Quarantining infected hosts (Was: FBI tells the public to call their ISP for help)

Mon Jun 18 11:29:25 UTC 2007

On 6/17/07, Jeroen Massar <jeroen at unfix.org> wrote:

> IMHO ISPs should per default simply feed port 25 outbound through their
> own SMTP relays. BUT always have a very easy way (eg a Control Panel
> behind a user/pass on a website) to disable this kind of filtering. This

Y'know, port 25 is just the tip of the iceberg when it comes to what
all an infected host can do .. which is why quite a lot of ISPs (Bell
Canada is particularly good at it, as are some others) are getting
good at deploying "Walled Gardens" - vlan the infected host into its
own little sandbox from where it can access only windows update, AV
update sites and the ISP's support pages, nothing else, on any port.

The user has to fix (disinfect, reimage, whatever) his host before he
contacts the ISP support desk and gets let back onto their network.

--srs