[97494] in North American Network Operators' Group
Re: Quarantining infected hosts (Was: FBI tells the public to call
daemon@ATHENA.MIT.EDU (Jeroen Massar)
Mon Jun 18 07:42:33 2007
Date: Mon, 18 Jun 2007 12:41:41 +0100
From: Jeroen Massar <jeroen@unfix.org>
To: Suresh Ramasubramanian <ops.lists@gmail.com>
Cc: frnkblk@iname.com, Sean Donelan <sean@donelan.com>,
nanog@nanog.org
In-Reply-To: <bb0e440a0706180429n106ca66fg2691fd31cde63386@mail.gmail.com>
Errors-To: owner-nanog@merit.edu
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig2EB89D913D54AA0355FB2970
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Suresh Ramasubramanian wrote:
> On 6/17/07, Jeroen Massar <jeroen@unfix.org> wrote:
>=20
>> IMHO ISPs should per default simply feed port 25 outbound through thei=
r
>> own SMTP relays. BUT always have a very easy way (eg a Control Panel
>> behind a user/pass on a website) to disable this kind of filtering. Th=
is
>=20
> Y'know, port 25 is just the tip of the iceberg when it comes to what
> all an infected host can do ..
Of course, though 25 is (afaik ;) the most abused one that will annoy a
lot of other folks with spam, phishings and virus distribution, though
the latter seems to have come to a near halt from what I see.
> which is why quite a lot of ISPs (Bell
> Canada is particularly good at it, as are some others) are getting
> good at deploying "Walled Gardens" - vlan the infected host into its
> own little sandbox from where it can access only windows update, AV
> update sites and the ISP's support pages, nothing else, on any port.
>=20
> The user has to fix (disinfect, reimage, whatever) his host before he
> contacts the ISP support desk and gets let back onto their network.
That is IMHO really the only way to go. People who get hit by that once,
or maybe even twice will make sure it doesn't happen the third time.
Support costs will effectively sink because of such a system as it will
avoid those hosts from infecting others hosts, to be part of bot nets,
spam attacks etc etc etc.
(Especially for managers: Lower your TCO! Drive Business! $buzzword!)
I tip my hat to the Bell Canada folks for having such a system!
Greets,
Jeroen
--------------enig2EB89D913D54AA0355FB2970
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Jeroen Massar / http://unfix.org/~jeroen/
iHUEARECADUFAkZ2b3YuFIAAAAAAFQAQcGthLWFkZHJlc3NAZ251cGcub3JnamVy
b2VuQHVuZml4Lm9yZwAKCRApqihSMz58I4WZAJ9KShkXJaGodi79Mn58PA1RkZVk
DQCdG431WZbBzBk7F2/ybZDyuayElUs=
=qv2B
-----END PGP SIGNATURE-----
--------------enig2EB89D913D54AA0355FB2970--
