Should ISPs Monitor Users PCs To Stop Botnets?

Homeland Securitys proposed code of conduct for notifying users when their PCs are infected by malware raises privacy concerns.

The Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST) are proposing that service providers notify their customers whenever they detect a botnet infection on the users PC, and then coordinate the subsequent removal of that malware.
But whats the best way to detect botnets and coordinate notifications? To answer that question, DHS and NIST last week released a
voluntary notification proposal
for comment--until November 4, 2011--in the Federal Register. In particular, theyre seeking information on the requirements of, and possible approaches to creating, a voluntary industry code of conduct to address the detection, notification, and mitigation of botnets. The agencies also want suggestions for potential models for detection, notification, prevention, and mitigation of botnets illicit use of computer equipment.
Busting botnets
is a priority for the government because of the potential economic impact of botnets and the problems they cause to computer systems, businesses, and consumers, said DHS and NIST. Notably, these networks of zombie computers are often
rented out
to be used as
spam relays
, in
phishing attacks
, and to launch massive,
distributed denial-of-service attacks
.
Furthermore, the incidence of botnets being used to
commit crimes
continues to increase. More coordinated botnet notifications, however, might help reduce the overall number of botnet infections, making zombie PCs more scarce. That, in turn, could make botnet-driven attacks more costly for criminals, as well as difficult to execute.
[Are your Web-connected photocopiers, scanners, and VoIP servers compromising your enterprise security? Learn more at
Corporate Espionages New Friend: Embedded Web Servers
.]
The cornerstone of any such notification program would likely be for service providers--not least because they already have both contact details and a working relationship with so many PC users--to detect infections via network traffic and notify affected customers. That approach has been used since December 2010 in
Australia
, and recently introduced in
Germany
and
Japan
.
Businesses and government agencies in the United States also have some experience with informing botnet-infected PC owners about their malware issues. In October 2010, Comcast implemented botnet notifications as part of its
Constant Guard
service, run by computer security firm Damballa. According to Comcast, it may email a service notice to Comcast email addresses when it suspects that a users PC is infected by malware. The email then directs users to the Constant Guard website for instructions on how to eliminate the malware.
After the FBI took down the Coreflood botnet earlier this year, any PC infected with the malware redirected to a
replacement government command-and-control server
, which remotely disabled the botnet. Authorities then alerted the users service provider, requesting that it warn the user that their PC was infected with the Coreflood malware, and offer advice for eradicating the infection.
But the practice of detecting botnet infections on peoples PCs raises privacy questions. If we agree to having our packets inspected as they traverse the Internet, will the temptation to use this information to track your activities, or sell your surfing habits to marketers, be too great for ISPs to resist? said Chester Wisniewski, a senior security advisor at Sophos Canada, in a
blog post
.
But he said the proposal offers great promise, as well as pragmatism in a world that too often obsesses over high-profile but incredibly rare attacks, such as
Stuxnet
. The vast majority of attacks are using our own computing resources to compromise our infrastructure, he said.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps