5 ms·

It's easy to fix; back in the day when a machine was infected; an ISP would just block outgoing traffic, contact line owner and re-enable when the issue is reso

by NKCSS 10y ago

It's easy to fix; back in the day when a machine was infected; an ISP would just block outgoing traffic, contact line owner and re-enable when the issue is resolved.

gaius 10y ago
If the "machine" in question is my ADSL router as supplied by my ISP, I will be deeply unimpressed if they block me due to their own negligence in updating it!
- Jtsummers 10y ago
  Similarly, a single bad device on my network would block the whole of my network from the internet. It's another sort of denial of service attack. We need IPv6 and have devices either access the internet with their own IP address or not access it at all. This solution, then, would only impact bad actor devices, not your other (non-compromised) devices. Still, not easy.
  - cpncrunch 10y ago
    I think it's fair to block the entire network. It is then up to the network administrator to fix the problematic device.
    - Jtsummers 10y ago
      While technically accurate to describe them as such, the vast majority of consumers (and internet service subscribers) lack the actual technical expertise to be network administrators. Where these devices are being attacked inside, ostensibly, professional organizations (companies, schools, government buildings), I agree. But there you have, again ostensibly, an actual network administrator capable of dealing with the issue (and paid to do so).
      - matthewmacleod 10y ago
        I think that's okay. We don't expect all homeowners to be, say, experts in electrical wiring, or gas supply, plumbing, drainage, or waste management. But all of these things—if they are poorly modified, managed, or maintained—can cause impacts on third parties. In the case of networked devices, the possible impact on third parties is even greater. We also enforce strong regulation on these systems – defining what may and may not be legally connected to public utility networks, for example. We would probably expect a homeowner to hire a tradesperson to maintain these services, and in some cases it's legally mandated that only a qualified person may install or modify these systems. Is it then unreasonable to kick consumers off of the Internet when they install poorly-maintained devices, and require them to resolve the problem – perhaps by hiring the networking equivalent of a qualified plumber?
        Jtsummers 10y ago
        Then we need to regulate the installation and maintenance of home networks like we do plumbing and electric. This is not a small requirement, and given the current ubiquity of home networks and networked devices it will be an incredible challenge to implement. Probably a startup idea or two would come out of that sort of regulation. Now that, to install that Nanny Cam, I have to hire a certified network administrator.
        jessaustin 10y ago
        If the ISP were held responsible by contract, the ISP could either transfer that responsibility as described above or they could just filter their outbound a little harder. The latter solution seems more practical.
        pavel_lishin 10y ago
        Or they could go the cheap route, and have a whitelist of devices you're allowed to use on your network. Huh, weird, this whitelist seems to mostly consist of devices the ISP would be glad to rent out to you on a monthly basis...
sparky_z 10y ago
Possibly stupid question: why is that no longer done?
- JoshTriplett 10y ago
  Because it's hard to get an ISP to disable a service for one of their paying customers to help other people on the Internet who aren't paying them.
  - zzleeper 10y ago
    Why can't everyone else then block the customer? Get the big 5 tech companies to block IPs that are shown to do DDOS, for say a 24hr period, and you will see how quickly they unplug that IOT Toaster
    - cortesoft 10y ago
      Not very quickly? First, you wouldn't know why you were disconnected. You would try the standard things first (plug and unplug your router, etc). Then maybe after a while you would call your ISP. Get put on hold a bunch. Your ISP tech support probably won't know much either, since in your scenario it isn't the ISP doing the blocking. They MIGHT test the connection, or maybe they just give the customer a new IP address. It is going to take quite a while in this scenario for the user to realize it is their IoT toaster that is causing the issue.
    - Jtsummers 10y ago
      Speaking as not-me, the average, non-technical homeowner who just installed his new internet connected washing machine at home. Great, now I can throw in a load and get a notice on my phone when it's done. This is awesome! (3 hours later) Wait, why can't I get to the internet? I call my ISP, they tell me that my connection is fine (it's tech support, they aren't security experts). But, I tell them, Google doesn't work for me. They do some tests, everything should work. I bitch, moan, cry a little, rage quite my ISP and sign up with someone new. It works for a few days until my washing machine (having been offline for a bit) gets exploited again. I still don't have a clue as to why I'm being blocked from Google and company. Maybe they kick back a message as a 4xx (what would be appropriate?) that says my network has been hacked. But I've seen those sorts of things all the time in ads, I know that's just someone trying to scam me, convince me to run something that'll install a virus on my computer. Must be my computer! Damn Dell piece of shit. I can't afford a new one. Maybe that neighbor kid can come over again and help me out with this. ($200 and several trips for the neighbor kid later it's still not solved)
rev_bird 10y ago
"Fix" is a relative term, especially if IoT devices are in play – yes, turning off the internet to customers stops the attack, but then (at least?) thousands of people lose internet connectivity because of a vulnerability that they could very well be powerless to fix. I'm not saying it's ok with me that an army of smart refrigerators could be taking out big chunks of the web, but it's a lot easier to tell someone, "Hey, either get the infection off your computer or re-format" than it is to make someone buy new lightbulbs and appliances.
- eridius 10y ago
  I would hope things like smart refrigerators and lightbulbs actually still operate normally when the internet is out, right? By "normally" I mean similar to "dumb" versions of the same product. So a customer could fix the issue by kicking the device off the network (disconnect the smart fridge from the ethernet / wifi, unplug the hub for your light bulbs, etc) without actually having to immediately replace them.
- zzleeper 10y ago
  Not powerless, just unplug their toaster and they get their internet back. What is powerless is that many people today couldn't get twitter, github, reddit, spotify, box, etc. because many people don't care about securing their webcam.
- rasz_pl 10y ago
  When a pipe breaks in your condo and starts flooding all the people below nobody asks which appliance might be leaking. Water is cut and you get the bill for _all of the damages_.
rasz_pl 10y ago
and dont forget the part where user is charged $ for violating contract.

