Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software The Internet Windows Worms

Major Aussie ISP Disconnecting Trojaned PCs 388

Posted by timothy from the sorry-fella-you're-wetting-the-sandbox dept.
daria42 writes "Australia's largest ISP, Telstra BigPond, has started disconnecting customers that it suspects have excess traffic-causing trojans installed on their PCs. The trojans have been flooding BigPond's DNS servers and causing extremely slow DNS requests for around a month now. Despite nightly additions of DNS servers, BigPond appears to be unable to cope with the extra traffic on its network." Note that the article says the disconnections are temporary and accompanied by communication with the affected customers, not just a big yanking-of-carpet.
This discussion has been archived. No new comments can be posted.

Major Aussie ISP Disconnecting Trojaned PCs More

Major Aussie ISP Disconnecting Trojaned PCs

Comments Filter:

  • My 1st Thoughts (Score:5, Insightful)

    by reezle ( 239894 ) on Wednesday April 13, 2005 @04:06AM (#12221338) Homepage
    "Thank God"

    "It's about Time"

    "Glad somebody is finally taking an interesting in keeping the neighborhood cleaned up"

    "Oh crap, is this the first chink in the armor, ISP's can disconnect people based on their traffic... Virus, Trojan, P2P, Torrent"
    • Oh, come on! Like there are currently no ISPs prohibiting P2P?!

      • Re:My 1st Thoughts (Score:3, Informative)

        by strider44 ( 650833 )
        not so much in Australia. Though ISPs will forward emails sent from RIAA and MIAA etc there is no action taken, and the identity of the IP addresses aren't disclosed.

    • Re:My 1st Thoughts (Score:3, Insightful)

      by Unipuma ( 532655 )
      "Oh crap, is this the first chink in the armor, ISP's can disconnect people based on their traffic... Virus, Trojan, P2P, Torrent"

      Fortunately, they can yank the plug because these machines are attacking their DNS servers. Not because these computers are just sending out a lot of DNS requests.

    • Re:My 1st Thoughts (Score:5, Insightful)

      by TeraCo ( 410407 ) on Wednesday April 13, 2005 @04:46AM (#12221470) Homepage
      ISP's can disconnect people based on their traffic

      They've always been able to do that.

    • Re:My 1st Thoughts (Score:3, Interesting)

      by Anonymous Coward

      "Oh crap, is this the first chink in the armor, ISP's can disconnect people based on their traffic... Virus, Trojan, P2P, Torrent"

      I can agree with you on the first 3 statements, but that last is just crap.
      Why the fuck should an ISP want to disconnect a user because of his P2P or Torrent uses? If the ISP can't cope with the amount of data flowing through, it shouldn't disconnect a user. If I pay for a 2mbit DSL with no limitations to usage, I want a 2mbit DSL with no limitations. My ISP shouldn't fucking c

    • Re:My 1st Thoughts (Score:4, Insightful)

      by Anonymous Coward on Wednesday April 13, 2005 @05:23AM (#12221591)
      "Oh crap, is this the first chink in the armor, ISP's can disconnect people based on their traffic... Virus, Trojan, P2P, Torrent"

      Yeah, that's a valid concern. I think what we are talking about here is the difference between being pragmatic and idealistic.

      Idealistically, the ISP would never look at your traffic, and just deliver the pipe. Practically, zombies are degrading the service of other customers significantly, and the ISP is going to know what the problem is.

      It's not a perfect Internet yet, we all know that, so I think it's pretty reasonable that certain measures are taken in cases like this.

      Just remember to scream really loud when there is an incident of an ISP disconnecting you for something that is perfectly legal.

      (PS. It's good to see that the use of Torrents appears to have a high legal/questionable content ratio, whereas the last time I looked at P2P, it was really hard to argue that it wasn't used mainly for illegally copying stuff)

    • Re:My 1st Thoughts (Score:5, Insightful)

      by spongman ( 182339 ) on Wednesday April 13, 2005 @06:18AM (#12221735)
      ISPs don't want to be liable for the shit your sending over their network. As soon as they start sniffing they make themselves responsible for your kiddy porn and your copyright infringements. They don't know, and that's what they tell the lawyers, they don't want to know and more importantly they don't want to have to know. just don't piss them off and you'll be fine.

    • Re:My 1st Thoughts (Score:3, Insightful)

      by Anonymous Coward
      sorry but ISP's can disconnect you for ANY reason. if you though differently you should have read that customer agreement..

      when I was running an ISP I had many clauses for termination and had to use them on rare occasion.

      If you think an ISP did not have this ability you are horribly niave.

    • Re:My 1st Thoughts (Score:3, Interesting)

      by jotok ( 728554 )
      It seemed like the customers are being ganked not because there was way too much "legitimate" traffic to handle, but because it was becoming a nuisance. The legitimacy of p2p applications is arguable so long as they have legal uses; the legitimacy of gaobot is not arguable as it has no legal uses on a public network.
    • I agree with your post completely, but from TFA:

      Another said: "I am having problems loading Web pages, I get the 404 [page not found] error. I have to retry five to 10 times to get some places."

