- NANOG - lists.nanog.org

Re: Packet Kiddies Invade NANOG
by John Quincy Taxpayer 16 Mar '04

16 Mar '04

On Tue, 16 Mar 2004 04:14:01 -0800 sthaug(a)nethelp.no wrote: >According to the people I spoke to, they had not noticed such an >attack >on the date specified. And, while not knowing the specifics of this situation, if you were being attacked, and it hurt your network, would you continue to piss the attacker off by validating it? You'll have a problem finding anyone that crazy, I think. On Tue, 16 Mar 2004 02:54:43 -0800 Michael.Dillon(a)radianz.com wrote: > >People should be worried about stuff like this. >Banetele is a facilities-based network operator >in Norway and these guys are directly attacking >their BGP sessions to put them off the air. > I don't know anything about the banetele attack mentioned specifically, other than to say, this matches his M.O. entirely, and, he isn't the only kiddie who figured out that attacking routers is sometimes more effective than attacking the intended victim. John Quincy Taxpayer Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: 2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village, no contact in whois, but seems to be nLayer...)
by Michael.Dillon＠radianz.com 16 Mar '04

16 Mar '04

>[cc: to hostmaster(a)arin.net, maybe now it will get their >attention instead of going into /dev/null] This is an odd thing to do because you don't say what action you would like ARIN to take. What do you think ARIN should do? >ASHandle: AS4474 >Comment: The information for this ASN has been reported to >Comment: be invalid. ARIN has attempted to obtain updated data, but has >Comment: been unsuccessful. Clearly ARIN has already done something about AS4474. So what else do you think they should do? Note that you might want to take this type of discussion onto the ARIN Public Policy mailing list which is open to anyone whether they are an ARIN member or not. http://www.arin.net/mailing_lists/index.html#ppml --Michael Dillon

3 3

RE: 2001:590::/32 announced by both AS4436 (nLayer) and AS4474 (Global Village, no contact in whois, but seems to be nLayer...)
by Jeroen Massar 16 Mar '04

16 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Jordan Lowe [mailto:jordan@servercentral.net] wrote: > Who are you to start publicly trying to deeper people? Nlayer has a > great noc, I am a customer, and know many more. They are currently > migrating from 4474 to 4436 due to the asn issue, and its not > illegal to source a route from two asn's. AS4474 is not theirs, for that matter it currently doesn't belong to anyone as there is not valid contact information registered in the ARIN database. > They're almost done with the > migration, I didn't see any emails from you when cogent was renumbering > from 16631 to 174 asking for a depeering. Because I am not watching IPv4 tables and cogent announced it. Also both those ASN's are properly registered in the registries. Next to that Cogent does respond to inquiries. > If you just emailed or called > they would have glady resolved your issue. Can you explain the > operational problem with this dual announcement? I seem to be missing it. I am a user of the internet who asked for a answer at their NOC from which I got *no* reply, except for ticket numbers, even after sending 2 messages the last two weeks. Which then caused me to inquire NANOG which is a correct list to do so as nLayer is a US based (North American) "ISP". Next to that mentioning nLayer to abuse-tracking people seems to also get a response that there is quite a lot of abuse in the forms of spam from them. Is that the reason they are 'migrating' to hide their paths from the spam aware people? Maybe you, as a perfect customer, can ask them to update their objects in the ARIN registry or stop hijacking internet resources? Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Comment: Jeroen Massar / http://unfix.org/~jeroen/ iQBGBAERAgAQCRApqihSMz58IwUCQFb/hgAA5fkAn0vQ8ShpW7djG0i9rYD0eGgy Lg90AKCveqh1xoaJWhMGAkwo+TuHoUUXXw== =X7/h -----END PGP SIGNATURE-----

1 0

Re: Packet Kiddies Invade NANOG
by sthaug＠nethelp.no 16 Mar '04

16 Mar '04

> > People should be worried about stuff like this. Banetele is a > > facilities-based network operator in Norway and these guys are directly > > attacking their BGP sessions to put them off the air. > > Can anyone from Banetele/who knows Banetele confirm this attack took place? According to the people I spoke to, they had not noticed such an attack on the date specified. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no (who used to work for BaneTele, and was intimately involved with getting suitable BGP filters in place)

1 0

A TCP Replacement protocol 6000 times faster than DSL?
by Scott Call 16 Mar '04

16 Mar '04

Found on slashdot: http://www.scienceblog.com/community/article2473.html Any idea what they're trying to say/sell? The article is so vague as to be mostly useless, but it seems to indicate the usual stuff like sliding windows. -S -- Scott Call Router Geek, ATGi, home of $6.95 Prime Rib I make the world a better place, I boycott Wal-Mart VoIP incoming: +1 360-382-1814

3 2

Re: who offers cheap (personal) 1U colo?
by Michael.Dillon＠radianz.com 16 Mar '04

16 Mar '04

> Too bad I can't automate the web logins. Huh!? http://curl.haxx.se/ And then there are all those Windows macro recorder programs http://www.tucows.com/macros95_default.html --Michael Dillon

