![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
NETI@home Data Analyzed 155
An anonymous reader writes "The NETI@home Internet traffic statistics project (featured in Wired and Slashdot previously) has a quick analysis on the malicious traffic they observed. It's a rough world out there." Perhaps not suprising, but still disheartening, the researchers find among other things that a large portion of typical end-user traffic consists of malicious connection attempts.
But did they find intelligent life? (Score:5, Funny)
Re:But did they find intelligent life? (Score:1, Funny)
Re:But did they find intelligent life? (Score:5, Funny)
Re:But did they find intelligent life? (Score:4, Funny)
Considering.. (Score:5, Insightful)
It would be like setting up a massive feedback loop on a mail server. When user X gets message X, he passes message X to user Y, who upon receiving message X sends it back to user X.
Re:Considering.. (Score:2, Interesting)
Oh, so there should be a central hub where the virus/worm can talk to other copies of itself. Any place it could talk to itself would quickly be located and shutdown. Besides, I don't think the writers of these kinds of programs are really concerned with your network utilization.
Most of the malicious type traffic I'm seeing lately (aside from SPAM) is ssh worms trying to log into my boxes. Most boxes are set to only allow ssh from a few IPs or subnets, but I have one that I block class A's anytime I see
Re:Considering.. (Score:2)
Not if it's on freenet...
Re:Considering.. (Score:2, Funny)
Not true! For example, they follow RFC 3514 [faqs.org]
Standards for viruses? (Score:4, Insightful)
The only way viruses will ever get standards is if the authors agree that they will get a considerable benefit by working together. I can't see that happening.
DSL/modem/router (Score:5, Insightful)
I would like to see more ISP isntead of suplying basic DSL modems with those overpriced sign up deals but instead a proper firewall/router/Dsl modem.
This would save us all alot of pain in the long run .
Recent Worms DO organize to manage utilization (Score:4, Informative)
Code Red II [caida.org] implemented a randomized variant on this: "1/8th of the time, CodeRedII probes a completely random IP address. 1/2 of the time, CodeRedII probes a machine in the same /8 (so if the infected machine had the IP address 10.9.8.7, the IP address probed would start with 10.), while 3/8ths of the time, it probes a machine on the same /16 (so the IP address probed would start with 10.9.)" It means the worms don't have to keep track of phases, but it gets similar effects, and while there is more chance of overlap, it's not too high until the worm's infected most of the net, and the added random searches help make up for machines that didn't successfully infect their netblocks due to firewalls or failures or simple slowness.
At least one worm that took this sort of approach had a bad random number generator, so it kept hitting the same territory too hard and missing other wide-open spaces, which protected a few parts of the net from infection.
Re:Recent Worms DO organize to manage utilization (Score:2)
The big reason is the sheer vastness and varied topology of the Internet. Try running a massively distributed application sometime and get a real life education in exactly how theoretical the guarantee of data transfer between two machines picked at random is. My
RBL of infected/malicious sites? (Score:5, Interesting)
Re:RBL of infected/malicious sites? (Score:3, Informative)
From the abstract of their paper:
Finally, we look at activity relative to the IP address space and observe that the sources of malicious traffic are spread across the allocated range.
So the answer is no, you can't filter effectively for bad sites.
Re:RBL of infected/malicious sites? (Score:2, Interesting)
Re:RBL of infected/malicious sites? (Score:5, Insightful)
Time to drag out this old chestnut (Score:4, Funny)
-Benjamin Franklin
Re:Time to drag out this old chestnut (Score:2)
Re:RBL of infected/malicious sites? (Score:1)
Don't use SSH password authentication (Score:5, Insightful)
Re:Don't use SSH password authentication (Score:1, Insightful)
Exactly right. It's almost trivial even under Windows to do it. Two factor should have been a standard years and years ago but as long as people can have four to eight digit passes which are easy to break, we keep seeing problems that shouldn't be there.
