From: Andy Davidson (no email)
Date: Wed Jan 03 2007 - 08:15:12 EST
On 3 Jan 2007, at 01:02, Joy, Dylan wrote:
> I'm curious if anyone can answer whether there has been any
> traction made relative to blocking egress traffic (via BGP) on US
> backbones which is destined to IP addresses used for fraudulent
> purposes, such as phishing sites. I'm sure there are several
> challenges to implementing this...
I have often thought that this would be a brilliant idea (on paper),
when working with one of my clients who suffer regular denial of
service attacks through open http and socks proxies. They are a
multi-homed end site running bgp4 on their edge networks.
From a 'problem solving' perspective, a Team Cymru-style bgp peer
that injected very specific routes into their routing table, and
matching configuration which caused those particular routes to be
dropped would be ideal. Additions and deletions would be as close to
real-time as possible.
From a political perspective, I could only advocate to clients such
a service that had a strict policy of adding routes to addresses
because of a provable policy infringement. For example, a route for
1.2.3.4/32 would only be announced by my bgp-blacklist peer if it
could be demonstrated that a device reachable at 1.2.3.4 was an open
http proxy (or socks proxy, or smtp relay).... and not because a
phishing site was hosted there. Different priorities for different
networks I guess ..
No interest in a service which requires companies running a blocked
proxy to pay before the route/block is lifted. Also no interest in a
service which blocks entire networks in the event of a policy
infringement, only the polluting hosts. I mention this paragraph
thanks to some of the policies of DNS-based email-abuse blacklists.
Phishing is content - when a service opens which filters based on
content, there's a whole new can of worms being opened - what *else*
is abusive content ? Does it stop being abusive content at some
point ? If phishing is abusive, is pornography abuse ? A mouthy
anti-West news agency ?
Anyone going to talk about this at Toronto ? Trying to justify
taking a week 'off' to visit ... ;-)
-- Regards, Andy Davidson http://www.devonshire.it/ - 0844 704 704 7 - Sheffield, UK
|
|
|