Slashdot Mirror
Australia Wants ISPs To Protect Customers From Viruses (sophos.com)
An anonymous reader quotes Sopho's Naked Security blog:
In a column in The West Australian, Dan Tehan, Australia's cybersecurity minister, wrote: "Just as we trust banks to hold our money, just as we trust doctors with our health, in a digital age we need to be able to trust telecommunications companies to protect our information from threats." A companion news article in the same newspaper cited Tehan as arguing that "the onus is on telecommunications companies to develop products to stop their customers being infected with viruses"...
Tehan's government roles include assisting the prime minister on cybersecurity, so folks throughout Australia perked up when he said all this. However, it's not clear if there's an actual plan behind Tehan's observations -- or if there is, whether it will be backed by legal mandates... Back home in Australia, some early reactions to the possibility of any new government interference weren't kind. In iTWire, Sam Varghese said, "Dan Tehan has just provided the country with adequate reasons as to why he should not be allowed anywhere near any post that has anything to do with online security."
The West Australian also reports Australia's prime minister met telecommunications companies this week, "where he delivered the message the Government expected them to do more to shut dodgy sites and scams," saying the government will review current legislation to "remove any roadblocks that may be preventing the private sector and government from delivering such services."
Tehan's government roles include assisting the prime minister on cybersecurity, so folks throughout Australia perked up when he said all this. However, it's not clear if there's an actual plan behind Tehan's observations -- or if there is, whether it will be backed by legal mandates... Back home in Australia, some early reactions to the possibility of any new government interference weren't kind. In iTWire, Sam Varghese said, "Dan Tehan has just provided the country with adequate reasons as to why he should not be allowed anywhere near any post that has anything to do with online security."
The West Australian also reports Australia's prime minister met telecommunications companies this week, "where he delivered the message the Government expected them to do more to shut dodgy sites and scams," saying the government will review current legislation to "remove any roadblocks that may be preventing the private sector and government from delivering such services."
Ha! Good luck with that!
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
Actually a friend of mine got their internet shut off this week because of an apparent infection. According to their ISP, they have a botnet active. They inquired what's a botnet and how to get rid of it. ISP said it was their problem to fix. My friend then replied they have unlimited data so who cares. After that call, I got a call to fix. Thanx ISP!
In a world where ISPs filter viruses for you, every user EXPECTS the ISP to do the protecting, and takes no precautions themselves. This leads to lazy netizens who cry foul at ever little thing. Instead, I say protect yourself. Run a firewall. Don't open ports unless you KNOW WHAT THE HELL YOU'RE DOING!
It's akin to asking doctors to protect you from STDs. Technically they can. Practically you wouldn't want that. A doctor in your bedroom. Overseeing every intercourse you have.
I don't 'trust' my bank to hold my money. I audit my accounts with them every month to be sure they don't make a 'mistake'.
I don't 'trust' doctors; I do my own research, especially when they tell me something that I don't think is in my best interests, or that just plain doesn't make sense.
I don't 'trust' my government, I question what it's doing all the time, and will speak up if I see something unjust, or just plain dumb, being dumb -- because *I* am not dumb.
I sure as hell don't trust my ISP, or any ISP for that matter, to 'keep me and my computer safe'. ISPs invade our privacy constantly in the name of higher profits for themselves, and because the government wants to collect data on it's citizenry and generally snoop into people's lives.
It is not, and should not, be the business of ISPs to do this thing. Their role should be to provide connectivity to the Internet for it's customers, and that is ALL they should be in business to do, not to 'censor' anything, 'filter' anything, or anything like that. Just give us a reliable connection and leave it at that!
if every file had to be scanned for viruses prior to being downloaded/uploaded, that sort of system would make a 56k dialup look fast
Politics is Treachery, Religion is Brainwashing
Nobody wants (tech) savvy citizens: They might question the course of events.
to build better and more secure operating systems? thats where the problem really is, if the operating systems and their applications used to access the internet were secure then the problem would be solved, asking the ISPs to do this would slow the internet speeds down to a really slow crawl
Politics is Treachery, Religion is Brainwashing
Whether this is supposed to refer to the landmass (unlikely) or the political entity, one particular subset of the idiot-fucks that presume it's their business to force their opinions and values onto millions of other people does not constitute 'Australia'. And why would anyone care about what these notoriously technologically inept parasites opine about this subject?
