Slashdot Mirror
The Internet's Bad Neighborhoods
An anonymous reader writes "Of the 42,000 Internet Service Providers (ISPs) surveyed, just 20 were found to be responsible for nearly half of all the spamming IP addresses — and some ISPs have more than 60% of compromised hosts, mostly in Asia. Phishing Bad Neighborhoods, on the other hand, are mostly in the U.S. Also, there is a silent ticking 'spam' bomb in BRIC countries: if India would have the same Internet penetration rate as the United States while keeping its current ratio of malicious IP addresses, we would observe 200% more spamming IP addresses worldwide. These are just few of the striking results of an extensive study from the University of Twente, in The Netherlands, which scrutinizes the Internet Bad Neighborhoods to develop next-generation algorithms and solutions to better secure networks."
Anybody who's worked at a datacenter has known this for years and years. And comparing them to bad neighbors is correct... if we didn't consider scope and the medium. It's a lot harder to police something that's not in physical form and is transitional, and A LOT harder when it's in a country you don't have jurisdiction over. Sure you could block these ISPs and in a lot of cases it makes sense, if your website is national, then it can save a lot of pain, but it's not the end all solution to spam.
Hey little girl...yeah, you...come on over here...want a favorable meta-moderation? /trenchcoat
http://www.nirsoft.net/countryip/
Done!
Doesn't sound like anything that a few drone strikes couldn't handle.
Other than the fact that something this obvious provided fodder for someone's PhD dissertation...
In summary the entire 245-page paper is an elaborate way of saying that blanket /24 IP range bans are an effective way of stopping spam. Oh, and that more people having computers connected to the internet in said "bad neighborhoods" will increase the amount of spam. Ladies and gentlemen, a new way to exclude developing nations from the Internet and look heroic while doing so.
As seen at the abuse workgroup of RIPE (and I have not seen a sane discussion):
>> This is the draft agenda for the RIPE 66 meeting...
> No agenda item about defining (or refining the definition of) "abuse"?
Nope.
> I'd like to just reiterate my view that all other activities of this WG
> will be utterly fruitless until such time as a reasonable, rational, and
> generally accepted definition of "abuse" is in hand.
I genuinely don't think it will be useful to spend time on this.../snip
nosig today
Isn't this supposed to be /.?
Missed headline opportunity
Those aren't the phishers you're really worried about. There seem to be about ten "usual suspects" we keep seeing on our phishing reports. The low-end ones are trolling for Habbo Hotel accounts. A few notches up are phony logins for bank accounts (PayPal and HSBC are popular targets. New this week: Swedish tax refunds. And, for some reason, several new phish sites for AOL 9.0 accounts.) We track these, but they're more of a nuisance than a real threat.
The ones to worry about are better targeted and are of better quality. Those are aimed at corporate login info. Those won't be seen by broad-based phishing detection services because they're only sent to people who might have those logins. So they tend not to be blacklisted.
Brazil: 196,655,014 people (World Bank)
Russia: 141,930,000 people
India: 1,241,491,960 people
China: 1,344,130,000 people
that's 2,924,206,974 people total.
world population: 6,973,738,433 people, so BRIC countries are 41% of the total in population.
FTFA:
Of the 42,000 Internet Service Providers (ISPs) surveyed, just 20 were found to be responsible for nearly half of all the internet addresses that send spam.
so I take it "nearly half" is between 40% and 50%, but less than 50%. If it's over 41%, then what we are looking here is some form of distribution of 'nuisance' that is related to the actual population and it probably shows normal distribution.
Is this really a surprise?
You can't handle the truth.
the "article" was very uninformative.
but lately on an opensource project blog lots of spam comes from "ovh dedicated servers" subnets. while it probably indicates doing well, it is not appreciated... blocked off a few subnets from them.
Rich
How is Al-Jazeera a bad neighbourhood? I found them to be a useful source during the Egyptian revolution, it is a western-style news channel from Arabia. Just because they have been sent tapes from terrorists does not mean that they support them, just as the guardian getting leaks from wikileaks does not mean that they support wikileaks.
Running your own gateway that does actual logging is an eye-opening experience. There are a phenomenal number of jerks out there...
Schwab
Editor, A1-AAA AmeriCaptions
Clearly the only solution is to only let the world's biggest telecoms provide Internet to people.
I would gladly take an Internet with some "bad neighborhoods" over a completely safe Internet provided by entirely by AT&T/Comcast and a handful of megacorps who are also involved in creating content.
The Internet/Media/Industrial Complex loves to tell us scary stories about how dangerous an "open" Internet can be. Apparently, the Internet, like the "free market" is only good if they can control it.
Just sell us some bandwidth and I'll look out for my own safety, thanks very much.
You are welcome on my lawn.
And yet, the article neglects to tell us the names of those 20 ISPs.
It makes you wonder what they're really trying to accomplish with this "study". If they cared about people being safe in the Internet, they could start by telling us exactly where the "bad neighborhoods" are.
