- NANOG - lists.nanog.org

RE: Network Abuse - Netblock x.x.x.x - IMPORTANT
by Martin, Christian 30 Jul '98

30 Jul '98

I guess the fella doesn't realize that smurfers monitor this group... And I thought it was dying down. :( -C -----Original Message----- From: Jay Stewart [mailto:cosmo@olywa.net] Sent: Thursday, July 30, 1998 1:28 PM To: jamie(a)ais.net Cc: nanog(a)merit.edu Subject: Re: Network Abuse - Netblock x.x.x.x - IMPORTANT -----Original Message----- From: James Rishaw <jamie(a)dilbert.ais.net> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT >A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. > > >-----Original Message----- >Sent: Thursday, July 30, 1998 7:36 AM >Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT > > >---------- >From: Andrew Shoemaker[SMTP:wrath@jerky.net] >Sent: Thursday, July 30, 1998 6:43 AM >Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT > >Hello > >My name is Andrew Shoemaker and I am the head security consultant at JNS. We >recently were the target of a denial of service attack that saturated our >Internet connection. This attack, known as a 'smurf' attack, uses unknowing >relays to source the at >tack. By relaying the attack through your network the attack is made >anonymous and increases in strength. This type of attack causes degraded >performance on both the attacked and relay networks and is the result of an >improperly configured router at you >r site. I urge you to fix your routers. If you are unable to do so, or do >not know how I suggest you call a security consultant. JNS is willing to >fix your router permanently for a one time fee of $100 US. If you are >interested in this deal please co >ntact me and I will send you a copy of our security contract and an invoice. > >Netblock de.le.te.d was found to produce 11 replys for each packet sent. >This means if the attacker is sending at T1 speeds the amount of your >bandwidth used in relaying > the attack is equivalent to 11 T1s > >regards, >Andrew Shoemaker >JNS Security >wrath(a)jerky.net >617.442.5408 Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98

1 0

FW: Network Abuse - Netblock x.x.x.x - IMPORTANT
by jamie＠dilbert.ais.net 30 Jul '98

30 Jul '98

A coworker's friend forwarded this to me.. kinda funny.. Kinda lame.. -----Original Message----- Sent: Thursday, July 30, 1998 7:36 AM Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT ---------- From: Andrew Shoemaker[SMTP:wrath@jerky.net] Sent: Thursday, July 30, 1998 6:43 AM Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT Hello My name is Andrew Shoemaker and I am the head security consultant at JNS. We recently were the target of a denial of service attack that saturated our Internet connection. This attack, known as a 'smurf' attack, uses unknowing relays to source the at tack. By relaying the attack through your network the attack is made anonymous and increases in strength. This type of attack causes degraded performance on both the attacked and relay networks and is the result of an improperly configured router at you r site. I urge you to fix your routers. If you are unable to do so, or do not know how I suggest you call a security consultant. JNS is willing to fix your router permanently for a one time fee of $100 US. If you are interested in this deal please co ntact me and I will send you a copy of our security contract and an invoice. Netblock de.le.te.d was found to produce 11 replys for each packet sent. This means if the attacker is sending at T1 speeds the amount of your bandwidth used in relaying the attack is equivalent to 11 T1s regards, Andrew Shoemaker JNS Security wrath(a)jerky.net 617.442.5408 -- jamie rishaw (dal/efnet:gavroche) American Information Systems, Inc. Tel:312.425.7140, FAX:312.425.7240 thirty thousand feet above the earth..youre a beautiful thing..

1 0

Re: vacation/auto-responders
by Joe Provo - Network Architect 30 Jul '98

30 Jul '98

> if you must use an auto-responder/vacation program, fix it to handle > mailing lists appropriately. It would help if merit put Precedence headers on messages. And yes, I've mailed the supposed-human address for nanog on this. Most vacation-handlers I know *always* skip 'bulk' or 'list' Precedence messages. Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Commercial Internet Services Group Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo(a)ultra.net>

1 0

vacation/auto-responders
by john heasley 29 Jul '98

29 Jul '98

up to five (and counting) responses from auto-responders stating that different folks are "out of the office". no one cares if you're out, permanently. if you must use an auto-responder/vacation program, fix it to handle mailing lists appropriately. > I am out of the office, returning on Monday August 3rd. I will be > checking my email off and on during my vacation, but if this message is > critical, please send email to !@$#@*

