- Test - lists.nanog.org

Re: Packet Kiddies Invade NANOG (retry)
by jqtaxpayer＠hush.com 16 Mar '04

16 Mar '04

Sorry about the last post, my client's linewrap seems to not work properly, I'll try again. Hello, I just thought I should chime in here. Below you will find OseK's (Greg Taylor) manifesto sent to EFnet admins during an event last year where OseK was attacking most EFnet servers. Additionally, I can tell you that Greg was attacking my network at some point in the last year, and readily admitted to it at the time. Signed, J. Quincy Taxpayer ----- Forwarded message from Don Crossman <deecee(a)deecee.ca> ----- DO NOT INCLUDE MY EMAIL ADDRESS IN THIS LETTER OR MY NAME KEEP ME ANONYMOUS MINUS MY NICKNAME --------------------------------------------------------------------- --------- -- To whom it may concern, I got by the nickname of OseK on the Eris Free Network, EFNet. I am sending this e-mail in response to certain claims and accusations being made by a few people in an attempt to clear up the situation for those who are both confused and aggitated. I will start off by giving you the reasons for my actions and what my intentions are and why I am taking the actions that I am taking. EFNet, throughout the existance of the network, has seen its good days and its bad. EFNet has had to deal with corrupt, abusive, egotistical opers who work contrary to the best interests of this network, and use their position of power to satisfy whatever ego they have. Unfortunately, for this network it has come to the point where the Network Administrators of certain servers have created an ironfist autocracy so to speak, where they can do whatever they want and answer to nobody. I myself, have put up with this constant abuse for several years. All of these years, every time I'm /killed, I do nothing, every time I'm /klined I do nothing, but most recently, a channel that I run that had no bots, only people, was taken over, mass /killed and set as a TROLL channel on #chanfix over a matter that didn't involve us to begin with. The person who committed this act was Darryl Williams, also known as shi on EFNet. Former torix admin and currently opered on NAC, Mindspring, Easynews, and Security Support. His abusive record extends much farther than even the most notorious criminals. He has run banned hacks on TorIX, has committed countless acts of abuse against users and then taunted those users into attempting to packet torix, which he thought, was invincible. After over 15 warnings to him to watch his actions, after constant emails to irc(a)torix.ca which were either pasted back to me and laughed at, or thrown into the trash bin, and after attempting to talk to various opers on that server to complain, I decided to take matters into my own hands. Either Torix was going to remove his O: line or it would be dropped indefinately. Neither of which happened. I was approached by the admin of torix asking why this was going on and I posted him legit and authentic logs (despite what shi may try to say). The TorIX admin decided because the logs showed too much incriminating evidence against shi, that he would suspend shi's O: line for further review of his future on that server. shi meanwhile utilized a backdoor in the IRCD itself to re-add his O: line and try to hide as a TCM bot. That is the direct reason he was permanently removed from TorIX. For adding himself back without permission from the other admins. Now we will talk about Qeast and what their big deal is. Qeast is WELL KNOWN for being the home of abusive admins in .CA EFNet. xyst and atomix have run server hacks, and have committed various forms of abuse including channel take overs, packeting of other .ca servers in order to reduce those servers max clients, and nickname juping. xyst also sees any potential future hub as a threat to qeast and utilizes his 2 of 4 votes to deny links to such servers. I will bring up irc.magic.ca and irc.total.net which were servers on efnet for many years, who even sponsored qeast's link to efnet, but xyst utilized his 2 votes per server to deny them links. For the record, xyst and shi are friends, they say they aren't but they are. IRCD/HUB IP addresses: These IPs were obtained through several confidential sources, some of which are operlist users, operwall viewers, and opers themselves. I will let you know that the HUB IP I had gotten for Qeast in the 192.77.73.* block which was broadcasting multiple IPs on various ports. I decided to drop the router which is what is currently under attack. Servers that will not be attacked: Servers that will NOT be attacked are those that the admins of said servers and opers, have shown countless times that they are truly here for the network and not for their ego. Opers who work hard every day to provide users with the most comfortable atmosphere to chat in. Opers who follow their own policies and will not allow abusive admins to push them around. These servers include all of .EU EFNet. irc.aloha.net, irc.vrfx.com, irc.nac.net, irc.limelight.us, irc.xo, and more. Take Care, OseK ----- End forwarded message ----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Packet Kiddies Invade NANOG
by jqtaxpayer＠hush.com 16 Mar '04

