My husband came home last night and told me about an incident that left me torn, as it speaks to the heart of the issue of internet safety. Someone he knows, who works within his company, was denied continued service by his ISP. Why? Because his ISP claims his home desktop is acting as a server for the Russian mafia, and branching out to over 500 different machines.
They are not claiming he is responsible in any way, but insist he remain offline until his computer is clean. Knowing what I do about systems security at the network admin level, this troubles me. Here is a person who exercised reasonable and prudent care with his desktop. He used firewall/ant-virus software, and never opened attachments. How can then his isp deny him service, when at their level, this could have been prevented or stopped, by having top notch IT security personnel, and state of the art ids systems? A network intrusion detection system, along with stateful packet inspection, and good logging could have caught this.
Is this going to be the start of a new isp reaction? If so, I think there needs to be input from the public on this. For starters, here is mine: anyone not using firewall/anti-virus programs should be denied service by any responsible isp. This is reasonable and prudent, given the increasing DDOS/DOS attacks on corporate servers. If an individual reports finding Trojans, involved with such attacks, they should NOT be denied service. Instead the isp security department should, in my opinion, either through remote or actual physical inspection, look at the compromised machine, its logs and attempt to find when the Trojan was planted, and if possible, look for any known footprints or methodology.
This information is vital in ascertaining how serious the threat might be to their servers/public domain. This isn’t extraordinary, it’s just good basic forensics and investigational procedure. The security tech could then instruct the client on how to rid their machine safely of the bot/zombie/Trojan. ISP’s charge people money to utilize their networks, and yet do very little in the way of being responsive to real security issues, which after all, in the hands of skilled crackers, can be breached. To simply deny service, leave the hapless consumer lost and not knowing even how to begin ridding his system of the Trojan, is unfair and unreasonable.
We as consumers have a responsibility too. To be aware that the net is simply a huge flow of information, broken into tiny bytes, flowing constantly through the lines. Because of this, anything one person does online can potentially impact thousands. People are still forwarding huge chain e-mails, any one of which might be infected, and think it’s just fun. Or clicking on unfamiliar e-mails, and discover, gasp, I got a virus. Well guess what? You and your 137 brothers and sisters got it too, thanks to one careless moment. A fellow chatter, happily babbling about her new baby, offers to send you a pic. You say awww sure and give him/her your e-mail. Did you know, malicious script can be embedded in photos. Photos by the way, never come as an exe. file And Mizz Babbler and cooer, is actually hostile and seeking victims of opportunity? The ‘net has become the playground of professional cons and criminal groups. We can’t be so naïve and trusting here.
I don’t want to see the internet become a police state, but I do think we all need to help make it more secure. And that begins with your own system. Secure it well, especially those of us in business online. Run diagnostics, defragment weekly and download kerio firewall, and check for intrusions. www.kerio.com. If you find Trojans listed in their log boxes, take the time to look up which type of Trojan they are here: http://www.staynew.com/~antitrojan/html/what_is_a_trojan_.html
If you have none, thank the computer gods, and uninstall kerio. I found a very good firewall, http://www.agnitum.com/products/outpost/, it outperforms all other firewalls I’ve tried, and it is easy to configure.
An excellent anti-virus, free to home users is Avast. www.alwilsoftware.com. It is extremely good and easy to use.
If your system is totally compromised, go buy a CD to erase your hard drive, using a DOD recommended 70 pass and shred wipe. Before going back online, load your firewall and anti-virus first and scan.
As for my husbands co-worker. I advised him to file a Federal class action suit against his ISP, in order to compel them to exercise more concern AND responsibility towards their customers. I believe this will be the only way to make them realize they can’t continue to reap enormous profits, without being responsive and responsible. It makes me wonder too. We live in the same area, is what is happening to me, related, and if so, why won’t this isp do something about it?
NEVER open unsolictied e-mail attachments. The mails are not in themselves dangerous, malware is contained in attachments, particularly .exe; .vbs or .scr files.
NEVER close a pop - up window with a mouse click. Malware scripts contained in pop - ups are often kicked off with the mouseover control. Use <CTRL>/W, it is much safer.
NEVER sign up to any web site through your pop3 mail. Open a Hotmail, Yahoo or similar mailbox. Onbce your address starts to get spread around the web you will become a target for all sorts of rubbish.
IF YOU USE Broadband never leave your computer switched on while you are not actually working on it. So long as the connection to the net is in place anybody could be looking at your personal data or hacking into your system. Remember, its a personal computer; than means nobody has any right to be working on it but you. It is not to our benefit to be online all the time, only Microsoft and people intent on mischief benefit. You have no obligation to help them.
Big thanks to Candy for raising these issues and also for kicking my arse so that as a former consultant I do something about this too.