April 2004 - Test - lists.nanog.org

Packet anonymity is the problem?
by Sean Donelan 14 Apr '04

14 Apr '04

If you connect a dialup modem to the public switched telephone network, do you rely on Caller ID for security? Or do you configure passwords on the systems to prevent wardialers with blocked CLIDs from accessing your system? Have a generation of firewalls and security practices distracted us from the fundamental problem, insecure systems. http://www.ecommercetimes.com/perl/story/security/33344.html Gartner research vice president Richard Stiennon confirmed that packet anonymity is a serious issue for Internet security. [...] "Because of the way TCP/IP works, it's an open network," Keromytis said. "Other network technologies don't have that problem. They have other issues, but only IP is subject to this difficulty with abuse." [...] Bellovin compared the situation to bank robberies. "[S]treets, highways and getaway cars don't cause bank robberies, nor will redesigning them solve the problem. The flaws are in the banks," he said. Similarly, most security problems are due to buggy code, and changing the network will not affect that.

14 19

Anyone from AT&T here? (AT&T bogus DNSBL answers)
by Steve Linford 14 Apr '04

14 Apr '04

AT&T customers have contacted us saying they can't reach any of our DNSBLs, seems AT&T have defined a fake sbl.spamhaus.org zone in their DNS servers so when AT&T customers ask AT&T's NS 12.149.189.2 for sbl.spamhaus.org they get: ;; ANSWERS: sbl.spamhaus.org 86400 IN SOA loopback root.loopback ( 1 ; serial 3600 ; refresh 600 ; retry 3600000 ; expire 86400) ; minimum ;; AUTHORITY RECORDS: sbl.spamhaus.org 86400 IN NS loopback ;; ADDITIONAL RECORDS: loopback 61703 IN A 127.0.0.1 And it's not just affecting our users... blackholes.mail-abuse.org 86400 IN SOA loopback root.loopback blackholes.mail-abuse.org 86400 IN NS loopback loopback 61520 IN A 127.0.0.1 cbl.abuseat.org 86400 IN SOA loopback root.loopback cbl.abuseat.org 86400 IN NS loopback loopback 61480 IN A 127.0.0.1 list.dsbl.org 86400 IN SOA loopback root.loopback list.dsbl.org 86400 IN NS loopback loopback 60855 IN A 127.0.0.1 -- Steve Linford The Spamhaus Project http://www.spamhaus.org

2 1

who not ARIN for route registry?
by Jeff Behl 14 Apr '04

14 Apr '04

Anyone good reason why a major ISP would not accept/mirror ARIN as a route registry? They do mirror others (altdb arcstar bell cw enterzone gt level3 radb rgnet ripe sinet), just not ARIN...

1 0

RE: SPAM Directly from AT&T Data Networking
by Dr. Jeffrey Race 14 Apr '04

14 Apr '04

On Wed, 14 Apr 2004 16:38:54 -0500, Stewart, William C (Bill), RTSLS wrote: >It looks like you as an attglobal.net customer might have received it from >another attglobal.net user Yes this is what I suspected >(or else there was other header forgery going on - >it looks like you didn't provide complete headers?) This was the complete header and that is what is so bizarre about the spam >Abuse(a)att.net may look a lot like a black hole, yes :(

1 0

RE: SPAM Directly from AT&T Data Networking
by Callahan, Richard M, GVSOL 14 Apr '04

14 Apr '04

Before the gates continue to open - let me be perfectly clear. I speak up as an individual and member of the community. I do not, can not and will not speak for AT&T. I am just another of the myriad of workers trying to do my job and be helpful where I can. Many of us make errors in execution and judgment and all we can do is not repeat them. As promised I will forward all the comments and concerns received for appropriate action. Sorry to have fanned the fires. -----Original Message----- From: Jay Hennigan [mailto:jay@west.net] Sent: Wednesday, April 14, 2004 4:02 PM To: Callahan, Richard M, GVSOL Cc: Dr. Jeffrey Race; nanog(a)merit.edu Subject: RE: SPAM Directly from AT&T Data Networking On Wed, 14 Apr 2004, Callahan, Richard M, GVSOL wrote: > Having spoken directly to her, I would like to point out that she did > indeed take the time to research the FCC SPAM laws and has stuck to > them. She has provided an opt-out message and assures me she takes it > very seriously. If you have responded to her with a request to NOT be > contacted again, you have not been. So AT&T condones the sending of bulk, unsolicited commercial email and permits its employees to do so and continue to do so until the victim begs that particular employee to stop? And then another AT&T salescritter can repeat the process? That's AT&T's official position? How well do you think this scales? -- Jay Hennigan - CCIE #7880 - Network Administration - jay(a)west.net WestNet: Connecting you to the planet. 805 884-6323 WB6RDV NetLojix Communications, Inc. - http://www.netlojix.com/

