🚀 go-pugleaf

On 1 Dec 2003 16:12:44 GMT, Jem Berkes wrote:
> As I'm sure lots of you are aware, cable/DSL machines are infected by 
> viruses and worms like nothing else. They become sources of email viruses 
> and other types of malicious traffic.

I think the current estimate is 400,000 to 500,000 still infected.
http://www.dshield.org/ can show you top 10 malware ports
and possible solution.

> 
> Then something occurred to me. Wouldn't it help dramatically if ISPs 
> delegated static IP addresses for any kind of permanent connectivity? This 
> way, customers' addresses would stay constant and make them easier to track 
> down:

I bought my cable connection from @home.com, I was sold to attbi.com, then I
was purchased by comcast.com and I think my dhcp ip has changed
twice. Pretty static for dhcp.


> 3) Infected hosts that are spewing worms by any method could be 
> automatically blocked by routers/gateways, since the IP address is constant

I agree. I wish that kind of trap software would flag the ip to the dhcp
server which would expire their lease.

The new ip renewal would give the infected ip dns and transparent
proxy servers which would route everything to an infected notice web page.

That page would indicate why they are seeing the "you are Infected"
web page. It can give possible solutions for the fix.  User can click
ok, to tell the trap software to clear the infected flag to allow the
user to get back on the net for another 24 hours.

ISP's customers would be happier because their internet experience would
be faster do to less malicious traffic.

>> Then something occurred to me. Wouldn't it help dramatically if ISPs 
>> delegated static IP addresses for any kind of permanent connectivity?
>> This way, customers' addresses would stay constant and make them
>> easier to track down:
> 
> Actually, if ISP's required users to install a router with NAT it
> would eliminate most of it. The hacks and worms could not infect new
> machines protected by NAT.

This is part of the great irony of ISPs not knowing what's really 
financially beneficial to them:

Static IPs cost little extra to set up, but help the Internet more easily 
self-regulate and block malicious traffic without having to resort to 
blocking the whole ISP. When large netblocks in the ISP are blacklisted 
globally, the ISP loses * way more business * due to customers going 
elsewhere.

ISPs (especially cable) don't like NAT. In some cases, the practice is 
disallowed in the terms of service or requires an extra fee. Again, 
fantastic irony: encouraging NAT (implied firewall) would result in fewer 
vulnerable customers, hence less malicious traffic, more bandwidth savings, 
and less cost incurred due to handling abuse.

-- 
Jem Berkes
http://www.sysdesign.ca/

In article <Xns944473C154314jbuserspc9org@130.179.16.24>,
Jem Berkes  <jem@users.pc9__org> wrote:
:Static IPs cost little extra to set up,

But can cost a lot in ARIN fees, and if you wanted a number of them,
ARIN would be asking hard questions with the intent to prove that
you are using your IP addresses effeciently. Dynamic IP addresses
are considered to use the space more efficiently (at least if you
oversubscribe and use a short lease.)
-- 
   I've been working on a kernel
   All the livelong night.
   I've been working on a kernel
   And it still won't work quite right.      -- J. Benson & J. Doll

In article <MPG.1a353cd8c276f345989ea9@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
:Actually, if ISP's required users to install a router with NAT it would 
:eliminate most of it. The hacks and worms could not infect new machines 
:protected by NAT.

Unless there was a translation that let them through, or unless
the NAT router had the target as a "dmz"...

Not all NAT implimentations are specific about who they let back in.
The existance of a recent outgoing NETBIOS connection could be enough
to allow -anyone- to get in to the NETBIOS ports.
-- 
"Meme" is self-referential; memes exist if and only if the "meme" meme
exists. "Meme" is thus logically a meta-meme; but until the existance
of meta-memes is more widely recognized, "meta-meme" is not a meme.
   -- A Child's Garden Of Memes

>:Actually, if ISP's required users to install a router with NAT it would 
>:eliminate most of it. The hacks and worms could not infect new machines 
>:protected by NAT.
> 
> Unless there was a translation that let them through, or unless
> the NAT router had the target as a "dmz"...
> 
> Not all NAT implimentations are specific about who they let back in.
> The existance of a recent outgoing NETBIOS connection could be enough
> to allow -anyone- to get in to the NETBIOS ports.