1 0

Re: Packet Kiddies Invade NANOG (retry)
by jqtaxpayer＠hush.com 16 Mar '04

16 Mar '04

Sorry about the last post, my client's linewrap seems to not work properly, I'll try again. Hello, I just thought I should chime in here. Below you will find OseK's (Greg Taylor) manifesto sent to EFnet admins during an event last year where OseK was attacking most EFnet servers. Additionally, I can tell you that Greg was attacking my network at some point in the last year, and readily admitted to it at the time. Signed, J. Quincy Taxpayer ----- Forwarded message from Don Crossman <deecee(a)deecee.ca> ----- DO NOT INCLUDE MY EMAIL ADDRESS IN THIS LETTER OR MY NAME KEEP ME ANONYMOUS MINUS MY NICKNAME --------------------------------------------------------------------- --------- -- To whom it may concern, I got by the nickname of OseK on the Eris Free Network, EFNet. I am sending this e-mail in response to certain claims and accusations being made by a few people in an attempt to clear up the situation for those who are both confused and aggitated. I will start off by giving you the reasons for my actions and what my intentions are and why I am taking the actions that I am taking. EFNet, throughout the existance of the network, has seen its good days and its bad. EFNet has had to deal with corrupt, abusive, egotistical opers who work contrary to the best interests of this network, and use their position of power to satisfy whatever ego they have. Unfortunately, for this network it has come to the point where the Network Administrators of certain servers have created an ironfist autocracy so to speak, where they can do whatever they want and answer to nobody. I myself, have put up with this constant abuse for several years. All of these years, every time I'm /killed, I do nothing, every time I'm /klined I do nothing, but most recently, a channel that I run that had no bots, only people, was taken over, mass /killed and set as a TROLL channel on #chanfix over a matter that didn't involve us to begin with. The person who committed this act was Darryl Williams, also known as shi on EFNet. Former torix admin and currently opered on NAC, Mindspring, Easynews, and Security Support. His abusive record extends much farther than even the most notorious criminals. He has run banned hacks on TorIX, has committed countless acts of abuse against users and then taunted those users into attempting to packet torix, which he thought, was invincible. After over 15 warnings to him to watch his actions, after constant emails to irc(a)torix.ca which were either pasted back to me and laughed at, or thrown into the trash bin, and after attempting to talk to various opers on that server to complain, I decided to take matters into my own hands. Either Torix was going to remove his O: line or it would be dropped indefinately. Neither of which happened. I was approached by the admin of torix asking why this was going on and I posted him legit and authentic logs (despite what shi may try to say). The TorIX admin decided because the logs showed too much incriminating evidence against shi, that he would suspend shi's O: line for further review of his future on that server. shi meanwhile utilized a backdoor in the IRCD itself to re-add his O: line and try to hide as a TCM bot. That is the direct reason he was permanently removed from TorIX. For adding himself back without permission from the other admins. Now we will talk about Qeast and what their big deal is. Qeast is WELL KNOWN for being the home of abusive admins in .CA EFNet. xyst and atomix have run server hacks, and have committed various forms of abuse including channel take overs, packeting of other .ca servers in order to reduce those servers max clients, and nickname juping. xyst also sees any potential future hub as a threat to qeast and utilizes his 2 of 4 votes to deny links to such servers. I will bring up irc.magic.ca and irc.total.net which were servers on efnet for many years, who even sponsored qeast's link to efnet, but xyst utilized his 2 votes per server to deny them links. For the record, xyst and shi are friends, they say they aren't but they are. IRCD/HUB IP addresses: These IPs were obtained through several confidential sources, some of which are operlist users, operwall viewers, and opers themselves. I will let you know that the HUB IP I had gotten for Qeast in the 192.77.73.* block which was broadcasting multiple IPs on various ports. I decided to drop the router which is what is currently under attack. Servers that will not be attacked: Servers that will NOT be attacked are those that the admins of said servers and opers, have shown countless times that they are truly here for the network and not for their ego. Opers who work hard every day to provide users with the most comfortable atmosphere to chat in. Opers who follow their own policies and will not allow abusive admins to push them around. These servers include all of .EU EFNet. irc.aloha.net, irc.vrfx.com, irc.nac.net, irc.limelight.us, irc.xo, and more. Take Care, OseK ----- End forwarded message ----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Packet Kiddies Invade NANOG
by jqtaxpayer＠hush.com 16 Mar '04

