MAMEWorld Forums - News - Re: Robbie's WIP

> That's a load of shit on several counts. Firstly I get the same TCP connection drops
> when connecting from an Australian IP address, so he's not just blocking China.
> Secondly, Robbie's site has no comments sections, so blocking comment spam isn't a
> valid reason in this case. And thirdly, China doesn't have an out-of-proportion
> spamming malware problem. According to Spamhaus stats which are a pretty decent proxy
> for estimating malware issues, China has 64% of the spam issues of the US despite
> having over four times the population. China's not doing as well as India on spam
> issues per capita, but they're not doing badly.

Except that spam is only one facet of the problem.

Hosts located in China are responsible for roughly two-thirds of the visible attack traffic that we see at work. This presents a significant signal-to-noise problem for our SOC analysts, who, if we were not actively blocking bad actor hosts and netblocks located in China, would literally not have time to be able to get on with their jobs. This would also have an upstream effect on our security engineers, who (even with SIEM, which is largely not as useful as the companies selling it would have everyone believe) would be in the situation of having to dig even more tons of crap out of logs than they already do in order to find and respond to potential indicators of compromise.

Thus, my choice comes down to this: let my staff be distracted by the legion of infected Windows XP boxes and people hitting Metasploit's big red hack button in Guangzhou and risk missing a successful attempt at exploitation or intrusion, or drop traffic from China (a country we have no business presence in or with) wherever possible. It's not a difficult decision to make.

Additionally, most of the exfiltration attempts that we've been seeing from inside of networks where exploit kits have managed to gain a foothold is going to - you guessed it - China. Russia's usually a close second.

If the problem was centred on Canada rather than China, we'd be doing exactly the the same thing to the Great White North. The country involved is irrelevant, but the origin is not.