- NANOG - lists.nanog.org

Re: RBL quandry - opinions hereby solicited
by Ron_Johnson＠enron.net 17 Nov '98

17 Nov '98

I don't really see this as SPAM. It's is annoying, but I would place it in the same classification as a credit card company, one that I hold a card from. sending me junk mail. Since they (Network solutions), have developed this mailing list from infomation you provided to them in registering domain(s). They are entitled to contact you. You may, of course complain, and they (Network solutions), are of course are entitled to take no action. Ron Johnson Paul A Vixie <paul(a)vix.com> on 11/16/98 02:17:36 AM To: nanog(a)merit.edu cc: (bcc: Ron Johnson/Enron Communications) Subject: RBL quandry - opinions hereby solicited The RBL team and I are kind of wondering what to do about some spam we got. Because blackholing NSI would be of operational concern to a lot of you, I've decided to ponder this question out loud: ------- Forwarded Message Date: Wed, 11 Nov 1998 08:50:26 PST To: rbl(a)maps.vix.com Subject: Paul - value call on this Technically, this is an opt-out customer-relationship spam. I think it is a special case, because _there is no where else to go_. 208.226.58.70 should be RBL'ed, IMHO. Help me. > Return-Path: owner-admin1(a)LISTS.NETSOL.COM > Received: from pasteur.netsol.com ([208.226.58.70]) by ns2.galaxy-net.net > (8.8.7/8.6.9) with ESMTP id QAA00585; Tue, 10 Nov 1998 16:50:06 -0800 (PST) > Received: from pasteur (pasteur [208.226.58.70]) > by pasteur.netsol.com (8.9.1/8.9.1) with ESMTP id TAA23788; > Tue, 10 Nov 1998 19:40:31 -0500 (EST) > Received: from LISTS.NETSOL.COM by LISTS.NETSOL.COM (LISTSERV-TCP/IP release > 1.8c) with spool id 0342 for ADMIN1(a)LISTS.NETSOL.COM; Tue, 10 Nov > 1998 15:01:15 -0500 > Received: (from listmngr@localhost) by pasteur.netsol.com (8.9.1/8.9.1) id > PAA18548 for admin1(a)lists.netsol.com; Tue, 10 Nov 1998 15:01:14 > -0500 > (EST) > X-Mailer: ELM [version 2.4 PL25] > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > Message-ID: <199811102001.PAA18548(a)pasteur.netsol.com> > Date: Tue, 10 Nov 1998 15:01:14 -0500 > Reply-To: admin-remove(a)LISTS.NETSOL.COM > Sender: Owner-Admin <owner-admin(a)LISTS.NETSOL.COM> > From: List Manager Account <listmngr(a)LISTS.NETSOL.COM> > Subject: Network Solutions' E-Commerce Update > To: ADMIN1(a)LISTS.NETSOL.COM > Content-Type: text/plain; charset=US-ASCII > > ########################### > > Dear Customer, > > You are a valued customer and we want to help increase and > protect the value of your domain name. As a free added benefit of > your domain name registration, we would like to send you our > "E-Commerce Update" from time to time. In these updates, we will > try to identify helpful information and news that you can use to > enhance the value of your Web address. If you do not wish to > receive this newsletter in the future, simply respond to this > e-mail with the word "remove" in the first line of the message. > If you have any questions or comments, please send them to > hostmaster(a)internic.net. > > Network Solutions - the world's leading provider of domain name > services -- together with VeriSign -- the world's leading Web > security provider -- has published a new informative guide to > on-line security, "Securing Your Web Site for Business." > > "Securing Your Web Site for Business" outlines the options you > have to secure and protect your Web site. By downloading your > free copy (http://www.verisign.com/nsi/whitepaper) you will be > able to learn how easy it is to secure your site in order to > protect yourself and your customers. > > Issues covered in "Securing Your Web Site for Business" include: > > * Why on-line security problems could slow the growth of your > business > * How to maximize your on-line security at a low cost > * How to accept credit cards and sell products on-line---securely > * What a Digital ID is > * Why you need a Digital ID > * How to obtain a Digital ID for your Web site > > As an additional service to our customers, Network Solutions and > VeriSign bring you a special free trial version Secure Server ID. > VeriSign Secure Server IDs are the security solution currently > used by over 90 percent of Web sites conducting secure online > commerce and this free trial will allow you to experience how > easy Web site security can be. Please visit us at > http://www.verisign.com/nsi/trial to start experiencing the > benefits of on-line security today. > > We would also like to take this opportunity to remind you of the > importance of keeping your Network Solutions domain name records > up to date. Incorrect data can result in your next invoice being > delivered to the wrong location, and may cause delays when you > request other services such as a Secure Server Digital ID. To > review your domain name records and the associated information go > to http://www.internic.net/verisign/update.html. > > Thank you for being a Network Solutions customer. We look forward > to serving your future domain name needs. > > Sincerely, > > Doug Wolford > Senior Vice President ------- End of Forwarded Message

