ISPs Can Tell Users About Infected Computers

If your computer’s been hacked, Dale Drew might know something about that. Drew is chief security officer at Level 3 Communications, a major Internet backbone provider that's routinely on the lookout for cyber-attacks on the network level. The company has linked more than 150 million IP addresses to malicious activity worldwide.

That means all of those IP addresses have computers behind them that are probably involved in DDoS (distributed denial-of-service) attacks, email spam, or breaches of company servers.

Hackers have managed to hijack those computers to "cause harm to the Internet," but the owners don't always know that, Drew said. 

The tracking capabilities of Level 3 highlight how ISPs can spot malicious patterns of activity over the Internet, and even pinpoint the IP addresses that are being used for cybercrime.

In more extreme cases, Level 3 can essentially block bad traffic from harassing victims, and effectively shut down or disrupt the hackers’ attacks.

So why aren’t ISPs doing more to crack down on cyber-crime? The issue is that an ISP's ability to differentiate between normal and malicious Internet traffic has limits and finding ways to properly respond can open a whole can of worms.

Malicious patterns

Level 3 has built up a database of 178 million IP addresses, most of them static IP addresses, that it has connected to suspected malicious activity. It’s done so by pinpointing patterns that deviate from “known good” Internet traffic, Drew said. 

He compared it to running a post office. Although Level 3 isn’t examining the content of the Internet traffic or the “envelopes” passing through, it does know who’s sending what and to whom.

For example, “every time this user gets a red envelope from person X, they complain its spam,” Drew said. “So I can start to build a heuristic off that behavior.”

Bad-behavior patterns have helped Level 3 build algorithms to identity suspicious traffic. Of the millions of IP addresses it’s been tracking, 60 percent are likely associated with botnets, or armies of infected computers that can be used for DDoS attacks.

Level 3 has associated another 22 percent with email phishing campaigns.

One might wonder why Level 3 doesn’t just block these IP addresses from the internet. But that can be problematic.  Often, users of hacked computers are unaware their machines have been compromised, and it may be unclear whether some of those machines are also being used for important purposes, such as legitimate financial transactions.

Blocking those machines could potentially mean stopping millions of dollars in transactions, Drew said.

Instead, the company tries to notify the users of those IP addresses. In many cases, they are businesses, which can be quick to respond, Drew said. However, when it comes to consumers, there's no phonebook linking one person to an IP address. So Level 3 has to work with the hosting provider in order to reach the user.

Confronting the limits

Overall, it can be an uphill battle. “For every IP address we repair, more IP addresses are being compromised,” Drew said.

Other ISPs, including some in Europe, have also been notifying customers when their machines might be infected. It’s become a years-old, growing practice, but getting users to fix their infected computers isn’t always straightforward, said Richard Clayton, a security researcher at the University of Cambridge and director of its cloud cyber-crime center. 

Even when ISPs send warning messages to users, what then? Not every PC user knows how to resolve a malware infection, Clayton said. For ISPs, it can also be a matter of cost.

“Of course we want to see ISPs helping, but they are in a competitive market,” he said. “They are trying to cut their costs wherever they can, and talking to customers and passing on a message is not a cheap thing to do.”

In addition, ISPs can’t identify every malicious cyberattack. Most hacking attacks masquerade as normal traffic and even ISP detection methods can occasionally generate errors, Clayton said.

“If you have a 99 percent detection rate, in an academic paper, that sounds fantastic,” he said. “But that basically means one out of 100 times, you’ll be plain wrong.”

No magic bullet

That’s why taking down suspected hackers usually requires collective action from law enforcement and security researchers who have thoroughly investigated a threat and confirmed that it is real. Governments and ISPs have also become involved in creating websites and services telling users how to effectively clean up their PCs.

It’s a difficult balancing act for ISPs, said Ed Cabrera, the chief cybersecurity officer at antivirus vendor Trend Micro. “They can do a lot of detection quite easily,” he said. “But the blocking piece is not something that they want to take responsibility for.”

Cybercriminals are also continually elevating their game, making them harder to detect. “The problem is nowhere near black and white,” Cabrera said. “We’re quick to say ISPs aren’t doing enough, but I think often times that’s unfair.”

Level 3’s Drew said it’s tempting to think that the world’s cybersecurity problems can be solved with a magic bullet. But for now, it will take a collective effort, of ISPs, governments, businesses and consumers, to clean up the internet and secure today's devices. 

"Even if we were able to deploy exhaustive technology to analyze the bad, ugly traffic, it still doesn't fix the infected devices," Drew said. "The end user still has a role to properly patch that device."

He also encourages all ISPs to take Level 3's approach and notify customers when their computers have been hijacked by hackers.

If more ISPs did this, Drew said, "we might make a dent."

Computereworld

DDoS: Deceptive Denial Attacks:

ENISA’s Threat Rankings: From Malware To Cyber Spies:

Turn Threat Data Into Threat Intelligence:

 

 


 

« Cloudbleed Is Just The Latest Internet Security Disaster
Mike Rogers Wants To Buy Cyber Weapons 'Off The Shelf' »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IASME Consortium

IASME Consortium

IASME is one of five companies appointed as Accreditation Bodies for assessing and certifying against the UK Government's Cyber Essentials Scheme.

Cyber Secure Forum

Cyber Secure Forum

The Cyber Secure Forum is a premier cybersecurity event dedicated to bringing together experts, and professionals to explore the latest trends, share knowledge, and discuss strategies.

Ovarro

Ovarro

Ovarro is the new name for Servelec Technologies and Primayer. Ovarro's technology is used throughout the world to monitor, control and manage critical and national infrastructure.

Nexcom International

Nexcom International

Nexcom operates six global businesses - IoT Automation, Intelligent Digital Security, Internet of Things, Intelligent Platform & Services, Mobile Computing Solutions, Network & Communications.

Spire Solutions

Spire Solutions

Spire Solutions is the Middle East & Africa region’s leading cybersecurity solution provider and value-added distributor (VAD).

RiskRecon

RiskRecon

RiskRecon makes it easy to gain deep, risk contextualized insight into the cybersecurity risk performance of all of your third parties.

Capsule8

Capsule8

Capsule8 is the only company providing high-performance attack protection for Linux production environments.

Conduent

Conduent

Conduent delivers mission-critical technology services and solutions on behalf of businesses and governments. Solution areas include digital risk and compliance.

Private Client Cyber Security (PCCS)

Private Client Cyber Security (PCCS)

PCCS provides enterprise-grade cybersecurity consulting and services to professional practices, executives, athletes, and high net worth families.

Aiden Technologies

Aiden Technologies

Aiden simplifies your IT process, giving you peace of mind and security by ensuring your computers get exactly the software they need and nothing else.

Immunefi

Immunefi

Immunefi provides bug bounty hosting, consultation, and program management services to blockchain and smart contract projects.

Central Intelligence Agency (CIA)

Central Intelligence Agency (CIA)

The CIA is an independent agency responsible for providing national security intelligence to senior US policymakers. This includes cyber security related activities.

Anonos

Anonos

Anonos is a global software company that provides the only technology capable of protecting data in use with 100% accuracy, even in untrusted environments.

Strata Information Group (SIG)

Strata Information Group (SIG)

Strata Information Group (SIG) is a trusted partner in IT solutions and consulting services.

Reality Defender

Reality Defender

Reality Defender stops deepfakes before they become a problem. Our proprietary deepfake and generative content fingerprinting technology detects video, audio, and image deepfakes.

Nightwing

Nightwing

Nightwing is the intelligence services company that continually redefines the edge of the possible to keep advancing our national security interests.