      I may be daft but I don't understand how a DNS or network capacity problem could cause a web server to respond with an explicit "404 File Not Found" HTML error. I could see a timeout, DNS error, or any number of other errors, but a 404 would mean literally that you contacted the web server, it was unable to fi

  • Why is this news!?! (Score:5, Informative)

    by pctainto ( 325762 ) on Wednesday April 13, 2005 @04:06AM (#12221339) Homepage
    ISPs around the world have been doing this for a while now! I live in a house with 12 people and one person had a hijacked computer sending out mail and Adelphia cut us off. Although they never told us that they did (a quick call to customer support hooked us back up).

    Seriously, why is this news?

    • It's Australia's biggest ISP according to the posting.
    • pctainto wrote:
      Seriously, why is this news?
      Because it is surprising that BigPond is doing anything proactive in the customer support area given its horrible customer service track record [whirlpool.net.au]. Although, I guess their goal is to save money, not help its customers.
      • Save money? I figure they'll be loosing revenue based on excess data traffic charges generated by extra traffic caused by the trojans. Note to Non-Aussies: BigPond counts both uploads and downloads for data traffic with excess usage charged at A$0.15/mb. There have been cases of people being hit with very large internet bills for one month (IIRC the largest was in excess of $10,000)

    • Shut up (Score:5, Insightful)

      by Hrothgar The Great ( 36761 ) on Wednesday April 13, 2005 @09:59AM (#12222781) Journal
      I really hate you "WHY IS THIS NEWS?!!!!" crybabies. It's news because this particular ISP is doing something which it previously was not. See how that works? Something HAPPENS, and then someone REPORTS that it happened, and then the story gets posted here because its subject matter appeals to a large portion of this site's readership. Are you so blindingly stupid as to actually need this explained to you? It's the fucking dictionary definition of news.

      By the way, most ISPs still are NOT doing this. Time Warner's Road Runner, for instance, never even looks in the direction of a trojaned machine on their network - at least in my area.

  • This is a good thing (Score:5, Insightful)

    by kasperd ( 592156 ) on Wednesday April 13, 2005 @04:06AM (#12221340) Homepage Journal
    More ISPs should handle compromised computers this way. Just leaving them around to harm the internet for the rest of is is irresponsible.
    • Well, there is no need to *disconnect* the computer if all you have to do is block the problematic port. It's so lazy to disconnect a computer. Do they know traffic shaping ?

      • Re:This is a good thing (Score:5, Insightful)

        by Anonymous Coward on Wednesday April 13, 2005 @04:42AM (#12221455)
        If you don't disconect the offending computer, how will the idiot who owns it know they've been an idiot? Disconecting it totally is a great way to handle the problem, because it forces the idiot to call customer services to find out why their connection no longer works, at which point you can lart them for being an idiot and force them to clean up their idiot-box before you reconnect them. Just silently droping the offending packets does nothing to educate the idiot involved.

        • Re:This is a good thing (Score:5, Interesting)

          by Dulcise ( 840718 ) on Wednesday April 13, 2005 @05:10AM (#12221547)
          I think isp's should do what ntl did during the ms blaster worm out break, which is only allow the user to connect to ether the removal tool or a page that contains a link to it and how to use it. it would take more work, but its better for the customer.
          • That would only work if it were easy to figure what was infecting the computer based solely on the traffic it's sending out. It's more complicated that you'd think.

            On the other hand, most people who don't know enough to keep their machines virus/trojan free are probably using the software that nearly every ISP sends out to "help" you connect to their services, which means they should be able to include enough diagnostic tools to be able to tell what's running on the machine.

        • Re:This is a good thing (Score:5, Insightful)

          by FireFury03 ( 653718 ) <slashdot@NoSPAm.nexusuk.org> on Wednesday April 13, 2005 @07:46AM (#12222040) Homepage
          Disconecting it totally is a great way to handle the problem, because it forces the idiot to call customer services to find out why their connection no longer works

          Even better is to block all access and redirect web requests to a server that explains what's going on and provides patches, etc. That way people (with more than one brain cell) don't _have_ to phone customer support.
      • I'm just going to straight up paste the comment that an AC already posted in order that more people might see it as the AC stated the case almost perfectly (even if a tad abrasively) already:

        "If you don't disconect the offending computer, how will the idiot who owns it know they've been an idiot? Disconecting it totally is a great way to handle the problem, because it forces the idiot to call customer services to find out why their connection no longer works, at which point you can lart them for being a

      • Re:This is a good thing (Score:5, Insightful)

        by R.Caley ( 126968 ) on Wednesday April 13, 2005 @04:56AM (#12221514)
        Well, there is no need to *disconnect* the computer if all you have to do is block the problematic port.

        I think for 99.9999% of a residential ISP's customers, having their access to DNS blocked would not be noticably different from disconnection.

        Besides, is someone has an infected PC, disconnection is a friendly action. It kicks them up the arse so they have to find out what is going on, and it prevents them being zombied.

        We have a collective problem that many many people have PCs on the internet but don't have the kind of basic understanding we demand before we'd allow them onto the road in a car. Sending them back to the garage for a day or two with a hint to learn what the windscreen wipers are for is good for everyone.

        • DNS has been extremely unreliable for me as of late with Verizon.

          I asked a friend for his DNS settings (small rural "broadband" ISP) and added the entries to my own. It's reliable, if slow.

          Moll.

        • Re:This is a good thing (Score:4, Insightful)

          by mwvdlee ( 775178 ) on Wednesday April 13, 2005 @05:24AM (#12221593) Homepage
          Then again; all the windscreen wipers in the world couldn't stop a group of thugs from spraypainting your windscreen; you'd need lengthy and expensive training in self defense and chemical paint removal.

