March 2004 - Test - lists.nanog.org

Re: Packet Kiddies Invade NANOG
by John Harold 15 Mar '04

15 Mar '04

Yes, Gregory Taylor aka "OseK" is a perfect gentlemen now. Here are logs from Feb 4th 2004 showing him being a perfect gentlemen... (08:35:45) <#sigdie!OseK_> :[NEMESIS] Nodes are attacking 212.242.41.0/24 on port 666 for 60 seconds using spoofed TCP RESET Packets ... (08:36:04) <#sigdie!OseK_> doesn't help the port 666 tho :( (08:36:31) <#sigdie!OseK_> you prolly have a much larger dosnet than me tho (08:36:34) <#sigdie!OseK_> i only have 500 nodes (08:38:55) <#sigdie!OseK_> you dropped it (08:38:58) <#sigdie!OseK_> so it cant take ICMP (08:39:00) <#sigdie!OseK_> what'd you hit? (08:39:18) <#sigdie!p> .17 (08:39:54) <#sigdie!OseK_> down (08:39:55) <#sigdie!OseK_> i got it (08:39:56) <#sigdie!OseK_> :) (08:40:03) <#sigdie!p> let me try by myself ! (08:40:07) <#sigdie!p> no (08:40:07) <#sigdie!p> its up (08:40:08) <#sigdie!OseK_> hold (08:40:10) <#sigdie!OseK_> wait 60 seconds (08:40:15) <#sigdie!OseK_> ah (08:40:16) <#sigdie!OseK_> wtf (08:40:20) <#sigdie!OseK_> i only dropped one box? (08:40:29) <#sigdie!OseK_> cuz it wouldn't respond for a second there (08:40:44) <#sigdie!OseK_> i wanna fucking drop banetele (08:40:49) <#sigdie!p> well (08:40:50) <#sigdie!p> my turn (08:40:51) <#sigdie!OseK_> cuz those fags are the ones that put that page up on there (08:40:55) <#sigdie!OvEr_LoAD> lol lets do it (08:41:05) <#sigdie!p> OK (08:41:06) <#sigdie!p> wach (08:41:08) <#sigdie!p> watch (08:41:13) <#sigdie!p> is everyone watching (08:41:18) <#sigdie!OseK_> yeah (08:41:28) <#sigdie!OseK_> pwned (08:41:31) <#sigdie!OseK_> p- (08:41:32) <#sigdie!OseK_> u (08:41:34) <#sigdie!p> no i didnt even do anything (08:41:35) <#sigdie!OseK_> pwn (08:41:36) <#sigdie!p> :P (08:41:38) <#sigdie!OseK_> wtf (08:41:44) <#sigdie!OseK_> why are they all fucked now (08:41:48) <#sigdie!p> they arent.. (08:42:01) <#sigdie!p> unless youre talking about 212.242.41.35 (08:42:05) <#sigdie!p> im flooding its httpd (08:42:28) <#sigdie!p> ok ok (08:42:29) <#sigdie!p> watch (08:42:57) <#sigdie!p> bewm (08:43:00) <#sigdie!OseK_> ok (08:43:02) <#sigdie!OseK_> dammit (08:43:05) <#sigdie!OseK_> you hit it right when i do (08:43:07) <#sigdie!p> it doesnt like ICMP (08:43:07) <#sigdie!OseK_> i can never tell (08:43:10) <#sigdie!OseK_> if my shit is working (08:43:22) <#sigdie!OseK_> :) (08:43:33) <#sigdie!OseK_> its up (08:43:44) <#sigdie!p> i only did 50 seconds (08:44:06) <#sigdie!OseK_> hrm (08:44:20) <#sigdie!p> 212.242.41.17 no like the icmp (08:45:19) <#sigdie!OseK_> ok (08:45:23) <#sigdie!OseK_> imma go play with banetele (08:48:02) <#sigdie!OseK_> i just collapsed banetele's BGP announcement (08:48:09) <#sigdie!OseK_> but that doesn't help (08:48:13) <#sigdie!OseK_> cuz they're not gonna split (08:48:43) <#sigdie!p> i dunno banetele looks dead (08:48:48) <#sigdie!p> or maybe im just lagging (08:49:00) <#sigdie!OseK_> ... BitchX: Sent server ping to [irc.banetele.no] (08:49:00) <#sigdie!OseK_> ... Server pong from irc.banetele.no 0.8224 seconds (08:49:12) <#sigdie!p> bash-2.05a$ telnetirc.banetele.no 6667 (08:49:13) <#sigdie!p> Trying 213.239.111.2... (08:49:16) <#sigdie!OseK_> thats cuz I collapsed their BGP announcement by nailing their router head on(08:49:26) <#sigdie!OseK_> but they have a secondary route to efnet (08:49:30) <#sigdie!