Anyone notice that PGP has passphrases of quite possibly insanely large size? It's hard to remember some farked and leeted phrase chosen to confound brute force and guessing when you have t
Re:Don't use SSH password authentication (Score:2)
Re:Don't use SSH password authentication (Score:1)
Re:Don't use SSH password authentication (Score:2)
On a UNIX ssh server (Open/Fsecure) look into the "PasswordAuthentication" parameter in sshd_config. Setting this to "no" will prevent password authentication to proceed. Check with '-v' to ssh; it will tell you what authentication methods that can proceed. Haven't played with a Windows sshd ser
Re:Don't use SSH password authentication (Score:1)
Re:RBL of infected/malicious sites? (Score:4, Informative)
Very highly recommended. With the case of p2p, it's good to keep your head down. It's the tall ones that get their heads chopped off...
They also have software to convert the lists to various formats for use in different firewalls. iptables fans should check out "linblock". Beware though, a large list can take an hour to parse on your typical recycled firewall box, but the tool merges the ranges to keep the tables as short as possible.
Re:RBL of infected/malicious sites? (Score:2)
Re:RBL of infected/malicious sites? (Score:2)
Also, a lot of zombies on the net sit on dynamically addressed machines. The next time a zombie connects to the net, your RBL won't block him since he will be coming from a different address.
Re:RBL of infected/malicious sites? (Score:2)
A bit controversial, mind you, but I'd like to see it incorporated in some projects like IPCop, for example.
List of Zombie Blocklists (+ other Bad-Site-BLs) (Score:3, Informative)
More malware, slower computer and net connection.. (Score:1)
Not necessarily a Bad Thing... (Score:4, Insightful)
Assuming that the statistics show which IP address ranges are the worst offenders for malicious traffic, the ISP(s) responsible could simply shut down the outbound connection(s) of the "problem" users until they de-virus their systems and KEEP THEM THAT WAY.
Perhaps that will help to finally clue people in that having Internet connectivity is a privilege, not a right, just like driving. If you're going to enjoy an Internet connection you need to show some responsibility for making sure your own system isn't going to be a problem to others.
I -still- think there should have been Internet user licenses, just like we have driver's licenses...
Keep the peace(es).
Re:Not necessarily a Bad Thing... (Score:2, Insightful)
Re:Not necessarily a Bad Thing... (Score:4, Interesting)
Maybe it would be a good idea to throttle the users down to a bare minimum and redirect all http traffic to a gateway page to tell them they have a problem with their computer they need to correct. It seems to work for wireless access points in hotels/airports/coffeeshops. Why can't big ISPs do the same thing?
Re:Not necessarily a Bad Thing... (Score:3, Insightful)
Any ISP who puts something like what you described in place is likely to lose customers in a hurry. Hotels/Airports/Coffeeshops have transient, non-recurruing customers, or the customers are there for somethi
Re:Not necessarily a Bad Thing... (Score:2, Interesting)
Re:Not necessarily a Bad Thing... (Score:2)
Cable Modem Customer Lock-In is Stronger (Score:2)
Re:Not necessarily a Bad Thing... (Score:2)
Would you really want to piss of 40% of your client base in one swoop?
No need to disconnect them initially. Just email with a warning and simple instructions on how to fix it, maybe linked to a web app to do the work. Most naive users are paranoid about viruses due to the media exposure and are happy to fix it if they are told how.
---
Keep your options open!
Re:Not necessarily a Bad Thing... (Score:4, Insightful)
Re:Not necessarily a Bad Thing... (Score:2)
Re:Not necessarily a Bad Thing... (Score:1)
Re:Not necessarily a Bad Thing... (Score:1)
You say that internet access is a privilege and not a right. True. But if I sign with an ISP and they do not disclose they they will block my access beforehand, aren't they breaking a legal agreement? In that case, do I not have a right to take legal action? If their contract does state they can shut down my connection, then fine. But in that case, I can switch ISP's
Re:Not necessarily a Bad Thing... (Score:2)
I'm sorry you feel that way. Are you saying, then, that people should NOT be held responsible for whatever spew their virus-compromised system sends out, regardless of how many problems it may cause other systems? That's what licensing would have done -- provide accountability.
