Network Abuse - Netblock x.x.x.x - IMPORTANT

A coworker's friend forwarded this to me.. kinda funny.. Kinda lame..

Sent: Thursday, July 30, 1998 7:36 AM
Subject: FW: Network Abuse - Netblock de.le.te.d - IMPORTANT

----------
From: Andrew Shoemaker[SMTP:wrath@jerky.net]
Sent: Thursday, July 30, 1998 6:43 AM
Subject: Network Abuse - Netblock de.le.te.d - IMPORTANT

Hello

My name is Andrew Shoemaker and I am the head security consultant at JNS.

We

recently were the target of a denial of service attack that saturated our
Internet connection. This attack, known as a 'smurf' attack, uses

unknowing

relays to source the at
tack. By relaying the attack through your network the attack is made
anonymous and increases in strength. This type of attack causes degraded
performance on both the attacked and relay networks and is the result of an
improperly configured router at you
r site. I urge you to fix your routers. If you are unable to do so, or do
not know how I suggest you call a security consultant. JNS is willing to
fix your router permanently for a one time fee of $100 US. If you are
interested in this deal please co
ntact me and I will send you a copy of our security contract and an

invoice.

Netblock de.le.te.d was found to produce 11 replys for each packet sent.
This means if the attacker is sending at T1 speeds the amount of your
bandwidth used in relaying
the attack is equivalent to 11 T1s

regards,
Andrew Shoemaker
JNS Security
wrath@jerky.net
617.442.5408

Did anyone take the time to look at this goober's web page? Here is a
*nice* snippet.

Jay Stewart
Vice President
OlyWa.Net - "Olympia's Premier Internet Service Provider"

On Thu, Jul 30, 1998 at 10:28:15AM -0700, Jay Stewart put this into my mailbox:

>
>regards,
>Andrew Shoemaker
>JNS Security
>wrath@jerky.net
>617.442.5408

Did anyone take the time to look at this goober's web page? Here is a
*nice* snippet.

[...]

from: http://www.jerky.net/smurf.html

The Smurf Relay List

[...]

How curious. 'jerky.net' is the ISP who hosted one of the IRC spammers a
while back that would smurf if we tried to interfere with his activity; they
steadfastly refused to remove his account until we banned the entire domain
from DALnet. Then they complied *grin*.

I wouldn't trust them to poke around in my routers, that's for sure.

-dalvenjah

They've also hosted a number of spamhausen. It required their backbones'
stomping upon their heads to make the spammers go away; Jerky.Net basically
said "screw you" to complaints.

Wabbit season!..duck season!..wabbit season!..duck season!..SPAMMER SEASON!

Dean Robb
PC-EASY computer services
(757) 495-EASY [3279]

[elided]

I didn't bother to read this. He _did_ catch a couple of our netblocks
that we failed to catch.

Unfortunately I referred him to NANOG to watch the smurf thread. :expressionless: