Australian ISPs Asked To Cut Off Malware-Infected PCs 286
bennyboy64 writes "Australia's Internet Industry Association has put forward a new code of conduct that suggests ISPs contact, and in some cases disconnect, customers that have malware-infected computers.
'Once an ISP has detected a compromised computer or malicious activity on its network, it should take action to address the problem. ISPs should therefore attempt to identify the end user whose computer has been compromised, and contact them to educate them about the problem,' the new code states. The code won't be mandatory, but it's expected the ISP industry will take it up if they are to work with the Australian Government in preventing the many botnets operating in Australia."
let's wait and see (Score:5, Insightful)
if the Australian definition of 'malware' is 'bittorrent'
Re: (Score:3, Insightful)
Doing portscan 24/7, taking pause only when sending out 100 mails per minute?
Re:let's wait and see (Score:5, Interesting)
Re:let's wait and see (Score:5, Insightful)
Telemarketers pay for access to the phone system. Spammers and botnet controllers hijack other peoples access.
And what third world country do you live in to get "network busy" at any time except during a disaster? I am 26 and have never experienced it myself although I know it happens.
Re: (Score:2)
And what third world country do you live in to get "network busy" at any time except during a disaster? I am 26 and have never experienced it myself although I know it happens.
I'm 22 and I've seen it before, ever seen 200 people trying to do voice calls simultaneously within 20x20m, the towers don't like it. It wasn't an emergency either.
Re:let's wait and see (Score:5, Funny)
And I'm sure most of the bot nets are from computers in Australia!
Which as everybody knows, is populated entirely by criminals! So clearly I can't use the botnet closest to me!
Re: (Score:2, Insightful)
Re:let's wait and see (Score:5, Informative)
ISPs regularly portscan connected clients to make sure that they aren't running a server in violation of the TOS... many large ISPs have terms of service that strictly forbid running such servers, and even the ones that don't have that prohibition will usually keep tabs on their users to see what they're running.
More than portscanning, they also monitor which ports account for the bulk of your traffic. If you're putting out more than 50MB/day average on port 25, it's a fairly safe bet that it's more than just personal e-mail use. Many large ISPs will also silently redirect all port 25 traffic directly to their own mail server, and some of htem won't be so silent about it, and will simply block outbound port 25 to anything other than their mail servers. When all outgoing mail has to go through their servers, it's pretty easy for them to check attachments for viruses.
Beyond active scanning, there's also abuse reports... those actually do get read, and if they have the appropriate information, then they can very easily be used to track down the user who's infected with a virus.
None of the methods are going to detect a user's virus infection the moment they're infected, but taking a few proactive steps as well as taking proper reactive steps can allow the ISP to pick up on suspicious activity, and to work with the user to clean things up.
Obligatory disclaimer: I used to work for an ISP that did exactly this. We would portscan our users, we would monitor their mail traffic for viruses, and we'd actively monitor the abuse mailbox. When we detected a virus-infected user, we'd send them an e-mail notifying them that they were infected. If they hadn't cleaned up or replied to the e-mail within 5 business days, we'd phone them, and if there was no response within 5 days of that, we'd segregate their connection so that the only sites they could navigate to were the company website, and several notable antivirus sites (McAfee, Norton, AVG, Avast, PC-Cillin). I suspect that the Australian policy described here will work very much the same, and I don't really understand why people are up in arms about it. There's other methods to deal with BitTorrent besides defining it as "malicious" and "viral" (traffic shaping anybody?), and besides that, most piracy these days doesn't even happen through bittorrent. Direct downloads + hjsplit, rename file extensions. They can't really know what's being downloaded, and they can't throttle direct downloads because it'd piss off their customer base.
Re:let's wait and see (Score:5, Funny)
that would make them a bunch of assholes now wouldn't it?
Nope, it would make us a bunch of arseholes
Re: (Score:2)
No, every single other act since their election two years ago have already made them a bunch of arseholes.
Australia's Internet Industry Association were elected two years ago?
Re: (Score:3, Funny)
Two can play at that game: if you support Conjob you support Scientology
Re:let's wait and see (Score:5, Insightful)
>>>freedom of speech means watching child porn.
