Recommendations for the Remediation of Bots in ISP Networks
RFC 6561
Document | Type |
RFC - Informational
(March 2012; Errata)
Was draft-oreirdan-mody-bot-remediation (individual in sec area)
|
|
---|---|---|---|
Authors | Jason Livingood , Nirmal Mody , Michael O'Reirdan | ||
Last updated | 2015-10-14 | ||
Stream | IETF | ||
Formats | plain text html pdf htmlized bibtex | ||
Reviews | |||
Stream | WG state | (None) | |
Document shepherd | No shepherd assigned | ||
IESG | IESG state | RFC 6561 (Informational) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Unknown | ||
Telechat date | |||
Responsible AD | Stephen Farrell | ||
Send notices to | elwynd@folly.org.uk |
Internet Engineering Task Force (IETF) J. Livingood Request for Comments: 6561 N. Mody Category: Informational M. O'Reirdan ISSN: 2070-1721 Comcast March 2012 Recommendations for the Remediation of Bots in ISP Networks Abstract This document contains recommendations on how Internet Service Providers can use various remediation techniques to manage the effects of malicious bot infestations on computers used by their subscribers. Internet users with infected computers are exposed to risks such as loss of personal data and increased susceptibility to online fraud. Such computers can also become inadvertent participants in or components of an online crime network, spam network, and/or phishing network as well as be used as a part of a distributed denial-of-service attack. Mitigating the effects of and remediating the installations of malicious bots will make it more difficult for botnets to operate and could reduce the level of online crime on the Internet in general and/or on a particular Internet Service Provider's network. Status of This Memo This document is not an Internet Standards Track specification; it is published for informational purposes. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6561. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. Livingood, et al. Informational [Page 1] RFC 6561 Remediation of Bots in ISP Networks March 2012 This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction ....................................................3 1.1. Key Terminology ............................................3 1.1.1. Malicious Bots, or Bots .............................3 1.1.2. Bot Networks, or Botnets ............................4 1.1.3. Host ................................................5 1.1.4. Malware .............................................5 1.1.5. Fast Flux ...........................................5 2. Problem Statement ...............................................6 3. Important Notice of Limitations and Scope .......................7 4. Detection of Bots ...............................................8 5. Notification to Internet Users .................................12 5.1. Email Notification ........................................13 5.2. Telephone Call Notification ...............................13 5.3. Postal Mail Notification ..................................14 5.4. Walled Garden Notification ................................14 5.5. Instant Message Notification ..............................16 5.6. Short Message Service (SMS) Notification ..................16 5.7. Web Browser Notification ..................................17 5.8. Considerations for Notification to Public Network Locations .................................................18 5.9. Considerations for Notification to Network Locations Using a Shared IP Address .......................18 5.10. Notification and End User Expertise ......................19 6. Remediation of Hosts Infected with a Bot .......................19 6.1. Guided Remediation Process ................................21 6.2. Professionally Assisted Remediation Process ...............22 7. Failure or Refusal to Remediate ................................23 8. Sharing of Data from the User to the ISP .......................23 9. Security Considerations ........................................23 10. Privacy Considerations ........................................24Show full document text