_mre|42o> BGP announcement? (08:49:31) <#sigdie!OseK_> thru their multihomed connection (08:49:32) <#sigdie!OseK_> yeah (08:49:37) <#sigdie!OseK_> they have a collapsable route (08:49:44) <#sigdie!OseK_> using the border gateway protocl (08:49:54) <#sigdie!OseK_> hey have to announce to a pool (08:49:58) <#sigdie!OseK_> in order to establish their route (08:50:07) <#sigdie!OseK_> but if thye get hit enough their router drops the announcements (08:50:10) <#sigdie!OseK_> and they lose their routes (08:50:14) <#sigdie!OseK_> its wierd (08:50:21) <#sigdie!OseK_> i dont quite understand how it works myself (08:50:33) <#sigdie!OseK_> its something you only find UU net and IRC servers doing (08:50:34) <#sigdie!OseK_> hehe (08:51:19) <#sigdie!OseK_> they should recover now (08:51:21) <#sigdie!OseK_> any time (08:53:30) <#sigdie!OseK_> damn (08:48:02) <#sigdie!OseK_> i just collapse (08:48:09) <#sigdie!OseK_> but that doesn't help (08:48:13) <#sigdie!OseK_> cuz they're not gonna split (08:48:43) <#sigdie!p> i dunno banetele looks dead (08:48:48) <#sigdie!p> or maybe im just lagging (08:49:00) <#sigdie!OseK_> ... BitchX: Sent server ping to [irc.banetele.no] (08:49:00) <#sigdie!OseK_> ... Server pong from irc.banetele.no 0.8224 seconds (08:49:12) <#sigdie!p> bash-2.05a$ telnet irc.banetele.no 6667 (08:49:13) <#sigdie!p> Trying 213.239.111.2... (08:49:16) <#sigdie!OseK_> thats cuz I collapsed their BGP announcement by nailing their router head on (08:49:26) <#sigdie!OseK_> but they have a secondary route to efnet (08:49:30) <#sigdie!_mre|42o> BGP announcement? (08:49:31) <#sigdie!OseK_> thru their multihomed connection (08:49:32) <#sigdie!OseK_> yeah (08:49:37) <#sigdie!OseK_> they have a collapsable route (08:49:44) <#sigdie!OseK_> using the border gateway protocl (08:49:54) <#sigdie!OseK_> hey have to announce to a pool (08:49:58) <#sigdie!OseK_> in order to establish their route (08:50:07) <#sigdie!OseK_> but if thye get hit enough their router drops the announcements (08:50:10) <#sigdie!OseK_> and they lose their routes (08:50:14) <#sigdie!OseK_> its wierd (08:50:21) <#sigdie!OseK_> i dont quite understand how it works myself (08:50:33) <#sigdie!OseK_> its something you only find UU net and IRC servers doing (08:50:34) <#sigdie!OseK_> hehe (08:51:19) <#sigdie!OseK_> they should recover now (08:51:21) <#sigdie!OseK_> any time (08:53:30) <#sigdie!OseK_> damn (08:53:34) <#sigdie!OseK_> banetele's getting nailed hard (08:53:52) <#sigdie!OseK_> i didnt realize their ircd is using the same core router as their web page (08:53:53) <#sigdie!p> and its still linked to efnet fine (08:55:23) <#sigdie!OseK_> yeah (08:55:26) <#sigdie!OseK_> they have a second link (08:55:28) <#sigdie!OseK_> to the hub (08:55:32) <#sigdie!OseK_> thru another line (08:55:36) <#sigdie!p> anyone wanna read something funny? (08:55:38) <#sigdie!OseK_> its almost a requirement on efnet anymore (08:55:40) <#sigdie!OseK_> sure (08:55:45) <#sigdie!p> http://news.com.au/common/story_page/0,4057,8579692%5E13762,00.html (08:55:51) <#sigdie!OseK_> <p-> http://news.com.au/common/story_page/0,4057,8579692%5E13762,00.html (08:55:56) <#sigdie!OseK_> god damn it (08:56:02) <#sigdie!OseK_> i was only trying to copy the url (08:56:04) <#sigdie!p> one exerpt from it (08:56:05) <#sigdie!p> i will show (08:56:10) <#sigdie!p> "He told police he noticed a brown female stray dog wagging its tail and "acting sexy" and pulled it into some tall grass by the roadside." (08:56:22) <#sigdie!OseK_> OMG (08:57:27) <#sigdie!gh0tzt> have you guys seen those movie commercials for anti piracy? (08:57:34) <#sigdie!p> yes (08:57:43) <#sigdie!gh0tzt> where the guy is like "I'm just a poor stunt double trying to make it, and when people click a few times blahblahblah" (08:58:01) <#sigdie!p> get a better job (08:58:02) <#sigdie!p> fuck face (08:58:38) <#sigdie!gh0tzt> I wish they'd make a pro-piracy commercial. have some kid sitting next to a computer like "I'm just a poor college student on loans, and when cd prices rise to $21 from $13.50 and I don't have a car..." (08:58:47) <#sigdie!p> pepsi has a pro piracy (08:58:52) <#sigdie!p> i sa it during the super bowl (08:58:54) <#sigdie!p> it said (08:58:59) <#sigdie!gh0tzt> really? (08:59:02) <#sigdie!p> 'we are the youth' (08:59:02) <#sigdie!gh0tzt> how'd it say that (08:59:09) <#sigdie!p> 'and we're gonna keep downloading music' (08:59:16) <#sigdie!p> 'you cant stop us' (08:59:23) <#sigdie!OseK_> 208.173.218.94 <-- p, want some fun? (08:59:36) <#sigdie!OseK_> one of the (hidden) routers on banetele's BGP pool :) It's a good thing for us that he's a white hat now! Greg the packet kiddie OseK Wrote: Matthew (yes I know it is you), The personal information you have posted regarding my phone number is me. However, the slanderous material and obvious hate/flame statements you made against me are absolutely false. I have not attacked any Internet Service Provider or IRC server in several years. I am and have been retired from the underground for a long while now, despite the constant comments made to the contrary by people who do not represent me in any manner. I admit publically to everyone who may read this posting, that I have made some very stupid decisions in the past and I had hurt alot of people in the process. Despite my attempts to justify my actions, the fact is two wrongs do not make a right. XWB is my dad's personal sole propietership. Not once has anyone involved with XWB ever attempted to represent that business as anything more than a Sole propietership that does web development work for non-profit organizations and small businesses. My father works very hard and your attempt at attacking his character was uncalled for and unnecessary. I do not know what your problem with me is, Matthew, but whatever they are, you need to leave them off of NANOG and the phone calls to my house are not appreciated either. I hope you realize that posting personal information about people, such as phone numbers, addresses, and any other such stuff to a public forum without the consent of the person to whom that information belongs to, is illegal. It is a felony in fact. Your unfounded truthless statements about myself and my father's business are a felony as well and if I wanted to take action, could end in a civil lawsuit against you for libel and slander. Will I take that approach? Probably not, mostly because the people on this list, minus certain people, are for the most part mature, intelligent adults who do not care to take part in flame wars, nor do they listen to slanderous statements made by someone who obviously has some kind of jealousy towards someone to the point that he has to make public unprovoked attacks against that person's character. The people who matter on this list will most likely ignore this thread and what not. Good luck in whatever future endeavor you may take. And this is my only and last response to this thread. Greg _________________________________________________________________ One-click access to Hotmail from any Web page download MSN Toolbar now! http://clk.atdmt.com/AVE/go/onm00200413ave/direct/01/