You are welcome on my lawn.
But... But... Terrorist Children!
Michael J. Ryan - tracker1.info
Yup OVH is close to #1 spam source here. Good luck reaching their abuse desk. Another nasty one is Dimenoc. Spamcop seems to become more and more pointless as more and more abuse@ addresses bounce. Furthermore, in my experience, more and more ISPs start using their own forms for reporting... Handling abuse costs time, time = money; it's a whining geek versus a paying customer. And as long as they can get away with it, they prefer the latter (and hence make it very hard for the former to contact them).
Perl Programmer for hire
They're right in that the SPAM comes from servers in those countries, but they are most probably not the original source. I would not be surprised if the only thing they are guilty of is insecure and badly maintained servers that someone found and is utilizing for sending SPAM, and to find the real culprit you'd have to analyse the log-files of every server.
Spam is how these people make money. By blocking spam, you're denying them their revenue.
ended up blocking anyone in China from accessing sites on my server. After seeing a lot of attacks from Seychelles (SC), blocked that country as well. A lot less spam and attacks.
There are two reasons why we are seeing this in the news.
First, it's because China is currently a main economic "enemy" to a lot of western economies when it comes to "jobs" and "quality". These are mainly economy based attacks where trade secrets are the main target. Some are politically based, some are military intel based, but the majority is about economic advantage.
The second reason is that China is hardly trying to disguise that it's a large, government organized and funded group of hackers that is doing this. If Japan, Korea, Russia and China would each be getting large amounts of spear fishing hacking attempts that all originate from the IP addresses of the Pentagon, it would be all over the news as well. The USA is probably doing just the same, either government or private company sponsored. The big difference is that it's not possible to link it without reasonable doubt to a single government controlled source, if any correlations can be made at all.
I was promised a flying car. Where is my flying car?
I want their IP ranges so only my firewalls will ever see them again.
Simple fix: If the list of ISPs really is that short, just block their prefixes in the core infrastructure and announce this. This way the genuine customers would flee and the ISPs would wise up and kick the spammers. Once unblocked the genuine customers would return (or stop fleeing).
If we're talking about zombie armies doing direct-to-MX spamming, just block that port 25 outbound dammit! - It's a painfully simple fix for any ISP-sysadm. If a zombie cannot spam it's a lot less interesting. If it's located in a BRIC country, chances are there's no money to steal from an online bank, so its only remaining use is as a DDoS participant.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
Often spam is sent from legitimate websites via a malicious script, which is planted there by hackers for spammers.
Humans in general and spammers in particular are very inventive. Automated filters alone are no match for spammers.
The same way, as any attempt to guard prisoners without human guards turned out to be a failure. Prisoners lure dogs, map mines, penetrate electric schemes of perimeter fences, etc.
It makes sense for website owners to participate with a human effort in paroling of the Internet. For example, reporting disguised spam messages to the Spam Black-hole: http://blackhole.mx/ or other reporting services.
By reducing financial attractiveness of spam, they would guard an integrity of their websites, and prevent turning the Internet from an effective global network into the garbage dump.
I want a bad ISP so they won't kick back my email saying it's spam when it's just a letter to my dad. FUCK CHARTER COMMUNICATIONS!!!
Yep. Permit me a tangent... /ranton
"Terrorists!" = let us (the US gov't) wire tap you, monitor your banking activity, and make it so free speech, protection against illegal search and seizure, and right to counsel (or to even know what charges are being brought against you) are no longer protected by law. Now "Chinese hackerz!" will = give us (the US gov't) free reign to monitor all Internet traffic and IPs without warrant and build tactical hacker teams in the NSA who's scope outreaches self defense (i.e., give us the right to hack - or turn off - citizens).
More fear = more liberty taken. And because we're scared, we'll give it away.
Gov't says, "Go about you're business, we'll take care of this big scary thing for you - just grant us the ability to do whatever we need to do to get the job done."
We say, "Please protect us fro that big scary thing. Yes, do whatever you need to do."
3 months later.... "Hey, um....why did I get 'visited' by people in dark suits and sunglasses grilling me about my banking history and things I've said in social media?"
Our governments have done more to scare us than terrorists ever have. /rantoff
I am *so* tired of China! China! China!
I work for a federal contracttor at a US gov't non-military agency. Yeah, we get our daily dose of Chinese trying to break in with ssh... but we get as many or more from:
- the Netherlands
- Brazil
and well below that, Italy, Turkey, Hungary, Kazakhstan, etc.
Do something about Brazil and the Netherlands, guys!
Facebook.
4chan.
AOL.com.
wikipedia.
wethepeople.
reddit.
thepiratebay.
al jazeera.
wikileaks.
anandtech.
tomshardware.
urbandictionary.
myfreecams.
engadget.
isohunt.
newegg.
slashdot
FTFY
Says "censorship", so you are saying that if spam is free expression after all, ./ ?
it is a western-style news channel from Arabia.
try the version not directed at westerners.