- Test - lists.nanog.org

Re: monkeys.dom UPL being DDOSed to death
by Dr. Jeffrey Race 24 Sep '03

24 Sep '03

On Tue, 23 Sep 2003 16:32:55 -0500, Jack Bates wrote: >Question: Why is it not illegal for an ISP to allow a known vulnerable >host to stay connected and not even bother contacting the owner? There >are civil remedies that can be sought but no criminal. Various theories of criminal liability could certainly be applied e.g. attractive nuisance (like leaving an unfenced swimming pool for children to drown in). However this kind of very plausible action would take an aggressive public prosecutor with a good computer forensic staff and a seriously injured victim. Since the public prosecutors can hardly handle the criminals at MCI, Enron, the leading finance firms, we may have to wait a while. Jeffrey Race

1 0

Re: Verisign Responds
by Paul Vixie 24 Sep '03

24 Sep '03

> ... > We recommend that any and all TLDs which use wildcards in a manner > inconsistent with this guideline remove such wildcards at the earliest > opportunity." > > What else does the IETF need to do here? issue an rfc. iab is not a representative body, and their opinions are not "refereed."

5 5

Re: New CA Law
by Joe St Sauver 24 Sep '03

24 Sep '03

Hi Leo, #Word is Gray Davis signed this law, #http://info.sen.ca.gov/pub/bill/sen/sb_0151-0200/ #sb_186_bill_20030911_enrolled.html today. It seems to be a pretty #strong anti-spam bill. Given all the talk of black lists and DDOS's #and the like does anyone think this will make a difference? Is #anyone planning on using the law to recover damages? Likewise, Oregon passed (and our Governor signed) SB910 http://www.leg.state.or.us/03reg/measures/sb0900.dir/sb0910.en.html which includes a right of private action with $500 per spam penalties [in the case of spam which "Misrepresents or hinders a person from determining the point of origin or transmission path of the electronic mail message"] among other nice provisions. "Electronic mail service providers" also acquire new rights of action, and some interesting immunities. All that's needed now is litigation support software that can ingest spam submissions, aggregate and summarize appropriately, do automated whois lookups and deobfuscation, and produce digestified ready-to-litigate spam packages for interested attorneys. Regards, Joe

1 0

[Fwd: monkeys.dom UPL DNSBL being DDOSed to death]
by Matthew Sullivan 23 Sep '03

23 Sep '03

Forwarded for your information. That leave 2 proxy DNSbls left - SORBS and DSBL... Looking at the stats for SORBS over at SDSC looks like SORBS is pretty ineffective thanks to the DDoS: (see: http://www.sdsc.edu/~jeff/spam/cbc.html) -------- Original Message -------- From: Jon R. Kibler <Jon.Kibler.multi(a)ng.aset.com> Newsgroups: news.admin.net-abuse.email Subject: monkeys.dom UPL DNSBL being DDOSed to death Date: Tue, 23 Sep 2003 14:26:47 -0400 Greetings to all: I have some really sad news. I just got off the telephone with Ron Guilmette who runs the monkeys.com Unsecured Proxies List DNSBL. I hate to say it, but monkeys.com has been killed. It has been DDOSed to death. Ron says that every aspect of his network is undergoing a massive DDOS attack from thousands of IPs -- apparently many/all spoofed. He has tried to get law enforcement to investigate, but to no avail. He indicated that this is probably the end of his service. This makes two DNSBLs that have been DDOSed to death recently. Which one is next? NJABL? ORDB? The computer security industry really needs to figure out how to get law enforcement to take these attacks seriously. It would only take a few good prosecutions to put an end to these types of attacks. Any thoughts/suggestions? This is really a dark day for those of us fighting spam. It looks like the spammers have won a BIG battle. The only question now is who will be the causality in this war? Jon R. Kibler A.S.E.T., Inc. Charleston, SC USA

3 3

Foundry BigIron series
by william+nanog＠hq.dreamhost.com 23 Sep '03

23 Sep '03

We're considering switching to Foundry BigIrons (probably the 4000, as opposed to Cisco 6500 series switches. We're currently using 7206VXRs). Anyone have opinions (on or off list) on this product? Looking through the archives, I don't notice any discussions of this since about 2001 [1]. (http://www.foundrynet.com/products/l3backbone/bigiron/BigIronx00Datasheet.h…) I'm mostly interested in its BGP implementation, as the boxes would be handling our core routing via BGP. (I haven't noticed anyone complaining about BGP problems in the past year or so); also opinions on the CLI would be helpful (I'm told it's 95% identical to IOS's CLI). The CLI was another complaint in the thread cited below, so I'm curious if it has improved since 2001. I'd be interested in hearing about the comparable Riverstone boxes as well. [1] thread starting at http://www.merit.edu/mail.archives/nanog/2002-09/msg00050.html -- "Since when is skepticism un-American? Dissent's not treason but they talk like it's the same..." (Sleater-Kinney - "Combat Rock")

1 2

Follow up to: [Fwd: monkeys.dom UPL DNSBL being DDOSed to death]
by Matthew Sullivan 23 Sep '03

23 Sep '03

Hi all, Sorry people I had forgotten about EasyNet.nl's proxy list (Wirehub).... and for the record for a proxy spam blocker I don't rate the opm. Yours Matthew

