How to take down rogue ISPs

According to Krebs, whose Krebs on Security blog has attracted a wide audience, the lengthy analysis focuses on several historical examples of what he calls 'shuns' and 'stuns' - better known as taking out rogue networks, either by ostracising them, or by `kneecapping' their infrastructure in a co-ordinated surprise attack.

Krebs says that the theme of this edition of the journal is finding ways to take security on the offence, and it includes articles from noted security researchers Joe Stewart and Felix `SFX' Lindner. In his feature, Krebs says that the security technologies most of us rely on every day - from anti-virus software to firewalls and intrusion detection devices - are reactive.

"That is, they are effective usually only after a new threat has been identified and classified. The trouble is that, meanwhile, an indeterminate number of individuals and corporations become victims of these unidentified stalkers", he said.

"Until quite recently, this "bag 'em and tag 'em" approach to dealing with malicious activity online had become so ingrained in the security community that most of the thought leaders on security were content merely to catalogue the internet's worst offenders and abide the most hostile networks", he added.

Krebs goes on to say that exponential increases in the volume and sophistication of new threats unleashed during the past few years - coupled with a pervasive attitude that fighting criminal activity online is the principal job of law enforcement - have helped to reinforce this bunker mentality.

Then, he noted, in the autumn of 2007, something remarkable happened that seemed to shake the security industry out of its torpor: a series of investigative stories in the mainstream and technology press about concentrations of cybercrime activity at a web hosting conglomerate in St. Petersburg known as the Russian Business Network (RBN) caused the ISPs serving the infamous provider to pull the plug.

The RBN, says Krebs, which had been a vortex of malicious activity for years, was forced to close up shop and, subsequently, scattered its operations.

"This was the first of many examples that would demonstrate the strategic (and, arguably, cathartic) value of identifying and isolating significant, consistent sources of hostile - if not criminal - activity online", he said.

"I will focus on two popular methods of taking the fight to the enemy and will offer a few thoughts on the long-term viability of these approaches", he added.

What’s hot on Infosecurity Magazine?