- NANOG - lists.nanog.org

Re: ICQ & AOL
by Omachonu Ogali 28 Apr '00

28 Apr '00

On Fri, 28 Apr 2000 dhudes(a)hudes.org wrote: > The breakin attempts on my server have come from Taiwan and Korea when > using portmap-based breakins; a number of US-based (@home etc.) have tried > to abuse samba. I have tried to notify the Taiwan and Korean networks > involved to no avail. I am in process of creating auto-counterattack tools > that will determine the allocation range and, assuming I have at least as > much or more bandwidth (presumably I'm dealing with an ISP serving dialup > customers), launch floods of packets at the offending netblock (and > hopefully find and attack the NAS by sending stuff to the RADIUS ports) > and any other counterattacks to make life miserable so the offending ISP > has a motive to fix things (i.e. beat them on the head until they behave). > Every good set of tools needs overall purpose, this will result in > enhanced WHOIS tools and probably a web page on security tools. Uhhhh, floods? I guess it's time to flood UUnet, Qwest, Sprint, or any other misconfigured network out there. :) > The samba breakins I have to create a script to peel out the breakins and > send notifications. Much better... > > > On Fri, 28 Apr 2000, Omachonu Ogali wrote: > > > > > So pretty much, you wish to create many different Internet 'islands' by > > isolating networks that are assigned address space from APNIC and RIPE? > > > > By doing so you threaten e-commerce and the businesses of many who receive > > their international customers via the Internet and yet this is effective. > > > > As communication overseas advances in the physical world, you'd further > > hinder the advancement of the Internet, give ISP's no other choice than > > cutting their many trans-Atlantic fiber links, and those who wish to keep > > their links up have to rely on the other side to not be angered and pull > > the plug on their side, yet this is effective. > > > > Take a look at Attrition.org's defacement archive, the majority of the > > defacers are from the United States, and a lesser crowd from APNIC/RIPE > > networks, I can't speak on credit card fraud, but should we in turn go > > around segregating the ARIN networks due to internal misuse, would that be > > 'effective' to you? > > > > On Thu, 27 Apr 2000, Universal Rundle wrote: > > > > > > > > I'd venture to say that this is the result of the following phenomena: > > > > > > Block all APNIC and RIPE assigned networks at the border and all of the > > > sudden, hack attempts and CC fraud disappear. > > > > > > It's fan-%^&#ing-tasticly simple to do and so very effective. > > > > > > > > > >From: "Igor V. Vorontsov" <iv(a)akcecc.net> > > > >To: nanog(a)merit.edu > > > >Subject: ICQ & AOL > > > >Date: Thu, 27 Apr 2000 13:35:10 +0300 (EEST) > > > > > > > > > > > >Hello colleque, > > > > > > > >Sorry my English. > > > > > > > >If engeneers from AOL or ICQ is present here... > > > > > > > >Many pople from Russia and Ukraine can't connect to your service. > > > >Your engeeners was closed many networks from Russia and Ukraine. > > > >But why? Many people from our country was usable service ICQ, but now > > > >this service is closed for them. > > > > > > > >Please open for your service our networks and resolve this problem. > > > >One of them - network 193.227.207.0/24 > > > > > > > > > > > > > > > >Igor V. Vorontsov > > > >IV144-RIPE > > > > > > ________________________________________________________________________ > > > Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com > > > > > > > > > > > > > > > -- +-------------------------------------------------------------------------+ | Omachonu Ogali oogali(a)intranova.net | | Intranova Networking Group http://tribune.intranova.net | | PGP Key ID: 0xBFE60839 | | PGP Fingerprint: C8 51 14 FD 2A 87 53 D1 E3 AA 12 12 01 93 BD 34 | +-------------------------------------------------------------------------+

2 1

Re: DSL problems (PacBell and Covad)
by Sean Donelan 28 Apr '00

28 Apr '00

If only certified techs are allowed to touch the line, and they only work 9-4 on weekdays, who cut the line? Do the certified techs cut the lines before they walk at the door at 4pm on Friday? On Thu, 27 April 2000, John Hall wrote: > Yikes! And I thought out US West service was bad! US(eless) West is > notorious for DLS service that stays up while the phone line is > down! It's happened to me three times for a total of 78 hours! The > great thing is that they allow only "certified" technicians to touch > these circuits, so even if the tech at the CO can see that the phone > line has been cut on the telco side of the DSL modem at the CO, he > can't touch it! And of course all the "certified" techs only work > 9am-4pm weekdays (at least the residential DSL ones). > > Once when I got through to their tech. support call center, the guy > on the phone was almost in tears, he'd had to tell that to so many > pissed off customers.

5 4

Re: ICQ & AOL
by Richard Colella 28 Apr '00

28 Apr '00

Did you try trouble(a)aol.net? If not, give it a shot. --Richard > Delivered-To: nanog-outgoing(a)merit.edu > Date: Thu, 27 Apr 2000 13:35:10 +0300 (EEST) > From: "Igor V. Vorontsov" <iv(a)akcecc.net> > X-Sender: iv(a)roll.akcecc.kiev.ua > To: nanog(a)merit.edu > Subject: ICQ & AOL > MIME-Version: 1.0 > X-Loop: nanog > > > Hello colleque, > > Sorry my English. > > If engeneers from AOL or ICQ is present here... > > Many pople from Russia and Ukraine can't connect to your service. > Your engeeners was closed many networks from Russia and Ukraine. > But why? Many people from our country was usable service ICQ, but now > this service is closed for them. > > Please open for your service our networks and resolve this problem. > One of them - network 193.227.207.0/24 > > > > Igor V. Vorontsov > IV144-RIPE > >

