- Test - lists.nanog.org

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Chad Skidmore 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Aaron Glenn [mailto:aaron.glenn@gmail.com] > Sent: Thursday, December 02, 2004 2:52 PM > To: Chad Skidmore > Cc: nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the > makelovenotspam scr eensaver site? > > On Thu, 2 Dec 2004 12:55:02 -0800, Chad Skidmore > <cskidmore(a)go180.net> wrote: > > To your other point, how do you know that other botnets are > not being > > identified and taken down every day by network operators? I > know for a > > fact that they are, they just are not nearly as public as > this one so > > those activities go largely unacknowledged. > > I find that very hard to believe. After getting nailed > (900Mbps/4000 unique hosts from the 1 second network capture > we could get) by a > relatively(?) small botnet, and doing all the hard work for > them, not one of the 20 networks we contacted (9 being very > very large) gave a flying peice of excriment as to what was going > on. > > It wasn't the first and probably won't be the last. Is that > too small a fish to fry? Do ops only care when its 2Gbps of > sustained traffic chocking their border routers, because I'm > half way there... > > </rant> > > Regards, > Aaron > Sorry your experience has been different, this is definitely one of those YMMV kinds of deals. That is a significant attack by most anyone's standards. Getting to the right security team usually ends up being the challenge. Once there however we have found many providers do a great job of dealing with attacks quickly. Use of BGP triggered blackholes can be a great help and going to the NOC/Abuse team with lots of good information from the start helps you get to the people that can pull the attack of quickly. You have to remember that, like all of us, larger service providers have their share of low clue factor customers. The quicker you can help them realize that you have a fairly high clue factor the quicker you'll get to folks on their side with a high clue factor. During times of outages, attacks, etc. it is easy to get agitated quickly and that often times doesn't help you get through the first couple of barrier noc techs. Anyway, just my $.02 worth and as we can see YMMV. Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+fTk2RUJ5udBnvEQIMeACeOEuV1XA64yujh+hKEypGPedyL4kAoN0I tjq/VueRQrb0gjJ2aHxHy4KY =yFzW -----END PGP SIGNATURE-----

2 1

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 4:14 PM > To: nanog list > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > on Thu, Dec 02, 2004 at 08:58:03PM +0000, Christopher L. Morrow wrote: > > > > On Thu, 2 Dec 2004, Steven Champeon wrote: > > > > > > > > on Thu, Dec 02, 2004 at 02:56:29PM -0500, Hannigan, Martin wrote: > > > > Possibly. What will happen if the Lycos botnet gets hijacked? > > > > > > > > The conversations between the clients and the servers > don't appear > > > > to be keyed. If a million clients got owned, it would be the > > > > equivalent of an electronic Bubonic Plague with no antidote. > > > > > > You mean, like the existing botnets we already know exist but are > > > already under the control of spammers? > > > > > > What's the difference? Why is everyone so upset about > Lycos and nobody > > > seems to be doing much of anything about the /existing > botnets/, which > > > conservative estimates[1] already put at anywhere from > 1-3K per botnet > > > to upwards of 1-5M hosts total[2]? > > > > perhaps the difference is 'reponsible people' don't go out > and recruit > > botnets... Lycos, as a corporate entity with it's business > model dependent > > upon the health and wellbeing of the Internet would try to be > > 'responsible', or so I would have thought. > > I agree. I also think it's up to the companies providing the Internet > connectivity to the non-Lycos-"owned" botnets to prevent such activity > from affecting others. > > > arguing that there are murderers and rapists out there and > that 'nothing > > is being done' is hardly reason to become one yourself. > > I couldn't agree more that vigilantism isn't the answer. My earlier > remarks were directed to the shock and awe evident in the possibility > that - via Lycos - there might be, heaven forbid, /large numbers of > computers under the control of spammers, that could be used > in spamming > and abuse/. Can you direct me toward a singluar entity of 1MM bots controlled by a single master? > > All I was pointing out was that, surprise, surprise, there > already are. > So why anyone thinks Lycos' botnet being hacked is /any > different/ from > /the current situation/ is utterly beyond my ken. Why would > any spammer > bother to hack Lycos' botnet? They /already have their own/. I think you might be behind on what's going on in botland lately.