1 0

Re: MCI [encore]
by Sean Donelan 29 Jul '98

29 Jul '98

I'm going to have to get a new name/e-mail address, obviously the provider announcements aren't making it all the way down to the "S"'s. Many people forwarded copies of MCI's mail, but I still haven't received a copy directly from MCI yet. Several people sent me several different possible causes. - AOL mail routing/DNS was FUBAR for an indeterminate period - A power plant blew up, which then fried several POPS in the midwest - Two sets of Cisco router problems - Two 'major' providers reported backbone-wide problems - SMURFing was running higher than average yesterday Is anyone correlating this? Did the Internet roll the dice and they just came up snake-eyes yesterday? And this is during the Internet's "slow period" of August. Just wait until the September effect hits. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Warrants for email and backup tapes
by Karl Denninger 29 Jul '98

29 Jul '98

On Wed, Jul 29, 1998 at 04:10:07AM -0500, Phil Howard wrote: > Karl Denninger wrote... > > [regarding what William Allen Simpson wrote] > > > Talk to a lawyer who understands this. > > Most definitely. > > > > IN GENERAL - a state-based subpoena out of jurisdiction does not have to be > > complied with. HOWEVER, the issuer can then turn around and get it served > > out of your state (if they want to). > > > > Its a pain in the ass for them to do this, but they certainly CAN. > > > > If you have what's in the subpoena, and the subpoena is valid, you either > > comply or risk a contempt citation from the judge who signed it. You don't > > have to produce what you don't have, obviously (you can't invent things that > > don't exist!) > > > > You CAN fight a subpoena (and you might even be able to get it quashed). > > You really need a good attorney to look this situation over. > > I'm not a lawyer, so I can't specifically comment about law with competence, > but without it, my feeling here is that asking for backup tapes of e-mail is > no different than asking for copies of the e-mail itself. AND, my feeling > is that the e-mail box is effectively the property of the person or business > to whom it is delivered. It is not different, IMHO, than a court ordering > your mailman to go back to your home, retrieve the mail from the mailbox he > put it in (which you have not yet removed), open it, photocopy it, re-seal it, > put it back, and deliver the copies to the party specified in the order. Thus > it is also my opinion that for a court to properly order the contents of the > mail to be delivered to it, it must issue the subpoena naming the specific > person, persons, business, or businesses for which it wants the mail, and it > must deliver that subpoena to said parties first, ordering you to deliver only > upon failure of the mail owner's to comply with the order of the court. Any > less is a violation of the 4th Amendment of the United States (IMHO). Uh, no. The point of the 4th Amendment is that it protects against *warrantless* searches and seizures. Now you can *challenge the subpoena* on those grounds (that the warrant is improper according to the 4th Amendment). What you can't do is pocket-veto the subpoena. It is exceedingly dangerous to ignore a subpoena under ANY set of circumstances. The appropriate choices of action are to either comply with it or fight it, but you must NEVER ignore it. If you DO ignore it, you risk the judge who signed the subpoena issuing a bench warrant for your arrest on either civil or criminal contempt charges. The cute part about contempt of court is that you can be locked up for what basically amounts to an indefinite period (until you comply with the court's orders) or fined hideous amounts of money with essentially no recourse. As a rule of thumb, do not screw around with men and women in black robes behind a bench! If you don't have what they want you still have to respond. Let's say you get a subpoena for (A), (B) and (C). You have (A), but not (B) or (C). You produce (A), and for (B) and (C) you instead produce an affidavit which says that no responsive reply is possible as the materials and/or documents you have been asked for do not exist. Note that lying about (B) or (C) constitutes perjury, a felony, so don't do that! Subpoenas are no big deal. We get them with some regularity (probably two or three a year) around here. Usually it is the result of some investigation that is being done on either a civil or criminal matter where someone did something that another party or the government doesn't like (ie: forgery of a purchase order or check, etc). We're on a good enough basis with the local Federales that when they're going to send one of these over they usually call first asking for what they want; we point out that our policies and contract prohibit disclosing what they want, and they very politely say "thank you very much". An hour later a nice man appears with papers in hand, signed by a judge - at which point we give them exactly what they asked for. :-) I've yet to fight one that we've received at MCSNet, but if I felt there was good cause to do it, I would. Unless you have a contractual duty to your customers not to comply with a subpoena (not unheard of in a contract, but also unusual) you do NOT have to notify them that you were served or give them the opportunity to quash the subpoena. If you EVER get one of these and suspect, for any reason, that it is aimed at *you*, don't do a thing until you talk to a GOOD lawyer - and do that RIGHT AWAY. Most subpoenas have to be complied with or fought quickly - if you're lucky you have five business days. Sitting on it for any length of time is a very bad idea. The kind of thing being talked about here though, where someone wants copies of *backup tapes*, could easily be aimed at *YOU*. It also might not be though - generally, when you get one of these and its aimed at a third party, the reason for that kind of request is that in order to be admissible the records must be produced in the "ordinary course of business". Ergo, if a customer is doing something "bad", and they think you have a copy of it on a backup tape, they can't ask you to extract the contents of THEIR directory, because doing that is not an ordinary record - and further, it leads to questions about the custody and control of the information. Instead, they'll ask for the whole tape and have one of their forensics people dissect it to get the information they want. Note that, as others have noted, if the subpoena is from a grand jury, you won't be told much when you inquire as to what's going on (other than that it is from a grand jury). The reason is that grand jury proceedings are held in secret, and it is a crime to disclose the proceedings in the grand jury room until they are concluded. None of this is legal advice, since I ain't a lawyer :-) -- -- Karl Denninger (karl(a)MCS.Net)| MCSNet - Serving Chicagoland and Wisconsin http://www.mcs.net/ | T1's from $600 monthly / All Lines K56Flex/DOV | NEW! Corporate ISDN Prices dropped by up to 50%! Voice: [+1 312 803-MCS1 x219]| EXCLUSIVE NEW FEATURE ON ALL PERSONAL ACCOUNTS Fax: [+1 312 803-4929] | *SPAMBLOCK* Technology now included at no cost

