September 2005 - Test - lists.nanog.org

RE: UNITED.COM (United Airlines) has been down for days! Any info on this?
by Hannigan, Martin 04 Sep '05

04 Sep '05

> Nice try, but the location that I was trying from did not use > "alternative root servers". > > FYI: They are "Inclusive Namespace Servers". United.COM works from everywhere I try it. MCI, AT&T, Internap, and Sprint. I can run tickets, check miles, and check my dining points. Currently linked via United News: "The aftermath of Hurricane Katrina is still causing cancellations and some flight irregularities. Check the status of your flight before traveling and read on for information about changing travel plans affected by the weather. We are attempting to recover to full operations as quickly as possible." Sounds like a local issue. -M<

2 1

New Orleans Comm Needs
by Jerry Dixon 04 Sep '05

04 Sep '05

I don't know how many of you have a Ham license but see below: In talking with communication providers in the region they just now got satellite phones and in process of assessing and repairing communication lines for New Orleans. They're still somewhat challenged with comms including at shelters. See the request below from ARRL. There is an HF net setup and efforts under way by NCS down there. -Jerry http://www.arrl.org Attention All Amateurs... Amateur Radio emergency communication volunteers needed! (Sep 2, 2005) -- The ARRL now is seeking experienced Amateur Radio emergency volunteers to help supplement communication for American Red Cross feeding and sheltering operations in Mississippi, Alabama and the Florida Panhandle--as many as 200 locations in all. Special consideration will be given to operators who have successfully completed the ARRL Amateur Radio Emergency Communications course training (Level I minimum) to serve as team leaders. These volunteer operators will help to provide communication and equipment for relief efforts in the aftermath of Hurricane Katrina. If you're interested and qualified, please send an e-mail message to Katrina(a)arrl.org, providing name, call sign, contact information and any equipment you're willing and able to take along on a field deployment for an indefinite period. Volunteers may face hardship conditions without the usual amenities and will need to provide their own transportation to the marshaling area. ---- Original message ---- >Date: Fri, 2 Sep 2005 19:59:40 GMT >From: "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> >Subject: FCC COORDINATING TECH AID FOR KATRINA DISASTER >To: nanog(a)merit.edu > > >http://www.boingboing.net/2005/09/02/fcc_coordinating_tec.ht ml > >- ferg > > >-- >"Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ >

2 1

RE: FW: Need some help: IDEAS, Inc.
by Hannigan, Martin 04 Sep '05

04 Sep '05

> > > this is NOT a good solution, since a successful phish attack > > > in this case > > > would look exactly like the official red cross web site. > > > > How's that one work? > > One form of DirectNIC's redirection, which the phisher was > supposedly using > (I didn't check myself), uses a <FRAMESET> to hide the > redirect inside a > frame, thereby not showing the real address in the browser > without deeper > inspection. Understood. If it's being pointed at redcross.org, a known good guy site, that wouldn't be a problem, would it? It seems that if the scammer is removed from the operation, it's not really a problem anymore. I'm interested because I think there could be value in a page(s) on an SP that says "This site terminated due to fraudulent activity" and pointers to how to not be sucked into these things. > Personally, I'd prefer registrar lock myself, as that keeps > the distinction > between scam and non-scam clear. Registrar lock is preferred on my part. The redirect idea was creative. -M<

1 0

RE: FW: Need some help: IDEAS, Inc.
by Hannigan, Martin 03 Sep '05

03 Sep '05

> this is NOT a good solution, since a successful phish attack > in this case > would look exactly like the official red cross web site. How's that one work? -M<

2 1

UNITED.COM (United Airlines) has been down for days! Any info on this?
by John Palmer 03 Sep '05

03 Sep '05

The United Airlines website appears to be down and has been down for days. Is this a network issue or are they out of business??