          You just assume that the people will suffice by installing (purchasing?) some equivalent to a windscreen wiper such as antivirus software but that won't be enough for the really nasty ones.

          Since the ISP can apparenty distinguish between good and bad traffic, can't they filter out any traffic which contains the troyans? They are assuming their non-IT clients can.

          • Re:This is a good thing (Score:4, Insightful)

            by R.Caley ( 126968 ) on Wednesday April 13, 2005 @05:35AM (#12221630)
            You just assume that the people will suffice by installing (purchasing?) some equivalent to a windscreen wiper such as antivirus software but that won't be enough for the really nasty ones.

            If someone targets you for a sophisticated attack, you are probably not a normal internet user (eg you're commercial or a political site or something), you need professional IT support and shouldn't be using a normal retail ISP.

            Th threat to normal customers is generic worms and trojans and so on. Things which the basic security everyone should be usig will protect against. Just the equivalnt of using windscreen wipers when it is raining.

            IIRC my ISP supplies some kind of firewall/antivirus package for all customers. (I've had my connection since before this kind of thing became really necessary and don't connect from Windows, so I've never investigated what they are offerring). I can't imagine why any ISP would not do that -- the saving in customer support calls alone would more than pay for it.

        • Re:This is a good thing (Score:4, Informative)

          by sadler121 ( 735320 ) <msadler@gmail.com> on Wednesday April 13, 2005 @09:45AM (#12222655) Homepage
          I think for 99.9999% of a residential ISP's customers, having their access to DNS blocked would not be noticably different from disconnection.

          Have you BEEN on the Comcast forums recently? Comcast is having a lOT of trouble with their DNS servers and it is effecting EVERYBODY.

          Last week when it happened I just switched my DNS addresses to MIT's, (though now I have a nice list of addy's just in case MIT's goes down). I have been instructing my friends on how to change the default DNS listings because they are being effected themselves. Once they change them, they have no problems. Hell, I didn't even know Comcast was having problems AGIAN yesterday because I just kept system with the MIT addy's.

          I have to think that if trojans are effectivly DDOSing Comcast's servers, if there is not some ultior motive behind this. DNS servers are the life blood of the Internet, to take them down means we would all have to know numbers to get around the Internet, and while I keep a few IP addy's in my bookmarks just in case, to except joe user to is rediculus.

          Of course it is probably just Comcast, who, as a regulated monopoly, has no incentive to upgrade services, because for many, Cable Internet is the only "broadband" (HA!) available. I would wouldn't be surprised if rates go up agian to cover the cost of whatever "upgrade" Comcast comes up with to solve this problem.

          Until then I am keeping my DNS addresses pointed to MIT's servers and I am NOT going to be using Comcasts.

      • Re:This is a good thing (Score:5, Interesting)

        by KiloByte ( 825081 ) on Wednesday April 13, 2005 @05:01AM (#12221526)
        block problematic port

        It's not that simple. The attack in question was done by a flood of DNS queries -- you're not really going to cut off port 53, as this is pretty much equal to knocking that person off the Net.

        The typical case involves a lot of outgoing connections on port 25 -- you can't really block this as well unless the user in question uses nothing but webmail.

        Traffic shaping won't help a lot, either -- it can protect the server, of course, but won't help the user himself. In this case, it will just make their legitimate use prohibitely slow -- their web browser/whatever will compete with the virus they have over the tiny allotted quota of allowed DNS queries.

        IMO it's much better to just cut them off outright, telling them that the fault is on their side.

        If you want to be nice, you can redirect all their traffic to a web server which gives them a nice idiot-proof message about what they need to do. This is what I've set up for a friend's basement ISP (~30 paying users) -- although in that case, the message was similar to "your payment is due for two months, you didn't heed our reminders".
  • ISP has problems with boxes infected with malware. ISP identifies and blocks said boxes. Block is only temporary, and will be lifted when customers disinfect their boxes.....

    Where's the story?

  • Hmm... makes sense to me! (Score:5, Insightful)

    by PDA_Boy ( 821746 ) on Wednesday April 13, 2005 @04:09AM (#12221349)
    Despite nightly additions of DNS servers, BigPond appears to be unable to cope with the extra traffic on its network."

    Right- I can smell a cake burning. Let's add more flour! Come on- more flour!

    Oh- right- let's take the cake out the oven...

    Seems a sensible thing to do to me- tackle the computers causing the problems, rather than trying to react to the problem itself.

    Although, tackling the writers of the infecting programs would be good too, if somewhat harder.
    • Yeah - that whole AIDS thing has been a real waste of resources; why bother with non-cures?

      I'd give Telstra a big round of applause for at least appearing to try other options before cutting customers off. A significant minority (maybe majority?) of the customers who get cut are going to be *very* uncomfortable when they get called by Telstra. Telling people that their rough driving finally caused their car to break down isn't easy. Many CSRs will be threatened this week.

      I'm only been in AU for 2 month
      • Lol, Bell and Rogers? The cellphone companies? Over here in the west, the telephone and cable monopolies are called "Telus" and "Shaw", respectively.
      • I'm only been in AU for 2 months but from what I'm told, Telstra (until the past 7 years or so) has been a very benevolent monopoly.

