- NANOG - lists.nanog.org

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 5:21 PM > To: nanog(a)merit.edu > Subject: RE: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > [SNIP] > > > As for go180.net, you don't show up much on my radar, but on > > Nov 9th we were hit by a spammer from > > SpokaneHotZone-63.go180.net [66.225.5.63]. > > I trust this is not a legitimate mail server and I can block > > it and any other host that looks like it within the same > > domain, right? Thanks. > > Otherwise, you may want to do something to distinguish it > > from the other generic hosts in the same range. > > Glad you don't see much from us, must mean that the effort put forth > by some of our team is not going to waste. You are correct, that is > not a legitimate mail server but is an IP from a City Wide wireless > network. That network has since been secured to restrict TCP 25 > outbound (along with other typical miscreant traffic) so you > shouldn't see anything again from that network on port 25. If we rise > up on your radar in the future feel free to make use of the typical > NOC and Abuse e-mail addresses, they do get answered and acted upon > here. > > Glad to hear that. Overall, I'm offering some operational content on the publicity intensive Lycos botnet and provide some level of operational analysis free of judgement of Lycos. I'd be happy to argue about breadth, depth, and width of botnets and their commodity status in email. :) -M<

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 4:28 PM > To: nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > on Thu, Dec 02, 2004 at 04:15:34PM -0500, Hannigan, Martin wrote: > quoting me: > > > My point was to Martin's question about what would happen if - god > > > forbid - there were large botnets under the control of spammers; a > > > careful reading will suggest that my major point was, > duh, that there > > > already are large botnets under the control of spammers. > > > > Um, not 1 million bots - in concert. > > And you know this how, exactly? I'm sure not convinced. http://w3.cambridge-news.co.uk/business/story.asp?StoryID=65877 "Lycos Europe's 20 million users will all be invited to download the software, but it is available to anyone with an internet connection running either Windows or Mac OSX or Mac OS9 operating systems." http://edition.cnn.com/2004/TECH/internet/12/02/anti.spamvigi.ap/ "Around 65,000 people already signed up for the offensive, called "Make Love not Spam" before Tuesday's official launch on a website by the same name, the company said. It is urging its 22 million users to download the screen-saver, but says anyone with a computer is welcome to it."

2 1

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 4:09 PM > To: nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > on Thu, Dec 02, 2004 at 12:55:02PM -0800, Chad Skidmore wrote: > quoting me: > > >What's the difference? Why is everyone so upset about Lycos and > > >nobody seems to be doing much of anything about the /existing > > >botnets/, which conservative estimates[1] already put at anywhere > > >from 1-3K per botnet to upwards of 1-5M hosts total[2]? > > > > Well, the primary difference is that Lycos is trying to market what > > they are doing as a "good" thing in a fairly public manner. If their > > vigilante efforts become accepted as "OK" then it further opens the > > door for others to take the next step towards making dDOS attacks ok > > as long as you feel your motivations are pure. As network operators > > we all need to make sure that we enforce our AUPs and make it known > > that breaking those AUPs is not ok just because you feel > your motives > > are pure. Most AUPs have some language that basically states that > > dDOS and simlar activities are "bad" and we will take action if you > > engage in said "bad" activities. > > My point was to Martin's question about what would happen if - god > forbid - there were large botnets under the control of spammers; a > careful reading will suggest that my major point was, duh, that there > already are large botnets under the control of spammers. Um, not 1 million bots - in concert. -M<

