Article View: comp.security.misc
Article #1113ISPs can easily decrease net abuse
From: Jem Berkes
Date: Mon, 01 Dec 2003 16:12
Date: Mon, 01 Dec 2003 16:12
33 lines
2854 bytes
2854 bytes
As I'm sure lots of you are aware, cable/DSL machines are infected by viruses and worms like nothing else. They become sources of email viruses and other types of malicious traffic. Then something occurred to me. Wouldn't it help dramatically if ISPs delegated static IP addresses for any kind of permanent connectivity? This way, customers' addresses would stay constant and make them easier to track down: 1) Anti-spam/proxy/hijack systems would see abuse coming from a particular IP and could more easily identify that abuse source without huge collateral damage. Currently, DNSBLs are force dto list entire netblocks, or even all dynamic IP addresses! 2) Responsible parties would be easier to track down, regardless of type of abuse and historical records found online (e.g. IPs in logfiles) could be associated with a single entity 3) Infected hosts that are spewing worms by any method could be automatically blocked by routers/gateways, since the IP address is constant My experience with Internet security has been that when abuse such as spam, viruses, or malicious UDP traffic is found to come from a dynamic IP the admin shrugs it off, whereas when abuse comes from a static source more serious steps are taken. So why allow people that dynamic shield? Imagine if there was a type of cheap cell phone service designed to facilitate outgoing calls only, accomplished via a dynamic origin phone number (that changed daily), making nearly impossible to have someone phone you back. Don't you think such a phone would be a huge source of all kinds of abuse? That's what ISPs are making possible by dynamic IP addresses on broadband customers. These hosts become rogue, because they are moving targets.
Technical Details
Message-ID:
<Xns944467F028317jbuserspc9org@130.179.16.24>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!cyclone.bc.net!torn!canopus.cc.umanitoba.ca!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10c8f2,17f958067a510d3b,start
X-Google-Attributes: gid10c8f2,public
X-Google-Thread: ff723,17f958067a510d3b,start
X-Google-Attributes: gidff723,public
X-Google-ArrivalTime: 2003-12-01 08:12:46 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!cyclone.bc.net!torn!canopus.cc.umanitoba.ca!not-for-mail
From: Jem Berkes <jem@users.pc9__org>
Newsgroups: comp.security.misc,can.internet.highspeed
Subject: ISPs can easily decrease net abuse
Date: 1 Dec 2003 16:12:44 GMT
Organization: PC9
Lines: 33
Sender: umberkes@wnpgmb01dc6-43-58.dynamic.mts.net
Message-ID: <Xns944467F028317jbuserspc9org@130.179.16.24>
NNTP-Posting-Host: wnpgmb01dc6-43-58.dynamic.mts.net
X-Trace: canopus.cc.umanitoba.ca 1070295164 17778 142.161.43.58 (1 Dec 2003 16:12:44 GMT)
X-Complaints-To: Postmaster@cc.umanitoba.ca
NNTP-Posting-Date: 1 Dec 2003 16:12:44 GMT
User-Agent: Xnews/5.04.25
X-Face: "lSxJlq"(eahd21S6n})>8f#lx%H`'&dseeU_;`ss0(92:cYhwE){!n"f:@vqEmUGW2;a[|Ve~UbIIKw[>%3Y8b1~,TDEOFG@xR;Wb5HM"V`%2Rz`Pn5g]$