Re: Nimda et.al. versus ISP responsibility

[robertm () austin ibm com]

This is how it's going to work:
As the owner of an infected machine you are going to notice you are disconnected from the net.
This will prompt you to call the ISP and inquire why.
The response will go something like:
By order of the Federal Government order x.y.z your host has been disconnected
in the interest of National Security to prevent it's unauthorized use by unknowns
as part of our new Anti-Terrorist Campaign....(blah blah bah...etc.etc...)
To be reconnected to the net, your host must first pass a test by
our security scanning software, - once this test is passed, our main router
will automatically un-blackhole your route.

-For information on how to make your machine compliant: please contact your software vendor.

Doesn't blame anybody...and protects the ISP, because they are following requirements of the law.


> Please be sure you place blame properly.
>
> No ISP is responsible for the actions of a person that releases a malicious worm on the Internet. No ISP is 
> responsible for the malicious actions of such worms on their software. The victim of a crime is not the perpetrator 
> of a crime!
>
> I hate to say it, but not even Microsoft is responsible for creating worms like Nimda. Yes, Microsoft is responsible 
> for releasing IIS software, but providing they had no prior knowledge of some bug, you can't blame them for the 
> crime, when some hacker discovers Yet Another Hole In A Microsoft Product. Their corporate pants get yanked to their 
> ankles on a regular basis by hackers the world over, but you still can't blame them for committing the crime! Blame 
> them for poor quality control perhaps, or say they get shot at the most because they're on top... but they aren't the 
> criminals here.
>
> Good luck trying to get ISPs to be responsible for content filtering. That's an impossible task.
>
> Let us not forget who the criminal is and who the victims are in cases such as Nimda. Certainly, those who provide 
> connectivity or hosting for others have the responsibility to stay on top of the latest software fixes, but you can't 
> completely plug that hole either. I know people who got infected by both CRII and Nimda, who didn't even know they 
> had IIS installed and running on their boxes. They didn't know their machines were toast until they could smell it 
> burning.
>
> We can no sooner get rid of malicious worms by placing responsibility for "handling" them on an ISP, than we can by 
> creating laws that make malicious software illegal. Until such time that we can successfully track the actual 
> perpetrators of the crime, or software authors miraculously invent perfect bug-free programs, not much is going to 
> change. Just make sure you place the blame where it belongs.
>
> -UMus B. KidN
>
> "Adcock, Matt" wrote:
> > <quote>
> >   I think we all agree that connecting an unpatched IIS machine to the
> > open Internet is acting irresponsibly. Most AUP's already prohibit
> > spamming, port scanning etc. (at least on paper). Why not include
> > "infection through negligence" as a reason for suspension? Maybe with a
> > reasonable grace period the first time.
> > </quote>
> >
> > I agree that the end administrator is ultimately responsible.  The ISPs
> > could also help by filtering this traffic.  It would take an infrastructure
> > upgrade that would end up costing the consumer, but I personally would be
> > willing to pay a little more.  Maybe give users a choice between being on a
> > filtered network or an open network?
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management 
> and tracking system please see: http://aris.securityfocus.com

-- 
--Robert Manning 
AIX Ztrans Team / L3TCP
Email: robertm () austin ibm com
PH: 512-823-9016 
EMERG: 512-663-3453


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com