PDA

View Full Version : Turning against the web worms


What_does_this_button_do?
4th Oct 2001, 23:03
from news.bbc.co.uk

Broadband users who do not protect their PCs against computer viruses could have their net connection cut off.

The recent rash of web worms, such as Code Red and Nimda, is forcing many net service providers to take a tough line with customers whose computers are infected.

Already companies in the UK and US have suspended the internet links of those who unwittingly let their home computers be used as a proxy to scout for other vulnerable machines.

The huge amounts of data that these web worms generate can delay e-mail messages, slow surfing speeds and even overwhelm webservers.

Data swamp

Although virulent web worms such as Code Red and Nimda do not pose a threat to the net as whole, they can cause chaos on smaller networks that serve a community of users inside a business or that are customers of a net service provider.

Speakeasy message to customers
The malicious programs are known as worms because they can spread across networks without the help of users.

The newer versions of Code Red and novel web worms like Nimda pose more of a problem for anyone trying to stop them because they do such an efficient job of finding and infecting vulnerable machines.

These worms look for victims sharing the same subsection of the internet that the infected machine is sitting on, a tactic that can swamp these high-speed net connections with huge amounts of data.

In the US, two net service providers, Speakeasy and DSL Inc, have taken direct action against customers who did not or would not do more to secure their machines. Both cut off the high-speed links of machines infected with the Nimda worm.

In an e-mail sent to customers, Speakeasy wrote: "All of us are part of a larger community, and it really isn't cool to infect your neighbours."

DSL Inc has taken similar action by cutting people off and changing their access passwords. The only way that the cut-off customers can get back online is by calling the help line of the company and asking to be reconnected.

Termination service

In the UK, Telewest has started taking similar action against customers of its Blue Yonder service, who do not know they are infected, or are not taking action to remove the Code Red or Nimda viruses from their machines.

"There were a couple of hundred people that had taken no precautions," said a Telewest spokesman, "no firewall or anti-virus measures."

He said the company used net newsgroups and direct e-mail to tell infected customers they had to sort themselves out or they would have their service suspended.

When the offending customers contacted Telewest help desk to find out why they had been cut off, the support staff told them how to disinfect their machines, and install patches to stop them being infected in the future.

"We see it as our responsibility to safeguard the internet experience and network service for the vast majority of our customers," said the spokesman.

He said although the practice of cutting off customers was not policy, it was a tactic that the company would use again if more web worms went on the rampage.