5 ms·

Disrupting the botnet is so far so good... but what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected fr

Disrupting the botnet is so far so good... but what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices. Internet access is a privilege, and being a threat to others in this shared space should lead to said privilege being revoked until the threat is gone.

kube-system 3y ago
> what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices. Yes, but a lot of the internet is on a shoe-string budget and managed by someone who DGAF, and connected to an ISP who also DGAF.
- mschuster91 3y ago
  Yeah, and these people don't deserve to be on the Internet. We also don't let people run cars with bad exhaust stacks on the road, and if police spot violators, they get issued remediation orders.
  - kube-system 3y ago
    The world is a big place and a lot of it doesn't work like that. Global emissions enforcement is just about as good as global internet security enforcement. That's why the internet is full of malware and the earth is getting warmer.
  - anigbrowl 3y ago
    May I recommend 'How to win friends and influence people' instead of such naked user hostility.
squigz 3y ago
Because it's the customers fault manufacturers sell insecure routers that go out of service 2 years later?
- candiddevmike 3y ago
  At some point consumers need to become more computer savvy and responsible netzens.
  - sgc 3y ago
    Sounds more like we need a minimum required period for security updates after a device is sold, and other similar measures. It is much, much easier to enforce this type of thing with one manufacturer than with 100k customers, many of whom are elderly and will never be able to do it themselves no matter how much we preach.
    - mschuster91 3y ago
      > It is much, much easier to enforce this type of thing with one manufacturer than with 100k customers, many of whom are elderly and will never be able to do it themselves no matter how much we preach. They all pay their ISP a hefty "rental" fee for their crap modem. It's only fair to hold the ISPs responsible in such cases.
      - sgc 3y ago
        That type of thing is why I threw in "and other similar measures". Of course there needs to be a basic security policy that is developed and enforced, and resellers / lessors should be responsible. We already have plenty to draw from, such as car/appliance recalls, large organization security policies, etc. There is a ton of low hanging fruit that could be easily dealt with quickly if there were political will.
      - gunapologist99 3y ago
        This is how you end up getting forced to be behind their awful DNAT DPI "firewall", which will still be insecure, and you won't have any access to it.
  - Arrath 3y ago
    Sounds like an empty feel good platitude for the technically minded to feel superior to the rubes buying crap from manufacturers who put out that insecure crap in the first place. Yes, everyone could be more responsible about their consumption but why should that free the manufacturers from the responsibility of making competent products to begin with?
costco 3y ago
What if a hospital was disconnected from the Internet because it has some insecure IoT device in it? The truth is that this "enforcement action" will make absolutely 0 difference because these devices were just used as proxies to launch attacks. There are a million other people offering this as a service. And it was a botnet with "hundreds of devices." That is literally nothing. People who want to live in this world where abuse emails are king and a bunch of Spamhaus type people lord over the Internet always weird me out.
- 2OEH8eoCRo0 3y ago
  Hundreds is plenty if your objective isn't DDoS. https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical https://www.justice.gov/opa/pr/us-government-disrupts-botnet... > China’s hackers are targeting American civilian critical infrastructure, pre-positioning to cause real-world harm to American citizens and communities in the event of conflict
  - costco 3y ago
    I mean it's enough to make at the most a few thousand a month selling residential proxy plans on crime forums. Not really significant. There are orders of magnitude larger botnets (some 100k, 400k+ in size) you can read about on https://blog.netlab.360.com/ https://blog.netlab.360.com/. Edit: I agree it is important to do takedowns. Qakbot, GameOver Zeus, Emotet, Snake, etc all had actual espionage risk / were cumulatively involved in billions of dollars of theft. But this botnet seems sort of irrelevant.
- mschuster91 3y ago
  > What if a hospital was disconnected from the Internet because it has some insecure IoT device in it? Give them a remediation time of 24 hours. If that doesn't help, cut them off anyway, as that's the only thing that will force management to give their IT people actual staff and budget. Hospital IT is almost always a shitshow and that won't change until external pressure forces management's hand.
  - 3y ago
mindslight 3y ago
This is a terrible narrative, essentially grease on the path of destroying the permissionless Internet in favor of an environment where every communication is tracked and "accountable". The basic reality is that Internet traffic should be considered hostile noise and Internet nodes need to be resistant to that. That's the crux of the seminal end to end principle and cross-jurisdiction operation (the whole "Inter" part). Furthermore, taking it at face value, why shouldn't this condemnation apply to the FBI first ? They've got compromised devices with the out of life software that's causing a bigger problem. So by applying that standard, they should be taken offline first. Which I'd say highlights a deep problematic assumption in reaching for the blame game, whereby some nodes start to be considered "more equal" than others.
ahmeneeroe-v2 3y ago
As a society we've settled on collective security (army/navy/police) to address outside physical threats. I believe that as our institutions mature we will take analogous steps towards addressing internet/computer security. It seems more obvious to me than making unsophisticated users responsible for their own individual security against highly sophisticated and well-resourced adversaries.
- molsongolden 3y ago
  “Cybersecurity today is like if we’d asked London building owners to install their own anti-aircraft guns during the Blitz.” Just a quote from a friend.
  - gunapologist99 3y ago
    I take it that your point is the opposite, but it's still a good one: the Blitz would have gone VERY differently had there been AA guns on every rooftop. It'd get pretty expensive for bombers to plunge into the Channel and pilots thrown into a POW camp.
    - TheCoelacanth 3y ago
      But the result wouldn't have been AA guns on every rooftop. The UK's capacity to produce AA guns wouldn't have increased. Their economy was already focused entirely on the war. The result would have just been a lack of planning on how to actually make effective use of the resources available.
      - mrguyorama 3y ago
        And there would not have been any advancements on the radars used in "Chain Home", because "Your place got bombed because you didn't defend it well enough, nothing we can do"
  - ahmeneeroe-v2 3y ago
    exactly!
stonemetal12 3y ago
For most non-tech people the only router in the house is the one the ISP provided, forcing ISPs to punish their customers for the ISPs misdeeds is odd.
- deleted 3y ago
  [deleted]
- dylan604 3y ago
  This used to happen back in dial-up days and malware using the home connection as and SMTP SPAM attack. The ISP would prevent you from getting online. Eventually, they just blocked that port from all home users. Since the modem connected directly, there weren't really firewalls yet. It was the stone ages, but people definitely had their accounts blocked for having an infected machine
rolph 3y ago
the option to refuse or indefinately defer, any or all upgrades or updates, should be preserved, until there is some basis to believe, there will be no loss or ransom of function bundled in.
willmadden 3y ago
Internet access is not a "privilege". It is a service people purchase.
fullspectrumdev 3y ago
The routers being exploited are, in many cases, supplied and managed by the ISP lol
willcipriano 3y ago
A year after this is implemented: "internet access is a privilege, we cant have people speading dangerous ideas!" How about you start your own internet for fragile systems that can't handle the real internet? Then you can be a dictator and require remote attestation or whatever.

