October 2007 - Test - lists.nanog.org

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 14 Oct '07

14 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gadi Evron <ge(a)linuxbox.org> wrote: >That's a different question all together, not about criminal ISPs, which >[...] No, not necessarily. Given that there are Tier 1 ISPs, Tier 2, etc., so you can certainly have some small-ish ISP colluding with criminal activity, in effect, by ignoring it or claiming ignorance. However, it's kind of hard to plead ignorance when, say, people continually alert them to the issues and they persist. That's just one example... I can come up with more. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHD/N0q1pz9mNUZTMRAqtkAKCLJifYupBbpjmqVfVGUND95NVGNwCdFYp8 SM37ObYbO88K2iCkd99fp7c= =DjDg -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 3

How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 14 Oct '07

14 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This question is part reality, part surreality. Let me ask you this: What would you do when you have alerted (via abuse@ contacts) a notable ISP in the U.S. (not a tier one, and not just one of them) about KNOWN, VERIFIABLE, and RECURRING criminal activity in their customer downstreams? And the downstream(s) do not respond? And the criminal activity continues? The most obvious answer is: Gather evidence, contact law enforcement. Right? I just wanted to reach out the NANOG on this and see what you thought... How would you handle it? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHDx/Uq1pz9mNUZTMRAiUSAJ94uQvlaBLWb7gxkxz0I/448reBZwCeKSTb ibBQj5TSBlr0utNar9tD60Q= =NIhs -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

8 16

RE: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 13 Oct '07

13 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Eric Van Tol" <eric(a)atlantech.net> wrote: >> We did exactly that with a similar incident and the local FBI Cyber >> Crimes folks told us that they couldn't help us because they were >> entirely dedicated to potential terrorist activities. So, I would >> say "contact local authorities and play it up as a terrorist act" if >> you want any help at all. > >Or, you can somehow work into your complaint about how you are just >trying to "protect the children". Ah, yes -- One of the Four Horsemen of the Information Apocalypse: terrorists, drug dealers, kidnappers, and child pornographers. http://www.schneier.com/blog/archives/2005/12/computer_crime_1.html :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHEQanq1pz9mNUZTMRAtOVAJ9ZoCVN1JMiGImA2Fis9MQr0/RSzwCg25pC DU6jQhjlTj8z7TtTQkXICW8= =F9xe -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Why do some ISP's have bandwidth quotas?
by Joe Greco 13 Oct '07

13 Oct '07

> > > Comparative to Milwaukee, I'd be guessing delivering high performance > > > internet and making enough money to fund expansion and eat is harder at > > > a non US ISP. It's harder, but there's nothing wrong with it. It compels > > > you to get inventive. > > > > The costs to provide DSL up here in Milwaukee are kind of insane, > > Insanity is a relative term :-) Try to deliver Internet outside of the > US in countries that share western culture and you'll start to > understand why caps are seen as an excusable form of treatment for the > insanity. Okay, so, let's pretend that today I'm sitting in Sweden. Go. Extremely high speed connectivity, uncapped, well in excess of what is delivered in most parts of the US. I was just informed that Road Runner upgraded locally from 5 to 7Mbps a month ago, and has a premium 15Mbps offering now, but there are folks with 100Mbps over there. So, your point is, what, that it's easier to deliver Internet outside of the US in countries that share western culture? That could be true, we're tied up by some large communications companies who don't want carrier- neutral networks to the residence. If we just want to start making up claims that fit the observed facts, I would say that the amount that a user can download from the Internet in countries that share western culture tends to decrease with distance from Sweden, though not linearly. AU gets placed on the far end of that. :-) (That's both a joke AND roughly true!) > Clearly they're not something we'd prefer, but they are useful > to manage demand in the context of high costs with customers who > benchmark against global consumer pricing (or those who think that the > Internet is a homogeneous thing) > > ...Hmm, that's a good idea, perhaps you should do that (get out of the > US) before you start saying what we're doing is "wrong with your > business" or "insane" or perhaps unreasonable. > > And I agree with Mark Newton's sentiments. It's completely delusional of > you to insist that the rest of the world follow the same definition of > "reasonable". We're not the same. Which is good in some respects as it > does create some diversity. And I'm quite pleased about that :-) Well, since I didn't insist that you follow any definition of "reasonable", and in fact I started out by saying : Continued reliance on broadband users using tiny percentages of their : broadband connection certainly makes the ISP business model easier, but : in the long term, isn't going to work out well for the Internet's : continuing evolution. it would seem clear that I'm not particularly interested in your local economics, no matter how sucky you've allowed them to be, but was more interested in talking about the problem in general. I *am* interested in the impact that it has on the evolution of the Internet. That you're so pleased to be "diverse" in a way that makes it more difficult for your users to join the modern era and use modern apps is sufficient to make me wonder. There's certainly some "delusional" going on there. ... JG -- Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net "We call it the 'one bite at the apple' rule. Give me one chance [and] then I won't contact you again." - Direct Marketing Ass'n position on e-mail spam(CNN) With 24 million small businesses in the US alone, that's way too many apples.

