[169583] in North American Network Operators' Group
RE: Hackers hijack 300, 000-plus wireless routers, make malicious
daemon@ATHENA.MIT.EDU (Ian McDonald)
Tue Mar 4 13:34:35 2014
X-StAndrews-MailScanner-From: iam@st-andrews.ac.uk
From: Ian McDonald <iam@st-andrews.ac.uk>
To: Octavio Alvarez <alvarezp@alvarezp.ods.org>, jim deleskie
<deleskie@gmail.com>, Andrew Latham <lathama@gmail.com>
Date: Tue, 4 Mar 2014 18:33:46 +0000
In-Reply-To: <53161615.6040604@alvarezp.ods.org>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Until the average user's cpe is only permitted to use the resolvers one has=
provided as the provider (or otherwise decided are OK), this is going to b=
e a game of whackamole. So long as there's an 'I have a clue' opt out, it a=
ppears to be the way forward to resolve this issue. Shutting down one set o=
f 'bad resolvers' will simply cause a new set to be spawned, and a reinfect=
ion run round the still-unpatched cpe's of the world.
Thanks
--
ian
Sent from my phone, please excuse brevity and misspelling.
________________________________
From: Octavio Alvarez<mailto:alvarezp@alvarezp.ods.org>
Sent: =FD04/=FD03/=FD2014 18:09
To: jim deleskie<mailto:deleskie@gmail.com>; Andrew Latham<mailto:lathama@g=
mail.com>
Cc: nanog@nanog.org<mailto:nanog@nanog.org>
Subject: Re: Hackers hijack 300, 000-plus wireless routers, make malicious =
changes | Ars Technica
On 03/04/2014 05:28 AM, jim deleskie wrote:
> Why want to swing such a big hammer. Even blocking those 2 IP's will
> isolate your users, and fill your support queue's.
When the malicious DNS services get shutdown you will still have your
support queue's filled, anyway.
Doing it now will let you identify those affected. Blockage doesn't have
to be all-or-nothing. It can be incremental, selective or all-or-nothing
on some time windows.
Better now than later.
