Slashdot Mirror
US Shows Interest In Zombie Quarantine Code
bennyboy64 writes "Barack Obama's cyber-security coordinator has shown interest in an e-security code of practice developed in Australia that aims to quarantine Internet users infected by malware, also known as zombie computers. He reportedly said it would be a useful role model for the US to adopt. One suggestion within the code is to put infected users into a 'walled garden,' which limits Internet access to prevent further security problems until quarantined. Another is to throttle the speed of an infected users' Internet connection until their computer fixed. The code is also being considered by other Asia-Pacific countries, ZDNet reports."
This is so NOT the story I was hoping it was going to be.
Like a baby Harp seal on the open ice, my dream has just been dashed.
I am an Australian on Exetel. I have had the quarantine kick in twice due to my house mates getting infected. Both times it was a spam relay, so it was presumably easy to detect the massive jump in port 25 traffic. Once you are quarantined all ports but 80 are blocked and port 80 only serves up a page telling you that you are quarantined, what you need to do to remove the quarantine (clean your system then click a link to tell the automated system to check your outgoing traffic), and links to ISP mirrors of malware removal tools. Both times it took about 15-30 minutes to clean the infections and get the quarantine removed.
I think schemes like this are best practice and the only way the Internet is going to be usable with the rise in online crime. Even if you have a secure local OS nothing stops users downloading trojans.
========
CINC, 4th Penguin Legion
I think you misunderstand. I have never had a compromised machine. Not once in the 25+ years I've owned machines.
What I am concerned about is what is required to support such actions. In order to support a law that requires machines get cut off the net perhaps only an IP address would need to be listed and issue to an ISP. What if that IP address was spoofed? What if something had changed? What if that IP address was hosted by a wireless network that was either compromised or on the network of someone trying to diagnose a problem before it was realized that it was infected? There are too many ways something could be mistaken in that regard. And what of the requirements for "proof"? Does the ISP receive more than the request or will complete forensic details be presented to the ISP? Will the user(s) ever see the complaint?
I do have some personal experience with how government actions can be made too easily and in error at the same time. I was once about to have my pay garnished for child support by the State of California while I was living in Texas. There was something wrong with that though... *I* had the children, not the mother! She filed false reports to welfare agencies. So based on those false reports, she collected money and my pay was to have my pay garnished? And what proof was offered? None! Just a letter ordering the State of Texas to do so. And while I insisted that I had the children with me, Texas wouldn't stop the action. I asked them to check the local school where I had them enrolled. They didn't want to bother. I ended up pulling them out of school with a copy of their enrolment and attendance records in hand and brought the children to the office in Texas personally as PROOF that I have the children with me and that the garnishment order was in error. In the end my pay was not garnished but it did require the loss of a day's pay to prevent it.
So in summary, this story shows that false reports/data/information can be part of a government order for some action and that report may have little or no proof supporting it. But the victim of such mistakes, the falsely accused, may have to go through ALL MANNER of trouble to prove they were innocent or otherwise not responsible.
Take for example that in my home, I run mostly Linux with occasional Mac OSX usage and an occasional Windows guest. If something were to happen resulting in my network getting limited in some way, what would be required of me to have it restored? Will the asshats at the government agency be required to inspect my home network and its inventory?! Will they understand that I run Linux or what to do with it?
I think you are not thinking this through. This is not fear of the unknown. I know quite personally how government can be when it comes to applying process and procedures for laws like these. I used the DMCA example because there is a fairly low cost of starting a claim under the DMCA and little if no evidence it required in making a claim. What's more, there are no punitive actions required in the event of a false claim. Meanwhile, the person who was claimed against suffers down time, emotional stress from dealing with the false claim and required to do a lot of work in order to restore things once removed. The burden is too often placed on the victim under laws like the DMCA.