        Note that this coincides with its semi-privatisation (the government has a 50.1% stake in Telstra - which it can't wait to unload - the rest is publicly owned). Unsurprisingly, customer service has declined dramatically ever since "profit" became important. Telstra had previously been a "benevolent" monopoly because it had no reason to be anything else.

        The idea of a fully p

    • Re:Hmm... makes sense to me! (Score:3, Insightful)

      by Anonymous Coward
      Umm... when the customer cannot connect to the
      internet, what do you think happens next?

      They call the ISP on the phone.

      And they are told to clean their computer.

      And the computer either gets cleaned,
      or they remain off the internet.

      Your cake analogy is flawed. Instead, think
      of an analogy involving quarantine, computers,
      viruses, ISPs and such. Wait. Instead of
      an analogy, why not just reason about what's
      going on in this situation.

      What confusion of facts lets you believe that
      quarantine is not addressing t
    • Another said: "I am having problems loading Web pages, I get the 404 [page not found] error. I have to retry five to 10 times to get some places."

      Which also is totally not a symptom of DNS timeouts either. You need a response from a webserver to get a 404.

      The article just seems poorly written, I wouldn't go out and assume that telstra just decided to throw 500 new dns servers at it.

  • Drastic Measures (Score:5, Interesting)

    by onosendai ( 79294 ) <oliyoung@nOsPaM.gmail.com> on Wednesday April 13, 2005 @04:09AM (#12221350)
    These are drastic measures, but given the average BigPond user is much less a geek than anyone frequenting these parts, this will probably be the first time that most of these users will know about it, and given BigPond's previous problems with mail-servers, perhaps they're striking before the problem gets too out of hand.

    Although I don't understand the purpose of a trojaned machine repeatedly hitting a DNS server, is this an attempt to cause an overflow and therefore making the DNS server itself vulnerable?

    • Re:Drastic Measures (Score:5, Informative)

      by Arghdee ( 813921 ) on Wednesday April 13, 2005 @04:15AM (#12221375)
      To expand on this, a lot of you non-australians should probably know that Telstra Bigpond is the ISP that people choose when they don't know any better.

      Value for money wise they rate very poorly compared to the opposition - for ADSL at least.

      For those of you that don't know, Telstra is a part government owned company, which owns much of the telco infrastructure in Australia. They like to make life difficult for any competitors.

      Also one of the few ISPs in Australia that charges traffic in both directions.

      Just in case you guys care :)

      • Re:Drastic Measures (Score:3, Informative)

        by novakreo ( 598689 )

        To expand on this, a lot of you non-australians should probably know that Telstra Bigpond is the ISP that people choose when they don't know any better.

        Not necessarily. Please don't generalise.
        Where I live I have the choice of Optus or Bigpond (Telstra) cable internet. Optus prohibits servers in their acceptable use policy, and according to the Whirlpool forums [whirlpool.net.au] they block certain ports to enforce this.

        ADSL is also available, but it has a much lower download speed. We also have the Optus Local phone s

    • Re:Drastic Measures (Score:3, Informative)

      by droleary ( 47999 )

      Although I don't understand the purpose of a trojaned machine repeatedly hitting a DNS server, is this an attempt to cause an overflow and therefore making the DNS server itself vulnerable?

      Well, let's say you've got yourself a spam zombie sending out a million messages. How many unique domains would that average out to be? 500,000? 100,000? Let's generously give it another order of magnitude and say 10,000 (i.e., average of 100 inboxes spammed per domain). Compare that to Joe Average user; how ma

    • Re:Drastic Measures (Score:3, Informative)

      by XSforMe ( 446716 )

      Although I don't understand the purpose of a trojaned machine repeatedly hitting a DNS server, is this an attempt to cause an overflow and therefore making the DNS server itself vulnerable?
      In adition to the already commented use of sending spam, zombied machiens can be used to poison DNS servers. The poisoning basically involves sending lots of forged packets to the DNS server in what is known as a birthday attack [securityfocus.com]. There has recently been a rash of these kind of attacks as documented [sans.org] by SANS.

  • Mathematically... (Score:5, Funny)

    by Shag ( 3737 ) * on Wednesday April 13, 2005 @04:10AM (#12221354) Journal
    if BIGNUM% of PC's are malware-infested (I've heard 80% tossed around) and they get disconnected, suddenly anyone who's looking at their web logs will think that an unusually high number of Big Pond users are on Linux boxen, Macs, etc.

    If more ISPs did this, maybe we'd see a decline in sites that only work in MSIE...

  • Good idea to me (Score:5, Interesting)

    by Rainwulf ( 865585 ) on Wednesday April 13, 2005 @04:11AM (#12221358)
    i think this is a good idea as well. I work in technical support, and the amount of infected machines i have to deal with is just phenomenal. Cutting of the machines access to internet both fixes the problem. The customer goes "WTF" and i say.. yea your machine is infected. Either install nix or go to a computer store. However its open to abuse... define excessive traffic.. and what traffic is malware or legitimate traffic. However... since a good 90 percent of spam comes from infected machines as well (go windows you good thing go) its all thumbs up from me.

