- NANOG - lists.nanog.org

Re: Wired mag article on spammers playing traceroute gameswithtrojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>>OrgName: CyberGate, Inc. >>OrgID: CYBG >>Address: 3250 W. Commercial Blvd. Suite 200 >>City: Ft. Lauderdale >>StateProv: FL >>PostalCode: 33309 >>Country: US > >This appears to be a rather prolific spammer. At first I thought they >were affiliated with www.skynetweb.com because they have the same >address, including suite number, but it now appears that they are really >affiliated with these guys: > >http://www.affinity.com/about/our_team/our_team.htm > >John I decided to revise the way I phrased this. I should have said that this is a rather prolific home for spammers. I doubt Affinity or its associates are doing much spamming of their own. It does appear that Affinity, et. al., are hosting the page that is accepting information from that javascript. Affinity ought to know who is paying for that site and it seems like law enforcement might be rather interested in that information. John --

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 09 Oct '03

09 Oct '03

On Thu, 09 Oct 2003 14:36:53 -0400, Mike Tancsa wrote: >OrgName: CyberGate, Inc. This is a notorious spam-enabler about which I had a quarrel with AT&T management several years back to get them thrown off the AT&T network. I had to take it to their lawyers since the abuse staff would do nothing. Jeffrey Race

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 09 Oct '03

09 Oct '03

On Thu, 9 Oct 2003 10:28:30 -0700 (PDT), Andy Ellifson wrote: >And as soon as you call law enforcement what happends? The spammer is >located offshore. Then what? This is an easy one. Again, see <http://www.camblab.oom/misc/univ_std.txt>

1 0

RE: Finding ASN from IP address
by Austad, Jay 09 Oct '03

09 Oct '03

There's a tool out there called "tracesroute" (note the "s") that will also provide the AS number of every ip it lists. > -----Original Message----- > From: Suresh Ramasubramanian [mailto:suresh@outblaze.com] > Sent: Thursday, October 09, 2003 12:46 PM > To: Avleen Vig > Cc: nanog(a)merit.edu > Subject: Re: Finding ASN from IP address > > > > Avleen Vig writes on 10/9/2003 10:19 PM: > > > I want to create a mapping of IP addresses to ASN, for a > specific like > > of IP addresses. Eg: > > 1.2.3.4 > > 12.34.56.78 > > > > etc, gathered from my system logs. > > > > What is the best way of doing this? > > Rob Thomas (cymru.com) has something like this - see below. > > -- > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > manager, outblaze.com security and antispam operations > > > > * To: apops(a)apops.net > > * Subject: [apops] New Team Cymru IP2ASN whois server > > * From: Rob Thomas <robt(a)cymru.com> > > * Date: Fri, 26 Sep 2003 01:56:11 -0500 (CDT) > > * List-archive: <http://www.apnic.net/mailing-lists/apops/> > > * List-help: <mailto:apops-request@apops.net?subject=help> > > * List-id: Asia Pacific Operators Forum <apops.apops.net> > > * List-post: <mailto:apops@apops.net> > > * List-subscribe: > <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apop > s-request(a)apops.net?subject=subscribe> > > * List-unsubscribe: > <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apop > s-request(a)apops.net?subject=unsubscribe> > > * Sender: apops-admin(a)apops.net > > > > Fellow networkers, > > > > Team Cymru is happy to announce the availability of a public whois > > server dedicated to mapping IP numbers to ASNs, located at > > whois.cymru.com. You can find the link to this tool at: > > > > http://www.cymru.com/BGP/whois.html > > > > This link has been added to our main BGP data page available at: > > > > http://www.cymru.com/BGP/index.html > > > > We have also extended the functionality of this daemon to > support BULK > > IP submissions for those who wish to further optimize their > queries with > > netcat. > > > > Following is a quick overview of how to use it: > > > > $ whois -h whois.cymru.com <IP> > > > > Where <IP> is replaced by the IP you'd like to map, like so: > > > > $ whois -h whois.cymru.com 4.2.2.1 > > ASN | IP | Name > > 3356 | 4.2.2.1 | LEVEL3 Level 3 Communications > > > > You can also include port information, and/or timestamps in your > > queries. Be sure to include quotes around your queries, or > the daemon > > will interpret your request as multiple lines: > > > > $ whois -h whois.cymru.com "4.2.2.1 -0600 GMT" > > ASN | IP | Info | Name > > 3356 | 4.2.2.1 | -0600 GMT | LEVEL3 Level 3 > > Communications > > > > For instructions on how to submit BULK queries via netcat, > simply issue > > the following command: > > > > $ whois -h whois.cymru.com help > > > > We hope you find this tool useful. Stay tuned for more features! > > > > If you have any comments or suggestions as to how we might > improve this > > service, feel free to let us know! > > > > Thanks, > > Rob, for Team Cymru. > > -- > > Rob Thomas > > http://www.cymru.com > > ASSERT(coffee != empty); > > > > > >

