Hacker News Reader

Comment by mschuster91 | Hacker News Reader

Disrupting the botnet is so far so good... but what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices.

Internet access is a privilege, and being a threat to others in this shared space should lead to said privilege being revoked until the threat is gone.

View on HN

For most non-tech people the only router in the house is the one the ISP provided, forcing ISPs to punish their customers for the ISPs misdeeds is odd.

This used to happen back in dial-up days and malware using the home connection as and SMTP SPAM attack. The ISP would prevent you from getting online. Eventually, they just blocked that port from all home users. Since the modem connected directly, there weren't really firewalls yet. It was the stone ages, but people definitely had their accounts blocked for having an infected machine

Because it's the customers fault manufacturers sell insecure routers that go out of service 2 years later?

At some point consumers need to become more computer savvy and responsible netzens.

Sounds more like we need a minimum required period for security updates after a device is sold, and other similar measures. It is much, much easier to enforce this type of thing with one manufacturer than with 100k customers, many of whom are elderly and will never be able to do it themselves no matter how much we preach.

> It is much, much easier to enforce this type of thing with one manufacturer than with 100k customers, many of whom are elderly and will never be able to do it themselves no matter how much we preach.

They all pay their ISP a hefty "rental" fee for their crap modem. It's only fair to hold the ISPs responsible in such cases.

That type of thing is why I threw in "and other similar measures". Of course there needs to be a basic security policy that is developed and enforced, and resellers / lessors should be responsible. We already have plenty to draw from, such as car/appliance recalls, large organization security policies, etc. There is a ton of low hanging fruit that could be easily dealt with quickly if there were political will.

This is how you end up getting forced to be behind their awful DNAT DPI "firewall", which will still be insecure, and you won't have any access to it.

Sounds like an empty feel good platitude for the technically minded to feel superior to the rubes buying crap from manufacturers who put out that insecure crap in the first place.

Yes, everyone could be more responsible about their consumption but why should that free the manufacturers from the responsibility of making competent products to begin with?

I'm a software developer, and I've thought about my home router almost never. I've updated it exactly never. I'm using the default one from my ISP, and I think I'm paying a monthly rental fee for the privilege.

I don't know how to tell whether my router is vulnerable, or what I could even do about it. If I'm not savvy enough for your proposed rules, which does seem quite possible, I don't think most people have much hope.

Any responsible citizen would respect the right of their fellow citizens to not be computer savvy, in an age where technology is eating us apart.

It is the job of the techies to fix techie problems. When a bridge shakes beyond specs, it is the job of engineers to fix it, bridge building is not crowdsourced to society.

I am computer savvy but I have better things to do vs researching innards of every tech gizmo I own.

No, but those devices are their responsibility.

Car analogies are always fun, so here's one: The catalytic converter on my car is sawzalled off in the middle of the night. I drive around with the missing cat for a couple months. Then I fail a smog check, or get a ticket for loud exhaust. Is it my fault the cat was stolen? No, but I still have a responsibility to everyone else to not pollute (fumes or noise).

If the ISP supplies the router, then of course they should correct it. But if the subscriber brings their own equipment, then they take on the responsibility of maintaining it. Including replacement if it turns out not to be fit for purpose.

I say we punish the car manufacturers for making easy to steal catalytic converters. Take it all the way up the chain. It's their responsibility for designing a flawed product they knew was flawed. It's not your fault the cat was stolen. It was the manufacturers.

But in this case it wasn't your fault that the cat was stolen, it is however completely your fault to continue to operate an illegal vehicle no matter how the vehicle came into that condition.

>"It's not your fault the cat was stolen. It was the manufacturers."

Not, it is a fault of thieves. And maybe a police who prefer to generate ticketing revenue rather then go after real criminals.

I don't think that's a good analogy.

Car manufacturers are required to do recalls on cars that have airbags that explode rather than inflate. Even 20 year old clunkers. They widely publicize cars they think aren't actually safe anymore so customers can choose to update.

When food is shipped out to customers full of listeria, they don't say "you should have kept a full pcr lab in the kitchen and tested every bite, this is obviously the eater's fault", they flood the news with recall notices and take the food back and offer a refund. (and often are still sued because they too have responsibility).

The firewall stopped doing it's job, if it had done it's job properly the device wouldn't have been owned. Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?

In my analogy, the motorist is the ISP customer, the thief is the hacker, and the DMV is the ISP. If I were to draw the corresponding links in your analogy, the motorist is still the customer, the auto maker is the router manufacturer. Whatever duty is owed to the owner of a faulty car, that duty is not on the DMV. It's on the manufacturer.

> Why shouldn't firewall manufacturers be required to have some responsibility when the firewall is shown to not actually firewall?