    • Re:Good idea to me (Score:4, Interesting)

      by asliarun ( 636603 ) on Wednesday April 13, 2005 @05:48AM (#12221660)
      I agree with you. This IS a big problem for ISPs. However, i feel that the solution is not to pass the buck onto the customers. You can't realistically expect Joe SixPack, who doesn't know the difference between the CD tray and a coffee cup holder, to keep his computer up to date with the latest service pack or patch.

      A better alternative for the ISPs, IMHO, would be to start behaving like the network administration team in a big company. Joe Sixpack would be better off if the ISP would install a centrally adminsitered system administration client on his machine that automatically scans and deploys the latest anti-virus program. I know that computer-savvy folks wouldn't like to give this much of control of their PCs to ISPs. However, for Joe, this would be the ideal hassle-free solution. With a proper security policy, privacy concerns would also not be an issue.

      The ISP could also have an opt-out policy that non-clueless people could make use of.

      Does this make sense?

      • You can't realistically expect Joe SixPack, who doesn't know the difference between the CD tray and a coffee cup holder, to keep his computer up to date with the latest service pack or patch.

        Why not? Most people don't know anything about how their cars work but do know that the oil needs to be changed at regular intervals and when the "Service Engine Soon" light comes on, it's time to visit a mechanic. They also know that if they don't do this their car will cease to function.

        I'm really sick of the wh

  • Waste of time? (Score:5, Interesting)

    by www.sorehands.com ( 142825 ) on Wednesday April 13, 2005 @04:15AM (#12221376) Homepage
    They should at least make a phone call to the party so they don't waste time trying to figure out the problem.

    Not all people pick up the phone and tolerate the script. Some people actually try to diagnose the problem first.


    Most ISPs have language in their terms of service that permits this action. It is a shame that an ISP need to have their services almost knocked out before taking action.

    I'd like to see some ISPs that ignore trojaned machines or support spammers get sued by other customers when their IP blocks end up on block lists.

    • Re:Waste of time? (Score:3, Informative)

      by Raumkraut ( 518382 )
      I was 'disconnected' from my ADSL a while back, not because any of my machines were infected, but because I'd tried scanning my company's IP.
      My ISP had detected traffic on port 135 (some Windows thing exploited by malware), and automatically stopped forwarding any connections to or from my home machines. The only port which was allowed was port 80, and every web page request was redirected to a help page explaining what had happened. :)

      After blocking port 135 at my router, all it took was clicking a l

  • Plusnet has a better way. (Score:5, Informative)

    by Zeussy ( 868062 ) on Wednesday April 13, 2005 @04:25AM (#12221409) Homepage
    My isp (plus.net) monitors any communications on port 135 etc and if it dedicates any when your connected. You get redirected to a Plus.net you may have been effected with MSBlast page etc. And give you the links to tools to fix it.

    Very handy indeed.

  • All ISPs should be doing this. (Score:5, Interesting)

    by Anonymous Coward on Wednesday April 13, 2005 @04:29AM (#12221419)
    All of these infected Windows boxes are killing the net. If ISPs would simply yank them as they show signs of infection (trojan, worms, etc) UNTIL the customers can demonstrate that they have taken care of problems, then things would be a lot easier.

  • Catch-22 (Score:5, Insightful)

    by Mr_Silver ( 213637 ) on Wednesday April 13, 2005 @04:32AM (#12221429)
    Of course, once you have no net connection, it becomes a little difficult to download all the latest Microsoft patches and virus updates to clean your machine so you can get back on the internet.

    Thats not to say it isn't impossible, but it wouldn't surprise me that taking a laptop/ipod/some other storage device big enough around to another friends house and getting all the updates is going to be beyond most people.

    Also, last time I checked, I can't download all the updates that have been developed after XP SP2 was released from a machine running Windows 2000.

    (side note: I'm on a 56k modem at home and therefore don't have a spare 3 weeks to get the several hundred megabytes of updates - and autopatcher xp hasn't been updated after sp2 was released)

    • Re:Catch-22 (Score:2, Insightful)

      by Guus.der.Kinderen ( 774520 )
      This is just a random thought, but what about this: after disconnecting, the ISP sends the customer a letter explaining why they dropped the connection, and include a coupon for a CD with some of the latest microsoft patches and servicepacks. They might even work out some deal with an antivirus vendor and add some shareware antivirus kits to cover the costs and send those CDs for free.
      • why not just "sandbox" the user into a explanation site and update.windows.com?
        if all dns querys outside of this would be dropped from users that are flagged as bad, it would also make the dos ineffective in the meantime.

    • Not really (Score:5, Informative)

      by Craig Ringer ( 302899 ) on Wednesday April 13, 2005 @06:27AM (#12221768) Homepage Journal
      With most such set-ups your Internet connection is generally not totally blocked, just severely restricted. Any web request gets proxy-redirected to a page with instructions on how to clean your machine up, and download links from the ISPs local mirrors. Anything else is locked down.

      I don't know if this is what bigpond are doing, but that's the usual way to handle this and it seems to work extremely well. My ISP uses a similar trick when users go over quota.

  • Nothing new (Score:5, Interesting)

    by Rob Kaper ( 5960 ) on Wednesday April 13, 2005 @04:33AM (#12221433) Homepage
    Dutch ISP Xs4All has been doing this for months/years, blocking all traffic (most notably SMTP) minus SSH and access to their HTTP proxy.
    • Then they're not really an "Internet" service provider are they....more like a "World Wide Web" service provider.

