November 1998 - Test - lists.nanog.org

RBL quandry - opinions hereby solicited
by Paul A Vixie 17 Nov '98

17 Nov '98

The RBL team and I are kind of wondering what to do about some spam we got. Because blackholing NSI would be of operational concern to a lot of you, I've decided to ponder this question out loud: ------- Forwarded Message Date: Wed, 11 Nov 1998 08:50:26 PST To: rbl(a)maps.vix.com Subject: Paul - value call on this Technically, this is an opt-out customer-relationship spam. I think it is a special case, because _there is no where else to go_. 208.226.58.70 should be RBL'ed, IMHO. Help me. > Return-Path: owner-admin1(a)LISTS.NETSOL.COM > Received: from pasteur.netsol.com ([208.226.58.70]) by ns2.galaxy-net.net > (8.8.7/8.6.9) with ESMTP id QAA00585; Tue, 10 Nov 1998 16:50:06 -0800 (PST) > Received: from pasteur (pasteur [208.226.58.70]) > by pasteur.netsol.com (8.9.1/8.9.1) with ESMTP id TAA23788; > Tue, 10 Nov 1998 19:40:31 -0500 (EST) > Received: from LISTS.NETSOL.COM by LISTS.NETSOL.COM (LISTSERV-TCP/IP release > 1.8c) with spool id 0342 for ADMIN1(a)LISTS.NETSOL.COM; Tue, 10 Nov > 1998 15:01:15 -0500 > Received: (from listmngr@localhost) by pasteur.netsol.com (8.9.1/8.9.1) id > PAA18548 for admin1(a)lists.netsol.com; Tue, 10 Nov 1998 15:01:14 > -0500 > (EST) > X-Mailer: ELM [version 2.4 PL25] > MIME-Version: 1.0 > Content-Transfer-Encoding: 7bit > Message-ID: <199811102001.PAA18548(a)pasteur.netsol.com> > Date: Tue, 10 Nov 1998 15:01:14 -0500 > Reply-To: admin-remove(a)LISTS.NETSOL.COM > Sender: Owner-Admin <owner-admin(a)LISTS.NETSOL.COM> > From: List Manager Account <listmngr(a)LISTS.NETSOL.COM> > Subject: Network Solutions' E-Commerce Update > To: ADMIN1(a)LISTS.NETSOL.COM > Content-Type: text/plain; charset=US-ASCII > > ########################### > > Dear Customer, > > You are a valued customer and we want to help increase and > protect the value of your domain name. As a free added benefit of > your domain name registration, we would like to send you our > "E-Commerce Update" from time to time. In these updates, we will > try to identify helpful information and news that you can use to > enhance the value of your Web address. If you do not wish to > receive this newsletter in the future, simply respond to this > e-mail with the word "remove" in the first line of the message. > If you have any questions or comments, please send them to > hostmaster(a)internic.net. > > Network Solutions - the world's leading provider of domain name > services -- together with VeriSign -- the world's leading Web > security provider -- has published a new informative guide to > on-line security, "Securing Your Web Site for Business." > > "Securing Your Web Site for Business" outlines the options you > have to secure and protect your Web site. By downloading your > free copy (http://www.verisign.com/nsi/whitepaper) you will be > able to learn how easy it is to secure your site in order to > protect yourself and your customers. > > Issues covered in "Securing Your Web Site for Business" include: > > * Why on-line security problems could slow the growth of your > business > * How to maximize your on-line security at a low cost > * How to accept credit cards and sell products on-line---securely > * What a Digital ID is > * Why you need a Digital ID > * How to obtain a Digital ID for your Web site > > As an additional service to our customers, Network Solutions and > VeriSign bring you a special free trial version Secure Server ID. > VeriSign Secure Server IDs are the security solution currently > used by over 90 percent of Web sites conducting secure online > commerce and this free trial will allow you to experience how > easy Web site security can be. Please visit us at > http://www.verisign.com/nsi/trial to start experiencing the > benefits of on-line security today. > > We would also like to take this opportunity to remind you of the > importance of keeping your Network Solutions domain name records > up to date. Incorrect data can result in your next invoice being > delivered to the wrong location, and may cause delays when you > request other services such as a Secure Server Digital ID. To > review your domain name records and the associated information go > to http://www.internic.net/verisign/update.html. > > Thank you for being a Network Solutions customer. We look forward > to serving your future domain name needs. > > Sincerely, > > Doug Wolford > Senior Vice President ------- End of Forwarded Message

