IMNSHO, the "authority" should be the ISP. I have no problem with the StrikeBack concept, but I do not think that inDUHviduals should be running StrikeBack system, lest we find ourselves with a new bunch of script-kiddies installing a modified version of StrikeBack and using it as a 3133T hAx0r tool.

OTOH, if an ISP includes in the ToS/AUP the fact that machines spreading worms are going to be neutralized (and the "block unsolicited outbound traffic at the port" is a great way to do it!), then I don't see any problem at all.

Bottom line: the ability to reach out and touch someone else's machine is a dangerout thing in the hands of the malicious evildoers and the clueless idiots alike. This is definitely something that shouldn't be opened up to the world.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/134/17611#17611