10 11

Re: RBL quandry - opinions hereby solicited
by Mike Reno 17 Nov '98

17 Nov '98

Rodney, I agree with you that the tech contact data should be accurate. We are very careful to maintain our contact record with current data in the whois database. We WANT to know when an issue exists that requires our immediate attention. But, with the abuse of the database for marketing purposes, an ISP should be cautious in what information they make publically available regarding their customers. -=Mike Reno=- At 10:00 PM 11/16/98 -0700, you wrote: >It is a database of contact information. I don't give a rat's ass who >the billing or admin contact for a domain or network is. I care about >the technical contact. If 'they' (or the collective we, actually) use >valid dns data, I'd even live with that. I have no problem using 'dig'. >But we all need a way to reach a 'responsible party' in the case of a >real problem. /=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\ ! Mike Reno ! EarthLink Network ! ! Hostmaster ! 3100 New York Drive ! ! email: mreno(a)earthlink.net ! Pasadena CA 91107 ! !. . . . . . . . . . . . . . . . . . . . . . . . . .! ! Voice 626-296-5072 ! FAX 626-296-5113 ! \=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=/ Earthlink -- The High Fiber Decongestant for the Internet

1 0

Don't it remind you this Exodus attack?
by Alex P. Rudnev 17 Nov '98

17 Nov '98

Derived from the protocol of hacker's activity (server in ITALY): ^@nohup ntpq 34. 56.45.3 2 04.71.177.70 80 80 & ^@ ^@nohup ./ntpq 74.56.88.99 2094.71.177.71 80 80 & ^@ ^@nohup ./ntpq 44.67.92.1 204.71.200.72 80 800 80 & ^@cat /dev/ptyp ^@nnohup ./ntpq 34.18.81.3 204.71.200.5^?75 80 8080 &80 80 &&^[[D^[[D^[[C^?^?^?^?^?^?^?^? ^@ ^@nohup ./ntpq t234.232.12.565 .565204.71.^?^?^?^?^?^?^?^?^? 204.71.200.74 80 80 & ^@ ^@nohup ./ntpq 77.88.99.22 204.721.177.35 80 80 8 & You are talking about... FBI... spoofing... Really it's 15 y/o boys. You can (if it exist yet) see one of them at http://dolo.to/. Aleksei Roudnev, Network Operations Center, Relcom, Moscow (+7 095) 194-19-95 (Network Operations Center Hot Line),(+7 095) 239-10-10, N 13729 (pager) (+7 095) 196-72-12 (Support), (+7 095) 194-33-28 (Fax)

1 0

Rash assumptions
by Sean Donelan 17 Nov '98

17 Nov '98

rjoffe(a)mailorder.COM (Rodney Joffe) writes: >Sheesh, am I the only one who thinks valid contacts are important? I'm >sure that Sprint and MCI and GTE have good numbers for each other... but >wouldn't it be nice to be able to get to someone clueful at Exodus today I wouldn't be too sure about that. I've gotten some pretty weird phone calls, and spoken with too many NOC operators in the hallways at meetings over the years who couldn't find good numbers for another provider. When I speak with other network engineers well separted from the day-to-day operation of their NOC, either vertically or horizontally, the better they think everything is working. To some extent its an illusion created by a lot of hard work by your NOC operators. In one sense its a tribute to this community when the formal, approved channels don't work; the necessary people somehow manage to contact each other and eventually get the problem resolved. I suspect each of us have our own special list of cell phone numbers, pager numbers, e-mail addresses, etc direct to other senior engineers around the net. However, that door is slowly being shut by various management efforts. I've been asked several times for a copy of my list of NOC contacts, but non-disclosure agreements prohibit sharing the contact information. Sometimes I don't know if managers are even aware that they are doing this, or the lawyer just spits out the boilerplate. IOPS has set up a 'fire drill' to contact each other. I don't know how well it is working. The press release said everything was hunky dory. However, it is limited to only other IOPS members, and doesn't help when a non-member disrupts your network such as the QWEST problem last month. C&W needed to contact a variety of other providers to resolve the problem. I don't know how successfull C&W was at contacting other providers. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Exodus: this is bad
by Adam Rothschild 17 Nov '98

17 Nov '98

Hrrrm, I'm seeing 38.29.63.195 trying to telnet to every IP addr in one of my Exodus /24's... (around 4.30p EST) Anyone notice any similar behaviour?