8 8

FW: Need some help: IDEAS, Inc.
by Marcus H. Sachs 03 Sep '05

03 Sep '05

One of our incident handlers at the SANS Internet Storm Center has been trying to chase down the bogus Katrina assistance web sites. Below is a note of frustration he sent internally to us this morning. I asked if I could cross-post over to NANOG to see if any of you could assist. Thanks in advance! Marc ++++++++++++++++++++++++++++++++++++++++++++++++++++++ Marcus H. Sachs, P.E. KJ4WA : marc(a)sans.org Director, SANS Internet Storm Center : isc.sans.org Washington D.C. USA (EDT, GMT-4) : +1 703 707 9293 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ -----Original Message----- Sent: Saturday, September 03, 2005 9:32 AM Subject: Need some help: IDEAS, Inc. Morning all: Last night, I pulled a new copy of the .com and .net zone files down and did another grep for "katrina" domains. Obviously, there are now more... In the process of checking and cross-referencing, I found that our friends "IDEAS, Inc" are a little more "involved" than we originally thought: http://www.hurricanekatrinarelief.com http://www.hurricanekatrinapics.com http://www.hurricanekatrinaneworleans.com http://www.hurricanekatrinaflooding.com http://www.hurricanekatrinainfo.com http://www.hurricanekatrinamap.com http://www.hurricanekatrinanews.com http://www.hurricanekatrinapath.com http://www.hurricanekatrinaphoto.com http://www.hurricanekatrinaphotos.com http://www.hurricanekatrinarelieffund.com http://www.hurricanekatrinatracking.com http://www.hurricanekatrinaupdate.com http://www.hurricanekatrinavideos.com http://www.katrinadamage.com http://www.katrinapics.com http://www.katrinavideos.com http://www.neworleanshurricanekatrina.com ...and those are just the 18 I was able to find. Right now, there are two weak points to this particular house of cards. 1) The first site listed, "http://www.hurricanekatrinarelief.com" is what drives all of the others. Each of the other sites, loads the first one in an IFRAME. That makes it easy for the bastards to update them all. This site is hosted by Interland. Their final word on shutting these scumballs down until they could prove they were legitimate was: "We have been advised by our legal department that the local authorities should be contacted. The local authorities can submit a subpoena to our legal department. We will be glad to comply to such a request." ie. "We have no balls. Go away". 2) All of the other sites are hosted at the IP address 206.251.184.10. Immediate upstream is "datasync.net/.com" and they are located in (of course...) Louisiana. I've emailed them numerous times, and tried to call ("all circuits are busy..."), but they're probably running in lights-out mode right now. The IDEAS, Inc. scum MUST die, but I'm all out of ideas at this point... the only other possibility that I can think of it to take them out at the DNS level. All of the "slave" sites at 206.251.184.10 use DirectNIC for their DNS... Anyone got sway with them? Frankly, gang, I'm at my wits end on this one...

4 5

Tidbit from DirectNIC
by Michael.Dillon＠btradianz.com 03 Sep '05

03 Sep '05

>From downtown New Orleans... http://www.livejournal.com/users/interdictor/ -----snip----- Fox News is reporting that there is an operation underway to refill chillers at the Bell South building down the street to keep phone service available to much of the southeast United States. That is apparently where all the firetrucks are going to in the area, in case you were wondering. -----snip----- It is interesting to note that it is possible to bring in diesel and water to resupply BellSouth yet it is impossible to bring in water and food for the residents, not to mention a fleet of small boats that could have prevented thousands from dying trapped inside their attics. If you have a datacenter in a location that might be flooded by rivers or storm surges, do you have inflatable rafts among your emergency supplies? --Michael Dillon

13 22

Re: FW: Need some help: IDEAS, Inc.
by Jerry Dixon 03 Sep '05

03 Sep '05

Just an FYI, FBI and Secret Service are actively working these as they are identified. We definitely don't need more victims. If you don't feel you're getting the response needed contact US CERT: https://forms.us-cert.gov/report/ or http://www.us-cert.gov/contact.html We'll make sure the information gets into the right hands. I will say that I know many others on the list have been doing a great job of identifying sites as well as reporting. SANS ISC keep up the good work! The information goes into Federal Law Enforcement who also works with Local LE. Jerry ---- Original message ---- >Date: Sat, 3 Sep 2005 11:00:03 -0400 >From: "Marcus H. Sachs" <marc(a)sachsfamily.net> >Subject: FW: Need some help: IDEAS, Inc. >To: <nanog(a)merit.edu> >Cc: <handlers(a)sans.org> > > >One of our incident handlers at the SANS Internet Storm Center has been >trying to chase down the bogus Katrina assistance web sites. Below is a >note of frustration he sent internally to us this morning. I asked if I >could cross-post over to NANOG to see if any of you could assist. > >Thanks in advance! > >Marc > > >++++++++++++++++++++++++++++++++++++++++++++++++++++++ >Marcus H. Sachs, P.E. KJ4WA : marc(a)sans.org >Director, SANS Internet Storm Center : isc.sans.org >Washington D.C. USA (EDT, GMT-4) : +1 703 707 9293 >++++++++++++++++++++++++++++++++++++++++++++++++++++++ > > >-----Original Message----- >Sent: Saturday, September 03, 2005 9:32 AM >Subject: Need some help: IDEAS, Inc. > > >Morning all: > >Last night, I pulled a new copy of the .com and .net zone files down and did >another grep for "katrina" domains. Obviously, there are now more... > >In the process of checking and cross-referencing, I found that our friends >"IDEAS, Inc" are a little more "involved" than we originally thought: > >http://www.hurricanekatrinarelief.com >http://www.hurricanekatrinapics.com >http://www.hurricanekatrinaneworleans.com >http://www.hurricanekatrinaflooding.com >http://www.hurricanekatrinainfo.com >http://www.hurricanekatrinamap.com >http://www.hurricanekatrinanews.com >http://www.hurricanekatrinapath.com >http://www.hurricanekatrinaphoto.com >http://www.hurricanekatrinaphotos.com >http://www.hurricanekatrinarelieffund.com >http://www.hurricanekatrinatracking.com >http://www.hurricanekatrinaupdate.com >http://www.hurricanekatrinavideos.com >http://www.katrinadamage.com >http://www.katrinapics.com >http://www.katrinavideos.com >http://www.neworleanshurricanekatrina.com > >...and those are just the 18 I was able to find. > >Right now, there are two weak points to this particular house of cards. > >1) The first site listed, "http://www.hurricanekatrinarelief.com" is what >drives all of the others. Each of the other sites, loads the first one in >an IFRAME. That makes it easy for the bastards to update them all. This >site is hosted by Interland. Their final word on shutting these scumballs >down until they could prove they were legitimate was: > >"We have been advised by our legal department that the local authorities >should be contacted. The local authorities can submit a subpoena to our >legal department. We will be glad to comply to such a request." > >ie. "We have no balls. Go away". > >2) All of the other sites are hosted at the IP address 206.251.184.10. >Immediate upstream is "datasync.net/.com" and they are located in (of >course...) Louisiana. I've emailed them numerous times, and tried to call >("all circuits are busy..."), but they're probably running in lights-out >mode right now. > >The IDEAS, Inc. scum MUST die, but I'm all out of ideas at this point... the >only other possibility that I can think of it to take them out at the DNS >level. All of the "slave" sites at 206.251.184.10 use DirectNIC for their >DNS... Anyone got sway with them? > >Frankly, gang, I'm at my wits end on this one... > >

