- Test - lists.nanog.org

Status Report - Mail Bombing of World.std.com by Sprint Client + FAQ
by Barry Shein 06 Jan '97

06 Jan '97

We are now well into day four and about to enter day five of this. As of about 9PM EST the mail-bombing of world.std.com by the Sprint client iq-internet.com continues full bore. It had stopped between about 8AM EST until about 8PM EST Sunday 1/5/97 and then restarted leading me to believe someone at iq-internet.com manually restarted the mail-bombing. There is no reason to believe there were any 12 hour connectivity problems between us or similar external explanations, someone at iq-internet.com most likely noticed it had stopped and restarted it. Sprint's position (explained to me at around 8:45PM EST when I called to report this status, also emailed Sprint the logs) is that they will meet during business hours tomorrow (Monday 1/6/97) to discuss this issue. To save hearing the obvious suggestions etc again, increasing traffic on these lists here is a brief FAQ: Q1. Are you (std.com) a Sprint customer? A1: No, we are not. Q2: Why don't you just block it at your router? A2a: It's effectively blocked at our host, which no doubt is faster than the router anyhow (a 16 cpu SGI Challenge XL w/ 1.5GB ram), but this gives me full logs. A2b: Note that blocking it at the router does nothing to free up our bandwidth to the internet we are trying to provide to our customers. Since the path between our router and world.std.com is a 100mb/s FDDI letting it go that one more hop is inconsequential to the harm being done. Q3: Ok, why don't you ask your provider (Alternet) to block it? A3a: A lot of this has to do with Sprint's reluctance to deal with their customer in any timely manner (four days, including two weekdays, would seem sufficient for them to simply put one route block in at iq-internet.com's router.) I want the logs for now, I want the bigger problem which seems to prevent Sprint front-line NOC personnel from fixing operational problems fixed. Burying it as another router block at our end or our backbone provider's end doesn't deal with the real problem here, that Sprint has policies in place preventing them from dealing with malicious, disruptive and damaging customers. A3b: Yes Alternet has offered to do this as soon as I request it. Q4: Why don't you email bomb, SYN attack, etc the host doing this to you? A3: Although I have sent a lot of email to a lot of accounts at the host periodically asking them to stop I don't think malicious behavior will help get to the root problem here which is Sprint's policies forbidding their personnel from intervening into even the most egregious and outrageous abuse of network facilities without self-defeating and lengthy bureaucratic process (I think that's a fair characterization as we go into the FIFTH day of this.) Q5: Ok, why don't you redirect it to addresses at sprint or mailbomb them or something similar to get their attention? A5: Again, self-defeating. But it is nice to know the people who are empowered to make this decision are enjoying *THEIR* weekend. Q6: Do you believe this is an isolated incident or a real failure in policy at Sprint? It seems fairly outrageous that they can't stop a customer whose behavior is so malicious, it doesn't seem possible that the customer doesn't know that this has gone way beyond "spam". A6: I believe this is a total failure of express Sprint policy and not an isolated incident in any way. I have been told many times now by Sprint personnel (at their NOC) that official policy forbids them from acting against this mail-bombing and there exists no process to get a decision made otherwise which takes less than the five days it looks like it is going to take (eg, there's no single manager they can call who has the authority to order the route block or some action be taken, or these people feel they can put such decision-making off until it is convenient for them personally.) Q7: Well, I can see Sprint's reluctance to block this loathsome creature entirely from the net without some process, these are litigious times, but you're saying Sprint refuses to even block the single route between iq-internet.com (the mail-bomber) and your host? Is there any legitimate reason for this site to be able to get to your host? A7: Yes, I am saying that Sprint policy is such that their personnel is not authorized to install even one route block without lengthy bureaucratic process taking several days. Q8: Why do you think this is so? A8a: Because there is an atmosphere of fear, essentially, at Sprint's NOC and their personnel have been completely unempowered from taking operational actions they know are required of them to operate within the greater internet. Essentially, they (Sprint policy-makers) apparently believe that any damage to the greater internet or any host or site is less important than their ability to run internal bureaucratic process at whatever pace and using whatever management style which suits them. A8b: As far as I can tell once they identify a customer as a "spammer" then they can take no action against him, no matter what the actual behavior is. At this point this is clearly an operational/technical problem, the "spam" has been blocked for four days now, the spammer has been told this, yet messages are still being looped from his machine almost non-stop. It is only via some bizarre exercise in "mind-reading" that someone, in my opinion, could surmise that the perpetrator's intention is to deliver advertising to mailboxes at our site. Yet, Sprint personnel are not empowered to do anything about this without lengthy internal process. Q9: Wow, this is quite outrageous, I'd go so far as to say "scary". Many of us sit here naively thinking that large companies such as Sprint selling internet services basically do their jobs within some reasonable range of quality, but this sounds like a very deep and worrisome failure of management at Sprint. How can any network emergencies be taken care of if they won't let their front-line NOC personnel take any operational responsibility, and it takes days and days to escalate internally what seem to be relatively straightforward problems with straightforward solutions which really should be dealt with quickly, in minutes, or certainly a very few hours? A9: No comment. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989

