FCC to push ISPs for zombie crackdown

TalkBack 28 of 29:

Next »

« Previous

• Thread View
• Flat View

wrong solution.

You are mixing outgoing and incoming port numbers. Blocking all outgoing ports would prevent users connecting to their legit POP3 account, they could not read news, could not discuss on IRC,etc... And they could no longer connect to HTTPS sites.

The main issue is outgoing connections to remote SMTP port 25. What an ISP can do is to block all outgoing connections to remote port 25 except to the regular SMTP servers of the ISP. It'sthe job of ISPs to operate STMP servers with good performance and connectivity, and then to detect and filter spams there, possibly adding delays above some reasonnable threshold for emails that exceed some limitation (this delay will allow easier detection of spam, because fingerprints can be computed and compared to detect infected user's PCs that are infected by spambots.

As well the ISP should block incoming connections to port 25 of the user's PC (so that these PCs won't be simple open-relays), however this has limited efficiency, given that spambots can receive emails to forward from another random listening port, also not necessarily using the SMTP protocol.

Users that don't wish such filtering should be given an option to unblock this port, and ISPs should offer assistance to their users to clean their PCs of known or detected spambots.
ISPs can/should work with antivirus vendors to provide cleaning agents. Once auser PC is cleaned (by running the agent online on the ISP's assistance website, the user can then unblock this port if they still really need it, but users should be warned that they need to keep their PC secured, and that any later reinfection may force the ISP to block this port again).

When the ISP blocks the port, he should send an email to its customerto inform him of the issue, and contianing a link to their user assistance website where updated cleaning agents are available.

Another thing that ISPs should consider is to implement and propose a full-featured firewall running at the ISP side, instead (or in addition to) of the user's site, or to have this firewall integrated (and managed remotely according to user's preferences, with a default profilewithmaximum security) in the broadband access modem-router they rent to their customer.

Clearly, ISPs must make more to assist their users, with much more options and services (and the most vital security services offered without additional fees, given that the ISP will save money by reduced traffic through their Internet peerings, and better performance and scalability of their DNS cache servercurrently affected by the volume of spam their users are originating).

Posted by: PhilippeV   Posted on: 12/27/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now