Feeds

ISPs turn blind eye to million-machine malware monster

Cablevision and Comcast coddling criminals?

  • alert
  • submit to reddit

Website security in corporate America

Several weeks ago, security researcher Lawrence Baldwin dispatched an urgent email to abuse handlers at OptimumOnline, the broadband provider owned by Cablevision, warning that one of its customers stood to lose more than $60,000 to cyber crooks.

"He's got a keylogger on his system . . . below is a log of the miscreant viewing the info that was logged from his system while accessing his [Bank of America] accounts," Baldwin's email read. "Looks like he's got nearly $60K in there, so a lot at stake. Can you get someone to phone me that might be able to establish contact with this customer?"

The email, which was addressed to a specific handler's email address and was also copied to OptimumOnline's abuse desk, went on to provide the user's IP address and enough specifics to suggest Baldwin's claim of a keylogger was probably accurate. Yet, more than three weeks later, Baldwin still hasn't heard back from the company.

"Normally, I don't bother because I think this is going to be a complete waste of time," says Baldwin, who is chief forensics officer for myNetWatchman.com. "The abuse and security department at an ISP is the bastard step-child component of a service provider. In some sense, they're doomed to failure by design."

Absentee Landlords

Talk to anyone who makes a living sniffing out online fraud, and you'll hear the same story over and over. Researcher uncovers the source of a massive amount of spam, identifies an IP address that is part of a botnet or stumbles upon a phishing site that's spoofing a trusted online brand. Researcher dutifully reports the incident to the internet service provider whose network is being used, only to find the bad behavior continues unabated for days, weeks and even months.

A lack of engagement from ISPs is nothing new, but it has continued even as the malware scourge makes steady gains.

No one really knows exactly how many infected PCs are out there, but just about everyone agrees the number is high and growing. Accepting even conservative estimates that 10 percent of machines are part of a botnet means that tens of millions of systems are actively sending spam, launching denial-of-service attacks, and spewing all sorts of other malicious traffic across networks owned by the world's biggest ISPs.

According to figures from researcher Peter Gutmann, the Storm Worm alone is believed to comprise from 1m to 10m CPUs, creating one of the world's most powerful computers.

"This may be the first time that a top 10 supercomputer has been controlled not by a government or mega-corporation but by criminals," Gutmann says.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.