7 6

Fw: Packet Kiddies Invade NANOG
by Joshua Brady 15 Mar '04

15 Mar '04

----- Original Message ----- From: "Joshua Brady" <jbrady(a)neoins.com> To: <albertpublic(a)hushmail.com> Sent: Sunday, March 14, 2004 6:44 PM Subject: Re: Packet Kiddies Invade NANOG > <rant> > > > > Greg, > > > > Let me spell it out crystal clear so you can understand. Are you, or > > are you not, the Gregory > > Taylor referenced in the URL's I sent below? > > Even if he is, what you did and said was slanderous, beyond a normal NANOG > flamewar. > > > Albert P. > > (signing his real name so Susan won't remove him from the list) > > Oh please do Susan what he did was already illegal. > > > > "Albert P." > > </rant> > > Can you take this off-list so we don't have to hear a play school convo? > > Thanks, > > Josh >

2 3

Will your cisco have the FBI's IOS?
by David Lesher 15 Mar '04

15 Mar '04

X-URL: http://www.washingtonpost.com/ac2/wp-dyn/A54512-2004Mar12?language=printer Easier Internet Wiretaps Sought Justice Dept., FBI Want Consumers To Pay the Cost By Dan Eggen and Jonathan Krim Washington Post Staff Writers Saturday, March 13, 2004; Page A01 The Justice Department wants to significantly expand the government's ability to monitor online traffic, proposing that providers of high-speed Internet service should be forced to grant easier access for FBI wiretaps and other electronic surveillance, according to documents and government officials. A petition filed this week with the Federal Communications Commission also suggests that consumers should be required to foot the bill. {meaning guess who does their work?} .... Justice Department lawyers argue in a 75-page FCC petition that Internet broadband and online telephone providers should be treated the same as traditional telephone companies, which are required by law to provide access for wiretaps and other monitoring of voice communications. The law enforcement agencies complain that many providers do not comply with existing wiretap rules and that rapidly changing technology is limiting the government's ability to track terrorists and other threats. They are asking the FCC to curtail its usual review process to rapidly implement the proposed changes. The FBI views the petition as narrowly crafted and aimed only at making sure that terrorist and criminal suspects are not able to evade monitoring because of the type of telephone communications they use, according to a federal law enforcement official who spoke on the condition of anonymity. {......} {It sounds to me like this means: Tear out backbone Move MAE-East, West and whatever into the Jill Edgar Hoover Building. Pay them rent for the Colo space... YMMV} -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

8 11

Counter DoS
by Joshua Brady 15 Mar '04

15 Mar '04

http://news.zdnet.co.uk/internet/security/0,39020375,39148215,00.htm Comments?

22 39

Re: Platinum accounts for the Internet (was Re: who offers cheap (personal) 1U colo?)
by Dr. Jeffrey Race 15 Mar '04

15 Mar '04

On Mon, 15 Mar 2004 04:57:03 -0500 (EST), Sean Donelan wrote: > NANOG has less than 500 attendees, >yet has about the same number as infected computers as any other >ad-hoc network population. If true this is a very significant fact

1 0

RE: who offers cheap (personal) 1U colo?
by Michael.Dillon＠radianz.com 15 Mar '04

15 Mar '04

>For most people it'd probably make much more sense to find a provider that >offers some form of SMTP relay service. It'd probably be cheaper/month, >and they wouldn't have the trouble and expense of providing/maintaining >a colo server. Yep, if you aren't technically inclined that is better. >What if the cost were only $10/month and they didn't have to maintain >anything other than a set of usernames/passwds (SMTP Auth) or perhaps a >list of their own IPs (relaying based on IP)? It's starting to sound like a nice little business for a college senior to set up using one of the colo providers from Paul's list. It would be a lot more palatable for large providers to crack down on unauthenticated SMTP if there were such alternatives available. Then instead of cracking down on users they would be supporting new small businesses. I imagine there are a lot of people doing this already but we just don't see it because they don't have a catchy name for themselves like "ISP". --Michael Dillon