1 0

Re: Phone networks struggle in Hurricane Katrina's wake
by Fergie (Paul Ferguson) 03 Sep '05

03 Sep '05

Me? I personally never trade my POTS for VoIP... - ferg -- Iljitsch van Beijnum <iljitsch(a)muada.com> wrote: On 30-aug-2005, at 22:08, Fergie (Paul Ferguson) wrote: > "In this age of cheap commoditized consumer electronics and > advanced mobile technology, why can't all the people of a city make > contact during an emergency? Simple: it's too expensive. Keep this in mind when trading in your POTS service for VoIP service over the internet. Discounting the local loop which is often the same in both cases, POTS is extremely reliable while VoIP over the public internet, well, isn't. But apparently people that switch to VoIP don't mind the reduced likelihood of being able to make calls during the next large scale emergency.

16 23

RE: Tidbit from DirectNIC
by Irwin Lazar 02 Sep '05

02 Sep '05

Per http://www.freerepublic.com/focus/f-news/1475927/posts the firefighters are taking sniper fire and have barracaded themselves inside the building. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Michael Greb Sent: Friday, September 02, 2005 5:16 PM To: nanog(a)merit.edu Subject: Re: Tidbit from DirectNIC On Fri, Sep 02, 2005 at 11:54:10AM -0400, Steven Champeon wrote: > on Fri, Sep 02, 2005 at 04:44:49PM +0100, Michael.Dillon(a)btradianz.com wrote: > > -----snip----- > > Fox News is reporting that there is an operation underway to refill > > chillers at the Bell South building down the street to keep phone service > > available to much of the southeast United States. That is apparently where > > all the firetrucks are going to in the area, in case you were wondering. > > -----snip----- > > > > It is interesting to note that it is possible to bring in diesel and water > > to resupply BellSouth yet it is impossible to bring in water and food for > > the residents, not to mention a fleet of small boats that could have > > prevented thousands from dying trapped inside their attics. > > 1) potable water is probably somewhat different from the water used in > chillers or fire trucks > > 2) phone service is, IMHO, one helpful pre-requisite to providing > emergency care and disaster relief Last year after Ivan phone service played no roll in emergency care or disaster relief. Ham Radio operators, myself included, were stationed at each shelter, the Red Cross and Salvation Army command centers, the county EOC, hospitals, and some assigned to shadow important people such as the mayor whereever they went. Every agency participating had a presence at the county EOC. When an ambulance was needed at a shelter, it was called for via ham radio, an operator at the EOC passed the message to the ambulance dispatcher in the same room, they called the ambulance out. Those in their home and not in a shelter had no way to call for help but the city and county themselves did not rely on phone service for anything. This is why the federal government gives so much valuable radio spectrum to Ham Radio, more then any other service, the principal purpose of Ham Radio is to provide emergency communications in times of need. > 3) the pictures I've been seeing have been full of boats, many of them > thrown up on land a few hundred feet from their berths > > Not saying that the utter failure of DHS as an organization isn't on > evidence here. Just saying that it's one thing to feed and water a plant > and quite another to feed and water a human being, let alone tens of > thousands of them. Michael Greb

1 0