kube-system 3y ago

> what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices. Yes, but a lot of the internet is on a shoe-string budget and managed by someone who DGAF, and connected to an ISP who also DGAF.

mschuster91 3y ago
Yeah, and these people don't deserve to be on the Internet. We also don't let people run cars with bad exhaust stacks on the road, and if police spot violators, they get issued remediation orders.
- kube-system 3y ago
  The world is a big place and a lot of it doesn't work like that. Global emissions enforcement is just about as good as global internet security enforcement. That's why the internet is full of malware and the earth is getting warmer.
- anigbrowl 3y ago
  May I recommend 'How to win friends and influence people' instead of such naked user hostility.

squigz 3y ago

Because it's the customers fault manufacturers sell insecure routers that go out of service 2 years later?

candiddevmike 3y ago
At some point consumers need to become more computer savvy and responsible netzens.
- sgc 3y ago
  Sounds more like we need a minimum required period for security updates after a device is sold, and other similar measures. It is much, much easier to enforce this type of thing with one manufacturer than with 100k customers, many of whom are elderly and will never be able to do it themselves no matter how much we preach.
  - mschuster91 3y ago
    > It is much, much easier to enforce this type of thing with one manufacturer than with 100k customers, many of whom are elderly and will never be able to do it themselves no matter how much we preach. They all pay their ISP a hefty "rental" fee for their crap modem. It's only fair to hold the ISPs responsible in such cases.
    - sgc 3y ago
      That type of thing is why I threw in "and other similar measures". Of course there needs to be a basic security policy that is developed and enforced, and resellers / lessors should be responsible. We already have plenty to draw from, such as car/appliance recalls, large organization security policies, etc. There is a ton of low hanging fruit that could be easily dealt with quickly if there were political will.
    - gunapologist99 3y ago
      This is how you end up getting forced to be behind their awful DNAT DPI "firewall", which will still be insecure, and you won't have any access to it.
- Arrath 3y ago
  Sounds like an empty feel good platitude for the technically minded to feel superior to the rubes buying crap from manufacturers who put out that insecure crap in the first place. Yes, everyone could be more responsible about their consumption but why should that free the manufacturers from the responsibility of making competent products to begin with?

costco 3y ago

What if a hospital was disconnected from the Internet because it has some insecure IoT device in it? The truth is that this "enforcement action" will make absolutely 0 difference because these devices were just used as proxies to launch attacks. There are a million other people offering this as a service. And it was a botnet with "hundreds of devices." That is literally nothing. People who want to live in this world where abuse emails are king and a bunch of Spamhaus type people lord over the Internet always weird me out.