If you can suggest a better way to provide some sort of accountability, then please go right ahead and suggest something. I don't pretend to have all the answers, and name-calling is hardly productive.
In other news... (Score:5, Funny)
Root of the problem (Score:5, Insightful)
Now, stepping back to the Windows complaints...wouldn't the ISP turning off your access motivate you to get a BASIC education in computing and maintain your PC?
To make an analogy, in most states you need to have your car inspected (and some require emissions inspection, too). PUBLIC roadways means you share it with other people...an unsafe car affects more than just you. When you're connected to the net, your PC affects everyone else. I'm not suggesting the ISPs make an inspection system or a law passes to force ISPs to monitor traffic, but the same logic applies....someone should be doing checkups and flagging the offenders.
Re: (Score:3, Insightful)
Re:Root of the problem (Score:2, Informative)
Re:Root of the problem (Score:2)
Re:Root of the problem (Score:2)
I do entirely agree with the idea of passive analyzers and filters, as long as they don't inhibit legit traffic. Put the burden on the ISP in this case.
Cheap access means unsafe computing (Score:5, Interesting)
At least such is their thought process as often presented. I suspect it's bad cost-benefit analysis; if your dumber customers leave, it's probably a net win for you. Smarter customers mean less bandwidth (at least, they don't act as spam zombies maxing out the bandwidth) and fewer tech support hours explaining how to fix the cup holder.
The big players (AOL, Comcast) are the best targets for this logic, but they live for those left-side-of-the-bell-curve customers. They're the "default" ISPs that people get because they're so readily available, so they get all the customers who don't know better. (Hell, I don't know better; I use Verizon for my DSL but I don't let them do anything but provide me bits.)
So AOL and Comcast are in a bit of a bind; they don't want these customers, but they don't want to lose them, either. I think that they're probably going to have to use gentle persuasion to say, "Hey, it looks like you've a spam zombie. Please call your cousin's best friend to clean the crap off your computer again and give you a stern talking-to. And please stop downloading Bonzi Buddy."
Re:Cheap access means unsafe computing (Score:1)
This is mostly considered a benefit since it helps the customer in keeping his PC operational. My father lost access to sending mail for a couple of days after getting
Re:Cheap access means unsafe computing (Score:2)
Another thing that will cost the ISPs money? Lawsuits. Class action lawsuits from people that experience damages from zombie PCs and virus infected spew-factories that could EASILY be shutdown by an ISP with a minimal effort of outbound scanning.
Re:Cheap access means unsafe computing (Score:2)
(Even so, eventually you'll find some lawyer willing to take the case. He'll treat it as a lottery ticket: low odds but a big win.)
So why don't they think it'll win? I'm not a lawyer, but I suspect that the defense will run, "Look, we just carry the bits. If you don't like the bits I send you you're free to set your router to drop 'em on the floor. It's not our job to censor our cust
In Defense of AOL (Score:2)
Because hundreds of people have my "public" email address in their address books, I recive dozens (sometimes hundreds) of virues per week when
Re:In Defense of AOL (Score:2)
Some of it must be filtering (blocking viral messages before they hit the user) on incoming mail. They may even be censoring outgoing mail. As for other worms, like sasser, I suspect they blocked the relevant ports long before XP SP2 came out.
But that's supposition. I'd love to know for sure.
Re:Cheap access means unsafe computing (Score:2)
Hey, I know it's below the
Re:Root of the problem (Score:3, Insightful)
You should have just stopped there. Analogies are fucking stupid. Car analogies even moreso. Just stop it.
The reason why your analogy doesn't hold? Computers with viruses can't kill people. Cars with bad brakes can.
someone should be doing checkups and flagging the offenders.
If you want to pay for it, go right ahead. I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.