      • Re:Nothing new (Score:3, Informative)

        by pe1chl ( 90186 )
        They only put up this block after it has been shown that your system is virus or trojan infected and you have not responded to requests to do something about that.
        Normally there is no filtering whatsoever.

  • How will the user tell the difference? (Score:5, Interesting)

    by aussie_a ( 778472 ) on Wednesday April 13, 2005 @04:35AM (#12221439) Journal
    Lucky they're ringing up the user, because otherwise the user will just assume that they've been disconnected. Yet again. Bigpond is terrible with keeping it's users online (I'm talking broadband here), and believe that two to three disonnects per day is perfectly fine, even when those disconnects last for an hour or more.

    I can see it now:
    Customer: My broadband is down again.
    Bigpond: Oh, I see. Well from time to time this does happen for a brief moment...
    Customer: It's been down all day, and it's happened every day this week.
    Bigpond: I see.. What's your account *clickety* Oh yes, we've marked you as a computer with a trojan. Please do a virus scan and call us back, if it comes back negative we'll re-connect you.

    I'd go with someone else but they're the only broadband provider for my area. And I live in Sydney (the suburbs, an hour from the city itself)

  • Just traffic? Or trojan traffic? (Score:5, Informative)

    by SlashDread ( 38969 ) on Wednesday April 13, 2005 @04:45AM (#12221465)
    Look, I ALL for ISP's disconnecting "polluting" PC's. They just better make damn sure its not legit traffic.

    My ISP does exactly this, if it suspects trojan traffic it shuts you down (and snail mail you). You subsequently call the helpdesk, they ask what you did to resolve the matters (The ISP provides FREE anti-virus and firewall software). If they rae happy with your counter measures, theyll reconnect you in a jiffy.
    If you can explain you have a legit reason to hit DNS 9765 times per second, I suspect they'll unlock you too.

    I love it.

  • Slow response times? (Score:5, Insightful)

    by Stephen Samuel ( 106962 ) <samuel@NOsPaM.bcgreen.com> on Wednesday April 13, 2005 @04:52AM (#12221489) Homepage Journal
    One problem with this is that many ISPs are days (or even weeks) behind on responding to complaints. I have a script which automates the process of generating SPAM and virus complaints. In the cases where I've actually gotten a real-live response, it's almost invariably been days after my complaint. (It's only the smallest ISPs that seem to have a fast response time.) In the menatime, these machines have been spewing spam and viruses across the 'net.

    If Telestra is like any other large ISP I've seen, I figure that the first thing they should do is hire (or allocate) a good gaggle of AUP investigators so that their intelligence on this problem is reasonably real-time.

    They could also write some scripts to log and categorize the DNS queries that they're getting from their customers. It should be fairly easy to automatically identify the worst offenders. You could then send notes to their owners, and if there's no reasonable response, pull the plug. Over the last few years, I think that I've written scripts to do pretty much everything but the last step, so I know it's doable. (that last step should almost always be manual).

    • I agree with that. Each and every incoming Nigerian 419 Spam message gets a semi-automatic complaint sent to all involved parties here (only requires a manual confirm to make sure it is really a 419 message and not some misdetection by SpamAssassin).
      The idea is that when their replybox gets closed, they won't be able to collect. However, the enthousiastic "we have removed this user's account" message that I seldomly receive is rarely within a week of the complaint, making the entire process useless.

      For v

  • Other ISPs block ports in order to reduce threats (Score:3, Informative)

    by goonerw ( 99408 ) on Wednesday April 13, 2005 @04:52AM (#12221491) Homepage
    Aussie ISP Internode (one of the better alternatives to BigPond) deliberately block various types of malware (usually port blocking but other means have been employed such as IP blocking a client's IP) and an advisory is placed on the service status page indicating what is blocked and for how long.

  • suspected PCs? (Score:2, Interesting)

    by Anonymous Coward
    Why do they talk about 'likely source' and about cuting off 'suspected PCs'?

    Why not simply do a precise measurement (get the netflow from the router) and take actions based on correct data rather then guessing?

    I for one wouldn't want to be cut off by my ISP because of someone at the ISP is guessing.

  • My permanent boycott of Telstra (Score:5, Informative)

    by petrus4 ( 213815 ) on Wednesday April 13, 2005 @05:09AM (#12221543) Homepage Journal
    Attempting to strangle ADSL adoption, killing the national BBS community when the Internet first became mainstream in Australia in order to force adoption of Big Pond, and a host of other offenses meant that after an extended period of shopping around, I finally stopped using Telstra as a carrier completely last year, and they can now consider themselves permanently boycotted as far as I'm concerned. They are one of the most short-sighted, destructive, and generally amoral corporations I've heard of. They were also vocally criticised by Bill Gates during one of his visits here, for their strangulation of broadband adoption.

    Apart from the above, to some degree there are now price incentives to use other carriers as well, particularly for voice. If you've got a credit card, you also might want to check out TPG [tpg.com.au] for ADSL...they probably have the best deals I've seen.

  • NTL (Score:5, Insightful)

    by bcmm ( 768152 ) on Wednesday April 13, 2005 @05:13AM (#12221556)
    NTL (UK cable provider) does this. They once started redirecting all HTTP requests from our home network to a page saying "You have netsky. Download this." or something. I had to try this with the Linux box before I believed this wasn't an attempt to distribute malware. Thing is, I checked all the Windows machines with NTL's tool and with Sophos AV, and they were all clean.

