2010-11-01
Abstract
‘Germany was the first country to launch a large-scale malware-cleaning project backed by the government.’ Sorin Mustaca, Avira
Copyright © 2010 Virus Bulletin
Millions of computers around the world are being controlled by malicious programs unbeknownst to their owners. These computers are used to send spam and phishing emails, spread malware, steal information and launch DDoS attacks on various networks. Take many computers infected by the same malicious program and controlled by the same people and you have a botnet.
At the beginning of October, Scott Charney, Corporate Vice President of Microsoft’s Trustworthy Computing team, suggested that infected machines should be blocked from the Internet and kept in quarantine until they are given clearance from some authority (ISP or governmental entity). Setting aside the obvious arguments as to how ISPs and governments would identify and isolate the infected PCs, I feel that Charney’s idea unfairly punishes the victim – the owner of the PC – for being infected. His proposal suggests that the victim is to blame, rather than faulty or badly written software (e.g. the operating system, third-party programs). Anyone who has been in the computer security industry for long enough will know that the truth is somewhere in the middle. The owners of the affected machines are not infecting their computers deliberately. They get infected because they are connected – through an ISP – to the Internet. So, does this mean that we can identify those who are responsible for this mess? Or those who can do something to help solve it? The ISPs?
I can’t answer these questions, but there are some who have started to take action. In the last three years we have seen a number of governmental initiatives that tried to opt in big ISPs with the purpose of identifying and cleaning infected PCs.
Germany was the first country to launch a large-scale malware-cleaning project backed by the government, ISPs and security companies. The ‘Botfrei’ (‘Bot Free’) initiative is a cooperation between eco (Association of the German Internet Industry) and the German Federal Bureau for Information Security (BSI). There is a telephone hotline for anyone who thinks their computer may be infected. The major ISPs in Germany are also cooperating (1und1, Telekom, Kabel BW, NetCologne, QSC and Versatel). They monitor suspicious activity on all IP addresses in their pool. For example, the sending of large volumes of data on port 25 for SMTP and incoming HTTP connections are considered suspicious activities. Once an ISP detects such activity, the customer is sent an email notification describing the suspicious activity and providing various other details. Anti-virus solutions are recommended to those who are infected.
Germany is not alone in taking such steps. One of the UK’s biggest ISPs, Virgin Media, has started to notify customers whose machines appear to be part of a botnet. The customers receive instructions on how to install free AV solutions, how to clean their computers and how to keep them clean. If unable to do this themselves, the customers can opt for a paid service provided by the ISP.
Comcast, the largest residential cable and Internet service provider in the United States, started a botnet-detection service a year ago and is planning to extend this to over 16 million customers in the next few months. The service detects connections made to botnet command centres and displays a banner on the user’s browser if they make connections there. Moreover, the Federal Communications Commission (FCC) is working on creating a ‘Cybersecurity Roadmap’ aiming to identify weaknesses in the country’s Internet infrastructure and to identify threats to home, corporate and government networks.
Another pioneer in this field is the Australian Internet Industry Association (IIA) which has already drafted an ‘eSecurity Code’ to which ISPs can adhere voluntarily.
Even though this kind of initiative has received a lot of positive press and support, it is only the beginning, so results will be slow to appear. Nevertheless, I raise my hat to these initiatives and hope that ISPs, governments, ISVs and software security companies will continue to work together to control this plague of the Internet world.