3 2

DSL problems (PacBell and Covad)
by Sean Donelan 28 Apr '00

28 Apr '00

InternetNews had an article about DSL problems at PacBell and COVAD. http://www.internetnews.com/isp-news/article/0,2171,8_347841,00.html It appears COVAD blames their problems on AT&T and Qwest cable outages, which did happen. But I have reports from half-a-dozen different people reporting several different outages due to switch failures, switch limits being exceeded, code upgrade failures, including one upgrade where the code crashed at one office one night, and the next night COVAD loaded it on the next office which also crashed. PacBell's DSL outage was reportedly due to a switch failure, although PacBell couldn't tell or wouldn't tell, how many customers were affected by it. Is this simply a case of different providers having switch problems at the same time? Typical problems of deploying bleeding edge technology?

7 6

Re: wow, Internet fiction must really sell. (abovenet)
by Scott Bradner 28 Apr '00

28 Apr '00

>Fear-mongering in the name of marketing with an ever-so convenient >omission (or, more accurately, a blatant lack) of empirical evidence to >offer? This should be criminal. might be a tech hard on the average politician so I kinda don't think such a rule will show up Scot

1 0

wow, Internet fiction must really sell. (abovenet)
by k claffy 28 Apr '00

28 Apr '00

iDEFENSE should sell the hallucinogens they're in clear possession/consumption of rather than the keystrokes they type while peaking. reckon the profit margin would be much higher f%^&ng ridiculous. the `i' must stand for imaginary >From: Jerry Irvine <JIrvine(a)iDefense.com> >To: >Subject: iDEFENSE iALERT: AboveNet Update, Evolved DDoS Tool Used >Date: Wed, 26 Apr 2000 17:18:43 -0400 >Importance: high >X-Priority: 1 > >Evolved Version of DDoS Tool Poses Significant New Threat to Business >Operations > >iDEFENSE Intelligence Services >April 26, 2000 >5:10 pm (EST) > >iDEFENSE believes that the behavior of the attack against AboveNet is an >example of the logical progression of distributed denial of service tools. >The devastating potential of this evolved tool was demonstrated during >Tuesday's attack against AboveNet which took down one of the world's leading >ISPs, for five hours, affecting companies such as eBay and Everyone.net. >AboveNet also hosts sites for AOL and numerous other high profile companies. >The extent of the disruption against these sites is not clear at this point. > >The evolved tool can attack with a speed and viciousness not even seen >during the attacks in early Feb. It appears to have a significantly enhanced >ability to communicate with an army of drones which can then in turn talk to >other drones at a significantly greater speed than what could be done by >other DDoS tools earlier in the year. These older tools operated by sending >one command from a master out to numerous zombies, the evolved version >allows the attack to reach critical mass instantaneously and may prove >significantly more difficult for investigators to identify the suspect. > >In light of this new development, companies need to immediately review their >incident response procedures in order to make sure they are adequate to >manage this threat. Having redundancies and multi-homing built into their >systems are key to minimizing the impact of an attack such as this. > >While the motive for the attack is unclear at this point, the potential for >future strikes in the coming weeks against AboveNet and/or other major ISPs >and Web sites cannot be ruled out. > >------------+------------------------+--------- > >iALERT delivers daily monitoring and analysis of cyberthreats, >vulnerabilities, and incidents to iDEFENSE's clients. > >This e-mail is delivered to journalists covering the information security >field. > >For more information or comment please contact Jerry Irvine at 703.898.8283 ><mailto:jirvine@idefense.com> > >------------+------------------------+--------- > >iDEFENSE - The Power of Intelligence > >Visit the iDEFENSE Web site for additional information: ><http://www.idefense.com> > >Copyright 2000 Infrastructure Defense Inc. (iDEFENSE)

3 2

Re: ICQ & AOL
by Richard Colella 27 Apr '00

27 Apr '00

> I'd venture to say that this is the result of the following phenomena: > > Block all APNIC and RIPE assigned networks at the border and all of the > sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. Nope, it's not. --Richard

1 0

Re: ICQ & AOL
by Martin Cooper 27 Apr '00

27 Apr '00

Universal Rundle <u_rundle(a)hotmail.com> wrote: > Block all APNIC and RIPE assigned networks at the border and > all of the sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. /me wonders if everyone's UU peering troubles would disappear if lots of them did that to its netblocks all at once... ;-) M.

1 0

Re: Above.net? ... vultures swoop in
by Mark Kent 27 Apr '00

27 Apr '00

It doesn't take long for the vultures to swoop in: I just picked up a voice mail from a UUnet salesperson that says "... I saw that y'all are at AboveNet and I'm fairly sure that you are aware of what happened yesterday with the denial of service attacks and I was wondering if y'all might be looking to go with somebody else that way you aren't shut down and you don't lose business ..." I must have missed the UUnet press release that stated that UUnet will not be affected by any DDOS attacks. Or maybe it is in a document covered by an NDA :-) -mark

5 4

Over subscription
by Arun Welch 27 Apr '00

27 Apr '00

What level of over subscription are people generally using for their tail circuits these days. In other words, if you've got a POP connected by one T3, how many customers (T1 and T3) would you typically connect to that POP (I'm just looking for generalities here, nothing exact)? I've got some numbers, but they're about 4 years old, and I suspect things have changed since then. ...arun Arun Welch Infinite Global Infrastructures

2 1