5 ms·
Ignorant thinking out loud here. Is it feasible for certain infrastructure providers to team up and collect the ip addresses of the requests. This gives us a li
by wes-k 10y ago
Ignorant thinking out loud here. Is it feasible for certain infrastructure providers to team up and collect the ip addresses of the requests. This gives us a list of IPs with bots. THEN google, Facebook, Twitter, etc (major web properties) use this list to notify any of its users that one or more of their devices have been compromised and point them to a how to guide for securing it. Or more simple a script to patch it.
My thinking is that the only way to stop this is to get users to lock down their insecure devices.
A constant banner would annoy most people to action. Especially if it was really easy to issue a fix. Download and run. Script determines the actual device causing the harm and patches it. Possibly asking for a new password from user. I guess this assumes that a script could be written to issue a patch for the majority of cases. If not, then how is this device connected? Script could detect router and apply fix at that point.
So we need:
1. IP addresses for the sources of the attack load.
2. A way to distribute patches for those IP addresses.
I propose:
1. Those suffering the attacks can provide this.
2. Notify users via websites coordinating on displaying an alert with tools to patch.
Alternative solution to #2:
Can some part of the ISPs that connect these IPs be patched to detect and block malicious attacks?
- mirimir 10y agoMakes sense to me. Back in the day, the Internet was far simpler, with far less bullshit. If your IP was spewing crap, you would hear about it. And you either resolved the problem, or got null-routed. The Internet is far^N larger and more complex, for sure. But accountability still has a place, I think. I wonder if Dyn will at least release a heat map of source IPs.
- wes-k 10y agoOr Dyn and the like should build a system to throttle requests from a given IP. Whitelist trusted IPs that REQUIRE high volume of requests.
- IntelMiner 10y agoWhich would still fall over when you're being flooded with more traffic than you can either outright handle, or screen for authenticity
- simooooo 10y agoMost users are on dynamic IPs. So you'd probably be blocking/nagging the wrong person
- wes-k 10y agoHow often do most dynamic IPs switch? Been rare for me. How quick can we go from recording malicious IP to showing user an alert on some website?
- jagermo 10y agoGermany: after 24 hours there is normally a short disconnect and a new ip address to prevent people from running servers at home
- anc84 10y agoAfter 24 hours at least, potentially earlier. Huge parts of Europe are at such setup at least.
- wes-k 10y agoI suppose that points to the solution needing to be at the ISPs. They know the IP assignment history. And they could also be responsible for filtering malicious traffic.
- bogomipz 10y agoInteresting I didn't know this. ISPs could certainly change this policy for a duration during which they scanned their networks for Mirai IoT devices and notified affected customers. In the US I believe cable modems are static DHCP leases tied to the mac address of the cable modem. Of course this would be an arms race of sorts if the next version of the malware simply added port knocking sequences to the compromised routers in front of these vulnerable IoT devices.
- leggomylibro 10y agoOr, ISPs could simply block all service to offending IP addresses. The customer would see a notice: "The following IP address delivered N Gb of traffic over our network as part of a malicious DDOS attack. Please patch or isolate the offending device and contact customer service at 123-456-7890 to restore service." I guess that wouldn't make your customers super happy, but it would probably be effective.
- tomjen3 10y agoIt would be effective in pissing of customers, more angry calls to support, possibly less retention.
- deegles 10y agoIf every service provider did the same it wouldn't affect retention. Besides, it seems many people only have one or two options anyways.
- TeMPOraL 10y ago> If every service provider did the same it wouldn't affect retention. If that would somehow happen, you could use this miracle to solve most of the problems on this planet. This is literally the biggest issue of humanity - it's extremely hard to get people to coordinate. Doing so usually requires forcing various incentives to align. In this case, you'd most likely need a direct government involvement to make all ISPs behave.
- oneeyedpigeon 10y ago> it's extremely hard to get people to coordinate That's exactly what government regulation addresses. A truly global approach would be nigh-on impossible, but it should be possible to get all ISPs in the states to come on board, for example.
- benevol 10y ago> it seems many people only have one or two options anyways. The monopolistic structure of the economy is a problem the US suffers much more than other countries (by definition at the cost of the consumer). (Although the tendency to reinforce monopolies naturally applies to all countries.)
- kchoudhu 10y agoIsn't this what CISPA was trying to provide a legal framework for?
- ddalex 10y agoThis is an attack over UDP. The source address is likely spoofed. Simply blocking an IP will do nothing but banning somebody not related to the attack at all.
- qeternity 10y agoI don't think you understand how spoofing works. And no, this attack was not spoofed. It was just hundreds of thousands of IoT devices each pushing a small amount of traffic (0.5-1mbps).
- niij 10y agoI don't believe this Mirai IoT attack is using spoofing. But on the topic of spoofing: if an ISP doesn't follow BCP38 and allows spoofed packets to leave their network, then there is truly no traceability in where a packet came from. See this talk from Strangeloop about how spoofed packets are a problem [0] [0]: https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/ https://idea.popcount.org/2016-09-20-strange-loop---ip-spoof...
- lttlrck 10y agoThere are still behind NAT so they are using the address assigned by the ISP. UPnP sets up the forwarding rule it's doesn't give direct access.
- bogomipz 10y agoI think there's might be a significant legal issue to an ISP patching customers devices. Also a spoofed IP renders the source meaningless. ">THEN google, Facebook, Twitter, etc (major web properties) use this list to notify any of its users that one or more of their devices have been compromised and point them to a how to guide for securing it." I am not sure I want FB and Google policing the internet. They have enough power as it is. This would set a bad precedent.
- user5994461 10y agoOr just brick all the IoT devices. It's easier, faster, more effective. ;)