Should your ISP protect you from yourself?

Where do they get the C&C info?

I've noticed a number of ISP's following this line of enforcement - have nothing against it so long as the c&c infrastructure information they have is accurate.

Where are they getting these blacklisted C&C servers? Are these servers "all bad" or hi-jacked channels on legitimate servers? What about non-irc c&c? Wondering if the ISP's are detecting c&c traffic themselves or just getting the research from elsewhere?

Jack

I cannot agree with what Cox

I cannot agree with what Cox is reported to be doing. It is known that the large ISP's wish to control the Internet, as highlighted by the Net Neutrality debate. This appears to be a step in that direction, though hidden under the guise of altruistic efforts to protect the users from themselves.

I do believe, however, that they have a couple of paths to follow. As mentioned in an earlier post, they could follow the example of AOL and offer free protection to the users, or even offer it on a subscription basis, with a small fee added to the bill each month as Verizon does, though I think Verizon is over pricing the service, since I can get the same or similar suites of products for less per year.

Should they take that route, the could go, I think, a step further and require that their customers maintain up-to-date A/V and firewall products to be able to connect to their network. While this would probably step on some toes, I do not believe that this would be construed as being illegal, just a clause in a a contract requiring it for use of the service.

Currently, if they detect a user who has an infected machine as determined from the type of traffic and, often enough, the destination, they can disconnect the user until the problem is resolved. I am sure that their current contract allows this. Then the burden is placed where it belongs, on the user, to clean up the offending machine or machines. If the user needs to seek out professional help for this, so be it.

Blocking ports, as mentioned in an earlier post, is not a viable option. There are legitimate uses for any port, and this could kill off those legitimate uses, as well as the user base. Those who write malware would then gravitate to ports that cannot be blocked, such as port 80, so they can communicate with their malware. Then where would we be?

Given that ISP's have a tendency to oversubscribe their lines, and given that they only have so much bandwidth to use, it is in their own self interest to find a way to limit traffic that may be considered as not legitimate. The way Cox is handling it is, I think, overstepping the bounds given other options that are available to them, however, from their perspective, it is probably the most cost effective.

There is one major key point

There is one major key point this article does not make clear: this was not an effective redirection of *only* infected traffic heading *only* to bot command and control centers. This was any Cox customer (infected or not, on Windows, Linux or Mac), that happened to want to use IRC and connect to a certain network/server. The server has a policy against botnets and does not tolerate abuse. If you wanted to, say, chat with your friends on irc.ablenet.org, and you were on Cox, you would find yourself forcefully redirected to Cox's fake server.

Additionally, their "removal tool" was nothing more than a bot in the auto-join channel there issuing bot-level commands to the infection Cox assumed you had. This denied legitimate, non-infected users from using IRC. Cox should be ashamed of themselves.

The the one who runs the IRC network pleads for help on FD list:
http://www.gossamer-threads.com/lists/fulldisc/full-disclosure/55016

While the botnets are

While the botnets are hampering the bandwidth of this user and others, I don't think it is the responsibility of the ISP to come into my computer and fix my problems. If they have a program that monitors this type of activity, isn't it better and safer to match the IP to the user and send off an snail/e-mail noting the problem. Then I as a good netizen have the resposibility to clean up my system. I would find it VERY intrusive and borderline illegal for the ISP to invade by computer even to remove malware.

That being said, I can understand an ISP shutting off certain ports for an individual if the abuse of the bandwidth continues after the warning.

The fact that the ignorant

The fact that the ignorant home user is not able to manage their own systems should not cost the isp additional money for the useless bandwidth consumed.

AOL figured out part of that when they offered free virus protection and spyware protection and packaged it as an altruistic move for their users, when in fact, it was probably a decision used to lower their bandwidth costs.

Definitely a slippery slope, but one day the ignorant home user’s endless consumption of bandwidth for botnets may lead to ISP's using metered service to bill bandwidth usage, so that the pain of the spyware hits where it should, at the user.

Will we see user agreements with the isp's that allow the ISP to automatically attempt to clean your computer or disconnect you if they see virus/spyware traffic from your computer? Only time will tell.