Re:Root of the problem (Score:2)
How do you know? Are you connected through some different internet than the rest of us. Some magical place where a goodly percentage of the traffic isn't malicious?
What if everything were all of a sudden faster, because there wasn't that stuff sucking up bandwidth?
Re:Root of the problem (Score:3, Insightful)
Oops! Someone hasn't noticed the number of trains and ships running Windows. No danger of a virus killing anyone there, then.
I don't experience any significant negative effects from zombie machines, so I am not willing to pay for such a system.
Someone also hasn't noticed the amount of effort that goes into protecting his system from zombie machine. Perhaps he thinks firewalls were a gift from unknown stellar travellers and spam filters require no effort to creat
Re:Root of the problem (Score:1)
Besides, you're paying for the spam/virus bandwidth in your monthly fees. Which is more expensive, bandwidth or forcing spyware-checks?
Re:Root of the problem (Score:2)
Red herring. Give me one example of a fully operational system (read: not that 7 year-old Navy test that everyone parrots) that has had a problem. In any case, Windows is a desktop OS and should not be used in these situations to begin with.
Perhaps he thinks firewalls were a gift from unknown stellar travellers and spam filters require no effort to create and update.
Well, my f
Re:Root of the problem (Score:2)
So, in contradiction to what you said in your post, you not only ARE willing to pay but you did in fact pay for protection.
TWW
Re:Root of the problem (Score:5, Funny)
Re:Root of the problem (Score:2)
Let me introduce you to California, my friend. Your car must pass SMOG tests, and if you don't pass, you will be paying for repairs so that it does pass.
If your car doesn't pass, will it kill someone? Probably not. There goes your reasoning.
ISPs could easily end most viral outbreaks with outbound scanning of port 25 traffic. Sadly, they won't do this until they start getting sued over it.
Re:Root of the problem (Score:2)
State vehicle emission tests are done as a result of the Clean Air Act which requires the States to meet what are known as the National Ambient Air Quality Standards (NAAQS). The reason some states don't have emission tests is because their air quality does not yet exceed the NAAQS.
In any case, a health argument can still be made to justify pollution reduction. While one car out of emission spec will not
Re:Root of the problem (Score:2)
Here is an additional error in your analogy. PUBLIC does not simply mean you share it with other people. Rather, it means "Maintained for or used by the people or community". Internet access is not a public utility (to wit. ISP's vs. municipal broadband), it's more like a toll road. There's nobody on the internet who doesn't directly pay t
Re:Root of the problem (Score:5, Insightful)
Bollocks.
The aren't running a network in their parents basement you know. Their networks are massive, with nodes LITERALY spanning thousands of miles. The volume of traffic they deal with is HUGE. They use cutting-edge routers just to keep up with the demand.
How on earth do you do traffic analysis on that level? You might be able to catch some of the more obvious spammers, but how do you differentiate (on the IP level) between: a) a residential user b) a commercial user who maildrops willing customers c) a zombie d) a community group or e) blah. Blocking someone based on traffic is not possible, unless you want to lose your valid customers.
What they should do is be more responsive to complaints. If a customer of theirs is a zombie spambot or acting as a stepping stone for some script kiddie, they should have their connection suspended until it is remedied. But they can only do this based on a complaint.
Besides, what's the profit in spending any resource on the problem in the first place? Until that is affected, they won't care about it.
Blocking Forged Packets is Very Easy RFC2827 (Score:2)
AT&T Internet Protect traffic analysis system (Score:2)
Re:Root of the problem (Score:1, Insightful)
I know Speakeasy polices their network for open SMTP relays, because I see it in my server logs. I don't know if they actively look for zombied machines, but I can tell you that they've pretty quickly shut off the connections of customer machines on their network that I've brought to their attention when I've seen obvious worm-related connection attempts
In a few minutes... (Score:4, Funny)
malicious? (Score:3, Informative)
Re:malicious? (Score:1)
If you had RTFP, you would have noticed they actually tracked a lot of that down and counted it as benign, not malicious, since they could ID the IP at their university.
