Re: Network Abuse - Netblock x.x.x.x - IMPORTANT

["Jay Stewart" <cosmo () olywa net>]

-----Original Message-----
From: James Rishaw <jamie () dilbert ais net>
To: nanog () merit edu <nanog () merit edu>
Date: Thursday, July 30, 1998 10:20 AM
Subject: FW: Network Abuse - Netblock x.x.x.x - IMPORTANT


> A coworker's friend forwarded this to me.. kinda funny.. Kinda lame..
>
>
> -----Original Message-----
> Sent: Thursday, July 30, 1998 7:36 AM
> Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT
>
>
> ----------
> From: Andrew Shoemaker[SMTP:wrath () jerky net]
> Sent: Thursday, July 30, 1998 6:43 AM
> Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT
>
> Hello
>
> My name is Andrew Shoemaker and I am the head security consultant at JNS.
We
> recently were the target of a denial of service attack that saturated our
> Internet connection.  This attack, known as a 'smurf' attack, uses
unknowing
> relays to source the at
> tack.  By relaying the attack through your network the attack is made
> anonymous and increases in strength.  This type of attack causes degraded
> performance on both the attacked and relay networks and is the result of an
> improperly configured router at you
> r site.  I urge you to fix your routers.  If you are unable to do so, or do
> not know how I suggest you call a security consultant.  JNS is willing to
> fix your router permanently for a one time fee of $100 US.  If you are
> interested in this deal please co
> ntact me and I will send you a copy of our security contract and an
invoice.
> Netblock de.le.te.d was found to produce 11 replys for each packet sent.
> This means if the attacker is sending at T1 speeds the amount of your
> bandwidth used in relaying
> the attack is equivalent to 11 T1s
>
> regards,
> Andrew Shoemaker
> JNS Security
> wrath () jerky net
> 617.442.5408


Did anyone take the time to look at this goober's web page?  Here is a
*nice* snippet.

Jay Stewart
Vice President
OlyWa.Net - "Olympia's Premier Internet Service Provider"

-=-=-=-=-
from: http://www.jerky.net/smurf.html

The Smurf Relay List

This is a list of subnets that can be used for the "smurf" attack. If you
find your subnet on this list FIX YOUR FUCKING ROUTERS! If you have subnets
you wish to add to this list please email the wrath-mon. Once you fix your
router email the above address to get your subnet removed. Until
then....everyone feel free to completely FUCK these networks...and remember
stupidity should never be tolerated.

Updated: 07.29.98