ISPs turn blind eye to million-machine malware monster
Cablevision and Comcast coddling criminals?
Agentless Backup is Not a Myth
Several weeks ago, security researcher Lawrence Baldwin dispatched an urgent email to abuse handlers at OptimumOnline, the broadband provider owned by Cablevision, warning that one of its customers stood to lose more than $60,000 to cyber crooks.
"He's got a keylogger on his system . . . below is a log of the miscreant viewing the info that was logged from his system while accessing his [Bank of America] accounts," Baldwin's email read. "Looks like he's got nearly $60K in there, so a lot at stake. Can you get someone to phone me that might be able to establish contact with this customer?"
The email, which was addressed to a specific handler's email address and was also copied to OptimumOnline's abuse desk, went on to provide the user's IP address and enough specifics to suggest Baldwin's claim of a keylogger was probably accurate. Yet, more than three weeks later, Baldwin still hasn't heard back from the company.
"Normally, I don't bother because I think this is going to be a complete waste of time," says Baldwin, who is chief forensics officer for myNetWatchman.com. "The abuse and security department at an ISP is the bastard step-child component of a service provider. In some sense, they're doomed to failure by design."
Absentee Landlords
Talk to anyone who makes a living sniffing out online fraud, and you'll hear the same story over and over. Researcher uncovers the source of a massive amount of spam, identifies an IP address that is part of a botnet or stumbles upon a phishing site that's spoofing a trusted online brand. Researcher dutifully reports the incident to the internet service provider whose network is being used, only to find the bad behavior continues unabated for days, weeks and even months.
A lack of engagement from ISPs is nothing new, but it has continued even as the malware scourge makes steady gains.
No one really knows exactly how many infected PCs are out there, but just about everyone agrees the number is high and growing. Accepting even conservative estimates that 10 percent of machines are part of a botnet means that tens of millions of systems are actively sending spam, launching denial-of-service attacks, and spewing all sorts of other malicious traffic across networks owned by the world's biggest ISPs.
According to figures from researcher Peter Gutmann, the Storm Worm alone is believed to comprise from 1m to 10m CPUs, creating one of the world's most powerful computers.
"This may be the first time that a top 10 supercomputer has been controlled not by a government or mega-corporation but by criminals," Gutmann says.
COMMENTS
attack by mail
"There is not and there never will be a means of executing anything arriving inside a mail body, for very obvious reasons."
I once received an e-mail containing detailed steps on how to unzip its contents, rename the executable (it didn't have an .exe extension -- for obvious reasons) and run the thing. Asking the user to perform su - and chmod a+x as well? That could happen. And that will catch some people as long as the executable is named "keiranude" or similar.
Don't confuse "number of steps" with "security".
I know the answer.
It's Microsnot's fault. All they need to do is stop distributing the "Malicious software removal tool" through boring old Windows Update as a "Critical security update" and distribute it via popup ads on popular websites masquerading as a stock-trading utility from a Bank of America subsidiary in Lagos that can make you $100,000 quickly and reduce your mortgage while giving you a bigger penis.
Then it might appeal to its target audience.
TeeCee
Port 25
What we need is port 25 blocking by default by the ISPs as their own exception to otherwise perfect pipe provisioning, with the clear option to turn this off (quick call to customer services, could even be automated using a ringback to the customer's number taken from records). In any event, the filtering, together with ingress filtering, should be done where it's going to make the most sense, at the ISP's sprawl.
BTW: yes, I'll be the first to turn off that block as I run my own MTA and with good reason. I paid for network access, which means I get to choose how I route my email and DNS. If I want to do that myself, then so be it - for those admins who disagree, you're just encouraging another subtle form of net discrimination (read: treating your customers as shit, and second-rate shit at that).
Cheers,
Sabahattin
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