Nudity is not porn except in the minds of mentally ill persons. And yet oftentimes mere possession of a naked photograph, even it's of your own family or yourself, will land you in jail. Witness the American students who were charged with child porn because they used their phones to shoot themselves without clothes. Why is taking a photo of yourself illegal??? It's stupidity. It's anti-liberty. Worse - fear of nude bodies is a psychological disease, and I suspect Conroy is patient zero.
Don't be a policeman (Score:5, Insightful)
Re:Don't be a policeman (Score:5, Informative)
Since infected computers often lead to DDOS and spam botnets, I think this is a good idea.
Up for debate is the method they use to detect a rogue machine, but if they can perfect that then I'm all for this.
Clueless users probably go for months without realizing they're sending out hundreds of emails a day, or helping to bring down some remote server.
It's the next-best thing to requiring a license to use the 'net. ;)
Re:Don't be a policeman (Score:5, Insightful)
The problem is the Australian government are already trying to censor our internet connections at the ISP level and whilst getting rid of bot nets sounds like a great idea, building any sort of traffic monitoring in now sounds dangeroulsy close to their existing plan to filter the net.
Hell, this could even be their plan, bring in filtering to take down bot nets then slowly but surely start to block porn they don't like and pro-abortion web sites and before you know it any political site not to their liking
Re:Don't be a policeman (Score:5, Insightful)
"The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all." - H L Mencken
Of course this is dicey, as the current proposition is, in my opinion a good idea. But we all know that GP's right.
Re: (Score:3, Insightful)
"The GP is right"??? Okay. And while we're at it we should advise women to stop wearing clothes cut above the knee, or more than 2 inches below the neck. Plus we should punish people who leave their car doors unlocked. Also we should punish people who have regular windows on their homes instead of unbreakable windows.
Point - This proposal strikes me as blaming the victim. It's not a woman's fault she got raped, just because she wore revealing clothing. It's not the car or home owner's fault somebody b
Re:Don't be a policeman (Score:5, Insightful)
It's quarantine. If a person gets sick with a contagious disease, it may not be their fault and you probably don't want to punish them. But for public safety, you do need to contain them until they are no longer dangerous to others.
The same applies to sick computers. If it is spewing viruses and malware then stop it, whether the person who owns it was doing it intentionally or not. You can forward all traffic to a local ISP web sight that informs them of the problem and directs them to appropriate ISP approved scanning software or other solutions available within the quarantine zone. If the user does not trust the ISP, fine. They can go clean their machine themselves.
Whether you trust the ISP/Government to have the right motive is a separate issue. But quarantine is an established procedure for humans, and it's not that different here.
Re:Don't be a policeman (Score:5, Insightful)
Having said all that, it is NOT the Aussie government advocating this action! Perhaps the errant public would be well served by their ISP informing them that their machine is infected. As it stands, I see machines that are "typhoid Mary's", So infected with trojan's, virus's and other malware that it is amazing they still work at all. The average user doesn't have a clue there is a problem beyond complaining that their machine is slow. (Which is often why they "upgrade" to a "faster" machine! Seems very fast until the new machine gets infected
Re:Don't be a policeman (Score:5, Interesting)
Re:Contact (Score:2)
Can't Nastyware authors detect which ISP you have? Presuming so, it just leads to another Phish attack. Combined with the completely abusive recordings their LEGIT tech support has, you get this:
"Hello, this is ________. Your account details need to be updated because we think you have malware on your computer. Have you rebooted your computer? Rebooting your computer can help remove local events in a browser that are slowing your machine down. Once you have rebooted your computer, stay on the line and an ac
Re: (Score:2, Insightful)
I think this is a dumb idea. ISPs shouldn't have to cover for Microsoft's insecure software. Why not require that everyone connected to the Internet use a better OS? That idea makes just as much sense, doesn't it?
Worse is that this can so obviously be used as a wedge to demand that ISPs do copyright policing, obscenity policing, and who knows what else.