16 Mar '04

Hello, I just thought I should chime in here. Below you will find OseK's (Greg Taylor) manifesto sent to EFnet admins during an event last year where OseK was attacking most EFnet servers. Additionally, I can tell you that Greg was attacking my network at some point in the last year, and readily admitted to it at the time. Signed, J. Quincy Taxpayer ----- Forwarded message from Don Crossman <deecee(a)deecee.ca> ----- DO NOT INCLUDE MY EMAIL ADDRESS IN THIS LETTER OR MY NAME KEEP ME ANONYMOUS MINUS MY NICKNAME --------------------------------------------------------------------- --------- -- To whom it may concern, I got by the nickname of OseK on the Eris Free Network, EFNet. I am sending this e-mail in response to certain claims and accusations being made by a few people in an attempt to clear up the situation for those who are both confused and aggitated. I will start off by giving you the reasons for my actions and what my intentions are and why I am taking the actions that I am taking. EFNet, throughout the existance of the network, has seen its good days and its bad. EFNet has had to deal with corrupt, abusive, egotistical opers who work contrary to the best interests of this network, and use their position of power to satisfy whatever ego they have. Unfortunately, for this network it has come to the point where the Network Administrators of certain servers have created an ironfist autocracy so to speak, where they can do whatever they want and answer to nobody. I myself, have put up with this constant abuse for several years. All of these years, every time I'm /killed, I do nothing, every time I'm /klined I do nothing, but most recently, a channel that I run that had no bots, only people, was taken over, mass /killed and set as a TROLL channel on #chanfix over a matter that didn't involve us to begin with. The person who committed this act was Darryl Williams, also known as shi on EFNet. Former torix admin and currently opered on NAC, Mindspring, Easynews, and Security Support. His abusive record extends much farther than even the most notorious criminals. He has run banned hacks on TorIX, has committed countless acts of abuse against users and then taunted those users into attempting to packet torix, which he thought, was invincible. After over 15 warnings to him to watch his actions, after constant emails to irc(a)torix.ca which were either pasted back to me and laughed at, or thrown into the trash bin, and after attempting to talk to various opers on that server to complain, I decided to take matters into my own hands. Either Torix was going to remove his O: line or it would be dropped indefinately. Neither of which happened. I was approached by the admin of torix asking why this was going on and I posted him legit and authentic logs (despite what shi may try to say). The TorIX admin decided because the logs showed too much incriminating evidence against shi, that he would suspend shi's O: line for further review of his future on that server. shi meanwhile utilized a backdoor in the IRCD itself to re-add his O: line and try to hide as a TCM bot. That is the direct reason he was permanently removed from TorIX. For adding himself back without permission from the other admins. Now we will talk about Qeast and what their big deal is. Qeast is WELL KNOWN for being the home of abusive admins in .CA EFNet. xyst and atomix have run server hacks, and have committed various forms of abuse including channel take overs, packeting of other .ca servers in order to reduce those servers max clients, and nickname juping. xyst also sees any potential future hub as a threat to qeast and utilizes his 2 of 4 votes to deny links to such servers. I will bring up irc.magic.ca and irc.total.net which were servers on efnet for many years, who even sponsored qeast's link to efnet, but xyst utilized his 2 votes per server to deny them links. For the record, xyst and shi are friends, they say they aren't but they are. IRCD/HUB IP addresses: These IPs were obtained through several confidential sources, some of which are operlist users, operwall viewers, and opers themselves. I will let you know that the HUB IP I had gotten for Qeast in the 192.77.73.* block which was broadcasting multiple IPs on various ports. I decided to drop the router which is what is currently under attack. Servers that will not be attacked: Servers that will NOT be attacked are those that the admins of said servers and opers, have shown countless times that they are truly here for the network and not for their ego. Opers who work hard every day to provide users with the most comfortable atmosphere to chat in. Opers who follow their own policies and will not allow abusive admins to push them around. These servers include all of .EU EFNet. irc.aloha.net, irc.vrfx.com, irc.nac.net, irc.limelight.us, irc.xo, and more. Take Care, OseK ----- End forwarded message ----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Platinum accounts for the Internet (was Re: who offers cheap (personal) 1U colo?)
by Michael.Dillon＠radianz.com 16 Mar '04

16 Mar '04

>I expect every NANOG conference from now on will be filled with >announcements asking people to please fix their computers because >worms are killing the network. NANOG has less than 500 attendees, >yet has about the same number as infected computers as any other >ad-hoc network population. Maybe NANOG needs to implement a system where you have to log in to a web page with your NANOG meeting passcode in order to get a usable IP address. Then, when an infected computer shows up we will know exactly whose it was. Might even be interesting for a researcher to interview every infected party and figure out why it is happening even among a supposedly clueful group. --Michael Dillon

13 17

Re: Packet Kiddies Invade NANOG
by albertpublic＠hushmail.com 16 Mar '04

16 Mar '04

>Matthew (yes I know it is you) No, my name is Albert. >I have not attacked any Internet Service Provider or IRC server >in several years. I am and have been retired from the underground >for a long while now, despite the constant comments made to the contrary >by people who do not represent me in any manner. Yeah, I bet. Guess that explains this exploit you contributed to recently: http://www.l33 (tsecurity.com/get.php?file=13 Furthermore, thanks for admitting to commiting felonies on this list. In case you were unaware, your statute of limitations has not yet expired. Signed, Albert Public (firstname lastname) Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Fw: Packet Kiddies Invade NANOG
by albertpublic＠hushmail.com 16 Mar '04