Sure, NAT doesn't guarantee security (actually it's not even designed for 
security, that's a firewall). But at least NAT will will keep out random 
probes that might otherwise reach NetBIOS, P'N'P, IIS/SQL, or some other 
fantastic Microsoft OS feature:)

-- 
Jem Berkes
http://www.sysdesign.ca/

In article <Xns94447C1CBCCCAjbuserspc9org@130.179.16.24>,
Jem Berkes  <jem@users.pc9__org> wrote:
:Sure, NAT doesn't guarantee security (actually it's not even designed for 
:security, that's a firewall). But at least NAT will will keep out random 
:probes that might otherwise reach NetBIOS, P'N'P, IIS/SQL, or some other 
:fantastic Microsoft OS feature:)

When going out, NAT implimentations often try to use the same source
port number, using a different port number only if the original is in
use. So if you have a PC that has NETBIOS turned on, and
Wiley E. Windows decides to do name resolution from the netbios-ns
(udp 137) source port, then the NAT implimentation might, as long
as the translation lasts, allow -anyone- to connect to that port.
And this being UDP, there is mechanism to signal when the name
resolution conversation is finished, so the translation would be kept
open until some timer expires.

The countdown theme from "Jeapordy" is running through my mind loudly
enough that you can probably hear it from your end of the city, Jem ;-)

-- 
Positrons can be described as electrons traveling backwards in time.
Certainly many Usenet arguments about the past become clearer when they
are re-interpreted as uncertainty about the future.
   -- Walter Roberson

In article <Xns9444C6E5598CBjuergennieveler@nieveler.org>,
Juergen Nieveler  <juergen.nieveler.nospam@arcor.de> wrote:
:roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson) wrote:

:> Not all NAT implimentations are specific about who they let back in.

:Not to mention that NAT will pass away as soon as everybody is on IPv6

In my opinion, NAT will continue to be used with IPv6. We
-prefer- the behaviour of hiding behind a small number of IP
addresses to the extent practical: there is no point in giving
away information about our internal computer facilities if we do
not need to.

Also, there are other uses for NAT. For example, in order to get
around an ISP filter combined with lack of IPSec at a remote end,
I routed from a remote office over an IPSec tunnel, and NAT
the packets and spit them out on our local net for delivery to
their final destination. The responses come back to our local
IP addresses, the box de-NAT's them back into the remote office
IPs, and those packets get forwarded over the IPSec tunnel to their
proper origin location. This kind of forwarding of network traffic
is not uncommon in facilities with satellite offices. IPv6 would not
help because the ISP is going to continue with that filter no matter
what IP address we use.
-- 
   Reviewers should be required to produce a certain number of
   negative reviews - like police given quotas for handing out
   speeding tickets.                        -- The Audio Anarchist

Juergen Nieveler <juergen.nieveler.nospam@arcor.de> wrote:
> roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson) wrote:

>> Not all NAT implimentations are specific about who they let back in.

> Not to mention that NAT will pass away as soon as everybody is on IPv6

Never ?


> -- 
> Juergen Nieveler / juergen.nieveler@web.de / PGP supported!
> 90% of being smart is knowing what you're dumb at

-- 
Peter H�kanson         
        IPSec  Sverige      ( At Gothenburg Riverside )
           Sorry about my e-mail address, but i'm trying to keep spam out,
	   remove "icke-reklam" if you feel for mailing me. Thanx.

Juergen Nieveler wrote:
> roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson) wrote:
>
>> Not all NAT implimentations are specific about who they
>> let back in.
>
> Not to mention that NAT will pass away as soon as
> everybody is on IPv6

Everybody on IPv6? This will not happen in your lifetime. Now that the ipv4
address shortage myth has been debunked, there's no point for massive
migration towards ipv6. We'll end up with a mixed internet with both
systems forever.

Laurent

In message <<Xns944473C154314jbuserspc9org@130.179.16.24>> Jem Berkes
<jem@users.pc9__org> did ramble:

>Static IPs cost little extra to set up, but help the Internet more easily 
>self-regulate and block malicious traffic without having to resort to 
>blocking the whole ISP. When large netblocks in the ISP are blacklisted 
>globally, the ISP loses * way more business * due to customers going 
>elsewhere.

They cost virtually *nothing* more on a day to day basis if implemented
properly (ignoring initial implementation costs)

Stick with DHCP, less client-side configuration required.  

Configure the DHCP server to issue new IPs based on a sort order, oldest
unused IP first.  

Next, you need to make sure you maintain the MAC address / IP address
tables past expiry, so that even if the DHCP lease is 24 hours and I
leave a machine off 168 hours, I'll still get the same IP.