8 8

Continuing on medical emergency...
by Howard C. Berkowitz 06 Jan '97

06 Jan '97

Tnanks to everyone who has responded. Unfortunately, this is not a joke. The person involved is one whom I've been corresponding for some time, and have been giving some medical advice within my expertise. Her last message to a chat room gave the name and dose of the overdose I have been trying the numbers given in the whois response, but have just been getting voicemail. I'm sending email to every address I can guess might be a support person at uniserve.com. I have called the Vancouver police, but they are stumped--I can't reach anyone above the telephone supervisor level. Altavista searches on the email name have turned up nothing.

2 1

quick update #2 (Sprint continues to defend network terrorism)
by Barry Shein 06 Jan '97

06 Jan '97

Just got off the phone with Sprint Security again, they absolutely refuse to stop the continuing (as of 15:40 EST Sat 1/4/97) mail bombing / mail loop of world.std.com from iq-internet.com, about 1,000 msgs today so far, well into the third full day of this. Understand: Sprint absolutely refuses to put ONE route block into their router at iq-internet.com between them and std.com. I did not ask them to shut the host down, shut their internet access down, etc. I simply laid out the problem of one site sending thousands upon thousands of msgs at us in a software loop, all going down a rathole (since we're blocking them), and asked Sprint to just please block this one route between us (and, with luck, deal with their customer but that's their problem ultimately.) Sprint refuses, apparently asserting that this one host has every legal right to bomb my (or I assume any) host with anything he likes via a Sprint connection and they will not acknowledge the possibility that this is merely software at his end out of control, or a person so malicious in their action that this one action should be blocked until it can be looked into, one action, merely the single path between iq-internet.com and std.com. Actually, the tone of the person I just spoke to at Sprint just now indicated to me they, meaning the individuals within Sprint security, may be now allowing this to go on purposely because they're now (since they're impotent to do anything about all this) getting annoyed with me calling them and asking them to please stop this every few hours etc. Well, sorry Sprint, so long as this guy keeps bombing my system non-stop I'm going to keep asking you to stop it every few hours (that's all that's gone on.) I'm not going to let you later say "hey we didn't know why didn't you tell us we thought it stopped!" etc. Sprint has now abandoned all rights or claims to be treated as reasonable people or fairly, they've had three days to assert their responsibility, others will now have to take responsibility for their absolutely reckless behavior. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989

4 3

Medical Emergency Help
by Howard C. Berkowitz 06 Jan '97

06 Jan '97

This is off the wall, but I'd appreciate any suggestions. The most urgent thing -- does anyone know a 24 hour number, pager, or anyone personally at uniserve.com in vancouver? Their upstream provider does not. I have a email/chat room friend that has apparently taken a drug overdose attempting suicide. I only have her email address; a finger gives back her husband's name which is not a listed phone. THe only way I can think of is to reach someone at Uniserve who has access to the billing records for the account. Thanks for any help. Howard Berkowitz voice (703)998-5819/5017

1 0

None
by JAOHDXS 06 Jan '97

06 Jan '97

.ATLXNXS 041401 Attn : On Duty >From : Benoit Be adv that for the past week we have been receiving a great deal of internet message from and to the below sender. It seems as if the sender is communicating with someone. All the messages are messages are addressed to atlxnxs but the funny thing about it is that no one here is communicating to them.. And when an attempt to contact these persons with the address below we are unable to do so...Can you provide any assist to getting ATL out of the address line....thks supplementary sender/recipients information from DD.RFC-822=owner-nanog(a)merit.edu/INTERNET to DD.RFC-822=alex(a)relcom.eu.net/INTERNET cc DD.RFC-822=nanog(a)merit.edu/INTERNET