    Other people with this problem have speculated that Linux machines (which NTL allows but "doesn't support") are sometimes mis-detected as Netsky-infected Windows PCs.

    The moral is, if this sort of thing is going to become widespread, they need good detection of many different types of network usage, and they need to tell them by phone instead of just giving them what looks like a default-homepage highjack.

    In a similar vein, remember MS marking VNC as spyware? Imagine if an ISP starts taking down VNC servers for the users own security, etc, etc.

  • sick are put in quarantaine net (on this uni) (Score:5, Interesting)

    by Anonymous Coward on Wednesday April 13, 2005 @05:26AM (#12221597)
    When computers here (utwente.nl) are infected it is usually automatically detected, resulting in every webrequest going to "you're in quarantaine, you can download clean-up tools HERE, and when you're clean send us a message HERE. apart from that you can connect to nothing." If you're interested, it's run by the guys from http://snt.student.utwente.nl

  • Pretty Standard (Score:5, Interesting)

    by jchawk ( 127686 ) on Wednesday April 13, 2005 @05:29AM (#12221610) Homepage Journal
    I'm surprised it's taken them this long. When one of our customers gets infected with a virus / open proxy / etc... We *gasp* pay attention, shutdown their connection and immediately contact them and help them fix the problem.

    It's amazing how quickly you can get your network under control doing this. And 9 times out of 10 the end user is greatful that you were willing to work with them to help them correct the problem.

    Fixing infected machines on your network only makes the network a better place for everyone using it.

  • Not So Fast, Sonny Jim (Score:5, Funny)

    by SQL Error ( 16383 ) on Wednesday April 13, 2005 @06:03AM (#12221695)
    I work for a phone company here in Oz, and among other things we resell Telstra ADSL.

    I've seen Telstra claim that a customer on a 512/128 line (512kb/s down, 128kb/s up) uploaded 4GB in 20 hours. When I pointed out that this was impossible, they suggested that maybe the user's computer had been infected by a virus - and insisted that I check this before they would investigate.

    I then spent some time explaining the concept of arithmetic to the Telstra support desk...

  • Best Practice (Score:5, Insightful)

    by MrNonchalant ( 767683 ) on Wednesday April 13, 2005 @06:21AM (#12221741)
    Send the effected customers (better yet, all customers) a CD with a free anti-virus, free anti-spyware, a free firewall, an alternative browser, and the latest updates for all of the above plus Windows and Office (including support for ME, NT, 2000, 98 SE, 98, and 95). With it include a letter explaining courtiously and simply why security is important. Sure, you'd probably have to get permission from a dozen different legal departments to do distribution of nominally free software on a wide scale like that, but some companies I know would jump at having their demo version shipped.

    Back this up with your regular tech support. Yes, some users will be too clueless but a good deal won't. A fair percentage of the clueless ones will catch on quickly when their internet gets shut off and stays off. I can guarentee you the network traffic they'd get would drop to a third of the levels seen before.

    Actually, in this perspective AOL's lackluster virus and spyware protection make perfect sense.

  • How acquire spyware removal tools if disconnected? (Score:4, Insightful)

    by matt me ( 850665 ) on Wednesday April 13, 2005 @06:39AM (#12221797)
    I don't think the ISPs quite thought this plan though. Users aren't going to be able clean up their computers without tools such as ad-aware and spybot search & destroy. These ppl probably don't even have a virus checker at all. The necessary software is freely avaliable online, but without a net connection these ppl will have to buy $100 of stuff at PC World. And that'll need updating online anyway.

    A better idea would be to restrict bandwidth and connections on infected computers. The ISP should also post everyone they disconnect a CD with the usual free tools and instructions on how to use them. Along with Firefox and Thunderbird, of course.

    I agree though, action should be taken against owners of zombie computers. They're irresponsibly spoiling the internet for others. Such users who think 'Internet Explorer' is the internet and believe the internet = the web.

    While such ignorant users should be allowed to run computers in private, once they're connected to the internet, they become a danger to everyone else. The way I see it, I'm not allowed to drive a car on the road without first taking a test to make sure I can use it safely, and recognise and repair common problems (or at least take the car to the garage). This requires knowledge of both how the mechanics of the engine work, and of the highway code. So why are people who have never even seen the inside of computer and don't realise that connecting an unpatched WinXP box to broadband is as dangerous as speeding down a motorway in the opposite direction to all traffic, allowed to do exactly that?

  • That's nothing (Score:5, Interesting)

    by themusicgod1 ( 241799 ) <.jeffrey.cliff. .at. .gmail.com.> on Wednesday April 13, 2005 @06:52AM (#12221833) Homepage Journal
    Here at the University of Regina my roommate MachinationX had gotten a virus on his WinXP box (why didn't he have antivirus software?! he's an IT consultant!! but I digress) So our ISP (U of R computing services) not only disconnected him from the network, but refused to let him back on the network unless he agreed to give them his computer and let *them* run an antivirus scan on it , after which it would be returned. I happened to have some of my old backups on his machine at the time, but the point is that our ISP can not only watch your internet traffic(as they have been), but if you "get a virus" they can disconnect you and demand they have access to all your personal files at will.

    Blows my mind.

