I would have to disagree with Mr. Mullen. I can see that there is a LOT of frustration building due to those who cause others harm simply because they can't secure their systems. It frustrates me too. But imagine the legal ramifications. "Oh, my IDS detected that your port scan was a possible worm, so now I'm going to legally DOS the crap of that IP, which is spoofed in the first place." With strikeback, actually identifying that it's a real valid attack, and the source can be trusted, would have to take place on a worm by worm basis. We simply can't write laws flexible enough for that kind of identification, because it opens up loopholes in the law which WILL be used for evil. I think a better solution is for the ISP's to take a more active role in this scenario. Notify the ISP that one of their clients are infected with code red, and have them disconnected until they can clean up. ISP's should clearly state in their terms agreements that they can and WILL shut you down if you are the source of malicious activity.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/134/17593#17593