- NANOG - lists.nanog.org

RE: Re: CalPOP contact? HTTP CONNECT scanning]
by Jeroen Massar 06 Sep '03

06 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- lynn [mailto:lynn@calpop.com] wrote: > Thanks for your lengthy letter- it's just the kind of letter we need - > complete with specific cases so that we can go and investigate and > terminate any individual cases that might not be terminated yet. Three days later... > The idea that CalPOP is in the spamming business is a joke, > we hate spam just as much as anyone else, That indeed why you are listed in spamhouse. > among our clients is Interland, Boeing Airlines, lots of the > entertainment industry, HilaryDuff.com, Jeopardy.com, Kingworld.com, Seal.com, - > ecommece companies like BizCrafter.com, So you've got 7 domains which are not spamming. But you apparently have a lot of clientelle that comes back and back causing you to earn bucks with signup fees and terminating them "directly" (ahem) when somebody complains in public. Good service indeed, for spammers. > and we even have servers for anti-virus > clients like Panda Software and AVG, and tons of Game servers here... we > do not have 1,000 spamming servers - in fact we terminate anyone who is You only got a couple, not 1000, spamming servers? Every spamming server is one too much. Terminate them. > found to be spamming instantly as it is a violation of our terms of > service which is in the signed contract that every one of our customers has signed. Which is nowhere to be found publicly, not even a public statement about this, unless you want to record this as your "CalPOP AUP". > Because we have inexpensive bandwidth and servers we get all types of > stuff - our network pretty much mirrors the internet at large- > a little bit of everything, but because we have a set-up fee we > usually don't get as many spammers as some of the other "free set-up" "We don't get as many spammers as some other..." Aka you _DO_ get spammers. This is going in the right direction. Admittance of your problems is better than denial. > cheap server companies. We turn people off for spamming all the time and You turn them off and probably back on again because they signup again, and only till you get a big public offense you suddenly turn them off. > we keep thier set-up fee so we are > not the company to come to for spamming! Indeed, you are in the perfect business of earning lots of money from spammers by cashing in their spamming fees. > abuse(a)calpop.com works too. I was just offering an > alternative by given out support(a)calpop.com as it seemed that > people were looking for additonal means > to contact us- we are open 24 hours so you can always call. > And our support(a)calpop.com assigns tickets- that was a great > idea to have the abuse assign tickets too and we will set that up. Ahem, so support and abuse are different and they don't work? > > The client at 216.240.140.204 has been terminated. So that's > a closed case- told you we were quick! After three days of PUBLIC messages and you getting it via some of your personal close friends who is in the same business :) > We have the signed signatures of every customer agreeing to > our acceptable use policy which of course calls for zero tolerance > for spam which is why you don't find it online- we are so adament > about abuse that we make every customer fill out a contract > AND SIGN IT PERSONALLY agreeing to our anti-abuse contract and we > make them sign-it and fax it back before we will put them online. If they sign it maybe you can earn MUCH MORE money ($$$ bling bling) if you put in a clause that when they spam that they have to pay you a fine for spamming. This will really keep those 'customers' away and earn you even more money. Though all your setup revenues will ofcourse go down, but you will get a better network and respect from the rest of the internet and maybe then even real non-spamming customers. > That's why you can't search google and find our policy. > However- since you suggested it, we will create an online > webpage just for that purpose - so that other people can see our > policy not just our customers. Step in the right direction. > The idea that we don't work as vigorusly as anyone else is > simply false, if anything, we are one of the most proactive > fighters of spam in the industry. Why where you in spamhouse again? http://www.spamhaus.org/sbl/listings.lasso?isp=calpop.com 216.240.129.0/26 is listed on the Spamhaus Block List (SBL) Jul 26 2003 - 8:13hrs GMT Daniel Licht Open proxy spammer. "Meet The Bullet-Proof Proxy Hijacking Licht Brothers - Daniel and Ernst" http://google.com/groups?selm=vi1pvep3jlil1f@corp.supernews.com "MORE: Licht Brothers Proxy Hijacking Team Really Gets Around!" http://google.com/groups?selm=vi3o5mat1rlpd9@corp.supernews.com Very pro-active indeed. Very speedy *rofl* > We have just finished working with the FBI to catch an > alleged spam ring known as Pilot Holding. Aha, you got forced to do track it down by law... And was that company owned by yourself or was it some other nice tax-evading contstruction like some other person who was caught redhanded and denies everything. Or where you talking about the fact that the FBI caught up to you and you needed to "work" with them? > I don't think people realize how big our operation really is We do, 1000 servers, you told that already. Basically nobody cares how big your (spamming?) "operation" really is, it spams through proxies. You should not do that not with 1 box and not with a 1000. > - our building for example > has only 5 clients - XO, QUEST, ICG, CALPOP, and EQUINIX and > that's why it can appear like we are a small operation that is > spamming when in fact we are a big operation that gets a > few spammers on it now and then, like all big and fast > growing operations. Now you are big again? Oh my, the contradictions. Also that you are in the same housing facility as another ISP doesn't relate to the fact that your abuse department doesn't do a thing unless complaints go up in public. <SNIP bottom quoted message> I think you now know how everybody thinks about your "operation". I also sincerely hope that you clean up your act and become a respectable hoster that does _really_ work on abuse reports. As for your ticket numbering system, you might want to let it send updates to the complainants that the matter has been sorted out and possibly the actions you took. Greets, Jeroen - -- "I am in the gutter now, but at least this gutter is mine" -- M.B. Former Spammer -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA+AwUBP1oV/ymqKFIzPnwjEQIZQwCYjWHelhmHrRdP9urfQlHREDA86QCgmhAC Tk4vtLfrNSu9BC3q/dMthRU= =ECFW -----END PGP SIGNATURE-----