4 3

Re: RBL quandry - opinions hereby solicited
by Mike Reno 17 Nov '98

17 Nov '98

Rodney, ISPs are businesses and have a right to protect their customer database. I don't think JC Penneys would want Sears to be able to grab their customer base and slam them with enticements to switch their alliance. While the sharks are swimming in these waters the ideal world you and I would like to see just simply won't exist. We must choose to either do whatever is necessary to protect our investment or take our chances. As most hosting providers leave the Organization information alone, anyone with a VALID reason to contact the owner of the domain could use snail mail or ask the information operator for the phone number. If the owner of the domain has his/her number unlisted .... guess they want to be left alone. NSI does use snail mail to send out invoices. It's not as if these precautionary steps being taken are resulting in any serious problems that will bring the world to an untimely demise. If the domain owner wants to move his domain, he can FAX an authorization to NSI on the Organization's letterhead. That is a very common practice as domain owners are not in the habit of updating their contact records which results in a failure to approve modifications based on 'Mail From'. Business is business. -=Mike Reno=- Hostmaster, EarthLink Network > >No. I think this is an extremely *bad* idea. I don't argue that the >issue of spam needs to be dealt with. But the registration of data like >email addresses and phone numbers is critical from an operational point >of view. These are needed when conatct has to be made because of an >operational failure. The purpose of whois data has become corrupt and >corrupted over the last couple of years, but we can't lose sight of it. > >If you can solve the problem of accurate contact data for operational >failures, fine. Until then, the data has to be accurate, and useful. Not >bogus. > >/rlj > >CenterGate Research LLC > >

3 2

RE: RBL quandry - opinions hereby solicited
by Mike Reno 17 Nov '98

17 Nov '98

WorldNIC will setup a domain without an email address using a bogus worldnic.com email address if the owner of the domain wishes to keep his email address private. This is a practice all registrars should consider. And, since WorldNIC is another face of NSI, it would seem that this practice is well within their acceptable guidelines. Some ISPs also hide the true phone number by using a phone line at their facilities. And others use Contact records that point to the ISP for Admin, Billing and Technical contacts on domains they register. These are very large registrars and they do get their domains registered without any hassles from NSI. Since snail mail is costly and not very cost effective, hiding the true data from NSI will reduce the SPAM the domain owner receives as most companies won't go the extra expense. WorldNIC is utilizing the database for marketing purposes which is something the old guard at NSI was totally against any ISP doing and in fact insisted on an agreement to those terms before giving us ftp passwords to pull down the .zone files. -=Mike Reno=- Hostmaster, EarthLink Network At 01:00 PM 11/16/98 -0500, you wrote: >No. That's not really a valid comparison. You have a choice about which >credit card company you deal with. Network Solutions is spamming you based >on information you are required to provide to them. If you refuse to >provide them with the info, you get no domain registration. Cute, eh? > >C > >Chris Mauritz >Director, Systems Administration >Rare Medium, Inc. >chrism(a)raremedium.com