5 4

RE: Exodus: this is bad
by Chris Mauritz 17 Nov '98

17 Nov '98

I spose. We're running 8.1.2 so it just wastes disk space with all the logging going on. If I had more time, I'd chase the twits down, but it just isn't worth it. C -----Original Message----- From: Richard Irving To: Scott Lampert Cc: Adam Rothschild; nanog(a)merit.edu; list(a)inet-access.net Sent: 11/16/98 7:05 PM Subject: Re: Exodus: this is bad WOW, this is getting to be a plague...... I guess a *lot* of people will be brought to awareness of the need to update their BIND, and tighten the security on the DNS's.... Fast! Scott Lampert wrote: > > On Mon, Nov 16, 1998 at 05:30:39PM -0500, Adam Rothschild wrote: > > Hrrrm, I'm seeing 38.29.63.195 trying to telnet to every IP addr in one of > > my Exodus /24's... (around 4.30p EST) > > > > Anyone notice any similar behaviour? > > I'm seeing 207.15.190.170 probing snmp ports throughout a whole /22 here.. > > -- > +-----------------------+--------------------------------+ > | Scott Lampert | Systems Administrator | > | scott(a)ioa.com | Internet of Asheville | > |(828) 687-8848 Ext 310 | http://www.ioa.com | > +-----------------------+--------------------------------+

1 0

Re: Network Solutions on TV
by Dean Robb 17 Nov '98

17 Nov '98

At 10:03 11/16/98 -0800, you wrote: >> This actually raises an operational concern. A little >> traceroute will show you that www.networksolutions.com and >> the worldnic stuff are down the same pipes as the internic.net >> stuff. With the DNS problems of the past few days, one has >> to ask, would "internic" activities have worked just fine if >> Network Solutions had not been using some {small,large} amount >> of the bandwidth for their other commercial activities. >> >> Not that I hold out any hope of the two activities using >> separate facilities, but it would be nice. > >Such seperation is mandated by the latest Amendment to the Cooperative >Agreement between the U.S. Government and NSI. However it doesn't have to >occur for several months still. I'm afraid I can't find that provision in any amendment to the Cooperative Agreement as posted at http://rs.internic.net/nsf/agreement/. However, Amendment 11 (7 Oct 98) is interesting because it mandates that the specifications and milestones for the Shared Registry System be given to the USG by 1 Nov 98 and that all the data accrued by NSI in it's registration process be turned over to the USG by 7 Nov 98. Have these provisions been effected? Has the SRS been planned out yet? NSI? Spammers should be investigated by Ken Starr! Dean Robb PC-EASY computer services (757) 495-EASY [3279]