Some ISPs already provide anti-viruses to the customer for an extra fee, like mine does. The only catch it is only windows compatible. I got the feature removed since they were charging me for something I couldn't use.
As for detecting viruses in an encrypted transport layer, at the ISP, then good luck with that.
Jumpstart the tartan drive.
...Australia's government shows that they don't really get this whole "technology" thing...
Not only is this an impossible guarantee or a means to charge customers more money for (Godfather voice) "protection," but it just provides a red herring to monitor more than just metadata.
This is probably the single biggest change that an ISP could make to help people increase their commitment to effective security.
On the other hand, there is an enormous amount of effective action that could be taken by the Australian government. It includes:
My first internet connection started in Japan in 1994. 100 Mbs fiber since 2000 and never had a virus, never had a data cap, never paid more than about US$ 60/month (now US$ 35/mo.), never had a browser hijack, never had malware, never had to reset a modem, never had less than 3 companies to choose from and only had service go out once and that was because of a massive earthquake 6 years ago.
Came back to the US and I'm loaded up with hijacks and malware every time I turn on my PC. Have to reset the modem every week or so, service is spotty. Slow and expensive.
It doesn't have to be that way.
Every file, image, video clip gets a checksum to help find virus like activity and block it at the ISP level.
If a file shows up many months later in some investigation, most ISP accounts that downloaded the same file can be listed.
Time to get a good VPN.
Domestic spying is now "Benign Information Gathering"
Dan Tehan is one of many Australian government ministers who has no clue about technology. http://bit.ly/2pMtFlG
Look, I'm all for sticking it to clueless politicians, and the original column doesn't commit to any policy of substance, but nevertheless I think the "companion news article" is interpreting it... very creatively.
The original column:
https://www.pressreader.com/au... (pressreader is paywalled but allows a certain number of free uses per time period)
I'm annoyed with the current climate of politicians just ignoring the facts and choosing to believe whatever they want, and I'm annoyed by the proliferation of clickbaity sponsored link sidebars in the genre of the fake-espn-fake-death-announcement stuff, but I'm also annoyed by how the news business doesn't seem to be able to hire writers who understand technology and can help the audience understand, rather than just making hay by subtly misleading people about it (often just due to not understanding it themselves).
In a world where ISPs filter viruses for you,
NO! The article makes it clear: He said the plan did not amount to web filtering . and he claimed previous efforts to do so had been “ill-advised”.
While ISPs cannot filter your downloads, there is plenty that can and should be done at the network level, such as detecting outgoing spam and DOS attacks from infected users.
it's not clear if there's an actual plan behind Tehan's observations
In other words, there is no news?
While surely not all, a good number of ISPs already provide anti-virus and anti-malware detection. If you use an ISP for email, chances are pretty high that the back end is running anti-spam rules which looks for attachments and strips where a "bad" MD5 sum is found. "bad" meaning it matches malware/virused attachments. They don't need to read the contents, just look for the checksum.
As a privacy advocate I'm not too uncomfortable with ISPs scanning like this, as anything I would be worried about would be through a channel other than email which they could not scan.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Certainly there are privacy issues to be discussed, and there are many questions that can be asked about what exactly should be done and how it should be done. The concept does work quite well. Especially related to botnets.
