- Test - lists.nanog.org

RE: ISP wants to stop outgoing web based spam
by Jeroen Massar 09 Aug '06

09 Aug '06

On Wed, 2006-08-09 at 09:50 -0400, Mills, Charles wrote: > I think if such a thing would exist, the "verification" gifs to prevent > automated free yahoo and hotmail account signups would be defeated as > well. You mean Captcha (http://en.wikipedia.org/wiki/Captcha) Which is not so much of an issue: http://sam.zoy.org/pwntcha/ Otherwise simply setup a resource that people want to access (always the best example on the internet: a pr0n site) and present the image there and let them answer it for you ;) Hmm maybe I should look into hooking pwntcha into SA. Greets, Jeroen (who now will receive another gateway(a)blogger.com response that it doesn't understand multipart/signed messages.... can some nanog-list-admin remove that crappy thing?)

5 4

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Wed, 09 Aug 2006 20:16:44 +0300, Petri Helenius wrote: >Arjan Hulsebos wrote: >> >> The ones who've been mugged don't start mugging other people, infected >> PCs will infect other PCs. That's the difference, and that's why an >> ISP should do something about that. Although it may be out of fashion, >> I'd like to see good netizenship. >SPAM as other types of abuse is easiest to control closest to the >source, which in most cases means the consumer ISP providing the local >access for the user. Exactly. We, the ISPs, are the friendly (or maybe not-so-friendly at times) neighborhood police officer. It's our network, we set the rules, and we enforce them. Gr, Arjan H

1 0

Detecting parked domains
by Sean Donelan 09 Aug '06

09 Aug '06

Has anyone come up with a quick method for detecting if a domain name is parked, but is not being used except displaying ads? I'm hoping there is other method besides chasing a list of constantly changing IP addresses being used by the parking advertising companies.

19 29

semi-IPV6 question (pls dont flame me for asking)
by Cerebus cerebus 09 Aug '06

09 Aug '06

I put the subject that way, otherwise I think people would ignore this completely. I actually want to know, after all the years of pain from J.F. and everything, I really believe IPv8 is workable, if it was open and done right and not handled by a spastic mental patient (notice I didn't mention any names specifically). I have "higher-ups" who read about Ipv8 and demanded we implement it, thus the previous questions about finding you know who. After reading myself though, it seems very intuitive, it can tunnel and interface with ipv4 a lot easier than ipv6 can, its practically native, you can connect gateways, and such, and somewhere I read Lucent was actually selling IPv8 router gateways, but I haven't been able to find anything further, and now Lucent is gone, so that makes it kinda difficult. >From a real technical standpoint, looking only at the mertis of the basic model, does anything think the ipv8 concept really viable, or are people just "happy" with the idea that ipv6 is "enough" "forever"? I mean, aside from the odd posting saying "coulda had a v8" - the joke is getting rather old, the addressing size capability of ipv8 and so forth, are rather appealing in some ways. For example, we have need of creating a simulated network environment of over 320 trillion nodes (don't ask), but working this out on ipv6 seems exceedingly difficult, where ipv8 has built-in concept of "clusters"/"galaxies" and easy ipv4 interface. Personally I think it would be easier to modify existing routers/etc to handle Ipv8 than the more complex incompatibility with ipv6. or have i got this all wrong? --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs.Try it free.

3 2

RE: mitigating botnet C&Cs has become useless
by Scott Weeks 09 Aug '06

09 Aug '06

----- Original Message Follows ----- From: "Barry Greene (bgreene)" <bgreene(a)cisco.com> > > What? That's what I'm trying to find out, but I'm not > > as smart as most, so I can only point out the things > > that I believe definitely won't work and why I think > > that. Hopefully by the application of flame to my butt > > by smart people for saying what I do will spark some > thought toward the goal. > > Start with: > > http://www.nanog.org/mtg-0602/greene.html I didn't see anything in there relating to bot brains. Also, with regard to 'cyberspace is just a meatspace overlay' I considered whay would I do to troubleshoot an overlay network. I'd work on the layer where the problem exists. (Duh! :) Here, the problem exists at two layers: Technically it's allowed and meat-wise there're those kinds of people in this world. So, the solution must be at both layers; meatspace and cyberspace. That makes us all correct, yes? (again, I'm putting on my flame-proof underpants... ;-) One thing someone mentioned offline: > The goal, as noted, shouldn't be to shut these things > down. It should be to keep them operating, not interfered > with, so that the C&C channels remain detectable > Shutting down C&C's is a direct action. > > More fun? Monitor those C&C's. In real time, update your > filtering to tag attack packets as a QoS that is > rate-limited at your borders. This would be hard for a > botherder to detect, but would limit damage against remote > sites. You don't actually want to *block* them; blocking > them lets the botherder know that you're on to them. But > this has to be done fairly cleverly (much moreso than I > suggest), so that they can't easily figure it out. This > is just an example for the sake of conveying the overall > idea. > But shutting them down, that's like the police arresting > all the informants. It doesn't stop the crime, it just > eradicates all your easy leads. What're folk's thoughts on that? scott