1 0

More on the DDoS Attack
by Matthew Sullivan 06 Sep '03

06 Sep '03

To those providers who have started filtering some if not all of the spoofed traffic, and those have been nuking the zombied hosts. Please accept my thanks, it seems that enough has been stopped so the DNS and websites are now available again. Thanks, Matthew

3 4

Important changes to the .org tld today.
by Rodney Joffe 06 Sep '03

06 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 During the root zone (.) update later today, specifically with root zone serial number 2003090501, the entries for .org will me modified. The current zone entry contains the following authoritative nameservers for the .org tld: org. 2D IN NS A7.NSTLD.COM. org. 2D IN NS L7.NSTLD.COM. org. 2D IN NS G7.NSTLD.COM. org. 2D IN NS F7.NSTLD.COM. org. 2D IN NS M5.NSTLD.COM. org. 2D IN NS TLD1.ULTRADNS.NET. org. 2D IN NS TLD2.ULTRADNS.NET. org. 2D IN NS J5.NSTLD.COM. org. 2D IN NS I5.NSTLD.COM. org. 2D IN NS C5.NSTLD.COM. org. 2D IN NS E5.NSTLD.COM. Effective with the 2003090501 load, the entry will reflect the removal of the Verisign NSTLD.COM nameservers. The zone entry will therefore contain the following only: org. 2D IN NS TLD1.ULTRADNS.NET. org. 2D IN NS TLD2.ULTRADNS.NET. If you have the 9 ??.NSTLD.COM nameservers cached or hard coded in any way, you may wish to flush your cache or modify your nameservers in the near future to avoid any inconsistent or stale data, and you may want to make your system administrators, NOCs and customer support groups aware of the changes. The .org zone file will continue to be pushed to the Verisign nameservers for a short period of time. However due to the fact that the UltraDNS nameservers publish and propagate zone changes globally within 5 minutes, rather than the twice daily update schedule of the Verisign nameservers, answers from the NSTLD.COM nameservers may be out of date and inconsistent with the actual SOA for up to 24 hours after a change is accepted by the Public Interest Registry (PIR.org) Any questions or concerns regarding this change should be directed to the PIR (http://www.pir.org) Sincerely, Rodney Joffe CTO and Chairman UltraDNS Corp. http://www.ultradns.com -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQA/AwUBP1iJJEa3pZtqJ3OwEQJvwACdHkKdAW3TqDSpOJVoguhFAx0YebwAnAw9 c6fW3PeXcgvjwhvLIPaxRVEW =+m9c -----END PGP SIGNATURE-----