4 5

RBL quandry - opinions hereby solicited
by Paul A Vixie 17 Nov '98

17 Nov '98

The RBL team and I are kind of wondering what to do about some spam we got. Because blackholing NSI would be of operational concern to a lot of you, I've decided to ponder this question out loud: ------- Forwarded Message Date: Wed, 11 Nov 1998 08:50:26 PST To: rbl(a)maps.vix.com Subject: Paul - value call on this Technically, this is an opt-out customer-relationship spam. I think it is a special case, because _there is no where else to go_. 208.226.58.70 should be RBL'ed, IMHO. Help me. > Return-Path: owner-admin1(a)LISTS.NETSOL.COM > Received: from pasteur.netsol.com ([208.226.58.70]) by ns2.galaxy-net.net > (8.8.7/8.6.9) with ESMTP id QAA00585; Tue, 10 Nov 1998 16:50:06 -0800 (PST) > Received: from pasteur (pasteur [208.226.58.70]) > by pasteur.netsol.com (8.9.1/8.9.1) with ESMTP id TAA23788; > Tue, 10 Nov 1998 19:40:31 -0500 (EST) > Received: from LISTS.NETSOL.COM by LISTS.NETSOL.COM (LISTSERV-TCP/IP release > 1.8c) with spool id 0342 for ADMIN1(a)LISTS.NETSOL.COM; Tue, 10 Nov > 1998 15:01:15 -0500 > Received: (from listmngr@localhost) by pasteur.netsol.com (8.9.1/8.9.1) id > PAA18548 for admin1(a)lists.netsol.com; Tue, 10 Nov 1998 15:01:14 > -0500 > (EST) > X-Mailer: ELM [version 2.4 PL25] > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > Message-ID: <199811102001.PAA18548(a)pasteur.netsol.com> > Date: Tue, 10 Nov 1998 15:01:14 -0500 > Reply-To: admin-remove(a)LISTS.NETSOL.COM > Sender: Owner-Admin <owner-admin(a)LISTS.NETSOL.COM> > From: List Manager Account <listmngr(a)LISTS.NETSOL.COM> > Subject: Network Solutions' E-Commerce Update > To: ADMIN1(a)LISTS.NETSOL.COM > Content-Type: text/plain; charset=US-ASCII > > ########################### > > Dear Customer, > > You are a valued customer and we want to help increase and > protect the value of your domain name. As a free added benefit of > your domain name registration, we would like to send you our > "E-Commerce Update" from time to time. In these updates, we will > try to identify helpful information and news that you can use to > enhance the value of your Web address. If you do not wish to > receive this newsletter in the future, simply respond to this > e-mail with the word "remove" in the first line of the message. > If you have any questions or comments, please send them to > hostmaster(a)internic.net. > > Network Solutions - the world's leading provider of domain name > services -- together with VeriSign -- the world's leading Web > security provider -- has published a new informative guide to > on-line security, "Securing Your Web Site for Business." > > "Securing Your Web Site for Business" outlines the options you > have to secure and protect your Web site. By downloading your > free copy (http://www.verisign.com/nsi/whitepaper) you will be > able to learn how easy it is to secure your site in order to > protect yourself and your customers. > > Issues covered in "Securing Your Web Site for Business" include: > > * Why on-line security problems could slow the growth of your > business > * How to maximize your on-line security at a low cost > * How to accept credit cards and sell products on-line---securely > * What a Digital ID is > * Why you need a Digital ID > * How to obtain a Digital ID for your Web site > > As an additional service to our customers, Network Solutions and > VeriSign bring you a special free trial version Secure Server ID. > VeriSign Secure Server IDs are the security solution currently > used by over 90 percent of Web sites conducting secure online > commerce and this free trial will allow you to experience how > easy Web site security can be. Please visit us at > http://www.verisign.com/nsi/trial to start experiencing the > benefits of on-line security today. > > We would also like to take this opportunity to remind you of the > importance of keeping your Network Solutions domain name records > up to date. Incorrect data can result in your next invoice being > delivered to the wrong location, and may cause delays when you > request other services such as a Secure Server Digital ID. To > review your domain name records and the associated information go > to http://www.internic.net/verisign/update.html. > > Thank you for being a Network Solutions customer. We look forward > to serving your future domain name needs. > > Sincerely, > > Doug Wolford > Senior Vice President ------- End of Forwarded Message

5 4

RE: Exodus: this is bad
by Chris Mauritz 17 Nov '98

17 Nov '98

I spose. We're running 8.1.2 so it just wastes disk space with all the logging going on. If I had more time, I'd chase the twits down, but it just isn't worth it. C -----Original Message----- From: Richard Irving To: Scott Lampert Cc: Adam Rothschild; nanog(a)merit.edu; list(a)inet-access.net Sent: 11/16/98 7:05 PM Subject: Re: Exodus: this is bad WOW, this is getting to be a plague...... I guess a *lot* of people will be brought to awareness of the need to update their BIND, and tighten the security on the DNS's.... Fast! Scott Lampert wrote: > > On Mon, Nov 16, 1998 at 05:30:39PM -0500, Adam Rothschild wrote: > > Hrrrm, I'm seeing 38.29.63.195 trying to telnet to every IP addr in one of > > my Exodus /24's... (around 4.30p EST) > > > > Anyone notice any similar behaviour? > > I'm seeing 207.15.190.170 probing snmp ports throughout a whole /22 here.. > > -- > +-----------------------+--------------------------------+ > | Scott Lampert | Systems Administrator | > | scott(a)ioa.com | Internet of Asheville | > |(828) 687-8848 Ext 310 | http://www.ioa.com | > +-----------------------+--------------------------------+

1 0

Re: Network Solutions on TV
by Dean Robb 17 Nov '98

17 Nov '98

At 10:03 11/16/98 -0800, you wrote: >> This actually raises an operational concern. A little >> traceroute will show you that www.networksolutions.com and >> the worldnic stuff are down the same pipes as the internic.net >> stuff. With the DNS problems of the past few days, one has >> to ask, would "internic" activities have worked just fine if >> Network Solutions had not been using some {small,large} amount >> of the bandwidth for their other commercial activities. >> >> Not that I hold out any hope of the two activities using >> separate facilities, but it would be nice. > >Such seperation is mandated by the latest Amendment to the Cooperative >Agreement between the U.S. Government and NSI. However it doesn't have to >occur for several months still. I'm afraid I can't find that provision in any amendment to the Cooperative Agreement as posted at http://rs.internic.net/nsf/agreement/. However, Amendment 11 (7 Oct 98) is interesting because it mandates that the specifications and milestones for the Shared Registry System be given to the USG by 1 Nov 98 and that all the data accrued by NSI in it's registration process be turned over to the USG by 7 Nov 98. Have these provisions been effected? Has the SRS been planned out yet? NSI? Spammers should be investigated by Ken Starr! Dean Robb PC-EASY computer services (757) 495-EASY [3279]

2 3