Subject: [saag] AD sponsoring draft-oreirdan-mody-bot-remediation

From: Stephen Farrell <[email-masked]>
Date: Mon, 13 Jun 2011 23:24:50 +0100

Hi all,

I've been asked, and have agreed, to AD sponsor this document. [1]

The authors and I would be interested in saag feedback on the
current version before I start an IETF LC. (I'll be giving them
my own feedback as well when I get a chance.)

The abstract says:

   This document contains recommendations on how Internet Service
   Providers can manage the effects of computers used by their
   subscribers, which have been infected with malicious bots, via
   various remediation techniques.  Internet users with infected
   computers are exposed to risks such as loss of personal data, as well
   as increased susceptibility to online fraud and/or phishing.  Such
   computers can also become an inadvertent participant in or component
   of an online crime network, spam network, and/or phishing network, as
   well as be used as a part of a distributed denial of service attack.
   Mitigating the effects of and remediating the installations of
   malicious bots will make it more difficult for botnets to operate and
   could reduce the level of online crime on the Internet in general
   and/or on a particular Internet Service Provider's network.

Most of the document seems quite straightforwardly useful but
I'd be particularly interested in comment about sections
5.4 (walled garden notification), 5.7 (web browser notification)
and 7 (failure or refusal to remediate) which may be somewhat
more controversial. I'm most interested in comment as to the
effectiveness, in terms of improved security, of the practices
described.

To comment, either reply to this, or just mail me and the authors,
or just me if you're very shy:-)

Thanks,
S.

[1] https://datatracker.ietf.org/doc/draft-oreirdan-mody-bot-remediation/

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 13 Jun 2011 15:51:56 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Stephen Farrell
> Sent: Monday, June 13, 2011 3:25 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [saag] AD sponsoring draft-oreirdan-mody-bot-remediation
> 

Have the authors provided such commentary about the effectiveness of the advice found in those sections?  Seems like they're in a particularly good position to do so.

Section 7 in particular seems particularly sparse in that regard.

---

From: Dave CROCKER <[email-masked]>
Date: Tue, 14 Jun 2011 07:52:06 -0700

> or just me if you're very shy:-)

Folks,

Since there's a considerable industry that's been working on anti-abuse and 
since the topic is not a major, on-going IETF activity, I thought it worth 
soliciting comments from APWG, since this sort of thing is their life.

Here's a response that came back:

> Subject: 	Re: [apwg] [saag] AD sponsoring draft-oreirdan-mody-bot-remediation
> Date: 	Tue, 14 Jun 2011 08:53:48 -0400
> From: 	Maxim Weinstein <[email-masked]>
> To: 	[email-masked]
> CC: 	APWG <[email-masked]>
>
>
> Dave, Neil, et. al.,
>
> Back when this IETF draft came to my attention, I developed a set of comments,
> which I shared with Mike O'Reirdan, and perhaps blogged about, at the time.
> Those comments can be found at:
>
> https://docs.google.com/a/stopbadware.org/Doc?docid=0AXgXeriL62dYZGQ0cmY1Ym5fMTA0bTQ4bW00cg&hl=en
> <https://docs.google.com/a/stopbadware.org/Doc?docid=0AXgXeriL62dYZGQ0cmY1Ym5fMTA0bTQ4bW00cg&hl=en>
>
> Regards,
> Maxim

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 14 Jun 2011 16:39:56 +0100

Thanks Dave,

Those look like comments well worth considering to me.
Authors?

S.

On 14/06/11 15:52, Dave CROCKER wrote:
> Since there's a considerable industry that's been working on anti-abuse
> and since the topic is not a major, on-going IETF activity, I thought it
> worth soliciting comments from APWG, since this sort of thing is their
> life.
>

---

From: "Livingood, Jason" <[email-masked]>
Date: Tue, 14 Jun 2011 16:43:12 +0000

I think we may have done so before, but we'll look at them again and
respond.

Jason