Throttling based solely on quantity of traffic coming from a customer seems a simpler, fairer, less politically exploitable method.
Re:Don't be a policeman (Score:4, Insightful)
"It's the next-best thing to requiring a license to use the 'net. "
Instead, you'll need a license to run a peer-to-peer protocol.* Any traffic from an "unlicensed application" will be assumed to be malware and thus blocked. That way, only "authorised" applications from vendors who have paid for a license will work. How many of those will be things like "iTunes" and how many things like "BitTorrent"...?
(*Just because I'm paranoid doesn't mean they aren't out to get us...)
Re: (Score:3, Insightful)
RTFA - They said if the ISP Knows a customer is using a malware infected PC; Working for an Australian (Adelaide) ISP at one point, I can tell you - this is the easy part, We don't have to monitor ports or anything - just wait for somebody to send an email to postmaster/abuse/etc on our domain complaining about spam from specified IP in our range.
Find the customers session - call them, tell them its malware, etc
Protip: Adelaide ISPs pretty much do this already; having your subnet blocked from sending email
Re: (Score:2)
Re: (Score:3, Insightful)
What about malware writers who figure out how the detection works? This is yet another arm race.
Re: (Score:2)
Over time it will be for the worst of the worst.
Then packet inspections will just be part of everyday internet usage.
Re:Don't be a policeman (Score:4, Funny)
Re: (Score:2)
That's true but I didn't mean specifically by lowering bandwidth usage, I meant by being more stealthy. What if there was some way for your malware to make itself look like some other kind of high-bandwidth usage like usenet, bittorrent or video streaming traffic. Not sure if it's possible because ultimately you need to end up as SMTP at some point.
Anyway, no doubt these kinds of traffic are things that ISPs will eventually want to flip the kill switch on too.
Re:Don't be a policeman (Score:4, Insightful)
I pretty much agree - but the ISP's already monitor traffic for a variety of reasons. Mostly bad reasons, but the monitoring is in place. It really isn't hard to determine that a machine's excessive traffic is due to viral infections. Shutting them down seems like a good idea. When the customer calls to complain, tech support has a kindergarten teacher on hand to explain how simple it is to upgrade to a safe unix-like operating system to avoid future infestations.
Problem solved.
Re: (Score:2)
When the customer calls to complain, tech support has a kindergarten teacher on hand to explain how simple it is to upgrade to a safe unix-like operating system to avoid future infestations.
What's wrong with the tech support monkey teaching them how to set up a restricted account for every day use? Why couldn't they instead tell the user that browsing the web from an Administrator account is what caused the issue, accompanied with clicking "Yes" "Accept" and "Allow" at every box which pops up in front of them?
Linux is not a cure, it's a choice. Education is the cure.
Re: (Score:2)
Linux is part of the cure. It helps in treating one symptom of the disease. Ignorance is drastically reduced after just one installation of any unix like operating system.
Of course, there are those who take pride in their ignorance. Some of those individuals insist on running as root when they finally upgrade to Linux.
Re:Don't be a policeman (Score:4, Insightful)
Any network admin worth the lunch they bring in every day can find a seriously malware infected machine in about 10 minutes.
Re:Don't be a policeman (Score:5, Insightful)
I've worked for ISPs here in Sweden and most serious ISPs here see it as standard practice to warn and then disconnect users who are running zombie machines, nothing strange or totalitarian about it, it's about protecting their network and their other customers from harm.
/Mikael
Re: (Score:2)
I've worked for ISPs here in Sweden and most serious ISPs here see it as standard practice to warn and then disconnect users who are running zombie machines, nothing strange or totalitarian about it, it's about protecting their network and their other customers from harm.
It certainly makes sense, but what happens next ? How do most clueless users manage to clean their machines, with no network access ? And how do they get their access back ? What's the process to certify their rig as being "clean" ? Or has a "home Windows cleaning" (no, not those windows) industry sprung up to meet the demand ?
Re: (Score:2)
Well, the procedure when I was handling abuse cases was:
Re: (Score:2)
What happens after you've been disconnected? You get it fixed or you find an ISP who cares less and end up dragging the Internet down from somewhere else.