You will virtually never see IPs changing except when a machine has been
off long enough that all of the available IPs have been used at least
once.  Obviously if you're overselling, this won't work as well, but it
should work as long as you have a few more IPs in each block then you
have customers.
-- 
In the 60's people took acid to make the world weird.
Now the world is weird and people take Prozac to make it normal.

Jem Berkes wrote:
> Static IPs cost little extra to set up, but help the Internet more easily
> self-regulate and block malicious traffic without having to resort to
> blocking the whole ISP.

When you consider support calls related to DHCP etc, static adresses probably
cost less to ISPs. However, when you consider that ISPs such as Bell,
Videotron etc, make their real money from business customers who must may
orders of magnitudes more to get service whose only difference is a fixed IP
and no blocked ports, then they are not about to start giving away those very
"expensive" features for free to residential customers. Those ISPs have to
find some way to differentiate the affordable residential service (with
limitations) from the very expensive business services (without those limitations).

Whether one has a fixed IP or not, the second the ISP notices that customer X
is infected and attempts to infect others, the ISP can simply disable service
to that customer, essentially forcing the customer to call, at which point he
can be told about his virus.

When you have a few million customers however, most of which running the virus
petri dish known as Windows, the problem becomes that of scaling your support
desk since whenever you have a new vuris circulating, you'll be disabling a
whole lot of your customers and will be spending a whole lot of time onthe
phone with each and every one of them.

In message <<3FCBAAFD.FE843731@istop.com>> JF Mezei
<jfmezei.spamnot@istop.com> did ramble:

>When you have a few million customers however, most of which running the virus
>petri dish known as Windows, the problem becomes that of scaling your support
>desk since whenever you have a new vuris circulating, you'll be disabling a
>whole lot of your customers and will be spending a whole lot of time onthe
>phone with each and every one of them.

There are other options too.  If you're assigning IPs via DHCP, you can
hand out 10.x.x.x IPs with a gateway that acts as a transparent proxy
that replaces all websites with a redirect to the ISP's help pages
explaining how to clean their computer, and possibly even with a
"restore my service" button that will reactivate the customer's
connection.

If the same machine is then found to be spewing again within
7/14/30/whatever days, contact with support is required to reactivate.

-- 
They'll say, 'You can't joke about rape. Rape's not funny.'
I can prove to you that rape is funny. Picture Porky Pig raping Elmer Fudd.
See?  Hey, why do you think they call him Porky?
-- George Carlin

jem@users.pc9__org wrote...
>
>As I'm sure lots of you are aware, cable/DSL machines are infected by 
>viruses and worms like nothing else. They become sources of email 
>viruses and other types of malicious traffic.

I've received as many as 20 infected emails in one day.  That's my 
record, so far.  I don't know what the current estimate is, but the last 
estimate I read was that at any given time, about 500,000 computers are 
infected.  It could be closer to a million machines now.

laurent@faked.mblelop.com (Laurent) wrote...
>
>Now that the ipv4 address shortage myth has been debunked...

What do you mean, debunked?  Could you point me to an article, please?

Rod

isnt the procative thing that the big isp s are doing these days is to sell
anti virus or firewall..bell and telus are pushing these services ot members
as much as they can. this sort of offering just seems to be the way ALL the
big isp s are going

so whats in it for them
2 or 3 dollars a month in hard revenue to pay for the firewall or antivirus
users with some sort of protection on the network

not sure if its worth it or not buth they are all going that direction for
some reason I would guess. dont get into a linux box or anyting like that
sort of setup. the big guys are not interested in ppl for that sort of setup
they want mom and day using the service. set them up once get it right and
hope they just keep paying and dont have to call back. there has to be
something to this strategy as opposed to smaller isps trying to get users to
download after midnight and before 8 am

I might not agree with what the big companies are doing but the business
plan is obviously putting some black into the bottom line at the end of the
year.

now a quick comment on the cap issue...from all Im seeing rogers backed off
or is in the process of backing off. the smaller isps have pushed the
bandwidth hogs back to bell or downloading in the way wya off peak hours

all that bell did with caps was push the high end bandwidth users away set
themselves up with a bandwidth monitoring system that is sitting there ready
to be turned back on at the flick of a switch....i think caps speed and
price should get real interesting between now and next may...all we can do
is wait and see