2 3

Re: RBL quandry - opinions hereby solicited
by Dan Maus 17 Nov '98

17 Nov '98

> From errors-nohumans(a)merit.edu Mon Nov 16 03:34 MST 1998 > To: nanog(a)merit.edu > Subject: RBL quandry - opinions hereby solicited > Date: Mon, 16 Nov 1998 02:17:36 -0800 > From: Paul A Vixie <paul(a)vix.com> I fully support you if you decide to blackhole Network Solutions. I also support the revocation of their NSF contract for improper use of the domain contact information entrusted to them. This is another round from them, we got several copies of a hostmaster $1000 seminar spam from them a couple of months ago. I despise all spam, especially the scum eminating from Network Solutions, It's time for somebody to take out the trash. NSI needs to be fired for abusing our resources, in my opinion. If they don't have enough bandwidth to handle whois requests and TLD zone transfers to root-servers.net then they sure as hell don't have enough bandwidth to be spamming us at our expense. Off with their head. Dan > The RBL team and I are kind of wondering what to do about some spam we got. > Because blackholing NSI would be of operational concern to a lot of you, I've > decided to ponder this question out loud: > > ------- Forwarded Message > > Date: Wed, 11 Nov 1998 08:50:26 PST > To: rbl(a)maps.vix.com > Subject: Paul - value call on this > > Technically, this is an opt-out customer-relationship spam. > > I think it is a special case, because _there is no where else to go_. > > 208.226.58.70 should be RBL'ed, IMHO. Help me. > > > Return-Path: owner-admin1(a)LISTS.NETSOL.COM > > Received: from pasteur.netsol.com ([208.226.58.70]) by ns2.galaxy-net.net > > (8.8.7/8.6.9) with ESMTP id QAA00585; Tue, 10 Nov 1998 16:50:06 -0800 (PST) > > Received: from pasteur (pasteur [208.226.58.70]) > > by pasteur.netsol.com (8.9.1/8.9.1) with ESMTP id TAA23788; > > Tue, 10 Nov 1998 19:40:31 -0500 (EST) > > Received: from LISTS.NETSOL.COM by LISTS.NETSOL.COM (LISTSERV-TCP/IP release > > 1.8c) with spool id 0342 for ADMIN1(a)LISTS.NETSOL.COM; Tue, 10 Nov > > 1998 15:01:15 -0500 > > Received: (from listmngr@localhost) by pasteur.netsol.com (8.9.1/8.9.1) id > > PAA18548 for admin1(a)lists.netsol.com; Tue, 10 Nov 1998 15:01:14 > > -0500 > > (EST) > > X-Mailer: ELM [version 2.4 PL25] > > MIME-Version: 1.0 > > Content-Transfer-Encoding: 7bit > > Message-ID: <199811102001.PAA18548(a)pasteur.netsol.com> > > Date: Tue, 10 Nov 1998 15:01:14 -0500 > > Reply-To: admin-remove(a)LISTS.NETSOL.COM > > Sender: Owner-Admin <owner-admin(a)LISTS.NETSOL.COM> > > From: List Manager Account <listmngr(a)LISTS.NETSOL.COM> > > Subject: Network Solutions' E-Commerce Update > > To: ADMIN1(a)LISTS.NETSOL.COM > > Content-Type: text/plain; charset=US-ASCII > > > > ########################### > > > > Dear Customer, > > > > You are a valued customer and we want to help increase and > > protect the value of your domain name. As a free added benefit of > > your domain name registration, we would like to send you our > > "E-Commerce Update" from time to time. In these updates, we will > > try to identify helpful information and news that you can use to > > enhance the value of your Web address. If you do not wish to > > receive this newsletter in the future, simply respond to this > > e-mail with the word "remove" in the first line of the message. > > If you have any questions or comments, please send them to > > hostmaster(a)internic.net. > > > > Network Solutions - the world's leading provider of domain name > > services -- together with VeriSign -- the world's leading Web > > security provider -- has published a new informative guide to > > on-line security, "Securing Your Web Site for Business." > > > > "Securing Your Web Site for Business" outlines the options you > > have to secure and protect your Web site. By downloading your > > free copy (http://www.verisign.com/nsi/whitepaper) you will be > > able to learn how easy it is to secure your site in order to > > protect yourself and your customers. > > > > Issues covered in "Securing Your Web Site for Business" include: > > > > * Why on-line security problems could slow the growth of your > > business > > * How to maximize your on-line security at a low cost > > * How to accept credit cards and sell products on-line---securely > > * What a Digital ID is > > * Why you need a Digital ID > > * How to obtain a Digital ID for your Web site > > > > As an additional service to our customers, Network Solutions and > > VeriSign bring you a special free trial version Secure Server ID. > > VeriSign Secure Server IDs are the security solution currently > > used by over 90 percent of Web sites conducting secure online > > commerce and this free trial will allow you to experience how > > easy Web site security can be. Please visit us at > > http://www.verisign.com/nsi/trial to start experiencing the > > benefits of on-line security today. > > > > We would also like to take this opportunity to remind you of the > > importance of keeping your Network Solutions domain name records > > up to date. Incorrect data can result in your next invoice being > > delivered to the wrong location, and may cause delays when you > > request other services such as a Secure Server Digital ID. To > > review your domain name records and the associated information go > > to http://www.internic.net/verisign/update.html. > > > > Thank you for being a Network Solutions customer. We look forward > > to serving your future domain name needs. > > > > Sincerely, > > > > Doug Wolford > > Senior Vice President > > ------- End of Forwarded Message >