They should! I'm not arguing against holding companies responsible for their crap products. I'm arguing that the ISP shouldn't be forced to keep an attack vector on their network.

If a shitty home router becomes a bot in a DDOS botnet, that's not the ISP's responsibility. From their perspective, it's on the subscriber. From the subscriber's perspective, it's on the maker of that shitty router. (ISP-provided equipment is obviously different)

What if a hospital was disconnected from the Internet because it has some insecure IoT device in it? The truth is that this "enforcement action" will make absolutely 0 difference because these devices were just used as proxies to launch attacks. There are a million other people offering this as a service.

And it was a botnet with "hundreds of devices." That is literally nothing. People who want to live in this world where abuse emails are king and a bunch of Spamhaus type people lord over the Internet always weird me out.

Hundreds is plenty if your objective isn't DDoS.

https://www.justice.gov/opa/pr/us-government-disrupts-botnet...

> China’s hackers are targeting American civilian critical infrastructure, pre-positioning to cause real-world harm to American citizens and communities in the event of conflict

I mean it's enough to make at the most a few thousand a month selling residential proxy plans on crime forums. Not really significant. There are orders of magnitude larger botnets (some 100k, 400k+ in size) you can read about on https://blog.netlab.360.com/.

Edit: I agree it is important to do takedowns. Qakbot, GameOver Zeus, Emotet, Snake, etc all had actual espionage risk / were cumulatively involved in billions of dollars of theft. But this botnet seems sort of irrelevant.

> What if a hospital was disconnected from the Internet because it has some insecure IoT device in it?

Give them a remediation time of 24 hours. If that doesn't help, cut them off anyway, as that's the only thing that will force management to give their IT people actual staff and budget. Hospital IT is almost always a shitshow and that won't change until external pressure forces management's hand.

And if any patient dies / suffers / injured because of this jail whomever had this genius idea.

This is a terrible narrative, essentially grease on the path of destroying the permissionless Internet in favor of an environment where every communication is tracked and "accountable". The basic reality is that Internet traffic should be considered hostile noise and Internet nodes need to be resistant to that. That's the crux of the seminal end to end principle and cross-jurisdiction operation (the whole "Inter" part).

Furthermore, taking it at face value, why shouldn't this condemnation apply to the FBI first ? They've got compromised devices with the out of life software that's causing a bigger problem. So by applying that standard, they should be taken offline first. Which I'd say highlights a deep problematic assumption in reaching for the blame game, whereby some nodes start to be considered "more equal" than others.

The routers being exploited are, in many cases, supplied and managed by the ISP lol

the option to refuse or indefinately defer, any or all upgrades or updates, should be preserved, until there is some basis to believe, there will be no loss or ransom of function bundled in.

As a society we've settled on collective security (army/navy/police) to address outside physical threats. I believe that as our institutions mature we will take analogous steps towards addressing internet/computer security. It seems more obvious to me than making unsophisticated users responsible for their own individual security against highly sophisticated and well-resourced adversaries.

“Cybersecurity today is like if we’d asked London building owners to install their own anti-aircraft guns during the Blitz.”

Just a quote from a friend.

I take it that your point is the opposite, but it's still a good one: the Blitz would have gone VERY differently had there been AA guns on every rooftop. It'd get pretty expensive for bombers to plunge into the Channel and pilots thrown into a POW camp.

But the result wouldn't have been AA guns on every rooftop. The UK's capacity to produce AA guns wouldn't have increased. Their economy was already focused entirely on the war. The result would have just been a lack of planning on how to actually make effective use of the resources available.

And there would not have been any advancements on the radars used in "Chain Home", because "Your place got bombed because you didn't defend it well enough, nothing we can do"

exactly!

Internet access is not a "privilege". It is a service people purchase.

A year after this is implemented: "internet access is a privilege, we cant have people speading dangerous ideas!"

How about you start your own internet for fragile systems that can't handle the real internet? Then you can be a dictator and require remote attestation or whatever.

> what actually needs to be done is that the ISPs need to be notified and the affected customers be disconnected from the Internet until they replace the compromised/out-of-life devices.

Yes, but a lot of the internet is on a shoe-string budget and managed by someone who DGAF, and connected to an ISP who also DGAF.

Yeah, and these people don't deserve to be on the Internet. We also don't let people run cars with bad exhaust stacks on the road, and if police spot violators, they get issued remediation orders.

The world is a big place and a lot of it doesn't work like that.

Global emissions enforcement is just about as good as global internet security enforcement. That's why the internet is full of malware and the earth is getting warmer.

May I recommend 'How to win friends and influence people' instead of such naked user hostility.

Reply on news.ycombinator.com