[SC-Help] Re: Getting balcklisted

[John E. Malmberg]

In article <cs6op4$o6i$1 at news.spamcop.net>,
   "Iain" <ipmarketing at spamcop.net> writes:
>
> Phishing and effective anti-phishing actions are another whole area I'm
> looking at...and have some quite nice solutions for. It's a major issue with
> banks and Government department that I work with and has taken a good deal
> of thought. Anti-phishing will be incorporated in the solution :-)

If you want to stop phishing, all you have to do is to get the anti-spam
laws in your country modified to hold the ISP hosting the spammer or allowing
the insecure system to relay spam responsible if they do not take action in
what should be a reasonable amount of time after notification should have
been able to be delivered to them.

Right now the laws provide penalties against the hard to locate perpetrator,
but totally ignore the liability of the enabler that could stop the crime
in progress with a few keystrokes and mouse clicks on a network management
console.

It seems that even if an ISP knows specifically that their customer is
breaking their countries spam law, that ISP is not held liable for allowing
after they have proof.  If your other laws worked the same way, you could
knowningly loan your car to a bank robber, and not worry about being arrested
if they got caught.  Your banking contacts should understand that.

For any ISP that provides 24*7 service, it should only take them 15 minutes if
they are slow.  If the site is still up or the security hole still present
after one business day, then put the owner of the ISP in jail until it the
problem is fixed.

In the law, such things are known as attractive nuisance, and the owner's of
such are generally liable for the damages that result.  So this is not new
or untried legal grounds.

My guess is that after the first time one of those ISP owners is a unwilling
guest of the jail that you will never see another phishing site hosted
in your country ever again, and you will also quickly see almost no spam
originating from anywhere in your country.

If the ISP has implemented a broken postmaster/abuse mailbox system that
prevents them from getting notifications in a timely mannor, then they
are negligent in their basic responsibilites in addition to allowing their
network to be used to abuse others.

Depending on what other control your country has, you can implement a policy
of null routing all I.P. traffic at the border from any foreign ISP hosting
a phishing site until that ISP certifies that it is gone.

It should only take a couple of times of a block for most ISP's to get the
message, unless you are in a very small country.

Note that an ISP ignoring a security hole that is relaying spam is costing
the ISP what could be significant money.  A lot of ISP's think that they
can just warn the owner of the infected machine and then wait 5 business days
to take action.

According to media interviews with convicted spammers, if they had to purchase
the bandwidth they can steal through a compromized computer, it would cost
them over $1,200 U.S. for those 5 business days that the ISP is waiting to
take action.

In addtion, one zombie computer being used to relay spam can knock out or
degrade the internet access of thousands of users on the network nearby it.

The ISPs that are not taking action on security holes are just passing the
costs on to their customers in addition to the service outages that it is
causing them.  And if they are a public company, their negligence in stopping
the bandwidth theft is costing their stockholders significant value.

If the electric and water utilites operated the same way as many of the
broadband ISPs, they would be taking no action against illegal taps that
they knew about and just passed the costs on to their law abiding customers.
Would your government allow that to be done to it's citizens?  After all
it would only be a few extra dollars per month on their bill when you
average it out.

And legal solution that does not hold the enabling ISP(s) liable for either
active participation or their wilful negligence is useless in getting spam
stopped.

-John
wb8tyw at qsl.network
Personal Opinion Only