2 1

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Chad Skidmore 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----Original Message----- From: Steven Champeon [mailto:schampeo@hesketh.com] Posted At: Thursday, December 02, 2004 12:22 PM Posted To: NANOG Conversation: How many backbones here are filtering the makelovenotspam scr eensaver site? Subject: Re: How many backbones here are filtering the makelovenotspam scr eensaver site? >>on Thu, Dec 02, 2004 at 02:56:29PM -0500, Hannigan, Martin wrote: >> Possibly. What will happen if the Lycos botnet gets hijacked? >> >> The conversations between the clients and the servers don't appear >> to be keyed. If a million clients got owned, it would be the >> equivalent of an electronic Bubonic Plague with no antidote. > >You mean, like the existing botnets we already know exist but are >already under the control of spammers? > >What's the difference? Why is everyone so upset about Lycos and >nobody seems to be doing much of anything about the /existing >botnets/, which conservative estimates[1] already put at anywhere >from 1-3K per botnet to upwards of 1-5M hosts total[2]? Well, the primary difference is that Lycos is trying to market what they are doing as a "good" thing in a fairly public manner. If their vigilante efforts become accepted as "OK" then it further opens the door for others to take the next step towards making dDOS attacks ok as long as you feel your motivations are pure. As network operators we all need to make sure that we enforce our AUPs and make it known that breaking those AUPs is not ok just because you feel your motives are pure. Most AUPs have some language that basically states that dDOS and simlar activities are "bad" and we will take action if you engage in said "bad" activities. To your other point, how do you know that other botnets are not being identified and taken down every day by network operators? I know for a fact that they are, they just are not nearly as public as this one so those activities go largely unacknowledged. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+BJU2RUJ5udBnvEQLzYACg7cc+5QPHyY0km3kK2H4kQ7ovcdMAoOG3 /C/QeyrlyeOxbVu2uQkJPi3a =ybZk -----END PGP SIGNATURE-----

2 1

"Make love, not spam"....
by Fergie (Paul Ferguson) 02 Dec '04

02 Dec '04

Techdirt has an article this morning that discusses how Lycos Europe is encouraging their users to run a screensaver that constantly "pings servers suspected to be used by spammers" and also suggests that "In other words, it's a distributed denial of service attack against spammers by Lycos." The Techdirt article referenced is on Heise Online: http://www.heise.de/english/newsticker/news/53697 I'd be curious to hear what NANOG readers thoughts are on this. Techdirt is located at http://www.techdirt.com/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

8 7

How many backbones here are filtering the makelovenotspam screensaver site?
by Suresh Ramasubramanian 02 Dec '04

02 Dec '04

I've heard reports of traceroutes through several backbones timing out or going !H after a few hops, and I note that the impact seems to have been enough for the site's IP to change .. suresh@frodo 06:56:27 [~]$ dnsip www.makelovenotspam.com 213.115.182.123 suresh@frodo 07:01:16 [~]$ dnsname 213.115.182.123 ua-213-115-182-123.cust.bredbandsbolaget.se Hosted on a cablemodem? Tch, tch, how the mighty have fallen

7 8

Susan's superior?
by Joshua Brady 02 Dec '04

02 Dec '04

Susan, Since you yourself have neglected and ignored my requests via email, and phone; I am now asking if the list has contact information on Susan Harris' supervisor at MERIT. Chances are, I will be censored for this and banned almost immediatly, so off-list replies are greatly helpful. Or anyone who can maybe point me in the right direction. Best Regards, Joshua Brady

1 0

My yearly post about environmental monitoring devices
by Alex Rubenstein 02 Dec '04

02 Dec '04

I'm sure if you peruse the archives, you'll see that I post about this about every year. The answer to your question is 'No, I haven't found what I am looking for yet.' However, the quest I am on is slightly different. I am looking for a device that meets the following criteria. a) Reasonably small. This probably wouldn't be rack mounted; it'd be wall mounted, desk mounted, celing mounted, etc. b) Powered by PoE. c) Is SNMPable over Ethernet. NOT RS232 or serial, or anything archaic like that. Not MODBUS. It's 2004, people. d) Provides Temperature and Humidity. e) Has 4 or so input contact sensors (connections to AC units, etc.) f) Has 4 or so output contact sensors. Help. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

6 5

BIND + DLZ
by Micah McNelly 02 Dec '04

02 Dec '04

Nanog, Does anyone have information on performance numbers comparing tinydns vs. bind w/ dlz patch? Hit me up off-list. /m

5 6

RE: My yearly post about environmental monitoring devices
by David Lesher 02 Dec '04

02 Dec '04

>I am looking for a device that meets the following criteria. I'd add: g) Inexpensive, so it can be widely deployed. A Basic Stamp might be the platform for such; but I've retired from hardware hacking projects. I'd suggest queries to sci.electronics.design in hopes of finding someome interested. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1