Block All the Russians?

Yesterday, this blogging site was temporarily hacked and infected with a Trojan. We quickly discovered the misdeed, cleaned the site, found the entry point (which would be available to any user of this best-selling blogging software), and blocked it.

Then the interesting part began. Our webmaster started looking through the logs for potential clues on who had launched the attack. I’d like to quote his comments:

“But many (website hackers) are trying to use the webserver to include files (likely viruses or trojan programs) from other websites (known as a cross-site scripting attack). That’s what the blog trojan was this morning.

“And all attacks seem to come from Russia (or call Russian websites for the virus files). I’m considering simply blocking all .ru connections. I don’t know if we have any subscribers there but the cost of a system compromise vs. our potential or actual revenue from that country seems minimal.”

Our webmaster is right in his appraisal. First, we have no paid subscribers from Russia. This is VERY strange, since we have subscribers from every other major country in the world, and lots of smaller countries. Why silence from Russia?

Second, if every attack is coming from Russia, or draws virus and trojan material from Russian servers, who needs it?

So I would like to put a question out there to our many lurkers:

Should we just “turn off” Russia? It’s easy to do.

Should you?

Should everyone, at least until they clean up their act? If we can see what’s happening, you know that Russian authorities are fully aware of it as well.

I’ve called Russia (at least the current Putin administration) a kleptocracy, and I feel that government actions have fully justified this charge over the last few years. But what if Russia is also the home of most of the crappy viruses in the world, with the full knowledge of the government?

Turn off Russia?

It wouldn’t be fair to the vast majority of Russians, who are innocent of this behavior. On the other hand, maybe their lack of concern is part of the problem.

Block All the Russians?