Home News Forum Articles
  Welcome back Join CF
You are here You are here: Home | Forum | Solution to current spam issues.


You are currently viewing our boards as a guest which gives you limited access to view most of the discussions, articles and other free features. By joining our Virgin Media community you will have full access to all discussions, be able to view and post threads, communicate privately with other members (PM), respond to polls, upload your own images/photos, and access many other special features. Registration is fast, simple and absolutely free so please join our community today.


Welcome to Cable Forum
Go Back   Cable Forum > Computers & IT > Security & Virus Discussion

Solution to current spam issues.
Reply
 
Thread Tools
Old 17-06-2005, 15:14   #1
cynicism theme ****
 
Scarlett's Avatar
 
Join Date: Jun 2003
Location: St Neots
Posts: 777
Scarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpack
Send a message via MSN to Scarlett
Solution to current spam issues.

Okay, I've been thinking about his one for some time.

There has been the press recently (here and here) many stories about how many computers are just zombies that spew spam out over the internet and although I know at least some of these infections couldn't be avoided the vast majority could be by the use of up-to-date firewall, anti spy ware and antivirus software.

The problem is that people who own PC's are not necessarily computer literate and with the growth of BB and places like PC world, more and more people are buying PC's. People who want the PC so that they can play the latest games or even just to send emails to their family but know absolutely nothing beyond how to turn it on and open outlook and internet explorer. Even worse are the those that do have some knowledge but just don't care. I remember taking to one guy in the office of a hire car company (As I was waiting for my car to come into the yard so that I could pick it up.) "I don't bother with a firewall or anti virus, its not mucking up my system so who cares." was his take on the issue. The problem is that he is very right. The vast majority of today's viruses etc do not really harm the users PC. The damage the do is spread out over many thousands of users

I think that it's time that we stopped selling PC to any Tom, Dick or Harry who walks through the door of a shop and started being more responsible. After all, we can't sell hand guns full stop and shotguns only after a number of checks. Your only allowed on the road on your own once you've passed the driving test.
Why should a computer be any different. If you computer is just a Zombie then it could be used to hold up an online poker site as part of a DOS attack or used to send out 1000's of emails telling the local bank customers that there passwords need to be reconfirmed. In both cases your PC would be an accessory to a crime but at the moment, you do not get held responsible. Your PC could also send out Millions of adverts for Fiagra, the better version of viagra to every one in your town but again, you would not be held responsible. Your ISP may restrict your access to the internet and make you clean up the malicious software on the PC but you will not then be taken to court by anyone for the spam that was spread.

The solution I've been thinking about is two fold.
1. If you buy a new PC then you should be offered 2 or 3 hour long training course's on internet security, how to use the software, how to spot obvious email viruses etc. The costs could probably be defrayed by the inclusion of a section on P2P software and not sharing music on line.
In addition to this, all new PC's would be sold with a firewall, antivirus and antispyware/trojen remover with a years subscription pre-loaded and pre-configured to auto update every 24 hours and/or each time the PC connects to the internet. The firewall could be the XP firewall (I don't personally rate it but its much better than nothing), the anti virus could be AVG and the anti trojen/spyware (Ad aware ?) could well be shareware or the like so there is little/no additional cost to the consumer. If you wanted a PC without this then you'd have to sign a waiver absolving the vendor of any responsibility for antivirus and firewall once it leaves the shop.

2. A change in the law to make people responsible for their PC's being involved in DOS attacks, spamming, phisting and all those other nasty little things you can do with a zombie PC. Provided it can be shown that you have taken reasonable steps to avoid contamination then you are fine. if however, your computer is checked and it is found that you have disabled the firewall or not bothered to keep it up to date then you should be taken to court and fined (probably up to £1000). You would also have to attend the course mentioned in 1 and your PC would be barred from being re-connected the internet until it has been fully cleaned.

Those who initially don't have a clue will probably be quite thankful that someone took 5 minutes to explain things. And as for those who are just irresponsible then the fine ought to make them see the error of their ways in fairly short order.

I think this would be something that could work because just sitting back and leaving the 'market' to go and buy anti virus products etc clearly isn't working and its time that we stopped allowing lack of knowledge and ignorance as an excuse for the vast amount of spam and DDos attacks that are now occurring.

What do people think ? I'm not really looking for suggestions like you could never police this and it could never happen but the idea in general. Am I insane ? Am I speaking sense ? answers on a postcard to...

Scarlett.
__________________
Founder member of the cynicism theme team

Last edited by Scarlett; 17-06-2005 at 15:17. Reason: Speeling, spelllink,spelk... words!
Scarlett is offline   Reply With Quote
Old 17-06-2005, 15:23   #2
Stuartbe
Guest
 
Location: Luton
Services: NTL Nafband
Posts: n/a
Re: Solution to current spam issues.

some very good idea's m8 but sadly I cant see any of them being implemented.

