Slashdot Mirror
FCC Chair Calls On ISPs To Adopt New Security Measures
alphadogg writes "U.S. Internet service providers should take new steps to protect subscribers against cyber attacks, including notifying customers when their computers are compromised, the chairman of the FCC said Wednesday. Julius Genachowski called on ISPs to notify subscribers whose computers are infected with malware and tied to a botnet and to develop a code of conduct to combat botnets. Genachowski also called on ISPs to adopt secure routing standards to protect against Internet Protocol hijacking and to implement DNSSEC, a suite of security tools for the Internet's Domain Name System."
Hey, its about time. Maybe this will start helping to cut down on spam as well. As long as the ISPs do what they are supposed to do.
Will torrent clients be classified as malware as well?
a popup in Iceweasel saying "Attention! Your computer is compromised!" then some spiel about IE9 and no antivirus...
oh, wait, now where have I seen this before? (link for information only! Do the clicky on "free scan" links at your own risk!)
Operation Guillotine is in effect.
Of course, ISPs' employees have nothing better to do than to notify ~90% of their customers their computers have malware. It boggles my mind the ideas that people come up with (sopa/pipa/acta, logging all connections, etc.) and try to implement about monitoring the Internet with little or no thought to the logistics or funding of their stupid ideas.....
unless they put some of their crappy bloated software on your computer? ISPs ought to be just that. An internet service provider. Give me an internet connection from point A to point B. PERIOD.
I don't need your stinking protection, I've been doing just fine since 1993.
Now excuse me while this strange web site forces my browser to full screen and scans my Linux Box for viruses...
"I bow to no man" - Riddick
Unless you do something along with the notification to make a customer actually ACT to clean up their system, they won't. As soon as you start taking customers offline when you confirm their compromised, they'll jump ISPs. It's a no win situation.
Back in the late '90s that's how we worked at ISPs. If we notices weird traffic on an account or were getting spam complaints, we'd call up the customer. If we couldn't get a hold of them we would disable the account until they called. Some kid pumping out Make Money Fast emails, we'd call mom and have a chat.
Then all the local ISPs got bought up by telco and cable companies. The price didn't go down, just the service.
I'm glad I'm still on one of the last local Mom&Pop ISPs in the area, when I call support I get a guy that actually has enable to the routers. It costs about $15/month more but I'm willing to pay for the service I get.
-- I have a private email server in my basement.
I expected something so silly spewed from a technology ignorant, grandpa Senator. But the chairman of the FCC?!
Stuff like this makes me wonder if democracy works.
Given that most knowledgeable people seem to think it's a bad idea... I have to wonder why government keeps coming up with schemes that essentially require monitoring by the ISP.
I mean, when you consider that as a practical matter, an ISP is (or at least should be) just a common carrier, like a telephone company. In fact the FCC originally -- and even very recently -- wanted to classify ISPs as common carriers. Which would preclude any monitoring. So what's up with all these monitoring ideas?
Are they maybe just trying to get some kind of monitoring in place, so that they can expand it later?
There seem to be a lot of negative comments about this, and perhaps some with subtle good reason. But I really like the idea, if it's implemented as opt-in, and boils down to "if any existing software run by the ISP believes that my computer is running known malware based on known traffic patterns, send mail to either or both of the email address and physicial address I registered during the opt-in process". To me this sounds analagous to the security breach notification laws corporations are subject to in some jurisdictions, and I believe those are generally a good thing as well. Without them, you get the status quo, which is things like Nortel knowing they were compromised for years, and just not caring. I actually think this is likely the status quo at all major organizations. I mean really, do you think if microsoft/google/etc found out that major fractions of their internal infrastructures had been owned by foreign government X for the last 5 years, that without laws they would ever _do anything about it_ if the attackers were friendly enough to just be sucking data about their engineering and customers, and not actually impacting the day to day monetary business? I'm pretty sure what would happen in such a case would be some management screaming at some overworked internal security folks. And then the internal security folks would either brush the problem under the rug, or get fired when they explained exactly how many resources it would take to remotely adequetely stop the espionage threat from government X. Bottom line- forcing by law companies to notify their customers when existing software discovers exploits seems like a really good idea to me. Yes, there will be some resulting pressure to just turn off their internal checks, but honestly, that doesn't bother me at all if when those internal checks were finding things, they weren't going to bother telling the customers anyway. In fact, my optimistic hope, which I think is quite reasonable, is that when the actual scope of these things is forced into the public view, that the horrendous security practices responsible, will actually get remedied in the right ways. I truly don't get why there is so much resistence here to this idea- fundamentally (as I described above, i.e. not mandating new software be run, but just that if existing software already running thinks a customer is owned by hackers, that they take the trouble of notifying the customer.
I would my telephone company to detect telemarketers and take steps to prevent them from calling again.
If they begin interacting and/or controlling users connections in some way such as possibly suggested, would these actions remove the provider (LEC/CLEC) from common carrier status?
Universal Theorem: a zombie can't be killed twice.
Sounds like just another law coming around that will have tons of back doors in it, allowing them to say that pretty much anything is bad.
This needs to be shot down before it can take its first breath.
Having worked for multiple ISPs I can absolutely guarantee this will not happen.
