The analogy with telephone equipment is limited in its utility. Telephone equipment is regulated in terms of its electrical characteristics, and most domestic modems are likewise regulated because they *are* telephone equipment. And even when the devices are not explicitly regulated as part of the telephone network, they attach to some physical network that has its own set of requirements, or operate wirelessly in accordance with other regulations.

I’m aware that you’re not talking about physical layer compatibility, but that was the analogy you drew, and I think it could create confusion. Regulation of the physical layer is very different from regulation of the layers above that point. You’re talking about regulation that sits somewhere between “device certification” and the likes of CAN-SPAM.

My most significant concern with your proposal is that you’re already looking to regulation as a solution when I don’t think we have a sufficient understanding of the problem. If we regulate at a low level, specifying that devices must react in such-and-such a way to particular traffic patterns, we may possibly defeat a number of current attack vectors. At the same time, I’m quite sure that other vectors would remain open, or be discovered, and so the net effect would be like rearranging deck chairs on the Titanic. I doubt that the regulative effort could ever pay off in positive results, and I despise regulation for its own sake.

If you are going to consider regulative efforts, then I have an alternative target for you to consider. Make ISPs liable for the hostile traffic generated by their customers, with protection clauses for ISPs that take “reasonable measures” to prevent abuse and halt it when alerted to it. If ISPs decide that your black box solution is a good “reasonable measure”, then they are welcome to use it. They could just as easily black-box their own end of the link, or consider any number of other possible solutions.

My rationale for this approach is this: the real problem actors in this scenario are the ISPs that don’t want to be responsible for activity on their own networks. Some ISPs are already well-behaved in this regard; others are the devil incarnate. The bad guys see their lack of action as a cost saving measure, since they tend not to bear any direct costs for the garbage their networks spew. They are the Internet equivalent of industrial polluters, and need to be regulated as such.

Given that there are good ISPs out there already, it may be sufficient to make the threat, “industry, regulate thyself lest the government intervene”. Just as with your proposal, mine requires significant further thought, but I’d be much happier with it as an overall direction.

> # Block certain illegal bit patterns (e.g. TCP > SYN+FIN or FIN+RST).

SYN+FIN is not illegal. See RFC 1644.

The fact that even Karl Auerbach can not get the list of forbidden things right clearly shows that it is a doomed task. I agree with Brett Watson, it’s much simpler to protect against physical dangers (where the fact that a behavior is a danger is clear) than against behaviors, where there is no possible definition of dangerous behavior.

Partial response to Bret Watson and Stephane Bortzmeyer:

You are both right that it is very hard to define a good “reverse firewall” set.  But I remain convinced that a few relatively simple things - such as source address protection - could solve a large number of problems.

As for SYN+FIN - RFC1644 (T/TCP) remains an “experimental” RFC since 1994 and has well documented security issues.  SYN+FIN, because it has few, if any, legitimate uses is one of those things that mom-pop PC’s really ought not to be originating until the state of the art in T/TCP significantly matures.  But the large context of what you are raising is what is ratio of marginal use versus improper use that justifies blocking or allowing a protocol pattern.  Given the Grokster case coming up this week, that is a rather timely question.

Bret suggests that ISP’s ought to be subject to liability when they allow their customers to do bad things.  That approach is a valid one and it might be the right one.  (And in that case, the kind of device I’m talking about might be a useful tool for ISPs to consider as a means of constraining what their customers do.)

The larger issue is not whether ISP’s impose the protection or whether it is done via a certified attachment device.  Rather it is that there is imposed some penalty for “doing bad things” to the net (and to other users).  Because the net is worldwide in scope the means to impose that kind of responsibility is hard.  And unless the responsibility falls equally on everyone those who chose to ignore it get an advantage.

ISP’s have had a long time to get their act together and to prevent their customers from doing bad things.  And, unfortunately, the good guys have been good and done the right thing and the bad or uncaring guys have done nothing and let the rest of us bear the burden and the costs.

I’m not particularly thrilled with the idea of a device that sits between user machines and the net to prevent those user machines from doing bad things.  But given the rapidly deteriorating state of the net and the rise of armies of zombie machines I’m not particularly hopeful that other approaches will work.

And as I mentioned in my main post - my goal is not to prevent people from doing bad things, rather I’m trying to diminish the amount of damage that can be caused through the capture and use of machines of innocent users.

Worth reading….

http://www.nanog.org/mtg-0210/ppt/ispsecure.pdf

-pb