There is another solution - one that all the ISP's could bring into force in 5 minutes....

With very few exeptions most spam mails and spreading virus's will spoof the source address, Becouse of the way that 2k, xp pro and home work with regards to the sockets this is very easy to do.

If all ISP'S added a simple one line rule on there routers it would stop 90% of these incidents. The line simply will not forward packets that do not have a valid source address that are originating from there networks source. This is simple to do but none of the ISP'S are interested in doing this !!!

These problems are not going to go away until the companies that run and maintain the net pull there thumbs out of there butts !!!!!
  Reply With Quote
Old 17-06-2005, 15:54   #3
[NTHW] pc clan
 
Ramrod's Avatar
 
Join Date: Jun 2003
Location: Tonbridge
Age: 40
Services: Be* Unlimited ADSL2+ BB
Posts: 17,739
Ramrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered stars
Ramrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered starsRamrod is seeing silvered stars
Re: Solution to current spam issues.

Quote:
Originally Posted by Stuartbe
If all ISP'S added a simple one line rule on there routers it would stop 90% of these incidents. The line simply will not forward packets that do not have a valid source address that are originating from there networks source. This is simple to do but none of the ISP'S are interested in doing this !!!
Why not?
__________________
Step by step, walk the thousand mile road...
-----------------------------------------------------
Are you a mature PC gamer? Then go to the mature gamers site: nthwgaming.co.uk
Ramrod is offline   Reply With Quote
Old 17-06-2005, 15:58   #4
Stuartbe
Guest
 
Location: Luton
Services: NTL Nafband
Posts: n/a
Re: Solution to current spam issues.

Very good question... Wish I knew the answer...

The very first thing I did when I took over the network where I used to work was to add this line to our cisco box. It does not create any problems. There is after all no ligitimate need for producing spoofed packets !
  Reply With Quote
Old 17-06-2005, 16:01   #5
In Permanent employment
 
Angua's Avatar
 
Join Date: Apr 2005
Location: Unfortunately David Camerons constituency
Age: 49
Services: L BB, XL Digi TV, basic phone.
Posts: 5,020
Angua has a nice shiny starAngua has a nice shiny starAngua has a nice shiny starAngua has a nice shiny star
Angua has a nice shiny starAngua has a nice shiny starAngua has a nice shiny starAngua has a nice shiny starAngua has a nice shiny starAngua has a nice shiny star
Send a message via MSN to Angua
Re: Solution to current spam issues.

Quote:
Originally Posted by Scarlett
<snip> In addition to this, all new PC's would be sold with a firewall, antivirus and antispyware/trojen remover with a years subscription pre-loaded and pre-configured to auto update every 24 hours and/or each time the PC connects to the internet.<snip>
This would probably be the best starting point, but would only last a year what then
__________________
BlueCross
Angua is offline   Reply With Quote
Old 17-06-2005, 16:46   #6
cynicism theme ****
 
Scarlett's Avatar
 
Join Date: Jun 2003
Location: St Neots
Posts: 777
Scarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpackScarlett has a very nice sixpack
Send a message via MSN to Scarlett
Re: Solution to current spam issues.

Quote:
Originally Posted by Angua
This would probably be the best starting point, but would only last a year what then
Well if the whole thing was implimented as above then they owner would need to pay for the next years subscription or risk having their ass hauled into court and fined + attending the course + lack of email etc until resolved.

Thats where the problem is at the moment. There isn't really a 'stick' as such to make people think about being responsible with there 'Always on PC'.
__________________
Founder member of the cynicism theme team
Scarlett is offline   Reply With Quote
Old 17-06-2005, 17:43   #7
Stuartbe
Guest
 
Location: Luton
Services: NTL Nafband
Posts: n/a
Re: Solution to current spam issues.

Here is the info needed to make a Cisco router / Pix block spoofed packets..

NB - these rules can also be applied to a level 3 / Managed switch !

In order to help prevent your network(s) from being used in Spoofed Denial of Service (DoS) Attacks, the following access list should be in place on your routers. The access list needs to be placed outbound on the Interface that connects to the ISP.

Please note that applying an access list on a Cisco may have a performance impact. You should monitor the CPU and Memory usage before and after applying the filters to determine the impact. You can use the "show proc cpu" command to do this.
access-list 1xx permit ip <Network-Base-Address> <Hostmask> any
access-list 1xx deny ip any any log

Please refer to the CIDR Table for help on the Network Base Address and the Hostmask.