This is standard procedure in the enterprise. Its 2017, not 1997, and we're far beyond "update your AV and pretend your safe". In enterprises that care at all about security, professionals, preferably security professionals in the SOC, but at least network professionals, use professional tools such as Cisco ASAs with Firepower to monitor incoming and outgoing traffic in a much more sophisticated and effective way than even a technical user would monitor their own workstation, much less some random clerk or manager. Where I work, the SOC is staffed 24/7 by career security professionals using $100,000+ toolsets. "Every user can update their AV", and "remind people not to open Office documents with macros" doesn't quite compete.
Certainly an ISP could monitor and null route or otherwise filter current verified malware sources and that sort of thing. They could easily prevent the spread of many botnet malware strains by not allowing the attacks to come out of their network, or through it.
So yeah it' much more than a "power grab". It's a solid idea that needs to be balanced against privacy concerns in how it is implemented.
"where he delivered the message the Government expected them to do more to shut dodgy sites and scams,"
(A month goes by)
"I didn't mean shut off access to government sites! >:-( "
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
It's Australia - google "Australia" and "metadata" and you'll see that privacy of citizens is not something that the current Government cares about. One department even decided to "doxx" a critic in the newspapers with confidential information that could have resulted in a jail term for a leaker if it had been released by anyone that doesn't own a police force.
I'm not suggesting you have a bad point, merely that priorities are different and the best sort of outcome is unlikely.
Isn't it funny when the "right" of politics decides to go all nanny state. They want to violate privacy for "our own good" despite calling themselves "conservative".
It sounds like a terrible idea. In work environments, there's a legitimate reason to limit people's access to the internet, i.e. customer data can be at risk (or in the case of where I work, patient data.) But in a home setting, it's just straight up annoying to have your ISP start blocking shit that you may not want to be blocked.
My ISP blocks incoming email and web ports because it's presumed that everyday customers running any servers on those ports are participating in a spam botnet. So that means I can't host my own small webserver for example.
And if we did what you suggest, it would be a whole lot worse. For example, most security vendors consider bitcoin software to be risky and will block it. Hell, some even consider really benign software like tftpd32 to be too risky to allow end users to run (I just got an email a few days ago from our infosec guy asking why I was running it on my PC, and I had to explain to him that I use it to upload IOS images to our switches.)
But if I need to use this stuff at home, and my ISP blocks it, what then? I have to buy a business class account?
> And if we did what you suggest, it would be a whole lot worse.
I'm not sure what you think I'm suggesting. What I said is in some ways the opposite of what you seem to think I said.
I said the ISP is in a position in monitor the network as a whole and respond to emerging threats, such as botnets currently active on the network or scanning the network. I said the ISP can reasonably have people in the SOC actually responding in real-time as exploits are released and threats become real. That's pretty much the opposite of "block port 80 for everybody". In fact, port-based blocking is what you get with consumer routers, with each customer doing there own. That's quite 1990s. Modern security is more about analyzing trends in flows.
To address your example, sure some vendors will point out a open tftp as a potential exposure- open tftp is also how the bad guys can get the config off those switches and routers. Which is why you "just got an email a few days ago from our infosec guys." There was something that looked like it might be a risk, so he checked it out. Good job InfoSec guy. Findings can generally be categorized into four groups:
1) Appears normal / safe
2) Potential vulnerability (open telnet, tftp)
3) Probably an attack (nigerian prince w/ Word document)
4) Known attack
The other axis is the damage scale, but let's stick with this axis for now. It would be reasonable, I think, to notify you of vulnerabilities (hey, you have telnet open), block known attacks (somebody trying hundreds of passwords against the telnet) and apply some more sophisticated analysis to group 3, probable attacks. Are they coming from known-bad IP addresses? What's the scale? What level of damage is likely?
One of the reasons it works well in the enterprise is that it's easy to get something whitelisted - I get an email that says , "I need this, but it's blocked" and I unblock it (after checks). Is an ISP going to be as responsive? Would Aussies be able to download SysInternals, or find that PSexec is blacklisted?
What about false positives? Or tools like Metasploit?