Nato warns of strike against cyber attackers

Tue Jun 8 20:30:27 UTC 2010

On 6/8/10 2:12 PM, Dave Rand wrote:

> It's really way, way past time for us to actually deal with compromised
> computers on our networks.  Abuse desks need to have the power to filter
> customers immediately on notification of activity.  We need to have tools to
> help us identify compromised customers.  We need to have policies that
> actually work to help notify the customers when they are compromised.
>
> None of this needs to be done for free.  There needs to be a "security
> fee" charged _all_ customers, which would fund the abuse desk.
>
> With more than 100,000,000 compromised computers out there, it's really
> time for us to step up to the plate, and make this happen.

Problem is, there's no financial penalties for providers who ignore 
abuse coming from their network.

DNSbl lists work only because after a while, providers can't ignore 
their customer complaints and exodus when they dig deep into the bottom 
line.

We've got several large scale IP blocks in place in the AHBL due to this 
exact problem - providers know there's abuse going on, they won't 
terminate the customers or deal with it, because they are more then 
happy to take money.

Legit customers get caught in the cross-fire, and they suffer - but at 
the same time, those legit customers are the only ones that will be able 
to force a change on said provider.

They contact us, and act all innocent, and tell people we're being 
unreasonable, neglecting to tell people at the same time that the 
'unreasonable' DNSbl maintainer only wants for them to do a simple task 
that thousands of other providers and administrators have done before.

-- 
Brielle Bruns
The Summit Open Source Development Group
http://www.sosdg.org    /     http://www.ahbl.org