    • (Uni computing services) != (commercial ISP) (Score:5, Insightful)

      by sczimme ( 603413 ) on Wednesday April 13, 2005 @07:29AM (#12221968)

      So our ISP (U of R computing services) not only disconnected him from the network,

      So you get your Internet feed through Uni computing services - noted.

      but refused to let him back on the network unless he agreed to give them his computer and let *them* run an antivirus scan on it , after which it would be returned.

      That's actually not a bad idea. They want to be sure that the system in question is no longer a problem. I'm sure you can see where a user would have motivation to lie about the scan if it would get him back on the network.

      but the point is that our ISP can not only watch your internet traffic(as they have been), but if you "get a virus" they can disconnect you and demand they have access to all your personal files at will.

      Blows my mind.

      Re: watching traffic, disconnecting users - re-read the Terms of Service you signed when you accepted their Internet access; I suspect you will find they've had these capabilities all along.

      However, your comment about demand... access to all your personal files at will is completely ridiculous.

      First, computing services will only need to examine your PC if it causing a problem for other users; if things have gotten to this point you are either unable or unwilling to maintain the machine yourself and have effectively abdicated this responsibility.

      Second, you probably already gave them permission to require such a scan when you agreed to the ToS (see above).

      Third, who says your personal files have to remain on the machine if/when you turn it in for virus scanning?? Your roommate was told to deliver the computer; he can sanitize it before he does so. (This should be obvious.)
      The University is not a commercial ISP. They provide the Internet access as a tool for you to use to further your education. It is a shared resource, and if you are causing problems they can rectify said problems as necessary based on the ToS. If you don't like their ToS you are free to go back to dial-up or pay for a T1.

  • My ISP does this regularly (Score:4, Informative)

    by tmk ( 712144 ) on Wednesday April 13, 2005 @06:55AM (#12221845)
    My ISP Netcologne disconnects PCs that are infected with trojans and try to infect others. The connection is interrupted and when the costumer tries to connect again he can only access one page, that shows an information. He can download Antivir there, too.

    There are two restrictions: Netcologne certainly does not monitor all traffic - they react on abuse-messages. And this "service" is not available to business costumers.

  • Routine? (Score:3, Insightful)

    by Kumochisonan ( 704897 ) on Wednesday April 13, 2005 @07:08AM (#12221879) Homepage
    My Employer, a large national Cable ISP in Britain routinely suspends service to customers due to nasties on the unsuspecting users PC. Our infrastructure runs daily scripts that scan for open mail proxies and other suspicious ports that may be open. It's just part of the normal security process.

    However it never used to be, this aggressive step of securing our network was prompted by the ISP being threatened with a Usenet Death Penalty, twice.

    Whether this BigPond story is any different (Because it deals with Trojans rather than mail relays) is another matter...

  • Cox Business ISP Does This (Score:3, Interesting)

    by SoupIsGood Food ( 1179 ) on Wednesday April 13, 2005 @07:25AM (#12221944)
    The Business Class cablemodem accounts with Cox Communications are cut off if their security systems catch suspicious activity (DDOS packets, worm traffic, etc.) or open relays on your network connection. They're very polite about it, explain the problem and how to get it fixed. Their security department's not open after hours, either, so you're horked if you figure this out after midnight.

    Haven't had to deal with their nice security people myself (No Windows or Linux or Sendmail here!), but I've laughed at colleagues who have. Mostly the same people who believe a $70/month cablemodem or DSL connection can replace their $800/month fiber line for serious webhosting enterprises.

    SoupIsGood Food

  • This is certainly within precedent (Score:4, Insightful)

    by smchris ( 464899 ) on Wednesday April 13, 2005 @07:29AM (#12221966)
    Amateur radio operators, for example, have a responsibility to make sure their equipment is working properly, properly tuned, and operated without malicious intent so that it doesn't interfere with others.

  • Ah... this is unusual? (Score:4, Insightful)

    by jidar ( 83795 ) on Wednesday April 13, 2005 @08:44AM (#12222284)
    I've worked for 3 ISP's in the midwest, and all of them have had no tolerance policies that allowed them to cut the customer off at the first sign of spam, trojan or virus activity. I personally have cut off dozens of accounts this way, and why not? People are responsible for their own machines, asking them to keep them cleaned up isn't unreasonable in my opinion. In fact, asking us to keep supplying service to them while their rogue systems flood the net with crap is a lot more unreasonable than that imo. This isn't like their bill is a day late or something, this is an active malicious atttack on the network, of course we aren't going to let it go on regardless of whether the customer is home to pick up the phone when we detect it. That's how it should be.

  • Roger's Cable Internet (Canada) Is Doing it Too (Score:3, Informative)

    by quakeroatz ( 242632 ) on Wednesday April 13, 2005 @12:09PM (#12224022) Journal
    I've had some phone calls lately from clients that were disconnected from Roger's Highspeed Cable becuase they were trojaned or mass mailing. After inspecting 3 systems, they were all infected with NetskyP and Bugbear.

    Both were very easy to remove, I even used Microsoft's Malicious Software Removal Tool [microsoft.com] (gasp) that was quick and easy. I wish they would kick all of these infected PC's offline and we wouldn't be dealing with these erratic spikes that have now made turned FPS gaming into a modem like affair.

    I bet a few of the "free" antivirus companies, like AVP could make a killing sending out "AOL Like" demo cd's that cure the ails of all these banished network newbies.

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close