That'd be something like "a computer store" - one of the ones where they have Techs to help fix things.
The obvious solution would
Re: (Score:2)
The idea is good because it would it that much harder to propagate botnets and even feasible, but the real problem is that almost all end users have no idea what malware is or how to stop it. Unless the enduser is supported in removing the malware, and in the case of rootkits this usually means reinstalling the OS, then it will only result in a huge number of complaints that the ISPs will not be able to cope with.
Re:Don't be a policeman (Score:5, Insightful)
The idea is good because it would it that much harder to propagate botnets and even feasible, but the real problem is that almost all end users have no idea what malware is or how to stop it. Unless the enduser is supported in removing the malware, and in the case of rootkits this usually means reinstalling the OS, then it will only result in a huge number of complaints that the ISPs will not be able to cope with.
Most end users have no idea how to replace the spin motor on their washing machine, either.
I don't understand why people who are perfectly happy with getting knowledgeable technicians to work on almost all of their household equipment think that their PC is some sort of magical exception.
Re: (Score:2)
I don't understand why people who are perfectly happy with getting knowledgeable technicians to work on almost all of their household equipment think that their PC is some sort of magical exception.
That one is easy.
Microsoft (and Apple) keep pushing the idea that computers and essentially their operating systems and software are super simple. Pah, a child a 5 could get this (fetch me a child of 5 !).
People here know that it's actually horrendously complex and that it's often a miracle that it works at all, especially if we let users tinker with the stuff, but marketers have to sell their wares, so that kind of talk just won't do. So they lie through their teeth (they're trained to do this from a young
Re:Don't be a policeman (Score:4, Insightful)
Well, quite. It doesn't help that Microsoft have conditioned people to ignore these warnings as being totally unimportant, and at the same time have worded them so badly that most people never even try to understand them, they just hammer away trying to find a way to do what they want without the warning coming up.
I've actually met IT professionals who seem to think that doing this is the correct way to troubleshoot a problem. Shoot me now...
Re: (Score:3, Insightful)
When my car's "check engine" light comes on, there is almost always a real problem. When my computer pops up its warning, it might be something serious or it might mean I need to enter a password, or it might be attention-whoring from my AV program. To be useful, PC warnings have to be rare events that only happen when your machine really does need attention, not things that happen all the time.
Re: (Score:3, Interesting)
I'm in the UK and used to use Zen as my ISP. I found their tech support very helpful in spotting dodgy activity emanating from my home network and advising me on ways to investigate and correct my problems. They did warn that I should take immediate action or they would have to consider suspending my connection. I found this a sensible, helpful and mature approach to the situation.
If done properly involvement of the ISP in identifying and helping resolve infected PCs should be welcomed I would have thought
Re: (Score:2, Insightful)
Not policeman, but please be a janitor! (Score:2)
ISPs should just provide internet access not police and monitor traffic.
Yeah, and if they help my neighbour get rid of their malware, there will be less useless (even harmful) traffic clogging up the pipes I want to use.
Even though I get along well with the "privacy paranoid" group, I think it's reasonably for ISPs to monitor for malware/spam traffic, and contact the users who get hit by it (which in many cases is through no fault of their own), tell them what's going on and offer help changing the situation.
That's good for the malware-infected customer; it gives the ISP a bett
Re: (Score:2)
ISPs should just provide internet access not police and monitor traffic.
The alternative is that the government ends up policing and monitoring traffic.
Both are bad yes, but one just a teeny bit more so.
Please don't (Score:5, Funny)
sigh (Score:2, Insightful)
Re: (Score:2)
We (your isp to the court) where looking for malware and noted that 'you' where distributing pornography.
eg possession of any content classified RC (Refused Classification) a criminal offence.
Can't wait! (Score:2)
Damn I hope the entire process is automated - sniff/clip/boom....including the customer help line. Gonna be some super fine yelling and screaming at the line judge over this one.
I mean, since 'the problem' has already been determined and all...