1. Most importantly: Figuring out who is infected is a huge amount of work. We'd need to scope out millions of dollars in project work to design a system to detect who has a problem, processes for creating tickets for people to notify them, hire people to do all of this work, then maintain this entire elaborate system every time we make a change to our network, our repair structure, etc... Even if the government funded a system, every ISP's internal structure is totally different. It would never work for more than 1. They'd have to fund every ISPs program individually, and the ISPs would suck up that funding like vampires and have little to show for it in the end.
2. To notify the customer automatically you'd need to either A: send them an email, which about 98% of your customers don't use the email address you gave them or B: Redirect them via your DNS server to a warning page. But if they aren't using your DNS that's not going to work, and the people writing the malware/bots will figure that out and either block your warning page, or more simply change the customers DNS server to googles or something and your entire system is useless.
3. When we do notify these people what is the very first thing they are going to do? Call the ISP. What is a virus? How did they get it? When are we going to fix it for them? Well they got it on our internet, they never had viruses when they had dialup... It's an hour long call at least. That just cost the ISP $20 and the customer is going to hang up and do nothing.
4. It's of absolutely no benefit to the ISP to do anything like this. So what if the customers are infected? They have the internet, malware doesn't hurt the ISPs network unless the ISP itself is the target witch is rarely the case. Even if one of the ISPs customers is the target they just adjust a few routers and the problem goes away. The customer is blissfully unaware of their problem and paying their bill. You don't mess with that. And yes, customers really are stupid enough to think the malware they have had for years and didn't know about, but were suddenly notified of when they signed up for your service, came from you.
5. Almost every ISP in the united states sells some sort of malware/antivirus package now. You're asking them to subvert their own product. Good luck getting that past product development.
And lastly, I want to re-iterate... the customer will DO NOTHING. They already know they have malware. Their computer runs like shit. They have habits that lead to them having malware. They bought their computer 10 years ago, their way of "fixing" it is using the Dell system restore disk that game with it that reverts it to the original unpatched version of XP. Then they install the pirated versions of autocad and photoshop they got from their brother-in-law 6 years ago, they sure are glad they kept all those CDs he burned... Then they go to bed, their teenage son gets up and surfs porn with IE6 from that fresh XP install, for a couple of hours. He erases the history... his tracks are covered.
Although it seems like a great idea for ISPs to try and help customers in reality they won't do it. FBI recently tried to send notifications out to ISPs to notify their customers but their data was screwed up and 100% worthless.
ISP: (Calling john smith)..
JS: Hello
ISP: Hello, I'm from x and your computer is infected with y.
JS: No I will not install your malware you must be trying to scam me.
JS: I have no idea what you just said...don't call back.
JS: You allowed my computer to be infected?!?
JS: I have to pay you to fix it for me?!? WTF!
JS: How do you know? Are you spying on me???
JS: My computer works fine, leave me alone.
The FCC is currently mismanaging radio spectrum sales and partitioning. That is their primary function. Do that and once you're doing your ACTUAL job then worry about the internet which you in fact have no authority over.
The FCC seems to be trying to fail up. TV viewership is dying so they're trying to expand themselves into the internet. I get it. But first maybe they should sell off that radio spectrum and do their actual jobs.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
I got a robocall from Comcast a few months back advising me of an infected machine connected to my network. Sure enough, my parents' computer had a bunch of trojans on it that would probably have stuck around for a couple more weeks had they not called me.
It's not a (only) a question of whether or not this would be able to be pulled off in a way that wasn't intrusive or engaging in censorship. It's also a question of: Is this really how we want the limited funds to be spent? Do we, the customers, want our ISP's to be checking for malware, rather than say, increasing our connection speeds? Or say, lowering the price? Some may say yes, while many will say no. Personally, I think I'd rather just see an opt-in option where ISP's offer this kind of service at an additional charge (might be unpopular, of course, unless say, the ISP ALSO bundles it in with antivirus software, which they may perhaps be able to acquire at a discount from the original companies in exchange for the bulk purchase and the better market position it would give them out of the partnership).
This may not be what everyone wants, and I understand that too. Botnets are a real problem, and at some point, hopefully we'll come up with a real working solution to them. This MAY be the best thing we have at this time. I hope not, and I don't particularly think it is, but I can't really claim to be an expert enough on the matter to have any final word.
Anyway, just a little food for thought.
ISPs should also take steps to protect customer privacy, especially against the media/copyright industry and the government.
Police asks for info about customer? Notify customer and challenge the police in court.
Copyright trolls want content taken down? Fight them in court.
Of course that won't happen since Internet Service is a cartel (a few big corporations own the lines).
What secure routing standards ? There are only secure routing practises, there are a few standards in development, starting with "Resource Public Key Infrastructure (RPKI)" but that is still very new and isn't yet broadly available by vendors.
New things are always on the horizon
404 Not Found
I wonder if Genachowski owns stock in Kindsight?
Theres also other security measures which could increase security in their "email" deparment. smtp and pop for example. most isp's today do nothing in that part. anyone can send emails to anyone without any limits...basically they suck there. Nothing is encrypted, authenticated and if it is its not enough for security.
further more, lots of protocol needs a big boost in security as most of them today lack lots of security features which could increase productivity, stability and security. I'm amazed that in 2012 we still have spam, bots, zombie machines today since those same ISP's makes millions.
No maintenance and a subsidized price. Why pay more for an unlocked computer? /s