5 6

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 5:21 PM > To: nanog(a)merit.edu > Subject: RE: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > [SNIP] > > > As for go180.net, you don't show up much on my radar, but on > > Nov 9th we were hit by a spammer from > > SpokaneHotZone-63.go180.net [66.225.5.63]. > > I trust this is not a legitimate mail server and I can block > > it and any other host that looks like it within the same > > domain, right? Thanks. > > Otherwise, you may want to do something to distinguish it > > from the other generic hosts in the same range. > > Glad you don't see much from us, must mean that the effort put forth > by some of our team is not going to waste. You are correct, that is > not a legitimate mail server but is an IP from a City Wide wireless > network. That network has since been secured to restrict TCP 25 > outbound (along with other typical miscreant traffic) so you > shouldn't see anything again from that network on port 25. If we rise > up on your radar in the future feel free to make use of the typical > NOC and Abuse e-mail addresses, they do get answered and acted upon > here. > > Glad to hear that. Overall, I'm offering some operational content on the publicity intensive Lycos botnet and provide some level of operational analysis free of judgement of Lycos. I'd be happy to argue about breadth, depth, and width of botnets and their commodity status in email. :) -M<

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 4:28 PM > To: nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > on Thu, Dec 02, 2004 at 04:15:34PM -0500, Hannigan, Martin wrote: > quoting me: > > > My point was to Martin's question about what would happen if - god > > > forbid - there were large botnets under the control of spammers; a > > > careful reading will suggest that my major point was, > duh, that there > > > already are large botnets under the control of spammers. > > > > Um, not 1 million bots - in concert. > > And you know this how, exactly? I'm sure not convinced. http://w3.cambridge-news.co.uk/business/story.asp?StoryID=65877 "Lycos Europe's 20 million users will all be invited to download the software, but it is available to anyone with an internet connection running either Windows or Mac OSX or Mac OS9 operating systems." http://edition.cnn.com/2004/TECH/internet/12/02/anti.spamvigi.ap/ "Around 65,000 people already signed up for the offensive, called "Make Love not Spam" before Tuesday's official launch on a website by the same name, the company said. It is urging its 22 million users to download the screen-saver, but says anyone with a computer is welcome to it."

2 1

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 02 Dec '04

02 Dec '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] > Sent: Thursday, December 02, 2004 4:09 PM > To: nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > on Thu, Dec 02, 2004 at 12:55:02PM -0800, Chad Skidmore wrote: > quoting me: > > >What's the difference? Why is everyone so upset about Lycos and > > >nobody seems to be doing much of anything about the /existing > > >botnets/, which conservative estimates[1] already put at anywhere > > >from 1-3K per botnet to upwards of 1-5M hosts total[2]? > > > > Well, the primary difference is that Lycos is trying to market what > > they are doing as a "good" thing in a fairly public manner. If their > > vigilante efforts become accepted as "OK" then it further opens the > > door for others to take the next step towards making dDOS attacks ok > > as long as you feel your motivations are pure. As network operators > > we all need to make sure that we enforce our AUPs and make it known > > that breaking those AUPs is not ok just because you feel > your motives > > are pure. Most AUPs have some language that basically states that > > dDOS and simlar activities are "bad" and we will take action if you > > engage in said "bad" activities. > > My point was to Martin's question about what would happen if - god > forbid - there were large botnets under the control of spammers; a > careful reading will suggest that my major point was, duh, that there > already are large botnets under the control of spammers. Um, not 1 million bots - in concert. -M<