There's already precedent for this, too... (Score:5, Informative)
Rogers, here in Canada, has been practising this for a few years now, and will notify and disconnect computers that are sending network packets that match known malware. I think it's an automated process, too.
It's sort of funny, there was once a time when someone set the DHCP lease length too short, and several customers wrongly got blasted off the internet as they had been "infected".
Reminds me (Score:5, Interesting)
Re: (Score:2)
I am guessing that the people who got infected probably saw the "you're infected" page as being normal [per earlier slashdot article] and once they realized they couldn't go anywhere else they blamed the ISP for it and went elsewhere.
Re:Reminds me (Score:5, Interesting)
A couple of years ago, a major ISP in Finland had a somewhat similar system. They wouldn't allow infected computers to take any other network access than HTTP and they redirected all HTTP traffic to a page saying "you're infected" and providing short instructions on how to fix it. It seems that they're not doing it anymore, but I don't know the reason.
The largest ISP in Finland, Elisa is still doing it and the system is actually working very well. I haven't seen a single false positive yet (yes I work in their helpdesk).
Re: (Score:2)
Wish I could mod you up. It's interesting.
Re: (Score:2, Funny)
I haven't seen a single false positive yet (yes I work in their helpdesk).
Every system was infected with Windows?
Re: (Score:2)
Same thing here for my ISP, Netcologne in Germany. Works like this for years. They even provide a malware removal download.
Re: (Score:3, Funny)
I think it's a great idea. (Score:4, Informative)
I've contacted ISP's about their customers attempting to "hack me" because they were infested with Code Red and Nimda and for some reason my Apache server on Linux looked incredibly tasty. They of course proceeded to ignore me and not even to contact their customers.
Re: (Score:3, Interesting)
Re:I think it's a great idea. (Score:5, Interesting)
I've contacted ISP's about their customers attempting to "hack me" because they were infested with Code Red and Nimda and for some reason my Apache server on Linux looked incredibly tasty. They of course proceeded to ignore me and not even to contact their customers.
I had a similar experience at University. I was living on campus and had my Apache server running along nicely on my Linux box, and kept on getting these weird error logs. As soon as I saw it I had a feeling that it was Code Red, so I checked up on the net just to confirm. It was. So I then traced it back to its source - one of the University's own computers. I contacted the Uni's IT staff and informed them that they had a machine that was infected with Code Red. Do you know what response they gave me?
"It isn't our machine that is infected. Your machine is the infected one."
For anyone who didn't read the above properly, or can't be bothered going back over it again, I was running Apache on Linux and the Code Red worm infected Microsoft IIS Web Servers.
About time (Score:3, Insightful)
Re:About time (Score:4, Interesting)
Having sold "unlimited" access at a fixed price, ISPs run on tight margins, so one simple email or phone call, plus the subsequent dealing with the customer, will wipe out the whole year's profit from that customer. So what in practice will happen if ISPs go down this route is that they will simply start blocking the ports for IRC and mail. And then the malware will move to another protocol, and that will be blocked, and so on.
I suspect the the law of unintended consequences will mean that we'll end up with ISPs that provide access only to http and https.
Re: (Score:2)
as usual, nerds are hopeless with business decisions.
Re: (Score:2)
No, nerds are just hopeless if one of the answers is "automate".
Re: (Score:2)
I suspect the the law of unintended consequences will mean that we'll end up with ISPs that provide access only to http and https.
You ever looked at any ISP's own online help or tried contacting one lately?
Certainly here in the UK, most ISPs seem to think that's all they do anyway.
Re: (Score:2)
Re: (Score:2)
Or the unintended consequence will be that (shock horror) ISPs will only sell what they're actually able to sell, and people won't be expecting "all you can eat" Internet access for £5 per month! You want excessively more bandwidth than is the norm? Pay for it.
Re:About time (Score:5, Insightful)
alice: I don't know what irc is!
3 hours later...
bob: alice, what happened to our internet? I couldn't connect to our server from work today.
alice: server?
