Fixed that for you.

I can't be the only person who moaned out loud at that notion, and who also sees no way to stop it. People so often need to be burned to learn about fire, but in this case owning an IoT item is unlikely to burn the owner.

I don't see a good solution to this, that is likely to actually happen, unless as another person said, ISP's just start blacklisting people with compromised IoT devices.

http://www.geekculture.com/joyoftech/joyarchives/2340.html

just became a patron myself patreon.com/joyoftech

What're ISPs more likely to do: Boot off a regular monthly paying customer because they're a "bad network citizen"? Or just charge them for any excess bandwidth they consume each month?

I suspect if some of the big CDNs start blocking ip address ranges that're sending large volumes of forged-source ip packets, ISPs will respond to customer complaints of "I can't load $website because Akamai/Cloudflare/PornHubCDN have blocked you!" (Not that this would have helped the Mirai L7 DDoS agains Krebs...)

It's hard to work out how to fix this, without somehow ending up on the slippery slope of "All ISPs need to to deep packet inspection and traffic analysis of every user's network use, to be able to block suspected-compromised customer devices". (And remember, as soon as we _require_ ISPs to record/store/analyse that, it's going ot get sold on to whoever else thinks they can extract value from it - advertisers, marketers, credit reporting agencies, insurance companies - I;m sure if you put your "evil monetization ideas" hat on you can think of a _big_ list of businesses you'd try to sell access to that data stream to...)

(And it even occasionally fails spectacularly in cases where it _ought_ to have worked OK - people offloading lithium battery charging safety to large locally represented brands like Samsung instead of self-importing Xaiomi or Doogee "brand" phones directly from China...)