🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #1113

ISPs can easily decrease net abuse

#1113
From: Jem Berkes
Date: Mon, 01 Dec 2003 16:12
33 lines
2854 bytes
As I'm sure lots of you are aware, cable/DSL machines are infected by 
viruses and worms like nothing else. They become sources of email viruses 
and other types of malicious traffic.

Then something occurred to me. Wouldn't it help dramatically if ISPs 
delegated static IP addresses for any kind of permanent connectivity? This 
way, customers' addresses would stay constant and make them easier to track 
down:

1) Anti-spam/proxy/hijack systems would see abuse coming from a particular 
IP and could more easily identify that abuse source without huge collateral 
damage. Currently, DNSBLs are force dto list entire netblocks, or even all 
dynamic IP addresses!

2) Responsible parties would be easier to track down, regardless of type of 
abuse and historical records found online (e.g. IPs in logfiles) could be 
associated with a single entity

3) Infected hosts that are spewing worms by any method could be 
automatically blocked by routers/gateways, since the IP address is constant

My experience with Internet security has been that when abuse such as spam, 
viruses, or malicious UDP traffic is found to come from a dynamic IP the 
admin shrugs it off, whereas when abuse comes from a static source more 
serious steps are taken. So why allow people that dynamic shield?

Imagine if there was a type of cheap cell phone service designed to 
facilitate outgoing calls only, accomplished via a dynamic origin phone 
number (that changed daily), making nearly impossible to have someone phone 
you back. Don't you think such a phone would be a huge source of all kinds 
of abuse? That's what ISPs are making possible by dynamic IP addresses on 
broadband customers. These hosts become rogue, because they are moving 
targets.
Technical Details
Message-ID: <Xns944467F028317jbuserspc9org@130.179.16.24>
Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!cyclone.bc.net!torn!canopus.cc.umanitoba.ca!not-for-mail

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10c8f2,17f958067a510d3b,start
X-Google-Attributes: gid10c8f2,public
X-Google-Thread: ff723,17f958067a510d3b,start
X-Google-Attributes: gidff723,public
X-Google-ArrivalTime: 2003-12-01 08:12:46 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!cyclone.bc.net!torn!canopus.cc.umanitoba.ca!not-for-mail
From: Jem Berkes <jem@users.pc9__org>
Newsgroups: comp.security.misc,can.internet.highspeed
Subject: ISPs can easily decrease net abuse
Date: 1 Dec 2003 16:12:44 GMT
Organization: PC9
Lines: 33
Sender: umberkes@wnpgmb01dc6-43-58.dynamic.mts.net
Message-ID: <Xns944467F028317jbuserspc9org@130.179.16.24>
NNTP-Posting-Host: wnpgmb01dc6-43-58.dynamic.mts.net
X-Trace: canopus.cc.umanitoba.ca 1070295164 17778 142.161.43.58 (1 Dec 2003 16:12:44 GMT)
X-Complaints-To: Postmaster@cc.umanitoba.ca
NNTP-Posting-Date: 1 Dec 2003 16:12:44 GMT
User-Agent: Xnews/5.04.25
X-Face: "lSxJlq"(eahd21S6n})>8f#lx%H`'&dseeU_;`ss0(92:cYhwE){!n"f:@vqEmUGW2;a[|Ve~UbIIKw[>%3Y8b1~,TDEOFG@xR;Wb5HM"V`%2Rz`Pn5g]$