My ISP (EXETEL) already does this.. (Score:5, Interesting)
My (Australian) ISP has been doing this at least for spam relays for a few years now. If they detect you are being used to spam they cut all your traffic and redirect port 80 to a page telling you what has happened and giving you links to AV tools and an automated traffic checker that will unblock you once you have dealt with the malware. Two of the guys I live with got infected and so I have personal experience dealing with the system. To me it seems like a perfectly sensible and responsible reaction to a serious problem. IMO any ISP not doing this is an irresponsible netizen.
To me it is like your CC company notifying you of suspicious charges or the phone company asking why your mobile is suddenly making hundreds of calls from Azerbaijan. It not only stops the current problem but if people are actually notified that they have a problem they are far more likely to take steps to protect themselves in the future.
Re: (Score:2)
The problem is that we've already had assholish ISPs use DPI as a means of discriminating against legitimate traffic.
Before I would allow an ISP to do that to me they'd need to earn my trust first.
Re: (Score:2)
EXETEL are a one of the best ISP's down here. The only problem with them is that the network is getting so saturated these days (none of the major telcos will invest in new capacity until the Aussie government sorts out its 10 billion AUD future broadband scheme) that they are shaping P2P and limiting "bonus" data to 3am to 8am. Kind of sucks but the other option is for all traffic to be slow if the links max out due to unrestricted P2P.
Other than the network capacity issue they are pretty "wink wink nudge
Re: (Score:2)
I meant to say they are shaping P2P except during the bonus data time of 3am to 8am. As I am only on ADSL1 I don't notice any shaping.
Re: (Score:2, Interesting)
Many school networks already do this (Score:4, Interesting)
Could be good if done right (Score:2)
1 - Users could opt-out
2 - The list of blacklisted "malware" was maintained and published by a non political body
Re: (Score:2)
You wouldn't need to scan the computer. Just watch for the network traffic signature of malware (eg. open ports known to belong to malware that respond to the appropriate malware's protocol when probed, or open ports belonging to a Web server serving up malware). My ISP already scans for open ports as a regular security precaution. As for opt-out, no. The people who are the most problem are exactly the ones who'd opt out instead of fixing the problem (because in their mind the problem isn't the malware, it'
Only Macs will be left (Score:3, Funny)
If you cut off all the Malware-Infected PCs, only Macs will be left. (ok, maybe some linux boxen).
*ducks*
internet licence (Score:2)
It's illegal to drive on public roads without a driver's licence.
It ought to be illegal to use a computer connected to the internet without some form of minimum qualification. i.e. an "internet licence"
Re: (Score:2)
Prove that this will save lives as the drivers license does and I'm sure some politician will hurt himself rushing to say it in front of a camera.
Re: (Score:2, Insightful)
Some kind of attitude test might be a good idea too.
Re: (Score:2)
Yeah, they thought [slashdot.org] of that too.
Verify and notify before you disconnect (Score:5, Insightful)
My otherwise stellar ISP has a "shoot first, ask no questions security policy"
It is frustrating to lose access to my home server while at work and not be able to do any troubleshooting because I need physical access to the machine.
It is quite maddening to finally get home, verify that there is nothing wrong on my end, call up support and (eventually) find out that I've been deliberately disconnected because of a security problem that doesn't exist.
Microsoft's response (Score:5, Interesting)
I'm curious about how MS will respond to this if it comes into being. On one hand they'll lose a large number of users, after all, does anyone outside the MS camp really believe that it's not gonna be 100% infected Windows PC's that will be affected? What will MS do?
Will they offer discounted or free vouchers for repairs, upgrades etc? How many of these machines will be unlicensed? Will they pay to fix unlicensed copies of Windows if the owners either have no money to spend on a sticker with a number on it? In the current economic climate you can't blame them. Is a subsidy to clean the PC worth the ISP's time and hassle knowing it'll be infected again by the end of the week at the latest, and they'll have to repeat the same warning and threat of disconnection all over again. Will they provide paid anti-malware software? Who pays for all of this? Will they provide training for Windows users to at least give them a chance of having a few months online without a letter?
This would reflect badly on MS in any free press, even having to be the only ones to offer fixes is embarrassing enough. Given that MS control the mainstream media it'll go unnoticed as far as PR is concerned, but it's yet one more thing eating into their profits at a time where they're struggling.