16 Mar '04

>I was talking more along the lines of disclosing personal information >without >permission Since when was re-pasting entries from the phonebook considered illegal? > slander is another one as well... I suggest you read a legal dictionary, and turn to the definitions of "slander" and "libel". One involves speech, the other involves print. And it's never slander or libel if it's all factually accurate. Unless, of course, you're disputing the accuracy of the phone book. Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: Packet Kiddies Invade NANOG
by albertpublic＠hushmail.com 16 Mar '04

16 Mar '04

>You know how easy it is to fake IRC logs? Yes, I do. And I also know that these aren't fake. I've seen them before, from some respected sources in the ISP security community, and I've also seen Gregory's manifesto sent to the EFNet admins list admitting to having launched DDoS attacks against the servers, and attempting to rationalize his behavior. Are you denying that, too? >I don't know why you people seem to think I'm involved with all >of this stuff. Because you're friends of Andrew Kirch (aka "trelane"), who's Mr. Gregory "OseK" Taylor's right hand man. Guilt by association, and all that. >If you want to show evidence, do it offlist and among yourselves, > because I >don't think people give a crap about your little spats between one >another - >especially not based on IRC logs. Sorry Brian, but I'm not going to play these games. If you can publicly dispute the claims that you and your friends are packet kiddies, I have just as much of a right to post to the list attempting to prove them, or at the least, pointing out the hyprocisy of your ways. Hopefully some prospective employer will find this thread when googling for info on you and your friends, and think twice about hiring you for "security" work. Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

1 0

Re: who offers cheap (personal) 1U colo?
by Michael.Dillon＠radianz.com 16 Mar '04

16 Mar '04

> $50/month at 40U rentable is $2000/rack/month if it's full. And then there's the newer high-density rackmount units like this one http://www.rlx.com/products/serverblades/dense.php This product puts up to 24 server blades in a 3U chassis which basically means you can put 8 times as many servers in a rack. And if any of you have played with things like the Zaurus C760/C860 then you know where all this is headed. $50/month today, $25/month in a year or two, and then in about 5 years it will be a free perk if you sign a two-year contract with your broadband provider. --Michael Dillon

2 1

RE: AS3561 - lights are on but nobody's home?
by Burton, Chris 16 Mar '04

16 Mar '04

I spoke with their NOC about 3 days ago @800.663.9932. Chris Burton Network Engineer Walt Disney Internet Group: Network Services The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact Walt Disney Internet Group at 206-664-4000. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Lewinski Sent: Monday, March 15, 2004 6:48 PM To: nanog(a)merit.edu Subject: AS3561 - lights are on but nobody's home? I know that C&W was supposed to close their US ops, and then it went to re-org and became C&W America or something of the sort, but does anyone here have a clue as to their new support info? Because just a week or so ago 800-486-9932 got me to a real human for support, and now it just rings and rings. And.... $ dig www.cw.net @ns.cw.net ; <<>> DiG 9.2.2 <<>> www.cw.net @ns.cw.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 35298 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.cw.net. IN A ;; AUTHORITY SECTION: cw.net. 600 IN SOA ns1.cw.net. hostmaster.cw.net. 2004031502 3600 600 3600000 600 ;; Query time: 48 msec ;; SERVER: 204.70.128.1#53(ns.cw.net) ;; WHEN: Mon Mar 15 19:40:25 2004 ;; MSG SIZE rcvd: 79 So, anyone else using C&W who might know how I can report a flapping BGP session & open a ticket? TIA, Mike

2 1

Electrical Fire at 2nd + Federal Street
by Tom (UnitedLayer) 16 Mar '04

16 Mar '04

Apparently there's some PG&E problem, and a possible electrical fire. It appears that 501 2nd street is on Generator, and several other businesses on federal and 2nd streets are out of power. Bryant street appears to have spotty power in the area. Anyone else know anything about this? --- Tom Sparks UnitedLayer Office: 415-294-4111 AS23342

1 1

AS3561 - lights are on but nobody's home?
by Mike Lewinski 16 Mar '04

16 Mar '04

I know that C&W was supposed to close their US ops, and then it went to re-org and became C&W America or something of the sort, but does anyone here have a clue as to their new support info? Because just a week or so ago 800-486-9932 got me to a real human for support, and now it just rings and rings. And.... $ dig www.cw.net @ns.cw.net ; <<>> DiG 9.2.2 <<>> www.cw.net @ns.cw.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 35298 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.cw.net. IN A ;; AUTHORITY SECTION: cw.net. 600 IN SOA ns1.cw.net. hostmaster.cw.net. 2004031502 3600 600 3600000 600 ;; Query time: 48 msec ;; SERVER: 204.70.128.1#53(ns.cw.net) ;; WHEN: Mon Mar 15 19:40:25 2004 ;; MSG SIZE rcvd: 79 So, anyone else using C&W who might know how I can report a flapping BGP session & open a ticket? TIA, Mike

2 1