- Test - lists.nanog.org

Re: ARIN whois
by Dean Anderson 23 Nov '99

23 Nov '99

Gee. We operated relay services for almost 4 years with only one incident before this summer. Since the antispammers started inciting attacks, we've been attacked more than 2 dozen times since July. Coincidence? I think not. Also, there aren't very many _real spams_ in the attacks. The attacks are spamlike, but generally not spam. But the content of the messages doesn't matter. I don't care if its spam or not spam. Services rendered are worth money. We are entitled to collect the money regardless of the purpose of the relayed messages. If the money exceeds $5000, the unauthorized access becomes criminal. We complain to FBI. The "relayer" will be found. And we are still entitled to the money for the services provided. --Dean Around 10:16 PM 11/21/1999 -0700, rumor has it that Forrest W. Christian said: > >On Sun, 21 Nov 1999, Kai Schlichting wrote: > >> THEY WILL FIND YOUR RELAYS ON THEIR OWN, AND THEY WILL ABUSE THEM, NO >> MATTER HOW LOUD YOU SCREAM. > >In transition to a new mail server (with a new address), I installed a >plug-gateway on the old server to redirect mail. > >Unfortunately, plugd hides the ip address of the sender, and since I trust >my netblocks, all of the ip addresses on the old server became "spam relay >entry points". > >It took the spammers 96 hours to find 3 of the addresses on that box and >for us to be listed in orbs. I figured I would have at least had a week >or two to figure out a better way. > >I ended up staying up all night getting transparent proxying to work right >on the new server and making it work with a cisco route-map. > >- Forrest W. Christian (forrestc(a)imach.com) KD7EHZ >---------------------------------------------------------------------- >iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com >Solutions for your high-tech problems. (406)-442-6648 >---------------------------------------------------------------------- > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Dean Anderson 22 Nov '99

22 Nov '99

We're up to 80K and rising. 2 big ones. Some smaller ones over 5K. Most the rest are under $500. Unless we can pin them to one or a small group of people. Then all their attacks are summed. A number of small attacks over a short period can then be criminal. This amount interests both lawyers and collections companies. --Dean Around 04:07 PM 11/22/1999 -0600, rumor has it that Joe Shaw said: > >What "legitimate business purposes" necessitate leaving SMTP relays open >to the world? While I think spammers shouldn't be spamming, I think >you'd find it better to do what you can to stop them from spamming via >means you control, i.e. your servers, as opposed to going through the >FBI. > >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. > >Your best bet is to find a solution to restrict access to your relays. > >-- >Joseph W. Shaw - jshaw(a)insync.net >Free UNIX advocate - "I hack, therefore I am." > >On Mon, 22 Nov 1999, Dean Anderson wrote: > >> >> These are coming from Mass, Cleveland, Ohio, and Virginia. >> >> We use our relays for legitimate business purposes. They are not "accidentally left open". >> >> --Dean > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Postmaster notify: Host unknown (Name server: servertest.com: host not found)
by Dean Anderson 22 Nov '99

22 Nov '99

Look. Just got 30 of these. First international relay. Coincidence that it happened today? Or is it more likely the culprit is on this list? That is, a malicious antispammer. Actually, we were probed by someone at dansk telecom a few weeks ago. From a non-customer machine. Hmm. --Dean >X-Persona: <Av8> >>From MAILER-DAEMON Mon Nov 22 16:53:46 1999 >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >To: postmaster >Subject: Postmaster notify: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (postmaster-notification) > >The original message was received at Mon, 22 Nov 1999 16:53:46 -0500 (EST) >from localhost > > ----- The following addresses had permanent fatal errors ----- ><mail_from(a)servertest.com> > > ----- Transcript of session follows ----- >550 <mail_from(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) > >Final-Recipient: RFC822; mail_from(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <MAILER-DAEMON> >Received: from localhost (localhost) > by odie.av8.com (8.9.3/8.8.5) with internal id QAA28557; > Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >Message-Id: <199911222153.QAA28557(a)odie.av8.com> >To: <mail_from(a)servertest.com> >MIME-Version: 1.0 >Content-Type: multipart/report; report-type=delivery-status; > boundary="QAA28557.943307626/odie.av8.com" >Subject: Returned mail: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (failure) > >The original message was received at Mon, 22 Nov 1999 16:53:45 -0500 (EST) >from ip111.arcnxr5.ras.tele.dk [195.249.99.111] > > ----- The following addresses had permanent fatal errors ----- ><rcpt_to(a)servertest.com> > > ----- Transcript of session follows ----- >550 <rcpt_to(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) > >Final-Recipient: RFC822; rcpt_to(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <mail_from(a)servertest.com> >Received: from server-test (ip111.arcnxr5.ras.tele.dk [195.249.99.111]) > by odie.av8.com (8.9.3/8.8.5) with SMTP id QAA28555 > for <rcpt_to(a)servertest.com>; Mon, 22 Nov 1999 16:53:45 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) >From: mail_from(a)servertest.com >Message-Id: <199911222153.QAA28555(a)odie.av8.com> >Subject: SERVER_TEST > >TEST MESSAGE > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Derek J. Balling 22 Nov '99