6 6

RE: Re: CalPOP contact? HTTP CONNECT scanning]
by Jeroen Massar 06 Sep '03

06 Sep '03

-----BEGIN PGP SIGNED MESSAGE----- [This message apparently was sent off list, but I think it is in everybodies interrest to know how the apparent owner/CEO/CTO whatever thinks about this, and possibly enlightening everybody where we do have to send abuse complaints.] lynn [mailto:lynn@calpop.com] wrote: > CalPOP has a vigorus anti-spam policy and > terminates any customers that are found to be spamming. > CalPOP has a ZERO TOLERANCE for spam and any abuse complaints should be sent to > support(a)calpop.com where they will be handled very quickly. 216.240.140.204 - - [03/Sep/2003:06:27:15 +0200] "CONNECT 65.54.253.99:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:17 +0200] "CONNECT 65.54.167.5:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:19 +0200] "CONNECT 65.54.253.230:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:20 +0200] "CONNECT 65.54.167.230:25 HTTP/1.0" 200 2366 "-" "-" 216.240.140.204 - - [03/Sep/2003:06:27:22 +0200] "CONNECT 65.54.254.151:25 HTTP/1.0" 200 2366 "-" "-" And see the beginning of the thread for more stuff and older dates. See: http://www.merit.edu/mail.archives/nanog/msg13312.html Let's lookup those IP's in whois: 8<------------------------------------------ jeroen@purgatory:~$ date Sat Sep 6 12:23:47 CEST 2003 jeroen@purgatory:~$ whois 216.240.140.204 OrgName: WebVision/ATMLINK Inc. OrgID: ATML Address: 3250 Wilshire Blvd. Address: Suite 1405 City: Los Angeles StateProv: CA PostalCode: 90010 Country: US NetRange: 216.240.128.0 - 216.240.159.255 CIDR: 216.240.128.0/19 NetName: CALPOP-COMMUNICATIONS NetHandle: NET-216-240-128-0-1 Parent: NET-216-0-0-0-0 NetType: Direct Allocation NameServer: NS1.CALPOP.COM NameServer: NS2.CALPOP.COM Comment: CalPOP Communications RegDate: 1999-09-22 Updated: 2003-01-11 TechHandle: BSB-ARIN TechName: Bacsa, Sam Samuel TechPhone: +1-714-330-9227 TechEmail: sam(a)calpop.com OrgAbuseHandle: CALPO-ARIN OrgAbuseName: CalPOP Abuse OrgAbusePhone: +1-213-351-1355 OrgAbuseEmail: abuse(a)calpop.com OrgNOCHandle: CNO4-ARIN OrgNOCName: CalPOP Network Operations OrgNOCPhone: +1-213-351-1355 OrgNOCEmail: noc(a)calpop.com OrgTechHandle: BSB-ARIN OrgTechName: Bacsa, Sam Samuel OrgTechPhone: +1-714-330-9227 OrgTechEmail: sam(a)calpop.com # ARIN WHOIS database, last updated 2003-09-05 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. - --------------------------------->8 Let me see... support(a)calpop.com... I don't see no support(a)calpop.com but I do see an abuse(a)calpop.com.. hmm so the "CEO" of this "company" doesn't even know where abuse is sent to? And they apparently don't handle abuse sent to the abuse address. > The idea that CalPOP is "knowingly facilitating this > behaviour" is simply not true. Then why don't you fix your customers and reply to abuse reports. Even having a ticket tracking system with an auto reply containing the wording that you are going to work at it and a pointer to your AUP, which you apparently don't