1 0

Re: who offers cheap (personal) 1U colo?
by Bohdan Tashchuk 15 Mar '04

15 Mar '04

> $50/month at 40U rentable is $2000/rack/month if it's full. > after paying for 60A of power and 50Mbits/sec of transit > and whatever the rack rents for, the provider's gross margin > will be between 25% and 50%, out of which they have to pay > salaries. as a standalone business this makes no sense, but > at scale or as part of another business, $50/month @1U is > just about right. I've only seen a few comments on the business aspect of this, so I'd like to throw my two cents in. Given: at least certain Linux distributions are free to copy Given: the various BSD distributions are all free to copy Given: vmware workstation is a relatively low-cost product Given: Linux and BSD run in virtual machines on Vmware on Linux Question: Why can't a provider sell virtual PC colocation, instead of physical PC colocation? So instead of 40 physical machines per rack, why can't it be 80 or 160 or even more virtual machines, running on 40 physical Linux boxes? I think the economics could shift significantly under those circumstances. For personal colo the virtual CPU would probably be idle at least 99% of the time. My home servers usually are. Which means that when hosting 4 typical virtual machines a real CPU would still be mostly idling. Also a small IDE drive now is about 120 GB. Divide that by 4 and each colo still has 30 GB of disk space, more than enough for most needs. The hardware cost per "machine" certainly goes down, and other than the vmware licenses the OS software is "free", either BSD licensed free or GPL licensed "free". Either is good enough for this purpose. Is some hosting company already doing this?

10 15

10GigaEthernet on GSR feedback ...
by Vincent Gillet - Opentransit.net 15 Mar '04

15 Mar '04

Hi, We recently installed 10GE interface on GSR boxes (Engine4+). I are experiencing a SNMP counter issue with 802.1q VLAN. We were used to have counters by 802.1q VLAN on GSR on 1GE, but it looks to be broken for 10GE subinterfaces. Counters are available by SNMP, but are buggy on Inbound. ifHCInUcastPkts is OK, but ifHCInOctets is not. Does anyone experienced such problem on 10GE with GSR ? Counters from physical interace are fine. We experiences this on SubInterfaces only. Thanks. Vincent. BTW : YES, we already opened a case with vendor, but we would like to share Operations feedbacks on this.