Kevin

"Leythos" <void@nowhere.com> wrote in message
news:MPG.1a35846b4a8b46bc989eaa@news-server.columbus.rr.com...
> In article <Xns944473C154314jbuserspc9org@130.179.16.24>, jem@users.pc9
> __org says...
> > >> Then something occurred to me. Wouldn't it help dramatically if ISPs
> > >> delegated static IP addresses for any kind of permanent connectivity?
> > >> This way, customers' addresses would stay constant and make them
> > >> easier to track down:
> > >
> > > Actually, if ISP's required users to install a router with NAT it
> > > would eliminate most of it. The hacks and worms could not infect new
> > > machines protected by NAT.
> >
> > This is part of the great irony of ISPs not knowing what's really
> > financially beneficial to them:
> >
> > Static IPs cost little extra to set up, but help the Internet more
easily
> > self-regulate and block malicious traffic without having to resort to
> > blocking the whole ISP. When large netblocks in the ISP are blacklisted
> > globally, the ISP loses * way more business * due to customers going
> > elsewhere.
>
> But your action is not PROACTIVE. If they forced non-business users to
> live with NAT it would be a proactive measure - meaning that they would
> block uninvited inbound activity at the modem.
>
> This could also have an added benefit of blocking inbound file sharing
> and servers that are not suppose to be running on residential networks
> anyway :)
>
> Static IP's are not something to mess with, they are a fixed resource
> that blacklisting is also reactive, not proactive.
>
>
> --
> --
> spamfree999@rrohio.com
> (Remove 999 to reply to me)

The need to go to ipv6 was due primarily to IP address shortages -- public
IP address space, they don't make any more.

Need to transition was put off when IGP protocols became more flexible with
VLSM i.e. classless vs classful plus the use of private IP address space
i.e. 10.0.0.0/8, 172.16.0.0/16 - 172.31.0.0/16, etc. This was done some
years ago, try and keep up !!!!!!!!!
"Rod" <stellar@idirect.com> wrote in message
news:5P-dnfb30tlQI1aiRVn-sA@giganews.com...
> laurent@faked.mblelop.com (Laurent) wrote...
> >
> >Now that the ipv4 address shortage myth has been debunked...
>
> What do you mean, debunked?  Could you point me to an article, please?
>
> Rod
>

> ... then they are not about
> to start giving away those very "expensive" features for free to

Perhaps they can adapt and find other markets. I don't know...

> Whether one has a fixed IP or not, the second the ISP notices that
> customer X is infected and attempts to infect others, the ISP can
> simply disable service to that customer, essentially forcing the
> customer to call, at which point he can be told about his virus.

Ideally this would happen. However as we know, the great majority of ISPs 
are useless in dealing with abuse. And _that's_ why I'm saying static IPs 
all around would be nice, because then the Internet community could more 
easily spot the point source of abuse and take their own measures to block  
it -- blacklist the IP address so people can block mail and any other 
traffic at their own firewalls/routers.

So the benefit of static addressing would be to the Internet in general, 
not to individual ISPs.

-- 
Jem Berkes
http://www.sysdesign.ca/

> I've received as many as 20 infected emails in one day.  That's my 
> record, so far.

Heh, during the late summer I was receiving about 4,000 a day. I had to 
kill an entire domain temporarily to ease the burden on my server.

-- 
Jem Berkes
http://www.sysdesign.ca/

funk49@sympatico.ca wrote...
>
>The need to go to ipv6 was due primarily to IP address shortages -- 
>public IP address space, they don't make any more.
>
>Need to transition was put off when IGP protocols became more flexible 
>with VLSM i.e. classless vs classful plus the use of private IP address 
>space i.e. 10.0.0.0/8, 172.16.0.0/16 - 172.31.0.0/16, etc. This was done 
>some years ago, try and keep up !!!!!!!!!

Is it possible to keep up?  I can't, can you?  You do seem to be fairing 
a little better at it than me.  :)

Yes I knew that the 32 bit address space was considered inadequate.  

Private IP space doesn't do you much good when you're trying to reach 
other machines on the Internet.  That's just for inhouse.  Your own LAN. 
I dunno.  I think 32 bits is inadequate because that's only 4.2 billion 
addresses.  Minus what's private or reserved.  That's less than the human 
population.

But I did think that 64 bits would have been plenty adequate.  I was 
dumbfounded when I read that IPv6 was 128 bits.  With 128 bits...most of 
the Earth's rocks could have an IP addresses.  Worms could have IP 
addresses.  Fields of wheat.  Cobs of corn.  Cows.  Cartons of milk, on 
the shelf, in the store.  The future: you can email a carton of milk in 
the store and find out its expiry date if you want.  It will 
auto-respond.  Carton of milk replies: "Sorry; I've turned."  (Etc.)