1 0

Re: MCI [encore]
by Sean Donelan 29 Jul '98

29 Jul '98

>How did they do (measured by your mailbox) today? :-( Not a peep today. There does still seem to be some fall out from Monday's events, but I'm having difficulty correlating all of Tuesday's weirdness with Monday's. People may have been re-routing around MCI on monday, and the extra traffic overloaded other lines; the backlog (mail, news, etc) started flowing when MCI did a rolling BGP reset overnight and it took most of the day to clear up; everyone checking the Powerball lottery web sites for their lucky numbers; or something completely different. I didn't see any large 'outages' on Tuesday, but there did seem to be a higher level of variability in all types of service. I'm interested in hearing what some of the professional and academic Internet measurement projects showed. I looked from many different vantage points, but I'm always worried there may be something unusual my customer population. >No ETR today AFAIK... I'm still seeing some of my routes re-presented to >the vbns, et al Water, electrons, and ip packets all want to follow the path of least resistance. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Warrants for email and backup tapes
by William Allen Simpson 29 Jul '98

29 Jul '98

Our ISP was just served a warrant (out of California) demanding our dialup logs and email backup tapes. So far, the warrant is probably invalid, as it mis-named the company. And as far as we can tell, we are not being charged with anything -- or at least we have not been told so. We only have our usual contracts attorney, and he seems a bit out of his depth. This is pretty invasive to our customers. We'll have a dickens of a time complying, as we don't back up client email, except at odd intervals backing up entire systems. And we only keep dialing logs around for a few months at a time, since we don't use them for billing. Is anyone else having this experience? If so, what have you done? WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

5 4

Re: MCI [encore]
by Joe Provo - Network Architect 28 Jul '98

28 Jul '98

Sean Donelan sez: >Not too bad. NANOG outage reporting beat MCI informing customers >by 52 minutes. All times measured at my mailbox :-) MCI did better >than most providers do. Although there was still a rather lengthy >delay between the start of the outage and the first responses to >customers. How did they do (measured by your mailbox) today? :-( No ETR today AFAIK... I'm still seeing some of my routes re-presented to the vbns, et al Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Commercial Internet Services Group Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo(a)ultra.net>

1 0

Re: MCI
by Sean Donelan 28 Jul '98

28 Jul '98

Not too bad. NANOG outage reporting beat MCI informing customers by 52 minutes. All times measured at my mailbox :-) MCI did better than most providers do. Although there was still a rather lengthy delay between the start of the outage and the first responses to customers. Overall a pretty crudy day for the Internet, but no reports on CNN which I saw. I guess that means it was a successful day. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0