- Test - lists.nanog.org

Sumbit Internet Account v1.1 (fwd)
by Dax Kelson 26 Mar '98

26 Mar '98

The bad part is this guy sounds like he really thinks he has made a "contribution" to the Internet at large. Even stating the savings in Internet access as a selling point. Dax Kelson Internet Connect, Inc. ---------- Forwarded message ---------- Date: Wed, 25 Mar 1998 10:59:23 -0700 From: Dax Kelson <dkelson(a)INCONNECT.COM> To: BUGTRAQ(a)NETSPACE.ORG Subject: Sumbit Internet Account v1.1 I just received a spam trying to sell me this lovely trojan for only $50. Another reason not to run programs emailed to you (even if it is punch_the_spice_girls.exe). I've mirrored (not the executable) the site in case it goes away: http://www.inconnect.com/~dkelson/SIA Dax Kelson Internet Connect, Inc. ======================================================================= http://www.germany.net/teilnehmer/100,92316/SIA/index.htm "SIA is the most powerfull util to get login names and passwords from other computers." "You give the program to a person and say its a game or something like this. Once started, the programm simulates a runtime error. People now think: "shity program don't work". They will uninstall it. But SIA installed itself on a secret place. The next time the person turns on his computer, SIA loads into the memory and waits until there is a Internet connection and then sends out all information from the "Dial-Up Networking" to your e-mail address. Turning of the computer won't help at all." =======================================================================

1 0

Re: IP over SONET considered harmful?
by Peter Lothberg 26 Mar '98

26 Mar '98

> As great as POS is, and as exciting as running IP on optical OC-48 onto WDM > gear sounds (no piece of cake, believe me...) It is a pice of cake, just belive me. > there is STILL room for > ATM. More than just the much-touted network traffic engineering value, too. This is not a pice of cake. -Peter

1 0

Re: Internic hosage (fwd) (The real end)
by Dean Anderson 26 Mar '98

26 Mar '98

At 5:23 AM -0500 3/26/98, Rich Sena wrote: >On Sun, 22 Mar 1998, Dean Anderson wrote: > >> Ah. Only girls with lowcut blouses and short skirts are raped. Since I >> don't wear lowcut blouses or short skirts, I have nothing to worry about, >> and shouldn't be concerned. Rape is OK, since it only happens to the sleazy >> girls. Uh Huh. When can I screw the interns? Say, you aren't hosting any >> porn or uncensored webcams are you? Boy, I think they're sick. Lets make >> sure we disconnect the entire lot, and any ISP/NSP who refuses to cooperate >> we'll just DoS them until they are pounded to dirt, like AGIS. Hey look, >> I think they are irresponsible. I'm justified in harassing them and >> publishing false routes etc. Right? >> >> I expect some kind of gaussian distribution of harassment develops where >> everyone gets harassed by some lunatic, and can't do anything about it. >> Eventually, somebody mails a bomb. To me? To you? To some kid in Vermont? >> You're smarter than that. I think. Besides, I react badly to coercion. So >> do most people. Thats why we need laws. Sensible ones at that. > >What type of crack are you on Dean? Your analogy is a mockery of the whole No crack. Just a cool, drug-free and relaxed guy, who thinks these anti-spammers need to get a life or maybe a dog to get rid of some stress. My analogy is a mockery of something. We just disagree on what it's a mockery of. Anti-spammer terrorists have no moral high ground. Even the Islamic fundamentalists believe they are doing Allah's work. Anti-spammers believe they are making the world what? More convenient? >Whose responsibility is YOUR dog - and if you don't curb your dog, and I >have to, I will definately make sure you do not enjoy and want to >avoid the experience in the future. Ok, here's a metaphoric response: Unfortunately, you don't get to kill the neighbors dog because it shit in your yard. True, in many big cities, there are ordinances which require dog owners to scoop up their dog shit, and keep all dogs on a leash. In most places places however, there aren't any such ordinances. You find shit in your lawn, tough. Go to the city council. Get an ordinance passed. Until you get an ordinance passed, and even if you do get an ordinace passed, it's going to be illegal to shoot your neighbors dog. I don't have any dogs. But I'm not going to stand idly by while you start shooting up the neighbhood trying to get rid of dog shit. I'm also not going to participate in your scheme to poison all the dogs in town. Dogs shit. Its what they do. You have to put up with a little shit in life. People act like the world is about to end because of a little dogshit. "Must... Stamp.... Out.... Dogshit... Kill... Dogs... At... All... Costs... Break... Gun... Laws... Shoot... Kill... Save... Humanity... From... Dogshit..." You're drooling. ;-) So, basically, I think anti-spammer terrorists are just like the jerks who run around trying to have dogs put to sleep, all because they are so terribly upset about a little dogshit in their lawn. Its not a big deal. After the next rain, its fertilizer, and their lawn grows greener. Some people are just over-reactive assholes. End of metaphor. How about that. Two issues we disagree on. On the other hand, there are some things about spam that should be regulated. There are postal service laws which apply to junk mailers, which prohibit things like pyramid schemes, a few other obscure crimes that happen via postal mail and could possibly happen over email. Junk mailers also must remove people from lists within 30 days. The post office maintains the list of who to remove, not the junk mailers. These are all quite reasonable things to apply to spammers. I'm for that. Just not for banning spam, nor violating laws to stop it, nor for vigilante activity in general. The paper or electronic media over which these crimes are committed shouldn't really matter. My proposal has been to make these laws essentially media-independent. It curbs the abuse legally. It just doesn't satisify the radicals who want to ban spam at any cost. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