have: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=AUP+sit… http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=Use+Pol… Turn up 0 records, oh and: http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=abuse+s… http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=spam+si… Don't return anything either. http://www.google.com/search?hl=en&lr=&ie=UTF-8&oe=UTF-8&safe=off&q=spam+ca… On the other hand show a LOT of spamming complaints. Thus dear "Lynn" go fix your network. Apparently you do want to do it as you did want to reply to the message, thus I sincerely hope you do so. > For the record, Patrick Greenwell never worked for CalPOP.com, Inc. - > although he did work for AirlineReservations.Com, Inc. for a VERY > short time when AirlineReservations.Com, Inc. owned CalPOP and was > under different management. Thus you worked for him, perfect :) > CalPOP has over 1,000 servers at it's Downtown Los Angeles > facility alone and is growing very fast and, of course, termination of > spammers is largely complaint driven- after all, there is such a thing as an > opt-in list - and there are various liability reasons and "common carrier" laws > which prevent CalPOP from prying into the servers of its customers to see > what they are doing . Good advertisement, thus you have 1000 spamming boxes? > CalPOP's Los Angeles data Center at Carrier Center 600 > W. 7th - a facility in which Patrick Greenwell has never been in so > obviously allot has changed. Why should he be going there if you just said that you can't pry into those servers anyways? > Patrick is a great and very knowledgable guy and I am > surprised to find him saying bad things about a network that he > was supposedly in charge of. Oh, so suddenly he DID manage it, quite odd that you say that he didn't just a few lines up. > Anyway, send any complaints, IF ANY, our way and we will handle them > accordingly. Fix your whois records, people all around the world don't even want to know about your operation in the spamming business. Also there is quite an apparent proof, see the other list managers that you really don't give a cents worth about anything related to being something in handling abuse and making you a good netizen. > Lynn Hoover > CalPOP.com, Inc. > 213-627-1937 > support(a)calpop.com Where can that address be found in whois again? > ----- Original Message ----- > From: "Jeff S Wheeler" <jsw(a)five-elements.com> > To: <lynn(a)calpop.com>; <ross(a)calpop.com> > Sent: Thursday, September 04, 2003 7:31 PM > Subject: [Fwd: Re: CalPOP contact? HTTP CONNECT scanning] > > > > Dear Sirs: > > > > I thought you should read what is being said about your > organization on > > the NANOG (North American Network Operators Group) mailing > list by an > > individual who claims to have been in your employ. I > imagine you will > > have an enforcable NDA with said individual. Oh god NDA's... SUE SUE SUE SUE SUE!!!! We are in the US again :) <grin> Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA/AwUBP1m5kCmqKFIzPnwjEQIu1QCfYPls1CyfHxVV4tUwMPT7ON/BdeIAnA5i W+6/G/7Vp1eEE3SwTXIkMiBT =fPI5 -----END PGP SIGNATURE-----

