Re: Network Abuse - Netblock x.x.x.x - IMPORTANT
-----Original Message----- From: James Rishaw <jamie@dilbert.ais.net> To: nanog@merit.edu <nanog@merit.edu> Date: Thursday, July 30, 1998 10:20 AM Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT
A coworker's friend forwarded this to me.. kinda funny.. Kinda lame..
-----Original Message----- Sent: Thursday, July 30, 1998 7:36 AM Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT
---------- From: Andrew Shoemaker[SMTP:wrath@jerky.net] Sent: Thursday, July 30, 1998 6:43 AM Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT
Hello
My name is Andrew Shoemaker and I am the head security consultant at JNS. We recently were the target of a denial of service attack that saturated our Internet connection. This attack, known as a 'smurf' attack, uses unknowing relays to source the at tack. By relaying the attack through your network the attack is made anonymous and increases in strength. This type of attack causes degraded performance on both the attacked and relay networks and is the result of an improperly configured router at you r site. I urge you to fix your routers. If you are unable to do so, or do not know how I suggest you call a security consultant. JNS is willing to fix your router permanently for a one time fee of $100 US. If you are interested in this deal please co ntact me and I will send you a copy of our security contract and an invoice.
Netblock de.le.te.d was found to produce 11 replys for each packet sent. This means if the attacker is sending at T1 speeds the amount of your bandwidth used in relaying the attack is equivalent to 11 T1s
regards, Andrew Shoemaker JNS Security wrath@jerky.net 617.442.5408
Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. Jay Stewart Vice President OlyWa.Net - "Olympia's Premier Internet Service Provider" -=-=-=-=- from: http://www.jerky.net/smurf.html The Smurf Relay List This is a list of subnets that can be used for the "smurf" attack. If you find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets you wish to add to this list please email the wrath-mon. Once you fix your router email the above address to get your subnet removed. Until then....everyone feel free to completely FUCK these networks...and remember stupidity should never be tolerated. Updated: 07.29.98
On Thu, Jul 30, 1998 at 10:28:15AM -0700, Jay Stewart put this into my mailbox:
regards, Andrew Shoemaker JNS Security wrath@jerky.net 617.442.5408
Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. [...] from: http://www.jerky.net/smurf.html
The Smurf Relay List [...]
How curious. 'jerky.net' is the ISP who hosted one of the IRC spammers a while back that would smurf if we tried to interfere with his activity; they steadfastly refused to remove his account until we banned the entire domain from DALnet. Then they complied *grin*. I wouldn't trust them to poke around in my routers, that's for sure. -dalvenjah -- Dalvenjah FoxFire (aka Sven Nielsen) "Aristotle was not Belgian. The central Founder, the DALnet IRC Network message of Buddhism is not 'every man for himself.' And the London Underground e-mail: dalvenjah@dal.net is not a political movement." WWW: http://www.dal.net/~dalvenjah/ -- Wanda, "A Fish Called Wanda" whois: SN90 Try DALnet! http://www.dal.net/
At 11:10 7/30/98 -0700, you wrote:
Did anyone take the time to look at this goober's web page? Here is a *nice* snippet. [...] from: http://www.jerky.net/smurf.html
The Smurf Relay List [...]
How curious. 'jerky.net' is the ISP who hosted one of the IRC spammers a while back that would smurf if we tried to interfere with his activity; they steadfastly refused to remove his account until we banned the entire domain from DALnet. Then they complied *grin*.
I wouldn't trust them to poke around in my routers, that's for sure.
They've also hosted a number of spamhausen. It required their backbones' stomping upon their heads to make the spammers go away; Jerky.Net basically said "screw you" to complaints. Wabbit season!..duck season!..wabbit season!..duck season!..SPAMMER SEASON! Dean Robb PC-EASY computer services (757) 495-EASY [3279]
On Thu, Jul 30, 1998 at 10:28:15AM -0700, Jay Stewart wrote:
Did anyone take the time to look at this goober's web page? Here is a *nice* snippet.
[elided] I didn't bother to read this. He _did_ catch a couple of our netblocks that we failed to catch. Unfortunately I referred him to NANOG to watch the smurf thread. :-| -- Jeffrey Haas "He that breaks a thing to find out what it is has elezar@pfrc.org left the paths of wisdom." (Or works for Fermilab...)
participants (4)
-
Dalvenjah FoxFire -
Dean Robb -
elezar＠pfrc.org -
Jay Stewart