[191760] in North American Network Operators' Group
Re: Krebs on Security booted off Akamai network after DDoS attack
daemon@ATHENA.MIT.EDU (Mark Andrews)
Mon Sep 26 19:41:50 2016
X-Original-To: nanog@nanog.org
To: "Livingood, Jason" <Jason_Livingood@comcast.com>
From: Mark Andrews <marka@isc.org>
In-reply-to: Your message of "Mon, 26 Sep 2016 23:32:12 +0000."
<03DC1038-024A-4D9F-AC5B-3E88CDF56246@cable.comcast.com>
Date: Tue, 27 Sep 2016 09:41:42 +1000
Cc: John Levine <johnl@iecc.com>, "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
In message <03DC1038-024A-4D9F-AC5B-3E88CDF56246@cable.comcast.com>, "Livingood, Jason" writes:
> On 9/26/16, 7:09 PM, "NANOG on behalf of Mark Andrews" <on behalf of
> marka@isc.org> wrote:
> > A good ISP would be informing their customers that they are seeing
> anomalous traffic.
>
> Therein lies the problem if the traffic does not look anomalous I
> suppose. But even if it does look unusual, ISPs would be asking consumers
> to trash/update/turn off a lot of devices in time like when every home
> has 10s or 100s of these devices.
> ISP: Dear customer, looks like one of your light switches is sending spam.
> Customer: Which one? I have 25 light switches. And 25 smart bulbs. And 3
> smart TVs, and 3 smart thermostats, and 6 cameras, and
>
> ;-)
>
> Jason
>
Dear customer,
we are seeing <xxxx> traffic coming from your network.
If you need help isolating the source of the traffic here are a few
companies in your city that can help you.
<list of companies>
This is not a exhaustive list.
Support
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