This access list will prevent packets being sent from your network with any Source IP Address other than your network.

For customers that have more than one connection to the internet, this would be applied outbound on any interface connected to the Internet.

Placing the ACL on interfaces toward the internet. In the following example the link to the internet is Serial0.1.
external-gw#show ip interface brief
Interface IP-Address OK? Method Status Protocol
Ethernet0 192.168.2.1 YES NVRAM up up
Serial0 unassigned YES unset up up
Serial0.1 192.168.1.1 YES unset up up
Serial1 unassigned YES unset down down
external-gw#

The network is 192.168.1.0 255.255.255.0. We want to create an access list that will permit traffic from any host within the 192.168.1.0/24 network and drop all other traffic.

To see if access list 150 is already defined, enter the following router commands:
external-gw#sh access-list 150
external-gw#

If there was an access list it would have shown up here.

If 150 already exists, simply choose a 1NN number that is not in use: 160, 165, etc. Substitute the number you choose in the configuration examples below.

Now we want to make sure that the serial interface does not have an access-list applied outbound.
external-gw#show ip interface serial0.1
Serial0.1 is up, line protocol is up
.
.
.
Outgoing access list is not set
.
.
.
external-gw#

You should see the line "Outgoing access list is not set". If not, you already have an outbound access list, and you will need to see your firewall administrator for help. The anti-spoofing rules can be applied to an existing outbound access list, but care needs to be taken not to interfere with the existing rules. If you do not have an existing outbound access list, then you can now create access-list 150 and apply it outbound on the interface connected to the ISP (in this example it is serial0.1).
external-gw#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
external-gw(config)#

Once you are at the (config) prompt, you can "cut-and-paste" the access-list into the router. You need to either create an access list to only allow traffic with source addresses belonging to your network as described in Step 1.1, or you can "cut-and-paste" the access-list to deny private and reserved addresses as described in Step 1.2.

Once you have created the access-list you need to apply it to the interface.
external-gw(config)#interface serial0.1
external-gw(config-subif)#ip access-group 150 out
external-gw(config-subif)#^Z
external-gw#write
Building configuration...
[OK]
external-gw#

Example Anti-Spoof Access List
You need to replace the network and hostmask with your network information. Then you can "cut-and-paste" the access list at the (config) prompt as described above.
no access-list 150
access-list 150 permit ip 192.168.1.0 0.0.0.255 any
access-list 150 deny ip any any log

Access List to Deny Private & Reserved Source Addresses
If you are implementing Step 1.2, you can "cut-and-paste" the following access list at the (config) prompt as described above.
no access-list 150
access-list 150 deny ip 0.0.0.0 0.255.255.255 any
access-list 150 deny ip 10.0.0.0 0.255.255.255 any
access-list 150 deny ip 127.0.0.0 0.255.255.255 any
access-list 150 deny ip 169.254.0.0 0.0.255.255 any
access-list 150 deny ip 172.16.0.0 0.15.255.255 any
access-list 150 deny ip 192.0.2.0 0.0.0.255 any
access-list 150 deny ip 192.168.0.0 0.0.255.255 any
access-list 150 deny ip 224.0.0.0 15.255.255.255 any
access-list 150 deny ip 240.0.0.0 7.255.255.255 any
access-list 150 deny ip 248.0.0.0 7.255.255.255 any
access-list 150 deny ip 255.255.255.255 0.0.0.0 any
access-list 150 permit ip any any

The "log" at the end of the deny statement in the access list, will log any packet that is sent with a source address other than the ones permitted by the previous statement.

After the access list is applied to the interface, the command "show ip access-list " will display counters for each access expression. Confirm that the counter for the expression to pass your address block is incrementing.

If it is necessary to remove the access list due to an error, use the interface command "no ip access-group 150 out" to remove it and confirm with "show ip int <interface>".

Never change the access lists on the router interface you are using to configure the router. Either remove the access-group first, or configure the router via the serial console interface. If you do not remove the access-group from the interface first, you will cause a momentary outage while installing the new access list and may disable all traffic through the interface if you make an error, plus inadvertently disconnect your telnet terminal session from which configuration changes are being made!

DONT FORGET to do this via sr1 and not SSH1 or TS as you will cut yourself off when you apply the ACL..

Dont forget copy run start !!!!

NB - I would not bother logging the droped packets unless you are having problems. It would just be better to turn on debug for the interface !

HTH

Last edited by Stuartbe; 17-06-2005 at 17:50.
  Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


All times are GMT +1. The time now is 06:55.


Links
Google
 
Web www.cableforum.co.uk


Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.1.0
Copyright © 2003 - 2008, Cable Forum.
(s204569790.onlinehome.info)