Hacker News Reader

Comment by JoshTriplett | Hacker News Reader

I'd like to see ISPs doing better policing of their customers: disconnecting (and prosecuting) spammers, blocking users infected with malware until they get clean, and so on. I'd like a world in which I can reasonably expect to react to spam by tracking down where it came from and getting the spammer removed from the Internet.

abuse@ ought to function and produce a rapid response.

(That doesn't mean we shouldn't have anonymous, untrackable services as well, but using such services means you have to put up with spam too. When you have a service like email, with all the tracking information readily available in the headers, it shouldn't be as near-impossible as it currently is to get something done with that information.)

View on HN

The problem is there are two sources of spam.

The first is large networks that tolerate spam, and those are irrelevant because their IP blocks are already on every blacklist in the world.

The second is compromised machines, which are the real problem because they're ephemeral. Spammers can compromise a hundred new machines a week. You can't fix them or block them faster than they compromise new ones. The only solution to that is to improve computer security so they don't get compromised to begin with, which has nothing to do with ISPs.

Removing people from the internet is never the answer, both because it's too broad (should the spammers not be able to go to the government's website to pay their taxes?), and because the nominal current source of the spam isn't actually where the spammer connects to the internet anyway.

The better solution if you can actually find a real life spammer is to impose a fine on them that exceeds the profits of spamming.

There is also the great firewall attack that hit GitHub a while ago.

Wait, why can't you block spammers as fast as they are created? If your computer is compromised, it seems fine to disconnect it, or at least severely rate limit uploading until you fix the problem. Its the responsibility of the internet user to keep their computer in working order.

Really, if your computer is spamming someone, even if you aren't aware of it, you are harming them, and ignorance shouldn't be protection. Maybe fines and jail are a bit too severe, but rate limiting and possible disconnection are more then fair.

So if Joe Shmo's router is compromised, then the ISP turns it off. How then is Joe supposed to learn that he's compromised by looking up symptoms, or download an antivirus to clean it up?

It's a pretty solution to the problem in theory, but when you actually apply it, it doesn't quite work out as well.

He calls the ISP and they tell him he is compromised. Or they robocall him.

My ISP actually did once cut me off when one of the machines on the network was compromised by malware. I called up their support line and they told me what had happened, I fixed it, and all was well.

Shameless plug: http://www.quarantainenet.com/

The ISP routes any HTTP request from you to a page that says "your computer has a virus, call your ISP support line to restore access". Of course, that in turn opens up the possibility of someone else taking over your modem and telling you to call this 900 number to fix the problem... :)

So you work from home and your 12yr old discovers SET and sends a few phishing emails to their friends, so now the ISP cuts you off from the Internet. Now what?

You call them and get it turned on again. Also, shut off doesn't have to be right away, it could be after a few days of intense spam, and a week of upload constrained connectivity. In other words, you can find a sensible policy.

(1) There is no point in complete cutoff -- partial filtering should be enough. So if email spam is sent, outgoing SMTP port is blocked; if there is a virus spreading over random ports, all outgoing ports except http/https are blocked; if malware leaves spam on webpages, then all http/https connections are redirected to captive portal explaining how to fix.

(2) Same with spam blacklists, you get de-listed either automatically, if few weeks pass without incident, or faster by manual request.

(3) It should not matter why bad traffic was sent. A much more realistic situation is: "So you work from home and your computer gets trojan which starts to send phishing emails, so now the ISP cuts you off from the Internet. Now what?"

In either case the answer is: prove to humans @ ISP that you are no longer danger to the internet and ask them nicely to unblock you. If you work from home is that critical, have a separate internet source (say 3G modem which you activate with a phone call)

So you work from home and your 12yr old discovers loaded revolver in night closet and shoots few friends, so now the Police come and arrest you. Now what?

> Wait, why can't you block spammers as fast as they are created?

They can literally compromise new machines faster than you can identify existing compromised machines. It doesn't do anything to impose anything on the machine owner -- as soon as you identify the machine you can blacklist it, and as soon as you blacklist it they stop using that one.

The problem is in the time it takes you to identify a compromised machine, they can compromise many more additional machines.

> The better solution if you can actually find a real life spammer is to impose a fine on them that exceeds the profits of spamming.

That's exactly what I'd like to see. But that does depend on cooperative ISPs.

> That's exactly what I'd like to see. But that does depend on cooperative ISPs.

How does that help? The ISP can tell you where the compromised machine is, but it will be a different compromised machine in an hour so that's no help. It can't tell you where the actual spammer is because they're behind five proxies in six countries.

Costs can be imposed in multiple ways.

Often it's more feasible to apply costs to a higher level of responsbility than the party directly responsible. E.g., sanctioning a country which, say, harbours pirates or highly-polluting industries.

It's the model of collective action and pressure.

There's some really interesting work (some of it recently from Cloudflare) on tying reputation to reliably anonymous trafic. Fair Anonymity and FAUST are the two approaches I'm familiar with, though AFAIU each are very preliminary academic proofs of concept, not anything production-ready.

There might be other ways of managing traffic, though it would require more pipe smarts.

Generally, I'm in favour of ASNs -- autonomous systems -- taking responsibility as you describe. After all, they do present a single administrative bound of control, and ought take responsibility for their traffic as you describe.

The Routeviews Project (asn.routeviews.org) offers both DNS lookups and downloadable zonefiles for mapping individual IPs to ASNs.

Of late, the problem I'm finding is that far too many services are hosted on Amazon, though firewalling off a wide swath of a few AWS AZs might be an interesting approach.

one of the major issues of malware/spam/botnets is a direct result of the hardware ISPs provide to their customers. They should at minimum be taking on that responsibility of security upgrading their rootable hardware. If abuse@ could just be triggered by honeypots that could quickly identify hacked routers & ISPs would replace/upgrade them accordingly, at least one ugly sliver of the IoT would be addressed.

How would an ISP identify spammers without directly inspecting unencrypted packets?

(Sr. Net Eng at $ISP)

Netflow data is extremely helpful, although not on its own (it will also identify legitimate customers running their own mail servers). It's a good start, though.

Reply on news.ycombinator.com