1 0

Policies affecting the Internet as a whole - Hitting where it hurts
by Chris A. Icide 06 Jan '97

06 Jan '97

There is a certain individual at a certain ISP in the .ro domain. I have yet to determine if this user is the owner of said ISP or if they are but a user. As it may be, this person has been responsible for many hacking attempts, including the destruction of several UNIX systems (rm -rf* after gaining root) in other ISP's. The person is also suspected to have been an initiator of Severl damaging SYN attacks, although the only solid proof is of the UNIX hacking. Anyway, to get to the point, I along with several others have been in contact with the ISP, which is aware of the individual's activity and refuses to deal with those activities since "there are no laws affecting his use of our system in this manner, and we have no recourse." So, my question to you folks is, would something like the intentional black holing of the source network for this user (he apparently sources all attacks from one swamp Class C address) be an appropriate incentive to the ISP to deal with the problem? If so, where would be a good place to announce such measures, their goal, evidence, etc? I can see how such a thing could easily get out of hand if it's not taken seriously. Chris A. Icide Nap.Net, L.L.C.

15 23

Sprint Mailbombing Update 3PM EST
by Barry Shein 06 Jan '97

06 Jan '97

3PM EST and that mailbombing from a Sprint customer continues full-blast, well into its third full day, and Sprint continues to refuse to do anything about it. Go ahead, tell me again how this is nothing but a spam whine -- three days, thousands and thousands of messages, all being bounced back, non-stop, and Sprint refuses to lift a finger or acknowledge that this is an operational problem. Sprint should not be allowed to operate on the internet, they're destroying it, they're completely irresponsible. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989

7 6

It Continues...Sprint Is played the fool...
by Barry Shein 04 Jan '97

04 Jan '97

Sorry if some of you are losing patience with this, I'm truly sorry, but this is amazingly evil. I get email from someone in Sprint Security, a new person, I'll be decent enough to leave his name out, around 10:30PM EST. The gist of it is that they've spoken with this guy who has been sending these thousands of msgs, and he's a reasonable fellow, and I'm inflating all this and perhaps even partly to blame, some wild and ridiculous story about how my refusing his mail with a 550 error is making his software do this, ridiculous if you know how mail actually works, that's like getting a User Unknown error, you just throw it on the floor, he runs sendmail 8.7 under Unix, telnet to his SMTP port at iq-internet.com. AT ABOUT 1AM EST THE MAIL LOOPING STARTS AGAIN, AFTER A FEW HOURS HIATUS. HE STARTED IT UP AGAIN! Unbelievable, I'm sorry, but this sort of behavior is going to destroy these networks, and I mean behavior on the part of people like Sprint. Bad people will happen, I know that, we all know that, but the people at Sprint have absolutely no excuse for their behavior other than sheer gullibility or abrogation of any shred responsibility. Is there anyone here, who Sprint will believe, who can tell them that they are dealing with a known evil person who is feeding them complete bull? Obviously they don't believe me and will give this execrable person more than every benefit of the doubt as he disrupts the network for his own vicious purposes, this is going into the third full day of this. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.std.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989

5 6

Re: IPv6 Internet
by Vadim Antonov 04 Jan '97

04 Jan '97

Randall Atkinson <rja(a)inet.org> wrote: >There are varying opinions on whether IPv6 will turn out to be the >OSI of the 90s. There are also varying opinions on whether it is desirable >for IPv6 to fly or not. Some believe that for IPv6 to fly operationally, the >"6+2+8" proposal needs to be adopted. Let me put it this way -- IPv6 does not fix _any_ hard problems (routing stability, etc). It is about as useful as IPv4 with a "more address bits" option. --vadim

1 0

Re: Non-profit IP Registry
by Paul Ferguson 04 Jan '97

04 Jan '97

At 02:58 PM 1/3/97 -0700, Wayne Bouchard wrote: > >May I please point out that this discussion has not mentioned the wide >scale implementation of IPv6 or some derrivative thereof. The greatly >increased quantity of addresses should have some impact on >this. Granted, for the sake of routing tables, some organization needs >to manage the allocation so we don't end up with piecemeal routing but >the restrictions on how many addresses folks can have should be >lessened in such a circumstance. > What wide-scale implementation? - paul

3 2