Email your toaster, find out if your toast is done.

Thanks for the answer.

Rod

In article <3FCD1A94.25FE3630@istop.com>,
JF Mezei  <jfmezei.spamnot@istop.com> wrote:
>What this means is that to get stuff to work behind NAT, you need to designate
>one machine as the default machine to get any unmapped ports and the software
>will run only on that machine.

No, there are a number of workarounds - things that allow
you to request an address mapping directly from the NAT
(UPnP, midcom, RSIP), things that allow you to discover your
address/port number (STUN), various relaying technologies,
and so on.  They all have their own problems, but there are
a lot of alternatives to what you've described.
-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com

            Bad taste is better than no taste -- Arnold Bennett

Bit Twister wrote:
> War Driving will be taking on a whole new meaning.
> http://wired.com/news/autotech/0,2554,61412,00.html?tw=wn_tophead_6

So now even pedestrians will be endangered by microsoft.

The scariest statement was:
"
The Microsoft platform already is in 23 different car models, including the
BMW 7 series, Citroen, Daimler, Fiat, Volvo, Hyundai, Mitsubishi, Subaru and
Toyota. 
"

How dare those car companies incorporate microsoft software into their
products ?

Are you sure this isn't some kid of hoax ? April fools perhaps ?

I wish.  That almost turns me off buying a BMW some day.  Maybe when I can
afford one
they will have realized their mistake and taken the M$ garbage out.


"JF Mezei" <jfmezei.spamnot@istop.com> wrote in message
news:3FCD31BF.8CA3AD8E@istop.com...
>
> Are you sure this isn't some kid of hoax ? April fools perhaps ?

Jem Berkes <jem@users.pc9__org> wrote in
news:Xns944467F028317jbuserspc9org@130.179.16.24: 

> Then something occurred to me. Wouldn't it help dramatically if ISPs 
> delegated static IP addresses for any kind of permanent connectivity?
> This way, customers' addresses would stay constant and make them
> easier to track down:

Not enough IP addresses.

Maybe with IPv6.

-- 
Lucas Tam (REMOVEnntp@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

JF Mezei <jfmezei.spamnot@istop.com> wrote in
news:3FCD31BF.8CA3AD8E@istop.com: 

> So now even pedestrians will be endangered by microsoft.
> 
> The scariest statement was:
> "
> The Microsoft platform already is in 23 different car models,
> including the BMW 7 series, Citroen, Daimler, Fiat, Volvo, Hyundai,
> Mitsubishi, Subaru and Toyota. 
> "

I'm sure it'll be fine. People over react.

-- 
Lucas Tam (REMOVEnntp@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

Juergen Nieveler <juergen.nieveler.nospam@arcor.de> wrote in 
news:Xns9445C2A53654juergennieveler@nieveler.org:

> Netbios? You're joking - the main competitors are the Internet Exploder 
> and Outhouse Explodes... of course, when it comes to companies, 
> Microsoft wins wuth no real contender :-)


Since IE 4.0 or 5.0, it's been pretty stable for me. So far, Mozilla has 
crashed more often than IE (well... older beta Mozillas).



-- 
Lucas Tam (REMOVEnntp@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

In article <MPG.1a36cd3d8712184d989eb5@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
:I think that your above description of a quality router/NAT device is 
:specifically what I was suggesting. I'm not sure why anyone would want 
:to use a NAT device that didn't ensure the returned packets were from 
:the correct location.

Because A) it's cheaper; and B) they don't know any better.


:So, we're back to what I said before - if ISP's were to use NAT (not 
:some unsecure version of NAT) we would all be a lot better off and 
:customers would be must less at risk. In most cases this would not cost 
:the ISP's anything as I would imagine that their basic hardware would 
:already be capable of implementing this.

The newer generations of SOHO devices do often support the necessary
logic, but those still cost noticably more than the less-protected
versions... and there is a lot of older generation equipment out there.

For example, the Cisco 837 has the necessary "firewall feature set"
built in (at about $US475 street), but it was an (commonly bundled)
option for the 827H and 827-4V, and a very expensive option for the 801
& 803.  And all of those devices are packed with features that very few
home users need. Meanwhile, devices like the Netgear MR314 are down
around the $US50 range but don't protect as well as the Cisco 837.  I'm
using the older generation Netgear RT314 myself, which does a good
enough job of NAT for -my- needs...  but I'm also not running PCs.

-- 
Warning: potentially contains traces of nuts.