1 0

Don't forget about physical security - Australia
by Sean Donelan 06 Sep '03

06 Sep '03

Two people dressed as computer technicians entered Australia's mainframe data center for customs and intelligence centre at the Sydney International Airport. They impersonated EDS technicians hired to repair the mainframes. They spent two hours disconnecting the mainframe communications equipment. They then put the equipment on trolleys and pushed them out the front door past the guards.

2 1

SNMP OID's for BGP monitoring
by Austad, Jay 05 Sep '03

05 Sep '03

What OID's are people using to monitor/graph BGP stats on Cisco routers? -jay

3 2

A web interface to check the consistency of RPSL policies
by Olivier Bonaventure 05 Sep '03

05 Sep '03

Dear All, In the framework of a research project on interdomain traffic engineering, Vincent Magnin, has developped a tool and a web interface that could be useful for network operators. The tool relies on the RPSL databases from the main 19 IRR and builds a map of the global Internet based on this information. Furthermore, by using a few heuristics the tool is able to infer the type of relationship (customer->provider, provider->customer, peer-to-peer, ...) between two autonomous systems. This heuristic works well when both AS register accurately their routing policies. Unfortunately, not all ASes correctly maintain their RPSL policy. In those cases, the heuristic will either perform an educated guess or indicate a potential problem found in the RPSL specification. The web interface of the tool allows to easily browse through the 19 RPSL databases and we believe that it could be useful for ISPs willing to check the consistency of their RPSL policy compared to the policy of their neighbors. You can access the web interface of the tool at the URL below : http://rpsl.info.ucl.ac.be Your feedback, to rpsl(a)info.ucl.ac.be is welcome as we intend to later release the tool in open source if it appears to be useful for operators. Best regards, Vincent Magnin, Steve Uhlig and Olivier Bonaventure -- CSE Dept. UCL, Belgium - http://www.info.ucl.ac.be/people/OBO/

1 0

zebra server redundancy
by Steve Francis 05 Sep '03

05 Sep '03

A while back there was a thread about using zebra/gated to originate a host route into OSPF that is tied to the loopback on multiple boxes, in order to achieve server redundancy and load balancing w/o appliances. In testing so far, this seems to work great. My only question is how are people withdrawing the routes? ospfd does not yet re-read its config on a HUP. Killing the daemon seems a bit rude, depends on timers for convergence, and precludes having more than one service per box. removing the alias from the loopback interface seems slow to converge, as zebra does not seem to be notified in real time of such events, but seems to have a periodic timer that looks at interface status. (Adding it back to the loopback has also had some issue, if the host route is already in the routing table from other hosts.) Looks like an expect script telneting to the ospfd and removing the network statement from the router ospf section is the best way, or is there some more elegant mechanism people use? Thanks

3 2

Re: Important changes to the .org tld today.
by neil＠DOMINO.ORG 05 Sep '03

05 Sep '03

> The .org zone file will continue to be pushed to the Verisign > nameservers for a short period of time. However due to the fact that > the UltraDNS nameservers publish and propagate zone changes globally > within 5 minutes, rather than the twice daily update schedule of the > Verisign nameservers, answers from the NSTLD.COM nameservers may be > out of date and inconsistent with the actual SOA for up to 24 hours > after a change is accepted by the Public Interest Registry (PIR.org) Hmm I thought this was NANOG and not MARKETINGPOINTLESSINFOOG ? Neil.

5 5

RE: SNMP OID's for BGP monitoring
by Austad, Jay 05 Sep '03

05 Sep '03

Doh, unfortunately, I'm on the 12.3 train, and that OID does not exist. I could have sworn that I saw some MRTG graphs awhile back where people were monitoring how many prefixes they had and other sorts of things. Were they scripting this somehow or pulling via SNMP? > -----Original Message----- > From: Jared Mauch [mailto:jared@puck.Nether.net] > Sent: Friday, September 05, 2003 10:27 AM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: Re: SNMP OID's for BGP monitoring > > > If you are running 12.0(26)S you can now graph the number > of routes you receive from a BGP peer. > > Here's the OID for those that have long-awaited such a > feature. > > .1.3.6.1.4.1.9.9.187.1.2.4.1.1 > > Now why this is missing from their "newer" 12.2 and > 12.3 software > is something that you will need to ask your cisco rep. > > - Jared > > On Fri, Sep 05, 2003 at 10:23:29AM -0500, Austad, Jay wrote: > > > > What OID's are people using to monitor/graph BGP stats on > Cisco routers? > > > > -jay > > -- > Jared Mauch | pgp key available via finger from jared(a)puck.nether.net > clue++; | http://puck.nether.net/~jared/ My statements > are only mine. >

2 1