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Mike Tancsa 09 Oct '03

09 Oct '03

Looks like attachments wont go through, so I will repost without the attachment. If anyone wants a copy, let me know ---Mike At 01:28 PM 09/10/2003, Andy Ellifson wrote: >Oops... Try this again... > >And as soon as you call law enforcement what happends? The spammer is >located offshore. Then what? Actually, in the case of the wired article (removeform.com) it seems to be connected to a site in Florida. I asked my programmer (gabor(a)sentex.net) to decode the obfuscated java script/page that is served up by one of the zombies (On FreeBSD fetch -B 18192 -o danger.html http://www.removeform.com/d - I got it from 207.5.215.72 at the time). I have attached it as a zip file with its contents. You will note that the form post goes back to form action="http://207.36.47.68/cgi-bin/addinfo.cgi" OrgName: CyberGate, Inc. OrgID: CYBG Address: 3250 W. Commercial Blvd. Suite 200 City: Ft. Lauderdale StateProv: FL PostalCode: 33309 Country: US ---Mike >--- Hank Nussbacher <hank(a)att.net.il> wrote: > > > > On Thu, 9 Oct 2003, Suresh Ramasubramanian wrote: > > > > > * "Follow the money" - find out the spammer / the guy who he spams > > for, > > > from payment information etc.Sic law enforcement on them. > > > > > > srs > > > > I think we can all safely assume that the people behind this are most > > probably on NANOG or reading the archives and are now aware of your > > idea > > :-) > > > > -Hank > >

1 0

Sitefinder and DDoS
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

Let's assume for a moment that Verisign's wildcards and Sitefinder go back into operation. Let's also assume someone sets up a popular webpage with malware HTML causing it, perhaps with a time delay, to issue rapid GETs to deliberately nonexistent domains. What would be the effect on overall Internet traffic patterns if there were one Sitefinder site? (flashback to ARPANET node announcing it had zero cost to any route) How many Sitefinder nodes would we need to avoid massive single-point congestion? AFAIK, the issues of distribution of Sitefinder, and even a formal content distribution network, were not discussed. I asked some general questions that touched on this at the ICANN ISSC committee meeting, but I think they were interpreted as directed toward the reliability of the Sitefinder service in operation, rather than potential vulnerabilities it might create. I am NOT suggesting this simply as an argument against Sitefinder, and I'd like to see engineering analysis of how this vulnerability could be prevented.

2 1

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Gregory Hicks 09 Oct '03

09 Oct '03

> Date: Thu, 9 Oct 2003 10:51:08 -0500 > Subject: Re: Wired mag article on spammers playing traceroute games with trojaned boxes > From: Chris Boyd <cboyd(a)gizmopartners.com> > To: nanog(a)merit.edu > > > > On Thursday, October 9, 2003, at 10:04 AM, Suresh Ramasubramanian > wrote: > > > > > http://www.wired.com/news/business/0,1367,60747,00.html > > > > -- > > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > > manager, outblaze.com security and antispam operations > > > > > > > > I found one of these today, as a matter of fact. The spam was > advertising an anti-spam package, of course. > > The domain name is vano-soft.biz, and looking up the address, I get > > Name: vano-soft.biz > Addresses: 12.252.185.129, 131.220.108.232, 165.166.182.168, > 193.165.6.97 > 12.229.122.9 > > A few minutes later, or from a different nameserver, I get > > Name: vano-soft.biz > Addresses: 131.220.108.232, 165.166.182.168, 193.165.6.97, 12.229.122.9 > 12.252.185.129 > > This is a real Hydra. If everyone on the list looked up vano-soft.biz > and removed the trojaned boxes, would we be able to kill it? This is NOT a hydra. The IP addresses are the same but presented differently. This happens because of THIS setup in DNS: vano-soft.biz. IN A 131.220.108.232 IN A 165.166.182.168 IN A 193.165.6.97 IN A 12.229.122.9 IN A 12.252.185.129 This setup is called "Round-robin" because the name server provides the first IP address FIRST to the first query; the second IP address first to the second query; the third IP address first to the third query; ... to the fifth query. Then it starts over with the first IP Address in response to the sixth query... In each case, ALL IP addresses are provided in response to each query. Yes, the TTL may be a bit low, but it is a workable setup... And no, I am NOT condoning what vano-soft.biz is doing, just trying to explain why, when you checked the first time, you got one answer, and when you checked sometime later, you got a different answer... (Donning flameproof underwear...) Regards, Gregory Hicks ------------------------------------------------------------------- "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Joe St Sauver 09 Oct '03

