[Dshield] Blackworm liability with ISPs?

Micheal Patterson micheal at tsgincorporated.com
Wed Feb 8 17:08:38 GMT 2006



----- Original Message ----- 
From: "Anonymous Squirrel" <anonymous.squirrel at gmail.com>
To: "General DShield Discussion List" <list at lists.dshield.org>
Sent: Wednesday, February 08, 2006 6:58 AM
Subject: Re: [Dshield] Blackworm liability with ISPs?


> On 2/7/06, Micheal Patterson <micheal at tsgincorporated.com> wrote:
>>
>>
>> I hate to say this, but requiring a training session to be able to
>> purchase
>> a PC these days isn't as ludicrous to me today as it was 10 years ago.
>> There
>> are far too many end users that have no idea how to update it, don't know
>> what a virus is, nor do they understand the necessity of keeping the OS
>> patched.
>>
>> It's at that point that Mom and Dad realize that they're in a world of
>> hurt
>> and shock. They needed to know the possible problems last year when they
>> bought the PC to do their taxes and send email to Grandma in her summer
>> Florida home. If they had known more about it then, they might have an
>> idea
>> about what Billy was doing all this time.
>>
>>
> Excellent points. If the education was slightly modified to fit the 
> precise
> capabilities of the access device purchased, market forces will take care 
> of
> the rest.  Imagine this: a clueless user who only wants to to taxes and
> email grandma has two choices of access devices for purchase:
>
> 1) A general purpose swiss-army knife of computing (XPSP2, *nix, OSX, 
> etc).
> Their training covers *all* they can do to react to the threat 
> environment,
> and the training must be completed before purchase.
>
> 2) A locked-down appliance that can only do taxes and e-mail grandma. 
> Once
> again, the training covers all they can do to react to the threat
> environment, and must be completed before purchase.
>
> Seems to me the hassle factor is vastly reduced in #2.  Assuming the price
> were the same, which will they choose?
>
> As I said before, the core problem is access devices whose capabilities 
> are
> far beyond the understanding and motivation of the user.
>
> Now, how does the consumer model apply to businesses, many of whom do not
> have competent administrators, or do have competent administrators but 
> allow
> the users too much control over the box.

I will not proclaim to be an expert by any means but I've been around long 
enough to know what it was like to not have dhcp configured ip stacks and 
dns. I remember how I took my first pc apart when it just *stopped* working 
and I remember deciding to buckle under and read my first book from Sams 
about PC repair and built my very own 286 PC and it worked. I remember when 
Best Buy's and Circuit City's didn't exist. I remember having to go to the 
local electronics hobby shop to get that $400.00 20mb ide drive that just 
came out that you had to have because it was so much less expensive than the 
20mb scsi drive that I'd been eyeing. It seems like ages ago but I remember 
the days of needing to be able to read binary and ita2 tape. I can still 
read Hollerith. I'm not saying that the average user needs to know how to do 
all of that mind you, but they need to be aware of just what it is that 
their buying and it's potential damage output if it goes out of control. 
Especially when they can go out and get everything they need to literally 
cripple the net as we know it with hardware that they can legally purchase, 
without any type of controls for less than $1000.00 in most cases. Pretty 
cheap investment to take down one of the largest communications mediums of 
today isn't it?

Mike P. 



More information about the list mailing list