1 0

RE: SPAM Directly from AT&T Data Networking
by Dr. Jeffrey Race 14 Apr '04

14 Apr '04

Pls see interleaved comments: On Wed, 14 Apr 2004 14:25:45 -0500, Callahan, Richard M, GVSOL wrote: >I do work for AT&T and I do have a vested interest in SPAM and other ISP related >issues. Good so far >Some of you may recall I was the naive idiot that allowed AT&T to launch >the Do Not Call Registry Forgot it but thank you for reminding us :) >I continue to stay engaged and am most definitely an anti-spam proponent. > >When I saw Mr. Lorenz's post I immediately verified it did indeed come >from AT&T and called the responsible party. Excellent. Please contact the casino spammer below (strictly illegal activity, btw) and let us know what he has to say. This was injected from 127.0.0.1. Jeffrey Race -------------------------------------------------------------------- Received: from att.com (localhost[127.0.0.1]) by prserv.net (in3) with SMTP id <200404140751271030andodve>; Wed, 14 Apr 2004 07:53:28 +0000 X-Originating-IP: [127.0.0.1] To: <jpalla(a)attglobal.net> From: "marshall" <sweetsfp1013(a)hotmail.com> Date: Wed, 14 Apr 2004 00:56:42 GMT Message-Id: <1081904202-10285(a)excite.com> Sender: sweetsfp1013(a)hotmail.com Subject: CAS1N0: New Deal!! 50% Sign Up Bonus! sundance cobrax Content-Type: text/plain; Come and play at the world's PREMImERE ONLINxE CASqINO! We are happy to offer you, in an elegant atmosphere, a 50% BONUvS for YOUR FIRST DEPOeSIT as a New Player. Sign up now! Don't wait! http://www.virtualcasinoes.net/_e4faa55afa1972493c43ac8a3f66f869/ We'll automatically CREDIxT your account with a 50% BONUmS of extra chips, to wager in our CASIzNO. Don't hesivtate and try your luck! CLICuK HERwE! http://www.virtualcasinoes.net/_e4faa55afa1972493c43ac8a3f66f869/ pearl jeanette rambo1 ariane gray baskeT concept supra sally republic jeanette preston safety cracker swimming josie bach scooby racerx twins marcus liverpoo yoda scuba1 paula deutsch

1 0

Can someone at Hotmail Mail/Spam contact me off list please
by Nicole 14 Apr '04

14 Apr '04

Can someone at Hotmail Mail/Spam contact me off list please Thanks! Nicole

1 0

Re: SPAM Directly from AT&T Data Networking
by Dr. Jeffrey Race 14 Apr '04

14 Apr '04

In the last few days I have had two spams with injection point 127.0.0.1. This definitely needs to be addressed by ATT. Anyone online from ATT like to say something? Jeffrey Race On Wed, 14 Apr 2004 14:17:08 -0400 (EDT), William R. Lorenz wrote: > >So, with AT&T being a network provider at all, is it just customary for >them to SPAM like this? This is the second one I've received from them. >

1 0

RE: SPAM Directly from AT&T Data Networking
by Burton, Chris 14 Apr '04

14 Apr '04

I have received similar emails (not many) in the past from AT&T and other providers, but nothing recently. At the time I received the emails we were not doing business with AT&T either; I do find it annoying, it was not a big problem since it only happen a couple of times. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of William R. Lorenz Sent: Wednesday, April 14, 2004 11:17 AM To: nanog(a)merit.edu Subject: SPAM Directly from AT&T Data Networking So, with AT&T being a network provider at all, is it just customary for them to SPAM like this? This is the second one I've received from them. And I'm sure they didn't have my email address for legitimate purposes. If you ask me, this is rather shady for a network provider to be doing. -- _ __ __ ___ _| | William R. Lorenz <wrl(a)express.org> \ V V / '_| | http://www.clevelandlug.net/ ; "Every revolution was \./\./|_| |_| first a thought in one man's mind." - Ralph Waldo Emerson ---------- Forwarded message ---------- Date: Wed, 14 Apr 2004 13:54:45 -0400 From: Jackie Macker <kujawa(a)ems.att.com> To: wrl(a)EXPRESS.ORG Subject: RE: Following up.. Quick Question... I wanted to follow up on our previous email to your company and find out if you have any additional bandwidth needs. If yes, may I email you over our current bandwidth promo prices? In some cases we were able to get as low as $83 per mb. We also have full T-1s to the Internet for $676/mo including loop and bandwidth on a 1 year contract with free installation. If this email does not pertain to your department, will you please forward it to the appropriate person or simply delete it if you're not interested? If you don't want me to email our bandwidth promos, please let me know and I will not email you further. Thanks for your consideration! Jackie Macker ISP Partner Manager AT&T Data Networking 386-753-1142 office 386-216-1072 cell 832-213-0785 fax 3200 Lake Emma Rd., 32746

1 0

SPAM Directly from AT&T Data Networking
by William R. Lorenz 14 Apr '04

14 Apr '04

So, with AT&T being a network provider at all, is it just customary for them to SPAM like this? This is the second one I've received from them. And I'm sure they didn't have my email address for legitimate purposes. If you ask me, this is rather shady for a network provider to be doing. -- _ __ __ ___ _| | William R. Lorenz <wrl(a)express.org> \ V V / '_| | http://www.clevelandlug.net/ ; "Every revolution was \./\./|_| |_| first a thought in one man's mind." - Ralph Waldo Emerson ---------- Forwarded message ---------- Date: Wed, 14 Apr 2004 13:54:45 -0400 From: Jackie Macker <kujawa(a)ems.att.com> To: wrl(a)EXPRESS.ORG Subject: RE: Following up.. Quick Question... I wanted to follow up on our previous email to your company and find out if you have any additional bandwidth needs. If yes, may I email you over our current bandwidth promo prices? In some cases we were able to get as low as $83 per mb. We also have full T-1s to the Internet for $676/mo including loop and bandwidth on a 1 year contract with free installation. If this email does not pertain to your department, will you please forward it to the appropriate person or simply delete it if you're not interested? If you don't want me to email our bandwidth promos, please let me know and I will not email you further. Thanks for your consideration! Jackie Macker ISP Partner Manager AT&T Data Networking 386-753-1142 office 386-216-1072 cell 832-213-0785 fax 3200 Lake Emma Rd., 32746

1 0