It looks like it's going to be necessary to get serious about ingress filtering. See RFC 2827, which laid out the basics. Fortunately, there aren't that many ISPs left. If Comcast, AT&T, and Verizon got serious about ingress filtering, it would cut way down on the number of devices that could get through with a random IP source address. The ISPs are in a good position to tell their customers to unplug whatever is causing the trouble. (Assuming it's not the ISP's own router, which they should be able to fix remotely.)
At the big-pipe level, there should be sampling. 1 in 10000 packets has been suggested, which will reveal any massive attack without hurting privacy much. If a big pipe has an excessive fraction of attack packets, that indicates the sending end isn't doing proper ingress filtering. That's a matter to be dealt with between network operators, possibly with involvement from CERT and Homeland Security if necessary.
This problem is solveable, but it's going to take some ass-kicking. There are now enough big companies annoyed about this for that to happen.
From the ISP perspective, it is ingress filtering -- he's saying they should be filtering their customer's traffic as it enters their network, such as leaving customer's cable modem and entering the CMTS.
As I understand it, this will do nothing, in these cases, because the traffic is perfectly valid. At least in the case of the "Krebs On Security" blog, the attack was "just" a massive amount of perfectly valid http/https requests. I don't see how the ISP would be able to filter that out.
Before filtering is implemented, it makes sense for ISPs to warn their customers that their hardware was involved in a ddos attack. Analyzing historical data is typically much easier than real-time.
You mean "egress", and that's only helpful in cases where the source is in fact spoofed. With a large and widely distributed number of small devices, there isn't much of a need.
If the IP address isn't spoofed, you can block by IP at intermediate points, firewall, attack the attacker, or get the responsible ISP to turn the connection off. Random IPs are a much bigger headache.
As for the ingress/egress thing, the RFC calls it ingress filtering. Not worth arguing over.
At the big-pipe level, there should be sampling. 1 in 10000 packets has been suggested, which will reveal any massive attack without hurting privacy much. If a big pipe has an excessive fraction of attack packets, that indicates the sending end isn't doing proper ingress filtering. That's a matter to be dealt with between network operators, possibly with involvement from CERT and Homeland Security if necessary.
This problem is solveable, but it's going to take some ass-kicking. There are now enough big companies annoyed about this for that to happen.