12 19

Re: Researchers ping through first full 'Internet census' in 25 years
by Tim Franklin 13 Oct '07

13 Oct '07

On Fri, October 12, 2007 2:49 pm, Justin M. Streiner wrote: > "HOST x.x.x.x ON YOUR NETWORK PINGED ME!!!! I TAKE MY SECURITY > SERIOUSLY!! I'M CALLING THE FBI!!!" That I can *sort* of understand - it's the flaming zealotry of "ALL ICMP IS EEEVIL!" trickling down from 99% of firewall admins working in enterprises to end users who just heard it from "someone in IT". It's the "Your server www.whatever.com is attacking me from port 80!" ones that leave me torn between laughing, crying, and seriously thinking about a cull...

4 3

*Revised* Discounted Internet Access at Hyatt Regency Albuquerque for NANOG Guests
by Carol Wadsworth 13 Oct '07

13 Oct '07

*Note* in order to receive the discounted rate, you will need to purchase one-day passes from the front desk.

1 0

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 13 Oct '07

13 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Not intentionally trying to be retarded, but I've received an enormous number of private responses. Many thanks. It is odd, however, why folks felt the need to reply privately, and although I'm glad you did reply, it is somewhat of a statement, in and of itself, on the issues involved that things happen the way they do. Maybe. In any event, I did want to mention that some people involved in the aforementioned "activities" may be getting their feelings hurt real soon now due to "looking the other way" and pretending they didn't know what was going on. Or maybe not. It should be pretty fun to to see what happens. Thanks for everyone who responded. Cheers! - - ferg - -- "Paul Ferguson" <fergdawg(a)netzero.net> wrote: This question is part reality, part surreality. Let me ask you this: What would you do when you have alerted (via abuse@ contacts) a notable ISP in the U.S. (not a tier one, and not just one of them) about KNOWN, VERIFIABLE, and RECURRING criminal activity in their customer downstreams? And the downstream(s) do not respond? And the criminal activity continues? The most obvious answer is: Gather evidence, contact law enforcement. Right? I just wanted to reach out the NANOG on this and see what you thought... How would you handle it? - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHDymoq1pz9mNUZTMRAi9JAKChOP+omJT+B08zY6/apubGPIV9ZQCgsr3F 1BcKzW2DrEte2Q/KS4I5de4= =RxGD -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Robert Bonomi 13 Oct '07