2 1

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Chad Skidmore 02 Dec '04

02 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----Original Message----- From: Steven Champeon [mailto:schampeo@hesketh.com] Posted At: Thursday, December 02, 2004 12:22 PM Posted To: NANOG Conversation: How many backbones here are filtering the makelovenotspam scr eensaver site? Subject: Re: How many backbones here are filtering the makelovenotspam scr eensaver site? >>on Thu, Dec 02, 2004 at 02:56:29PM -0500, Hannigan, Martin wrote: >> Possibly. What will happen if the Lycos botnet gets hijacked? >> >> The conversations between the clients and the servers don't appear >> to be keyed. If a million clients got owned, it would be the >> equivalent of an electronic Bubonic Plague with no antidote. > >You mean, like the existing botnets we already know exist but are >already under the control of spammers? > >What's the difference? Why is everyone so upset about Lycos and >nobody seems to be doing much of anything about the /existing >botnets/, which conservative estimates[1] already put at anywhere >from 1-3K per botnet to upwards of 1-5M hosts total[2]? Well, the primary difference is that Lycos is trying to market what they are doing as a "good" thing in a fairly public manner. If their vigilante efforts become accepted as "OK" then it further opens the door for others to take the next step towards making dDOS attacks ok as long as you feel your motivations are pure. As network operators we all need to make sure that we enforce our AUPs and make it known that breaking those AUPs is not ok just because you feel your motives are pure. Most AUPs have some language that basically states that dDOS and simlar activities are "bad" and we will take action if you engage in said "bad" activities. To your other point, how do you know that other botnets are not being identified and taken down every day by network operators? I know for a fact that they are, they just are not nearly as public as this one so those activities go largely unacknowledged. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+BJU2RUJ5udBnvEQLzYACg7cc+5QPHyY0km3kK2H4kQ7ovcdMAoOG3 /C/QeyrlyeOxbVu2uQkJPi3a =ybZk -----END PGP SIGNATURE-----

2 1

"Make love, not spam"....
by Fergie (Paul Ferguson) 02 Dec '04

02 Dec '04

Techdirt has an article this morning that discusses how Lycos Europe is encouraging their users to run a screensaver that constantly "pings servers suspected to be used by spammers" and also suggests that "In other words, it's a distributed denial of service attack against spammers by Lycos." The Techdirt article referenced is on Heise Online: http://www.heise.de/english/newsticker/news/53697 I'd be curious to hear what NANOG readers thoughts are on this. Techdirt is located at http://www.techdirt.com/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

8 7

How many backbones here are filtering the makelovenotspam screensaver site?
by Suresh Ramasubramanian 02 Dec '04

02 Dec '04

I've heard reports of traceroutes through several backbones timing out or going !H after a few hops, and I note that the impact seems to have been enough for the site's IP to change .. suresh@frodo 06:56:27 [~]$ dnsip www.makelovenotspam.com 213.115.182.123 suresh@frodo 07:01:16 [~]$ dnsname 213.115.182.123 ua-213-115-182-123.cust.bredbandsbolaget.se Hosted on a cablemodem? Tch, tch, how the mighty have fallen

7 8

Susan's superior?
by Joshua Brady 02 Dec '04

02 Dec '04

Susan, Since you yourself have neglected and ignored my requests via email, and phone; I am now asking if the list has contact information on Susan Harris' supervisor at MERIT. Chances are, I will be censored for this and banned almost immediatly, so off-list replies are greatly helpful. Or anyone who can maybe point me in the right direction. Best Regards, Joshua Brady

1 0

My yearly post about environmental monitoring devices
by Alex Rubenstein 02 Dec '04

02 Dec '04

I'm sure if you peruse the archives, you'll see that I post about this about every year. The answer to your question is 'No, I haven't found what I am looking for yet.' However, the quest I am on is slightly different. I am looking for a device that meets the following criteria. a) Reasonably small. This probably wouldn't be rack mounted; it'd be wall mounted, desk mounted, celing mounted, etc. b) Powered by PoE. c) Is SNMPable over Ethernet. NOT RS232 or serial, or anything archaic like that. Not MODBUS. It's 2004, people. d) Provides Temperature and Humidity. e) Has 4 or so input contact sensors (connections to AC units, etc.) f) Has 4 or so output contact sensors. Help. -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

6 5