2 1

Re: Packet Kiddies Invade NANOG
by Gregory Taylor 15 Mar '04

15 Mar '04

Matthew (yes I know it is you), The personal information you have posted regarding my phone number is me. However, the slanderous material and obvious hate/flame statements you made against me are absolutely false. I have not attacked any Internet Service Provider or IRC server in several years. I am and have been retired from the underground for a long while now, despite the constant comments made to the contrary by people who do not represent me in any manner. I admit publically to everyone who may read this posting, that I have made some very stupid decisions in the past and I had hurt alot of people in the process. Despite my attempts to justify my actions, the fact is two wrongs do not make a right. XWB is my dad's personal sole propietership. Not once has anyone involved with XWB ever attempted to represent that business as anything more than a Sole propietership that does web development work for non-profit organizations and small businesses. My father works very hard and your attempt at attacking his character was uncalled for and unnecessary. I do not know what your problem with me is, Matthew, but whatever they are, you need to leave them off of NANOG and the phone calls to my house are not appreciated either. I hope you realize that posting personal information about people, such as phone numbers, addresses, and any other such stuff to a public forum without the consent of the person to whom that information belongs to, is illegal. It is a felony in fact. Your unfounded truthless statements about myself and my father's business are a felony as well and if I wanted to take action, could end in a civil lawsuit against you for libel and slander. Will I take that approach? Probably not, mostly because the people on this list, minus certain people, are for the most part mature, intelligent adults who do not care to take part in flame wars, nor do they listen to slanderous statements made by someone who obviously has some kind of jealousy towards someone to the point that he has to make public unprovoked attacks against that person's character. The people who matter on this list will most likely ignore this thread and what not. Good luck in whatever future endeavor you may take. And this is my only and last response to this thread. Greg ---------- Original Message ---------------------------------- From: <albertpublic(a)hushmail.com> Date: Sun, 14 Mar 2004 14:37:38 -0800 > >Greg, > >Let me spell it out crystal clear so you can understand. Are you, or >are you not, the Gregory >Taylor referenced in the URL's I sent below? > >Albert P. >(signing his real name so Susan won't remove him from the list) > >>maturity in its purest form. >> >>---------- Original Message ---------------------------------- >>From: <albertpublic(a)hushmail.com> >>Date: Sat, 13 Mar 2004 17:17:42 -0800 >> >>> >>>I've noticed a number of shining stars in the network engineering >>industry >>>have graced us >>>with their presence and infinite wisdom in the past few days, including >>>Gregory Taylor. I >>>can't help but wonder if this is the same who launched multi-gigabit >>>DDoS attacks against >>>IRC servers and major ISP's recently: >>> >>>http://www.geocities.com/osek_owned/ >>>http://www.urbandictionary.com/define.php?term=osek >>> >>>Coincidence? You decide. Better yet, call his mother at 1-253- >>475-1227, >>> and let her know >>>you don't approve of his hacking activities. If enough of us put >>the >>>pressure on, it's possible >>>he'll be grounded, and his computer priviledges will be revoked. >> It's >>>happened before, it can >>>happen again. >>> >>>For those of you wondering, "Xpert Web Builders" (XWB.COM) is bogus. >>> They don't operate a >>>network, they're a sole proprietorship tech support and web dev >>group, >>> run by some clue- >>>challenged kids who don't even have the cashflow needed to invest >>in >>>a post-paid cellular >>>phone. >>> >>>Then there's Andrew Kirch, aka "trelane", who just published a >>fascinating >>>(albeit highly >>>technically inaccurate, and bearing little or no basis in reality) >>> >>>whitepaper on the "script kiddie culture": >>> >>>http://software.newsforge.com/software/04/02/28/0130209.shtml >>> >>>Only problem is, he hangs out on EFNet in #sigdie, a channel known >>in >>>security circles as a >>>place where large-scale DDoS attacks, usually involving 1000's >>of >>>drone nets or otherwise compromised machines, are coordinated. >> Takes >>>one to know one, I >>>guess. The fun doesn't stop there: he's publicly admitted to helping >>> >>>packet IRC servers before! >>> >>>I'm still working on building a rap sheet on Kirch's friend, Brian >>Bruns, >>> and their "Summit >>>Open Source Development Group" (which, by all accounts, is a >>>legitimate-looking front for their not-so-legitimate activities). >> If >>>anyone has any info, mail >>>me privately, and I'll summarize. >>> >>> >>> >>>Concerned about your privacy? Follow this link to get >>>FREE encrypted email: https://www.hushmail.com/?l=2 >>> >>>Free, ultra-private instant messaging with Hush Messenger >>>https://www.hushmail.com/services.php?subloc=messenger&l=434 >>> >>>Promote security and make money with the Hushmail Affiliate Program: >>> >>>https://www.hushmail.com/about.php?subloc=affiliate&l=427 >>> >> >> > > > >Concerned about your privacy? Follow this link to get >FREE encrypted email: https://www.hushmail.com/?l=2 > >Free, ultra-private instant messaging with Hush Messenger >https://www.hushmail.com/services.php?subloc=messenger&l=434 > >Promote security and make money with the Hushmail Affiliate Program: >https://www.hushmail.com/about.php?subloc=affiliate&l=427 >

3 2

None
by guy 14 Mar '04

14 Mar '04

On Sun, 14 Mar 2004, Andrew Dorsett wrote: > > This is a topic I get very soap-boxish about. I have too many problems > with providers who don't understand the college student market. I can > think of one university who requires students to login through a web > portal before giving them a routable address. This is such a waste of > time for both parties. Sure it makes tracking down the abusers much > easier, but is it worth the time and effort to manage? This is a very > legitimate idea for public portals in common areas, but not in dorm rooms. Andrew, Doing this is an effective way to introduce an AUP policy to the students. Something to the effect of, "By clicking here, you agree not to do X Y and Z" and other provisions that will not be read by 99.9% of the students/renters. However, by doing this, if need be at a future time, shutting off service for AUP violations is much easier. Guy

2 1