by NKCSS 10y ago

It's easy to fix; back in the day when a machine was infected; an ISP would just block outgoing traffic, contact line owner and re-enable when the issue is resolved.

gaius 10y ago

If the "machine" in question is my ADSL router as supplied by my ISP, I will be deeply unimpressed if they block me due to their own negligence in updating it!

Jtsummers 10y ago
Similarly, a single bad device on my network would block the whole of my network from the internet. It's another sort of denial of service attack. We need IPv6 and have devices either access the internet with their own IP address or not access it at all. This solution, then, would only impact bad actor devices, not your other (non-compromised) devices. Still, not easy.
- cpncrunch 10y ago
  I think it's fair to block the entire network. It is then up to the network administrator to fix the problematic device.
  - Jtsummers 10y ago
    While technically accurate to describe them as such, the vast majority of consumers (and internet service subscribers) lack the actual technical expertise to be network administrators. Where these devices are being attacked inside, ostensibly, professional organizations (companies, schools, government buildings), I agree. But there you have, again ostensibly, an actual network administrator capable of dealing with the issue (and paid to do so).
    - matthewmacleod 10y ago
      I think that's okay. We don't expect all homeowners to be, say, experts in electrical wiring, or gas supply, plumbing, drainage, or waste management. But all of these things—if they are poorly modified, managed, or maintained—can cause impacts on third parties. In the case of networked devices, the possible impact on third parties is even greater. We also enforce strong regulation on these systems – defining what may and may not be legally connected to public utility networks, for example. We would probably expect a homeowner to hire a tradesperson to maintain these services, and in some cases it's legally mandated that only a qualified person may install or modify these systems. Is it then unreasonable to kick consumers off of the Internet when they install poorly-maintained devices, and require them to resolve the problem – perhaps by hiring the networking equivalent of a qualified plumber?
      - Jtsummers 10y ago
        Then we need to regulate the installation and maintenance of home networks like we do plumbing and electric. This is not a small requirement, and given the current ubiquity of home networks and networked devices it will be an incredible challenge to implement. Probably a startup idea or two would come out of that sort of regulation. Now that, to install that Nanny Cam, I have to hire a certified network administrator.
        jessaustin 10y ago
        If the ISP were held responsible by contract, the ISP could either transfer that responsibility as described above or they could just filter their outbound a little harder. The latter solution seems more practical.
        pavel_lishin 10y ago
        Or they could go the cheap route, and have a whitelist of devices you're allowed to use on your network. Huh, weird, this whitelist seems to mostly consist of devices the ISP would be glad to rent out to you on a monthly basis...