1 0

Re: Providers removing blocks on port 135?
by Mike Tancsa 23 Sep '03

23 Sep '03

At 01:55 PM 21/09/2003, Justin Shore wrote: >On Sun, 21 Sep 2003, Mike Tancsa wrote: > > > Yes, this is all too familiar. Luckily it was not so acute for us. The > > porn company in question was using legit credit cards and we knew where > > they were located. We too got to the point where I had to contemplate > > blocking dialups with no ANI as I had already blocked all access from > their > > phone numbers. However, once they started doing that I called up their > > office yelling and screaming law suits and I guess they figured there were > > other ISPs that didnt care as much and moved on to them. > >I don't know if you did this but if it were me I'd have contacted two >other places. The first would have been the credit card companies with >the stolen credit cards. The credit cards in our case were legit. They were different numbers, but they were not stolen. > They are usuaully fairly responsive when it >comes to them loosing money. Secondly after I contacted the local police, >state BI, and perhaps the FBI (assuming no luck could be had with any of >them) I am in Canada, but I know that it has been stated that the FBI will not investigate computer fraud if damage is under $100,000. >I would have given the story to the local media. There's nothing >like a little bad PR to give law enforcement a little kick in the butt. I doubt a porn company with international clientele would give a toss about what the local media say. >If your newspapers where you're at are anything like our's, they love to >print a good scandal involving the local government. Local government has nothing to do with it. It was just some dime a dozen porn company. ---Mike

3 5

Re: Verisign Responds
by Rich Braun 23 Sep '03

23 Sep '03

Leo Bicknell wrote: >Looks like the lawsuits are going to be the ones to settle this >dispute...anyone think there's a chance of ICANN pulling .COM and .NET >from Verisign due to breach of contract? I think it's highly unlikely. Dave Stewart wrote: >Oh, I dunno... ICANN has no teeth, so that won't happen. Shouldn't one of them smarty-pants attorneys file for an immediate injunction against VeriSign? Looks like plenty of technical arguments have been posted here which even the most dim-witted judge would understand vs. the public position taken by VeriSign that they should keep their cash register jingling with Sitefinder proceeds while the topic is studied and/or fought over for another 24 months. It's obvious to me that the technical arguments fade out quickly if the service is kept up and running. VeriSign cashes in while everyone else incurs the expense of implementing workarounds and bug-fixes. Once the workarounds are in place for more than a couple weeks, there isn't much impetus to put everything back the way it was. Has an injunction been requested? -rich

1 0

RE: Foundry BigIron series
by Joel Perez 23 Sep '03

23 Sep '03

Hey Will, I do not have experience using any Foundry boxes. I do however use Riverstone extensively; my whole network is composed of RS boxes ranging from RS3000's up to RS8600's. I have an RS8600 handling my core routing right now! Im taking full bgp tables from 3 upstreams and several gig and ds-3 links for my OSPF backbone. I used to have a 7206VXR trying to do the same. The cli is in my opinion easier than Cisco's IOS to learn. It has plenty of neat features that make it very user friendly. The only issue I have had is with the way it handles flows. I used to hit 100% cpu utilization when my traffic peaked due to the way the flows were handled. However, the problem was sort of fixed by enabling Riverstone's version of Cisco's CFE and move the flows to the ASIC's in the linecards. Just as an example during my peak usage I move between 300-350Megs of traffic and my cpu barely goes above 10% utilization. The draw back is that I can not use ACL's as effectively in my core, so I moved all my ACL's to my edge routers! Oh, and they are a fraction of the cost of the other big name brands. If you want any more info you are more than welcome to ask. Regards, ---------------------------------------------- Joel Perez <jperez(a)ntera.net> | IP Engineer http://www.ntera.net/ | Ntera 305.914.3412 >>-----Original Message----- >>From: Will Yardley [mailto:william+nanog@hq.dreamhost.com] >>Sent: Tuesday, September 23, 2003 2:55 PM >>To: nanog(a)merit.edu >>Subject: Foundry BigIron series >> >> >>We're considering switching to Foundry BigIrons (probably the 4000, as >>opposed to Cisco 6500 series switches. We're currently using 7206VXRs). >>Anyone have opinions (on or off list) on this product? Looking through >>the archives, I don't notice any discussions of this since about 2001 [1]. >> >>(http://www.foundrynet.com/products/l3backbone/bigiron/BigIronx00Datas heet >>.html) >> >>I'm mostly interested in its BGP implementation, as the boxes would be >>handling our core routing via BGP. >>(I haven't noticed anyone complaining about BGP problems in the past >>year or so); also opinions on the CLI would be helpful (I'm told it's >>95% identical to IOS's CLI). The CLI was another complaint in the thread >>cited below, so I'm curious if it has improved since 2001. >> >>I'd be interested in hearing about the comparable Riverstone boxes as >>well. >> >>[1] thread starting at >>http://www.merit.edu/mail.archives/nanog/2002-09/msg00050.html >> >>-- >>"Since when is skepticism un-American? >>Dissent's not treason but they talk like it's the same..." >>(Sleater-Kinney - "Combat Rock") >>

1 0

Re: Verisign Responds
by Paul Vixie 23 Sep '03

23 Sep '03

> I wonder btw why Verisign didn't catch the "typo's" in their > own domains if they think it is that important: > ... > ;; QUESTION SECTION: > ;wwww.verisign.com. IN A wildcards don't work that way. there are ns rr's in .com for verisign.com, so you get a referral to those servers no matter whether a *.com wildcard exists or not.

2 1