Hello All, I have a customer who is being ping-flooded. His bandwidth is being sucked up due to these floods, and wishes me to block them on my router. I am somewhat reluctant to do this, since it goes against our policy; however, the customer has been very patient with us on this issue and his patience is running out. I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, and the customer hangs off the router on a T-1. What is the general consensus on providing such a service, particularly in terms of processing overhead and manageability. Is there another way to prevent this type of attack, aside from watching packets go by and trying to trace it back through the source. The source IPs are spoofed. Thanks! Christian Martin

3 4

Ellipse - a new anonymous ftp server implementation
by ikuo＠ellipse.org 26 Mar '98

26 Mar '98

Hi all, We are very grad to announce an alpha release of the `Ellipse' which is a new anonymous ftp server implementation. A few Ellipse processes (one is the master and others are pre-forked processes) can handle a lot of ftp clients at a same time. So, it requires less memory or process resources to serve a large number of ftp sessions. Ellipse is designed to serve ANONYMOUS ftp services only. So it is VERY SECURE. For example, it calls chroot system call and leaves from any privilege mode before accepting connections. IPv6 extensions, such as LPRT, LPSV are also supported. We tested IPv6 extensions with INRIA and Hydrangea. For more details, see http://www.ellipse.org/ or README in a distribution. The newest distribution can be found in: ftp://ftp.ellipse.org/pub/net/ellipse Best regards, Ikuo Nakagawa

1 0

Re: Internic hosage (fwd)
by Dean Robb 26 Mar '98

26 Mar '98

At 10:54 3/19/98 -0500, Eric Eden wrote: >Dalvenjah, > >Thanks for your feedback. Network Solutions served over >35 million WHOIS queries in the month of January 1998. >The average response time for our WHOIS service is less >than 5 seconds per query. Thank you for the statistics. Not sure of their applicability, but it's nice to know just how heavily used this database is. Hmmm...one would think that if it's that heavily hit, maybe there would be some interest in keeping it accurate, yes? > >Please keep in mind that Network Solutions is not the >registry for the .to domain. We recommend you contact >the Tonic registry for information about .TO domain names. >Their web site is www.tonic.to And it's the Kingdom of Tonga's domain, for which Tonic is merely the Registry. However, the point has been completely missed here, Eric. The point Dal was making is that Perhaps.youwant.to FALSIFIED, LIED, FORGED, STOLE, MISAPPROPRIATED, and otherwise BS'd about their WhoIs entry: [No name] PERHAPS-HST Hostname: PERHAPS.YOUWANT.TO Address: 205.166.250.10 System: ? running ? Coordinator: HOST Networks-DNS Administration HNA-ORG hostmaster(a)HOST.NET 800-697-2437 Fax- 800-697-2437 Record last updated on 16-Mar-98. Database last updated on 20-Mar-98 04:11:54 EDT. [perhaps.youwant.to] Translated Name: perhaps.youwant.to IP Address: 207.89.50.3 Internet Gateway Connections (NETBLK-IGC-FL-BLK-1) 10011 Pines Boulevard - Suite 203 Pembroke Pines, Florida 33024 Netname: IGC-FL-BLK-1 Netblock: 207.89.0.0 - 207.89.127.255 Maintainer: IGCN Coordinator: Master, Host (HM511-ARIN) mike(a)WEB2000.NET 305-655-2955 (FAX) 305-652-5090 Domain System inverse mapping provided by: NS3.WEB2000.NET 207.89.0.10 NS4.WEB2000.NET 207.89.0.30 Record last updated on 17-Aug-96. Database last updated on 19-Mar-98 16:08:42 EDT. Traceroute confirms that youwant.to is hosted by Web2000.net. The WhoIs-listed IP is user.host.net, the machine on which Host.Net runs their webpage, FTP, et al. Not real likely they'd give that out for a hosted domain's IP. So....four days ago, youwant.to [side issue: Why does a machine, "perhaps", have a host entry in WhoIs, but the domain, "youwant.to" not?] updated their WhoIs record with a bunch of lies. THAT is the point, and the problem. What is NSI/InterNIC going to do about it, Eric? > >Regards, > >Eric Eden >Senior Analyst Network Solutions, Inc. >Phone: 703-925-6710 erice(a)internic.net Spam: it's not just for breakfast anymore.... Dean Robb PC-Easy On-site computer services (757) 495-EASY [3279]