8 9

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Wed, 09 Aug 2006 10:10:21 -0600, Michael Loftis wrote: >Yup this is a social problem. Just like there's nothing actually stopping >any of us from beating up a guy on the street, we don't do it because it >isn't legal, doesn't make sense, etc. Some muggers do, the people in >control of the SPAM problem are the muggers....the people with infected >systems are just the ones who've been mugged. The ones who've been mugged don't start mugging other people, infected PCs will infect other PCs. That's the difference, and that's why an ISP should do something about that. Although it may be out of fashion, I'd like to see good netizenship. Gr, Arjan H

2 1

Re: mitigating botnet C&Cs has become useless
by Arjan Hulsebos 09 Aug '06

09 Aug '06

On Sat, 5 Aug 2006 17:17:27 -0400 (EDT), Sean Donelan typed: >Railroads have the railroad police. The Post Office has postal >inspectors. Do we want to give ISP security the power to arrest >people? We (ISPs) already do have that power, we can disconnect misbehaving subscribers. And in cases like this, we should keep them off the 'net until they've cleaned up their PC. And besides doing that, we should educate our subs on how to properly maintain their PC (installing and keeping up-to-date antivirus software, patch the OS on a regular basis, you know the drill). I don't think hunting down the botnet operator is going to solve the problem. If I were to setup a botnet, I'd have many layers of machines (in as many different countries as possible) and protocols between me and the drones that do my dirty work. So, yeah, it can be solved (OK, to a large extend) by manpower, but as someone else already mentioned, it's a case of ROI. And, as usual, security is only costing you money..... Gr, Arjan H

7 11

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 08 Aug '06

08 Aug '06

----- Original Message Follows ----- From: Sean Donelan <sean(a)donelan.com> > arrest people for mail fraud. Where are the Internet > inspectors with the authority to arrest people? Thankfully, they're nowhere around! We need to figure this out without the creation of such, also. scott

1 0

AT&T routing
by Andrew D Kirch 08 Aug '06

08 Aug '06

Would a routing engineer from AS7132 (SBC/AT&T) please contact me off list to resolve a routing issue I've discovered on your network? -- Andrew D Kirch | Abusive Hosts Blocking List | www.ahbl.org Security Admin | Summit Open Source Development Group | www.sosdg.org Key fingerprint = 4106 3338 1F17 1E6F 8FB2 8DFA 1331 7E25 C406 C8D2

2 2

Re: SORBS Contact
by Stefan Hegger 08 Aug '06

08 Aug '06

If you are blacklisted due of SPAM, and this happens often when you are an ISP, there is not automatic process. Stefan On Tuesday 08 August 2006 11:36, Stephen Satchell wrote: > Stefan Hegger wrote: > > We have the same problem. We are blacklisted and I filled out the > > webform. I got an email regarding ticket number and account/password to > > track the ticket. But it seems that nobody is working on it. > > There has been extensive discussion on NANAE and NANABl newsgroups on > this issue. The bottom line: The SORBS ticket queue is handled by a > group of unpaid volunteers, and there is quite a backlog. That's why > there is the automatic de-listing system in place, which requires proper > host names and longer time-to-live (TTL) values in rDNS. > > Yes, it's a bit of work, but it beats waiting for someone to get around > to your ticket. > > No, I'm not associated in any way with SORBS, just an interested > observer and system administrator who has had to deal with listings myself. -- Stefan Hegger Internet System Engineer Stefan.Hegger(a)lycos-europe.com Tel: +49 5241 8071 334 Lycos Europe GmbH Carl-Bertelsmann Str. 29 Postfach 315 33311 Gütersloh

1 0