2OEH8eoCRo0 3y ago
Hundreds is plenty if your objective isn't DDoS. https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical https://www.justice.gov/opa/pr/us-government-disrupts-botnet... > China’s hackers are targeting American civilian critical infrastructure, pre-positioning to cause real-world harm to American citizens and communities in the event of conflict
- costco 3y ago
  I mean it's enough to make at the most a few thousand a month selling residential proxy plans on crime forums. Not really significant. There are orders of magnitude larger botnets (some 100k, 400k+ in size) you can read about on https://blog.netlab.360.com/ https://blog.netlab.360.com/. Edit: I agree it is important to do takedowns. Qakbot, GameOver Zeus, Emotet, Snake, etc all had actual espionage risk / were cumulatively involved in billions of dollars of theft. But this botnet seems sort of irrelevant.
mschuster91 3y ago
> What if a hospital was disconnected from the Internet because it has some insecure IoT device in it? Give them a remediation time of 24 hours. If that doesn't help, cut them off anyway, as that's the only thing that will force management to give their IT people actual staff and budget. Hospital IT is almost always a shitshow and that won't change until external pressure forces management's hand.
- 3y ago

mindslight 3y ago

This is a terrible narrative, essentially grease on the path of destroying the permissionless Internet in favor of an environment where every communication is tracked and "accountable". The basic reality is that Internet traffic should be considered hostile noise and Internet nodes need to be resistant to that. That's the crux of the seminal end to end principle and cross-jurisdiction operation (the whole "Inter" part). Furthermore, taking it at face value, why shouldn't this condemnation apply to the FBI first ? They've got compromised devices with the out of life software that's causing a bigger problem. So by applying that standard, they should be taken offline first. Which I'd say highlights a deep problematic assumption in reaching for the blame game, whereby some nodes start to be considered "more equal" than others.

ahmeneeroe-v2 3y ago

As a society we've settled on collective security (army/navy/police) to address outside physical threats. I believe that as our institutions mature we will take analogous steps towards addressing internet/computer security. It seems more obvious to me than making unsophisticated users responsible for their own individual security against highly sophisticated and well-resourced adversaries.

molsongolden 3y ago
“Cybersecurity today is like if we’d asked London building owners to install their own anti-aircraft guns during the Blitz.” Just a quote from a friend.
- gunapologist99 3y ago
  I take it that your point is the opposite, but it's still a good one: the Blitz would have gone VERY differently had there been AA guns on every rooftop. It'd get pretty expensive for bombers to plunge into the Channel and pilots thrown into a POW camp.
  - TheCoelacanth 3y ago
    But the result wouldn't have been AA guns on every rooftop. The UK's capacity to produce AA guns wouldn't have increased. Their economy was already focused entirely on the war. The result would have just been a lack of planning on how to actually make effective use of the resources available.
    - mrguyorama 3y ago
      And there would not have been any advancements on the radars used in "Chain Home", because "Your place got bombed because you didn't defend it well enough, nothing we can do"
- ahmeneeroe-v2 3y ago
  exactly!

stonemetal12 3y ago

For most non-tech people the only router in the house is the one the ISP provided, forcing ISPs to punish their customers for the ISPs misdeeds is odd.

deleted 3y ago
[deleted]
dylan604 3y ago
This used to happen back in dial-up days and malware using the home connection as and SMTP SPAM attack. The ISP would prevent you from getting online. Eventually, they just blocked that port from all home users. Since the modem connected directly, there weren't really firewalls yet. It was the stone ages, but people definitely had their accounts blocked for having an infected machine

rolph 3y ago

the option to refuse or indefinately defer, any or all upgrades or updates, should be preserved, until there is some basis to believe, there will be no loss or ransom of function bundled in.

willmadden 3y ago

Internet access is not a "privilege". It is a service people purchase.

fullspectrumdev 3y ago

The routers being exploited are, in many cases, supplied and managed by the ISP lol

willcipriano 3y ago

A year after this is implemented: "internet access is a privilege, we cant have people speading dangerous ideas!" How about you start your own internet for fragile systems that can't handle the real internet? Then you can be a dictator and require remote attestation or whatever.