ISPs and Egress Filtering

An increasing number of ISPs are beginning to brooch to concept of egress filtering of their end users (and not just port 25, and not just to stop spam). This has become a security vs usability problem, with the usability side probably going to lose. As a highly technical person, I do not want to hear that my ISP will not allow me to do what I want to do. I am in the minority.

On the other hand, most users don't have automatic updates, patch their machines, have anti-virus software, run Windows 95, or all of the above and the ISP has no control to do much about it. These machines will get compromised and happily spew all its malware goodness all over the Internet. There will come a day when ISPs will simply stop caring about the minority and reduce the high level of impact that compromised machines cause by filtering more and more traffic from their customers.

Many Universities have solved this problem by setting up "leper colony" VLANs and putting the problem users on them once infected. Then when they try to do something, they are redirected to a "clean up your machine" page. This may be something ISPs may more and more want to look at, in addition to setting minimum security standards for their users to get on the Internet.

Bad News for Reverse Engineers

IDA Pro has a vulnerability that allows for buffer overflows that execute arbitrary code under the context of the logged in user. If a user opens a hostile Portable Executable file with a vulnerable version of IDA Pro, they can be compromised.

The iDEFENSE Advisory is here: http://www.idefense.com/application/poi/display?id=189&type=vulnerabilities

Broken Spam Message

A handful of users have reported getting spam messages that contain:
"<br />
Fatal error/: Call to undefined function: imagecreatefromgif() in /var/www/html/spamw/img.php/ on line4<br />"

This is probably due to a broken PHP spam engine that is sending email via multiple SMTP servers/open-relays throughout the Internet. If there is any hosting company that has a username on their machine with "spamw", kindly delete the account. Enabling spammers is bad.

==========
John Bambenek
bambenek /at/ gmail.com