Dear Scott,
First off, props for being good at trivial pursuit. I wasn't then, but probably would find it easier now.

Secondly, your friends are obviously not in unique circumstances. I've often contemplated blocking country-wide netblocks, and we make money from our web site... Unfortunately, blocking netblocks is a temporary fix for a problem that is not going away. Personal action is often necessary; yes I'm talking "Netizenship". Early on in the security field I wrote a script for parsing out Linux firewall logs, identifying offending ip addresses, looking up their netblock owners and sending them a very nice cease and desist note with the logs attached to the bottom.
When you have a problem, you must seek out the people immediately causing it and ask them to stop. There were many such emails not responded to. However, I received many responses from admins who were interested in figuring out what happened. This turned up a lot of Code-Red and Nimda "consumers" as well as others with machines actively 0wned by a hacker.

It is true that we have little real recourse against these attacks, although there are possibilities there as well. But the fact that we are all human, and many of us are interested in what happens on our networks, a well-worded note can garner a great deal of assistance.

Technical means can only take you so far, and sometimes the roads are not worth traveling... and permanent country-blocking is one of these.

Carpy

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/350/32308#32308