09 Oct '03

Hi, #I think even if we get all the ones for this domain name today,=20 #assuming we can muster even man hours to get it today, another #5000 will be added tomarrow. Actually, we wrote a little tool to systematically track the dotted quads associated with the vano-soft domain name. We have been seeing a steady stream of new dotted quads advertised for that host, but no where near thousands per day. There have also been some Usenet posts talking about this particular site and the methodology it uses; see: http://groups.google.com/groups?selm= pan.2003.10.03.19.40.44.564854%40frontiernet.net&output=gplain Regards, Joe

1 0

Re: Finding clue at comcast.net
by Sirius F. Crackhoe 09 Oct '03

09 Oct '03

-----Original Message----- From: Sirius F. Crackhoe [mailto:sirius@crackhoe.com] Sent: Thursday, October 09, 2003 12:37 PM To: 'Howard C. Berkowitz' Comcast's Technical and Customer Support is outsourced to EDS and is based in the EDS call center in Hallifax. I believe they were also taking calls in the Winchester, KY call center, which was an old MCI/WorldCom Outsourced Call Center that they sold to EDS a few years back. They are setup the same as MSN, WebTV and RoadRunner. I used to do implementations for WorldCom's outsourced call centers and call tell you for sure, they have no access to the NOC or their staff. They are merely paid phone operators. :) Sirius -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Howard C. Berkowitz Sent: Thursday, October 09, 2003 11:21 AM To: nanog(a)merit.org At 9:29 AM -0500 10/9/03, Austad, Jay wrote: >Comcast's phone support department is the *worst*, WORST, I've ever >dealt with. I think they are outsourced, they have to go by a script, >and many of them probably hardly know what a computer even is. Once I >called because of a problem on their network, and I told the person on >the phone that there was a problem on their network, and I pinned it >down to a couple of routers where the problem may be, and she >responded, very sternly, "Sir, WE DON'T HAVE ANY ROUTERS" Same thing here. Last night, I was told that no escalation personnel were available. On the couple of occasions where I got escalation, I once had an informal conversation with a 3rd level. Their phone center is in Halifax, NS -- didn't find out if it is outsourced or not. While the person with whom I spoke was reasonably clueful, he told me that customer support had no interactive communication with network operations -- at best, they could send an email about a routing, SMTP, etc. problem and hope somebody would respond. At the time, I was paying for their "Pro" service, intermediate between regular residential and full business. My contact said that while that was supposed to get better customer support, an early plan to route it to business Comcast failed, and there really was NO separate Pro support organization. I dropped the Pro service after I learned that residential service no longer insisted you remove any local routers and firewalls before deigning to troubleshoot. They still ask you to do that, but repeated NO responses can get them to proceed. A few NANOGs back (Atlanta), I did a presentation on customer satisfaction, which, frankly, was in many respects a case study of how I'd reform customer support at my then ISP/DSL, cais.net. If NANOG ever did formal documents, I'd like to see a guideline on how to run customer support. > >In any case, if you manage to get the call escalated a couple of times >(after lying about rebooting your computer 47 times), You forgot reinstalling Windows. On a Mac. >you'll get someone >good. Also, there are some good people who read this list. But >calling their phone support to get anything useful is like trying to >squeeze blood from a rock. > >-jay > >> -----Original Message----- >> From: Howard C. Berkowitz [mailto:hcb@gettcomm.com] >> Sent: Wednesday, October 08, 2003 7:36 PM >> To: nanog(a)merit.org >> Subject: Finding clue at comcast.net >> >> >> >> I'm rapidly beginning to believe this is equivalent to finding the >> pot of gold at the end of the rainbow. When my broadband alternative >> is Verizon and it's looking better, this is scary. >> >> Sometime today, their SMTP server started bouncing messages with >> more than 3 addressees. When I called customer support, I was told >> "we only handle troubleshooting, not mail service." The operator >> "guessed" they might be doing software updates on the mail service, >> had no information, and said there was no person to which it could be >> escalated. >> >> She insisted that I call my local cable office to find out when the >> "server repair" would be completed, because "they schedule all >> repairs." >> >> Is this a bad dream? >>

1 0

Customer support tutorial
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

I was about to answer a request for my presentation about customer support, but I had a cat-on-keyboard exploit and I don't know who asked. In any event, the Atlanta presentation is at http://www.nanog.org/mtg-0102/cust.html I did it as a two-part with an intermediate BGP tutorial. In one of the two, there is an RFC 2270 slide. Please, please ignore it -- my brain went out to lunch on that one! Actually, this raises the interesting point -- is there an interest in updating and having running commentary on older presentations, keeping some content up to date? Is this something the NANOG site could support?

1 0