13 Oct '07

> From owner-nanog(a)merit.edu Fri Oct 12 16:26:36 2007 > Date: Fri, 12 Oct 2007 21:23:15 GMT > Subject: Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity? > > So, back to my original question: If you alert an ISP that "bad and > possibly criminal" activity is taking place by one of their customer, > and they do not take corrective action (even after a year), what do > you do? This is straying somewhat afield from 'network operations', but it is at least tangentially relevant, so.... 'What do you do?' conceals a raft of other issues that have to be identified and answered before the 'obvious' quesiton cn be addressed. First off -- not to belabor (well, not too much, anyway) the obvious -- you have to identify what your 'goals' are. Both tactical (short term), and strategic (long term). And what level of resources you are willing to commit toward supporting those goals. A "desirable" state of affairs is that every network operator _does_ actively police its user base, and makes 'former customers' out of anyone who egages in activities deemed "not acceptable" by a large portion of the "rest of the 'net world". Unfortuntely, commercial providers are driven by 'economic self-interest', rather than "the good of the 'community'" as their _primary_ motivation. They _will_ consider the 'good of the community' when it is not in conflict (or at _most_, represents a *minor* conflict) with their self-interest, but if the two are diametrically opposed, there is no doubt as to which viewpoint _will_ prevail. So, when you ask them to _do_something_, quote "for the good of the community" unquote, and 'nothing happens' it is reasonable to conclude that 'economic self interest' is controlling -- either it is 'not worth the effort/expense', or it would cost revenues that they're not willing to give up. I'm sure this is no surprise to anyone. In fact, Isuspect everybody has seen these exact sysmptoms in _their_own_ management, in varying degree. There are only two things one can change to influence that decision -- either one 'somehow' makes 'the good of the community' more inportant, *or* one finds a way to invoke their 'economic self-interest' on the 'right' side of the issue. One possible way to do the latter is to look or 'sensitive' departments, *other* than the 'abuse' contacts, who have 'hot buttons' that can be pushed. Some possiilities for this approach include "legal", "investor relations", and "Public Relations". All the folks who have to 'deal with the mess' when something 'embarassing' becomes public knowledge. contacting such departments, with an 'early warning' about what could become 'very messy' public attention to policies/practices that "could easily be mis-understood", if done carefully, can be very effetive. And, as a final alternative, there is "public embarrassment", to shame them into taking action. One 'option' that has *never* been successfully employed would be to organize 'the community' for co-operative action in 'shunning' those provider who do not keep a clean house. I'd _love_ to see such an approach implemented, but it requires ignoring short-term self-interest for the long-term 'good of the community' -- even though the long-term good of the community _is_ in the self- interest of each and every provider. Back to original "what do you do?" 'Viable' options are rather limited -- If you have _hard_ evidence, reporting to law enforcement, *WITH* notice of 'apparent provider compliciy' -- including 'what was given to the provider _when_' to establish their 'actual knowledge' of the criminal activity and hence provider liability for allowing it to continue. You can try 'public humiliation' -- calling in the press. And, of course, you *DO* -- if you haven't already (comment: if not, _why_ not?) -- take 'defensive measures' to block communications in either direction involving those 'bad guys' and your customers.

1 0

Discounted Internet Access at Hyatt Regency Albuquerue for NANOG Guests
by Carol Wadsworth 13 Oct '07

13 Oct '07

FYI - NANOG meeting attendees staying in the Hyatt Regency Albuquerue can receive a discount on in-room Internet access. The front desk is suppose to inform guests upon check-in that wireless Internet connectivity is available for $4.99 per day (50% off the standard rate).

1 0

Re: How to Handle ISPs Who Turn a Blind Eye to Criminal Activity?
by Paul Ferguson 12 Oct '07

12 Oct '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Michael Smith <mksmith(a)adhost.com> wrote: >We did exactly that with a similar incident and the local FBI Cyber Crimes folks told us that they couldn't help us because they were entirely dedicated to potential terrorist activities. So, I would say "contact local authorities and play it up as a terrorist act" if you want any help at all. > Indeed -- thanks for reminding me of that. :-) In fact, Brian Krebs over at the Washington Post wrote a nice article on this very issue last month: "The cyber portion of the 2008 [FBI budget] request includes a request for $258.5 million in funding for some 659 field agents, a 1.5 percent increase over 2007 levels. That's 659 out of a total of 11,868 FBI agents nationwide, which would mean the FBI is on track to dedicate roughly 5.5 percent of its agents to cyber crime investigations. But as we'll see later, the true number may actually be lower." http://blog.washingtonpost.com/securityfix/2007/09/is_cyber_crime_a_distant _3rd_p.html Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFHD+1kq1pz9mNUZTMRAl24AJ4+XV3I44EXglS+lHjs+tyjA2UC8gCg0fk7 cWx8xPg/5Chqc82Li5OpN+w= =1IUs -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0