14 30

Re: Hope it's operational enough....
by Chris MacFarlane 26 Mar '98

26 Mar '98

Send me some private mail and I will line you up with an account on Internet Canada/ACC. We have dialup in all major Canadian cities. Chris MacFarlane Manager, Data Operations ACC Telenterprises Canada 4162132023 cmacfarlane(a)acc.ca cjm(a)ican.net -----Original Message----- From: Randall S. Benn <rbenn(a)clark.net> To: Howard C. Berkowitz <hcb(a)clark.net> Cc: nanog(a)merit.edu <nanog(a)merit.edu> Date: Wednesday, March 25, 1998 9:20 PM Subject: Re: Hope it's operational enough.... >On Wed, 25 Mar 1998, Howard C. Berkowitz wrote: > >> I'm going to be in Canada a fair bit in the near term, but in a number of >> different cities. Are there any Canadian ISP's that have local dial access >> in most major cities? So far, from south of the border, I only find ones >> in specific cities. > >Howard, > >Check out IBM. They have by far more local dial numbers scattered around >the planet than anybody. For $20/month you can get a local connection >just about anywhere. At a quick glance, looks like they have almost 50 >numbers throughout Canada. > >Check out their list of local dial numbers at: >http://www.ibm.net/hlpctr/html/access_numbers_accessnum.html > >Randy > >-------------------------------------------------------------------- >"Cisco Systems In A Nuthsell" >http://www.clark.net/pub/rbenn/cisco.html >-------------------------------------------------------------------- > > >

1 0

Hope it's operational enough....
by Howard C. Berkowitz 26 Mar '98

26 Mar '98

I'm going to be in Canada a fair bit in the near term, but in a number of different cities. Are there any Canadian ISP's that have local dial access in most major cities? So far, from south of the border, I only find ones in specific cities. TIA... Howard

2 1

RE: Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

It is more of a case of at all. My associates feel that if a downstream ISP pissed someone off, it is their problem to solve, not ours. We do filter traffic not destined for our IP space at our borders, but, for the same reasons you stated, do nothing outbound, except on our BGP sessions where we don't want certain netblocks routed in the Internet. My concern is, if a perpetrator is persistent enough, he can write a ping flood program that uses some obscure ICMP type that is rarely used, say net-tos-redirect, and get in that way. Even if we were to block ICMP completely, which would take away source-quench, he could use UDP, or perhaps even TCP syn floods and the like to get at this guy. Either way, it is a difficult situation. Moreover, it is difficult to trace this stuff back through, because I have to get every ISP, NSP, etc, etc involved in order to trace spoofed IP addresses. Ho do you block spoofed IP addresses? I am already blocking ICMP redirects and IP source routed packets. Is there a better way, or should I just tell my customer to deal? I want to prevent this from consuming my bandwidth as well. Thanks! -Chris Deepak Wrote Are you trying to avoid a precedent of filtering at all or just filter at a whim? I don't think its really possible nowadays to be responsible and not do _any_ filtering. I'd love to be able to not, but sometimes we have to. We also block source routed packets at our borders. We filter all inbound traffic to make sure it is destined for IPs that we route for (we can't filter outbound both by policy and technical difficulty). -Deepak. On Wed, 25 Mar 1998, Martin, Christian wrote: > That is what I am going to do. But with over 100 downstream customers, > and IOS 11.1 (sans named access lists) I don't want to start a > precedent. > > Thanks! > > > > On Wed, 25 Mar 1998, Jain Depak Wrote > > Why not just filter all ping traffic to his T1 until the attack > subsides? > > -Deepak. > > On Wed, 25 Mar 1998, Martin, Christian wrote: > > > Hello All, > > > > I have a customer who is being ping-flooded. His bandwidth is being > > sucked up due to these floods, and wishes me to block them on my router. > > I am somewhat reluctant to do this, since it goes against our policy; > > however, the customer has been very patient with us on this issue and > > his patience is running out. > > > > I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, > > and the customer hangs off the router on a T-1. What is the general > > consensus on providing such a service, particularly in terms of > > processing overhead and manageability. Is there another way to prevent > > this type of attack, aside from watching packets go by and trying to > > trace it back through the source. The source IPs are spoofed. > > > > Thanks! > > Christian Martin > > >

3 2

RE: Access Lists
by Martin, Christian 26 Mar '98

26 Mar '98

That is what I am going to do. But with over 100 downstream customers, and IOS 11.1 (sans named access lists) I don't want to start a precedent. Thanks! On Wed, 25 Mar 1998, Jain Depak Wrote Why not just filter all ping traffic to his T1 until the attack subsides? -Deepak. On Wed, 25 Mar 1998, Martin, Christian wrote: > Hello All, > > I have a customer who is being ping-flooded. His bandwidth is being > sucked up due to these floods, and wishes me to block them on my router. > I am somewhat reluctant to do this, since it goes against our policy; > however, the customer has been very patient with us on this issue and > his patience is running out. > > I would be implementing on a Cisco 7507, with 3 T-3s to the Internet, > and the customer hangs off the router on a T-1. What is the general > consensus on providing such a service, particularly in terms of > processing overhead and manageability. Is there another way to prevent > this type of attack, aside from watching packets go by and trying to > trace it back through the source. The source IPs are spoofed. > > Thanks! > Christian Martin >

2 1