3 2

clue phone
by Janis Purl 17 Nov '98

17 Nov '98

TTSG and nanog: Excuse our non response to the hacking problems over the weekend. We have just gone to a central response system and have had a bunch of completely new people staffing it over the weekend. We will take steps to have the clue phone installed in that center and also have encouraged the staff to not just give random answers when called. They will now respond that they don't know if they really don't know the answer and will find someone who can answer the question. Now to respond to the attack issue. Exodus leases IP space to various customers, many of whom in turn have customers. One of our customers had their name server hacked and that machine was attacking everything else in sight. When one of the engineering staff found out the attack was in progress, we took the name server off the network and contacted the Sys. Adm. That took place Sunday evening. The system has been cleaned up and is now back in operation. We are looking to see if anything else comes from that customer. An aside: We don't filter in the routers as a rule because our Backbone engineering group is concerned about router performance. We go to the source to attempt to stop problems and not just filter the packets. Sincerely, Janis Purl, Abuse Manager and Leroy Lacy, Director of Security Exodus Communications

1 0

Re: National Infrastructure Protection Center
by Bill Woodcock 17 Nov '98

17 Nov '98

Ah, but at least they're kind enough to warn you, right next to their mailto link, that they don't respond to email. :-) -Bill

1 0

Another origin IP
by Richard Irving 17 Nov '98

17 Nov '98

209.119.115.65 telnetd a mile a minute....... to our DNS. Check yours !

2 1

Re: RBL quandry - opinions hereby solicited
by Dean Anderson 16 Nov '98

16 Nov '98

>>> Technically, this is an opt-out customer-relationship spam. >>> >>> I think it is a special case, because _there is no where else to go_. Uhh, aside from the other issues, there are actually other registries you can use. You don't _have to_ use NSI. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

RE: Exodus / Clue problems
by John Fraizer 16 Nov '98

16 Nov '98

Why on earth would anyone let any of the following networks in to their network at the border? 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Hell, for that matter, I block anything claiming to be from our networks as well. There's no way they'll be originating from the outside unless it's spoofed. Nothing and I mean NOTHING claiming to be from any of them at your border is valid. At 09:36 PM 11/15/98 -0500, Adam Rothschild wrote: >On Sun, 15 Nov 1998, Dave Van Allen wrote: > >> Same here, dozens of times in a few seconds just now, to all listed >> nameservers... I can't imagine what "process" could do this >> unintentionally. Exodus??? You home? > >Interesting you mention this. I've noticed the following on a FreeBSD >2.2.6 box, running BIND 8.1.2... > >server# netstat >Active Internet connections >Proto Recv-Q Send-Q Local Address Foreign Address (state) >tcp 0 0 server.4375 172.16.1.1.1984 >SYN_SENT >tcp 0 0 server.ftp server.4374 >TIME_WAIT > >Internal addr space... port 1984.. cute. > > > ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

5 4

Re: Hold on to your news servers
by Scott Gifford 16 Nov '98

16 Nov '98

>> I think a lot of people hope you are reconsidering your plans to do this. >> It's a nice idea, and your motivation is good. It just won't work in >> practice. So, in my nicest and most appreciative tone, I would like to ask >> you on behalf of myself and many people who are also appreciative of your >> efforts and your motives to reconsider and abandon this plan. > >I'd be happy to abandon it if something that accomplishes the same job, or >substantially the same job, shows up before it goes online. Have you considered using NoCeM's to do this? This would be much more opt-in, as somebody would have to specifically configure NoCeM to accept your key. It is also much more efficient than cancels, at least propogation-wise. Just a thought from a news administrator who doesn't want to be processing 300,000+ cancels a day all of a sudden, -------Scott.

1 0