16 Mar '04

Hello, I just thought I should chime in here. Below you will find OseK's (Greg Taylor) manifesto sent to EFnet admins during an event last year where OseK was attacking most EFnet servers. Additionally, I can tell you that Greg was attacking my network at some point in the last year, and readily admitted to it at the time. Signed, J. Quincy Taxpayer ----- Forwarded message from Don Crossman <deecee(a)deecee.ca> ----- DO NOT INCLUDE MY EMAIL ADDRESS IN THIS LETTER OR MY NAME KEEP ME ANONYMOUS MINUS MY NICKNAME --------------------------------------------------------------------- --------- -- To whom it may concern, I got by the nickname of OseK on the Eris Free Network, EFNet. I am sending this e-mail in response to certain claims and accusations being made by a few people in an attempt to clear up the situation for those who are both confused and aggitated. I will start off by giving you the reasons for my actions and what my intentions are and why I am taking the actions that I am taking. EFNet, throughout the existance of the network, has seen its good days and its bad. EFNet has had to deal with corrupt, abusive, egotistical opers who work contrary to the best interests of this network, and use their position of power to satisfy whatever ego they have. Unfortunately, for this network it has come to the point where the Network Administrators of certain servers have created an ironfist autocracy so to speak, where they can do whatever they want and answer to nobody. I myself, have put up with this constant abuse for several years. All of these years, every time I'm /killed, I do nothing, every time I'm /klined I do nothing, but most recently, a channel that I run that had no bots, only people, was taken over, mass /killed and set as a TROLL channel on #chanfix over a matter that didn't involve us to begin with. The person who committed this act was Darryl Williams, also known as shi on EFNet. Former torix admin and currently opered on NAC, Mindspring, Easynews, and Security Support. His abusive record extends much farther than even the most notorious criminals. He has run banned hacks on TorIX, has committed countless acts of abuse against users and then taunted those users into attempting to packet torix, which he thought, was invincible. After over 15 warnings to him to watch his actions, after constant emails to irc(a)torix.ca which were either pasted back to me and laughed at, or thrown into the trash bin, and after attempting to talk to various opers on that server to complain, I decided to take matters into my own hands. Either Torix was going to remove his O: line or it would be dropped indefinately. Neither of which happened. I was approached by the admin of torix asking why this was going on and I posted him legit and authentic logs (despite what shi may try to say). The TorIX admin decided because the logs showed too much incriminating evidence against shi, that he would suspend shi's O: line for further review of his future on that server. shi meanwhile utilized a backdoor in the IRCD itself to re-add his O: line and try to hide as a TCM bot. That is the direct reason he was permanently removed from TorIX. For adding himself back without permission from the other admins. Now we will talk about Qeast and what their big deal is. Qeast is WELL KNOWN for being the home of abusive admins in .CA EFNet. xyst and atomix have run server hacks, and have committed various forms of abuse including channel take overs, packeting of other .ca servers in order to reduce those servers max clients, and nickname juping. xyst also sees any potential future hub as a threat to qeast and utilizes his 2 of 4 votes to deny links to such servers. I will bring up irc.magic.ca and irc.total.net which were servers on efnet for many years, who even sponsored qeast's link to efnet, but xyst utilized his 2 votes per server to deny them links. For the record, xyst and shi are friends, they say they aren't but they are. IRCD/HUB IP addresses: These IPs were obtained through several confidential sources, some of which are operlist users, operwall viewers, and opers themselves. I will let you know that the HUB IP I had gotten for Qeast in the 192.77.73.* block which was broadcasting multiple IPs on various ports. I decided to drop the router which is what is currently under attack. Servers that will not be attacked: Servers that will NOT be attacked are those that the admins of said servers and opers, have shown countless times that they are truly here for the network and not for their ego. Opers who work hard every day to provide users with the most comfortable atmosphere to chat in. Opers who follow their own policies and will not allow abusive admins to push them around. These servers include all of .EU EFNet. irc.aloha.net, irc.vrfx.com, irc.nac.net, irc.limelight.us, irc.xo, and more. Take Care, OseK ----- End forwarded message ----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Platinum accounts for the Internet (was Re: who offers cheap (personal) 1U colo?)
by Michael.Dillon＠radianz.com 16 Mar '04

16 Mar '04

>I expect every NANOG conference from now on will be filled with >announcements asking people to please fix their computers because >worms are killing the network. NANOG has less than 500 attendees, >yet has about the same number as infected computers as any other >ad-hoc network population. Maybe NANOG needs to implement a system where you have to log in to a web page with your NANOG meeting passcode in order to get a usable IP address. Then, when an infected computer shows up we will know exactly whose it was. Might even be interesting for a researcher to interview every infected party and figure out why it is happening even among a supposedly clueful group. --Michael Dillon

13 17

Re: Packet Kiddies Invade NANOG
by albertpublic＠hushmail.com 16 Mar '04

16 Mar '04

>Matthew (yes I know it is you) No, my name is Albert. >I have not attacked any Internet Service Provider or IRC server >in several years. I am and have been retired from the underground >for a long while now, despite the constant comments made to the contrary >by people who do not represent me in any manner. Yeah, I bet. Guess that explains this exploit you contributed to recently: http://www.l33 (tsecurity.com/get.php?file=13 Furthermore, thanks for admitting to commiting felonies on this list. In case you were unaware, your statute of limitations has not yet expired. Signed, Albert Public (firstname lastname) Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0