The alternative is to lose a large number either to Linux, or off the internet altogether. Anyone who's had the internet for a while knows what it's like when it goes down for a few hours, will those people really decide the internet is not worth it?
I'm guessing the great philanthropists and all round nice people at MS are busy lobbying at every level to stop this from happening or at least water it down (notice the ISPs are being "asked" not "told"). They need to keep market share by any means necessary, ideally without spending a cent on it. The rest of the world can suffer as long as MS's interests are not hurt.
Given that Windows has all the security of a paper tank in a thunderstorm this will be hilarious to see the workload the scheme entails, and over time the number of Windows PCs in Australia still connected because they're NOT infected. They will drop like flies. Give it a few years and it'll be a Windows free zone.
Re: (Score:3, Insightful)
Re: (Score:2)
Re:Microsoft's response (Score:5, Insightful)
Oh come on.
90% of security holes that have been exploited in the last few years are sitting on the chair in front of the computer. Even if Windows were to evaporate overnight and everyone using it were magically switched to a Mac or to Linux, inside a few weeks you'd see malware pop up which has Apple logos and Linux penguins and makes reassuring noises while insisting it really does need your password.
Re: (Score:3, Insightful)
Re: (Score:2)
That doesn't mean it has to be.
There's no reason why malware can't be installed using local exploits in the application or social engineering.
Re: (Score:2)
will those people really decide the internet is not worth it?
Let's hope so.
Re: (Score:2)
EVERY country needs to be doing this, and not making it voluntary either. Any problem on the internet affects everyone connected to it. Cutting off PCs in one country has limited effect in isolation. Considering botnets are an exclusive Windows problem, Microsoft should be forced to pay for the scheme too. It's their mess after all.
Um, not exactly. Evidence of Linux botnets [computerworld.com] and OS X variants with confirmed infections in the wild. Methinks you're buying a bit too much into the late 90s / early 2000s era FUD against Microsoft. Maybe if this was ten years ago your sabre-rattling might have been acceptable. But these days, to categorically deny the leaps and bounds at which Microsoft has improved security in both Windows Vista and Windows 7, and not realizing that malware is more and more becoming a user education problem than anythin
Re: (Score:2)
ONE small Linux botnet found recently because of badly configured systems? It's a tiny drop in the ocean. Is that in any way close to sharing blame with Windows for their 1,000's of LARGE botnets being actively used? Microsoft like to spread FUD about Windows market share being almost total, with Linux and OSX hardly getting a mention. They're right, but it seems they're talking about the botnet scourge ALL PC users have to suffer, regardless of our choi
Re: (Score:3, Insightful)
The 'botnet' consisted of about 100 Linux servers, none of whom could be proven to have been infected via automated means. Indeed, the man who discovered this threat speculated that they were compromised by sniffing FTP passwords. Not included in the report was how many actual machines were compromised. Individual Linux web servers can host hundreds of accounts or more.
As a proportion of Linux servers, this nu
Re: (Score:3, Insightful)
Did this get modded up so we could all marvel at the insanity of this person? Because those are some outrageously ignorant claims.
Car Inspection (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Do you really want a government bureaucrat picking through your hard disk deciding what is malware and what isn't? Would the government even have technicians capable of determining whether your linux install is malware or not?
Viable Alternatives (Score:2)
Instead of disconnecting the user, my (Australian) ISP has a more proactive approach. By default they block:
Port 25 (smtp) inbound and outbound
Port 80 (http) inbound
Port 135 DCOM SCM inbound
Port 139 (netbeui/ipx) inbound
Port 443 inbound
Port 445 Microsoft Windows File sharing / NETBIOS inbound
The option to disable port blocking is given on their website, and changes take effect within 15 min. This blocks the propagation of malware without running the risk of accidentally disconnecting users on false positive
Pick a number. Make it six digits. (Score:3, Insightful)
Re: (Score:2)
What? The Internet?
I'm not particularly keen on government interference, but without it we mightn't have the Internet in the first place.
Would you like some cake?