc. when they start doing that, they are going to start becoming more evil (as in giving out IP addresses and subscriber names, etc). Content-agnostic ISPs are -always- going to be better for the internet. Unless, you want throttling and your ISP to check for "pirated" content.
Taxation is legalized theft, no more, no less.
We've been doing something like this at SiteTruth for two years. We have the list of major domains being exploited by active phishing scams. This is simply a list of domains that are both in PhishTank (about 100,000 entries) and Open Directory (about 1.5 million entries). Today, 84 domains are in both. There's been a surge; it was 54 two days ago.
Domains are on this list for one of several reasons.
While this is to some extent a "blame the victim" approach, it's more effective than "phishing education" aimed at end users. Hundreds of webmasters have to be educated, not hundreds of millions of end users.
i recommend peer guardian for some huge lists of malicious IP's
Why should corporations care? Two words "litigation exposure." A bot-net living in your network takes down an e-commerce site for day. They will see you in court. Good luck with that "don't blame me, blame my ISP" defense. I think that kind of "not my problem" thinking is what is driving the current cloud computing craze. Corporations seem to think that they can side step the accountability hassle if they outsource IT to the cloud . Good luck with that too.
College-Pages.com - Online Colleges, Degrees, and Programs