NTL builds bigger worm trap
Port blocking plan
Posted in Malware, 11th June 2004 16:36 GMT
Free whitepaper – Transforming IT culture
Cable telco NTL is blocking more Internet ports to stop worms from spreading across its network. Last month it blocked port 135. Now it is blocking (inbound only): 137 (UDP), 138 (UDP), 139 (TCP), 445 (UDP & TCP), 593 (TCP), 1433 (TCP), 1434 (UDP) and 27374 (TCP).
"This 'port-blocking' should have little or no effect on your use of the Internet but it will significantly reduce the vulnerability to infection from variants of the Welchia and MSBlast worms," NTL explains in a notice to subscribers. Welchia and MSBlast are also known as Nachi and Blaster, respectively. NTL hopes to shepherd users with virus infection to special websites to help them clean their computer.
A recent study by network traffic management firm Sandvine estimats that computer worms such as Blaster will cost UK ISPs €22.4m this year. Although worms are usually associated with attacks on corporate networks, the malicious traffic also ties up service provider networks, degrading the broadband experience for home Internet users. Meanwhile, outbreaks of computer worms generate a huge upsurge in support calls to ISPs.
NTL's measures are a rational response, but the move will create problems for some home users who need to use Windows File and Print Sharing over the Internet or run applications like Exchange at home. This minor inconvenience is considered by NTL to be a price worth paying in the fight against worms. ®
Related stories
Windows worms tax ISPs
Zombie PCs spew out 80% of spam
NTL email suffers 'complex failure'
The Register Webcast - Desktop Support : The Hub of IT
The Register Guide to managing spam
The Register Green Computing Report
Secure Mobile Working
Risk and Resilience