Re:malicious? (Score:1)
Flow observation conclusions... news u can use (Score:4, Interesting)
ISPs are already starting to work together on this type of information. If an ISP sees malicious worm spreading behavior, it can upload the offending IP into a global db that all ISPs can use to block at their borders.
Again, the authors conclusions are that nothing beats having a nice dark block to trigger alerts.
Re:Flow observation conclusions... news u can use (Score:2)
I resemble that remark. (Mmmmm, three class C's...) Benefits or working for an organization who got on the net back when Arin was handing out blocks like candy.
Next Step? (Score:4, Insightful)
The biggest problem in Intrusion Detection Systems (buzzword for firewalls with more intelligence than a typical rule-based firewall) is that metrics gathering is occuring at a specific site, making it difficult to discern malice intent from dropped packets or bad coding.
Any time the central server sees a certain threshold of malicious attempts from a single IP, it adds it to a short term blacklist... Make the term length just slightly longer than the reporting period so if it persists it'll remain on the list but if it stops, the IP is cleared in short order.
Spyware? (Score:1)
Re:Spyware? (Score:1)
proposal (Score:3, Funny)
This project will record 3 years of data and prove once and for all whether or not it actually rains in seattle.
sincerely,
Kelly H.
Head research scientist
Darington Univeristy of Heretics
The Most Illegible Graphs. Ever. (Score:3, Funny)
Re:The Most Illegible Graphs. Ever. (Score:3, Funny)
This is /. Pretty is for Windows users. [ducks]
Re:The Most Illegible Graphs. Ever. (Score:2)
Apparently no one told the authors the second thing anyone reading a paper does is skim over the graphs and tables. I had flashbacks to a lecture from a lab professor about making clean clear graphs after trying to decode those cryptic plots.
Re:The Most Illegible Graphs. Ever. (Score:1)
The number of the port molested isn't really a good ordinate.
Randomly Generated Topics? (Score:1)
one of the randomly generated research papers
i got from that MIT research groups website..
(Questions...)
I passed the randomly generated paper around campus to a bunch of C.S. kids and they all bought it without thinking.. Quite amusing...
Re:Randomly Generated Topics? (Score:1)
neti samples (Score:1)
If you build it, they will portscan (Score:1)
Does it prove or disprove simple A==B logic to note that these incidences of spyware and insecurity are growing at the same time as adoption of Linux variants? Just musing on the "l33t win script kiddie finds Linux religion" phenomenon I've been seeing lately.
Anyhow, this does suggest further that security is where it is at for the future skillset of interest at intervie
Maybe analyze their own network trafic? (Score:1)
Re:Maybe analyze their own network trafic? (Score:1)
Reminds me of a friend who works at Adobe, trying to get us to post a large PDF for our web page, when all we needed was a small 4k JPEG.
People who don't grok that half the Net has limited bandwidth don't deserve to ever use the Gigabit Internet we use here at universities, IMHO.
If it doesn't need formatting, sending it in clear text.
April 27th-30th? (Score:2)
Apparently this site will be linked to by Slashdot in two days, but it hasn't been yet...
Re:April 27th-30th? (Score:1)
Re:April 27th-30th? (Score:1)
Big deal. (Score:2)
It remains to be seen if I'll find positive results.
-Peter
So Yeti@Home isn't for you? (Score:2)
Re:So Yeti@Home isn't for you? (Score:2)
Blocked sinuses? No problem! Just as a carefully contained fire can clear a forest choked with dense undergrowth, so too can fire cleanse your sinuses of all manner of ills.
Just one problem. What color should it be?
-Peter
Neti? (Score:2)
PDF, ack (Score:3, Insightful)
Slashdot generates "malicious" traffic too (Score:2)
If I didn't know it/ ignorant etc, I would see 100s of port scans from a huge , evil T class machine.
Oh btw CmdrTaco, don't hack my machine