sparky_z 10y ago

Possibly stupid question: why is that no longer done?

JoshTriplett 10y ago
Because it's hard to get an ISP to disable a service for one of their paying customers to help other people on the Internet who aren't paying them.
- zzleeper 10y ago
  Why can't everyone else then block the customer? Get the big 5 tech companies to block IPs that are shown to do DDOS, for say a 24hr period, and you will see how quickly they unplug that IOT Toaster
  - cortesoft 10y ago
    Not very quickly? First, you wouldn't know why you were disconnected. You would try the standard things first (plug and unplug your router, etc). Then maybe after a while you would call your ISP. Get put on hold a bunch. Your ISP tech support probably won't know much either, since in your scenario it isn't the ISP doing the blocking. They MIGHT test the connection, or maybe they just give the customer a new IP address. It is going to take quite a while in this scenario for the user to realize it is their IoT toaster that is causing the issue.
  - Jtsummers 10y ago
    Speaking as not-me, the average, non-technical homeowner who just installed his new internet connected washing machine at home. Great, now I can throw in a load and get a notice on my phone when it's done. This is awesome! (3 hours later) Wait, why can't I get to the internet? I call my ISP, they tell me that my connection is fine (it's tech support, they aren't security experts). But, I tell them, Google doesn't work for me. They do some tests, everything should work. I bitch, moan, cry a little, rage quite my ISP and sign up with someone new. It works for a few days until my washing machine (having been offline for a bit) gets exploited again. I still don't have a clue as to why I'm being blocked from Google and company. Maybe they kick back a message as a 4xx (what would be appropriate?) that says my network has been hacked. But I've seen those sorts of things all the time in ads, I know that's just someone trying to scam me, convince me to run something that'll install a virus on my computer. Must be my computer! Damn Dell piece of shit. I can't afford a new one. Maybe that neighbor kid can come over again and help me out with this. ($200 and several trips for the neighbor kid later it's still not solved)

rev_bird 10y ago

"Fix" is a relative term, especially if IoT devices are in play – yes, turning off the internet to customers stops the attack, but then (at least?) thousands of people lose internet connectivity because of a vulnerability that they could very well be powerless to fix. I'm not saying it's ok with me that an army of smart refrigerators could be taking out big chunks of the web, but it's a lot easier to tell someone, "Hey, either get the infection off your computer or re-format" than it is to make someone buy new lightbulbs and appliances.

eridius 10y ago
I would hope things like smart refrigerators and lightbulbs actually still operate normally when the internet is out, right? By "normally" I mean similar to "dumb" versions of the same product. So a customer could fix the issue by kicking the device off the network (disconnect the smart fridge from the ethernet / wifi, unplug the hub for your light bulbs, etc) without actually having to immediately replace them.
zzleeper 10y ago
Not powerless, just unplug their toaster and they get their internet back. What is powerless is that many people today couldn't get twitter, github, reddit, spotify, box, etc. because many people don't care about securing their webcam.
rasz_pl 10y ago
When a pipe breaks in your condo and starts flooding all the people below nobody asks which appliance might be leaking. Water is cut and you get the bill for _all of the damages_.

rasz_pl 10y ago

and dont forget the part where user is charged $ for violating contract.