22 Nov '99

No offense to all, but you are ALL wasting your time trying to convince Dean through logic on this topic. We've all been round and round the same discussions on the anti-spam mailing lists, and Dean continues to insist that he MUST run open relays. Dean appears to be completely impervious to logic, so don't waste your time sending it his way. :) D At 04:07 PM 11/22/99 -0600, Joe Shaw wrote: >What "legitimate business purposes" necessitate leaving SMTP relays open >to the world? While I think spammers shouldn't be spamming, I think >you'd find it better to do what you can to stop them from spamming via >means you control, i.e. your servers, as opposed to going through the >FBI. > >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. > >Your best bet is to find a solution to restrict access to your relays. > >-- >Joseph W. Shaw - jshaw(a)insync.net >Free UNIX advocate - "I hack, therefore I am." > >On Mon, 22 Nov 1999, Dean Anderson wrote: > > > > > These are coming from Mass, Cleveland, Ohio, and Virginia. > > > > We use our relays for legitimate business purposes. They are not > "accidentally left open". > > > > --Dean

3 2

History question, Morris worm
by Sean Donelan 22 Nov '99

22 Nov '99

>and what's more fun, when they come back up on jan 3 or whatever, they will >have whatever y2k problems then. I recall after the Morris worm hit the Internet, reading a report sites which unplugged their ARPANET connection were down longer than sites which remain connected and got repair information over the net. Does anyone else remember that, and knows a citation for the report (or news story) I'm recalling? Thanks.

4 3

Re: History question, Morris worm
by Dean Anderson 22 Nov '99

22 Nov '99

I don't have paper or email documentation. I know what I know because the friend was Andy Sudduth. He was the first postmaster at the OSF. I came to work at the OSF a several months after the worm was released, and heard the story from the other Computer Facilities people who were there at the time. I think that Sudduth testified at the trial, but he had left the OSF by the time the case went to trial. So I think this was all discussed in the court documents of Morris' prosecution. Those should be public domain. --Dean At 06:24 PM 11/21/1999 -0800, George Herbert supposedly said: > >I have printouts of all the Usenet traffic which was Worm-related >(not 100%, but close) over the few months immediately after. >I don't recall that story coming out. That doesn't mean it >didn't happen, but I'd like to see some documentation. > > >-george william herbert >gherbert(a)crl.com > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: History question, Morris worm
by George Herbert 22 Nov '99

22 Nov '99

I have printouts of all the Usenet traffic which was Worm-related (not 100%, but close) over the few months immediately after. I don't recall that story coming out. That doesn't mean it didn't happen, but I'd like to see some documentation. -george william herbert gherbert(a)crl.com

1 0

Re: History question, Morris worm
by Dean Anderson 22 Nov '99

22 Nov '99

I don't have a reference, but I suspect that what you are thinking of is that CSNet shutdown very early, preventing the innoculation message (sent by Morris via his friend from the OSF which was a CSnet customer) from getting out for 3 days. The worm was <probably> released from MIT, and Morris <probably> went across the street to the OSF to see his friend from his undergraduate days at Harvard about the problem. They composed and sent out a message describing the worm, its accidental escape, what it exploited, and how to stop it. But CSnet had already shutdown and the message stayed in queue at the OSF for 3 days. Much of the panic was due to the lack of communications about the nature of what was going on. This was made worse by sites shutting down. Morris' message didn't get out for 3 days. By then, Spafford and others had decompiled and analyzed the program, figured out by themselves how to stop it, and were making fun of it. And they were pissed. Due to lack of information, they assumed it was hostile. If the innoculation message had gotten out early on, fears of a hostile attack would have been allayed, and people would not have responded as though under hostile attack. So, I suppose CSnet bears some responsibility for the ensuing panic, and Morris' subsequent prosecution. --Dean Around 03:50 PM 11/21/1999 -0800, rumor has it that Sean Donelan said: > >>and what's more fun, when they come back up on jan 3 or whatever, they will >>have whatever y2k problems then. > >I recall after the Morris worm hit the Internet, reading a report sites >which unplugged their ARPANET connection were down longer than sites which >remain connected and got repair information over the net. > >Does anyone else remember that, and knows a citation for the report (or >news story) I'm recalling? > >Thanks. > > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: ISP Address Allocation
by Aleksi Suhonen 21 Nov '99

21 Nov '99

Hello, Let me guess: you want to make demographics of different ISPs' users for web advertising purposes and that is why you need to know which IP belongs to which ISP. RIPE database licence says you can't use their data for that purpose and I would be surprised if ARIN (or any of the others) allowed it. (Just as a reminder.) -- Aleksi Suhonen

1 0

Re: ARIN to Allocate from 64.0.0.0/8
by Aleksi Suhonen 21 Nov '99

21 Nov '99

Hello, Richard Steenbergen and Kai Schlichting discussed how this new allocation policy affects ingress filtering. I was disgruntled too when I heard of it for the same reason. The way I fixed it was that I just changed the filter from 64.0.0.0/2 to 96.0.0.0/3. It isn't as perfect though of course. -- Aleksi Suhonen

1 0