🚀 go-pugleaf

In article <3ghioe$q83@trance.helix.net>,
Eric Gisin <ericg@trance.helix.net> wrote:
>$ finger @direct.ca
>[direct.ca]
>           Thank you for connecting to Internet Direct.

>The service you attempted to connect to on this host is for the 
>internal use of Internet Direct only.  We ask that you do not 
>attempt to connect to it again.  

>All connection attempts are logged.  If unauthorized connection 
>attempts continue from a single source CERT/RCMP/CIA/Scotland Yard 
>will be informed.

>Thanks for your co-operation.

>-----
>Who do these people think they are?
>Finger is a *public* service, there is nothing "unauthorized" in using it.
>If they don't want the outside world to use it, they should just disable it.
>Would CERT even listen to Internet Direct?

This is probably idiosyncratic of how their protection facilities work.
Probably TCP/IP security wrappers.

Say they have only one machine and it's connected to the Internet.

If they turn off the port entirely, then their internal users can't
use the service at all.

If they turn off the port to outside requests, then people get
connection failures (or maybe their software needs to connect first
before killing it), without knowing why, and keep trying.  So they
try to be "nice" and give you a "go away, we mean it!" message.  The
"we mean it" part seems rather excessive about "finger", but imagine
that this was telnet or ftp.

They probably could try to use different messages for different services,
but maybe their software doesn't allow that (it may simply be "if we
get an external connect on any port other than x,y,z, issue the following 
message), or they explicitly decided to reduce support complexity by using
the same one.

I can't imagine how you can claim that use of finger against a privately
owned machine is a "public service" that an Internet-connected machine
is somehow required to perform.  It is not.  No machine on the Internet
is obligated to do *anything* for anyone.

Further, finger is a security hole, and smart administrators have their
Internet firewalls prohibit it.  Ours certainly do, but we're not "nice",
and simply refuse connects - if they only have one machine, they may
not even be able to do that - the connection may need to be established
first before their software can decide whether to kill it or not.

If someone started messing around with indirect.ca's finger port, even
with it disabled, that caused service impairment at indirect.ca (eg:
ping storms of the finger port that impaired bandwidth over indirect's
IP link), you can bet that CERT will be interested - once they've satisfied
themselves that indirect is doing the right thing technically.
-- 
Every once in a while I write something that someone might use
in a signature.  So I go back and make it real spiffy.  No luck.
Then some guy goes and uses *that* dog.  Argh!

In article <3ghioe$q83@trance.helix.net>,
Eric Gisin <ericg@trance.helix.net> wrote:
>$ finger @direct.ca
>[direct.ca]
>           Thank you for connecting to Internet Direct.
>
>The service you attempted to connect to on this host is for the 
>internal use of Internet Direct only.  We ask that you do not 
>attempt to connect to it again.  
>
>All connection attempts are logged.  If unauthorized connection 
>attempts continue from a single source CERT/RCMP/CIA/Scotland Yard 
>will be informed.
>
>Thanks for your co-operation.
>
>-----
>Who do these people think they are?
>Finger is a *public* service, there is nothing "unauthorized" in using it.

Untrue. Finger is a 'standard' service, but the bottom line is that the
owner(s) of a machine are the ONLY people that matter when it comes to
determining who may or may not connect to the machine. If they say you
can't connect, you can't connect, and continued attempts to do so can be
legally prosecuted (at least, so say the lawyers I've talked to).

Remember, NOTHING on a machine is EVER public unless declared so. A machine
offering a service is NOT the same as a someone giving you authorization to
access it.

>If they don't want the outside world to use it, they should just disable it.

Why? Keeping track of attempted connections to a machine is a good way to
catch first glimpse of a possible attack.

>Would CERT even listen to Internet Direct?

Oh, they'd listen, point them at their documentation, maybe bounce off
a message to the sysadmin of the "attacking" system, but that's about it.
CERT has -no- authority to actually -do- anything. 

									-WW

In article <3ghioe$q83@trance.helix.net> ericg@trance.helix.net (Eric Gisin) writes:
>Who do these people think they are?
>Finger is a *public* service, there is nothing "unauthorized" in using it.

Finger is only a public service of those sites that choose to offer such a
service to the public.  Internet Direct has chosen to provide that service
only to their customers.  Their response to other sites is to inform them
that they aren't providing this service to the public.

My company has a help desk.  Using direct inward dialing, this help desk
can be called by anyone with a phone.  However, that doesn't mean that
they're offering assistance to anyone who can reach them; it's only
intended to be used by employees of the company.  If a non-employee were to
call the help desk repeatedly we would probably complain to the police that
the help desk workers were being harassed.
-- 

Barry Margolin
BBN Internet Services Corp.
barmar@near.net

Eric Gisin (ericg@trance.helix.net) wrote:
: $ finger @direct.ca
: [direct.ca]
:            Thank you for connecting to Internet Direct.

: The service you attempted to connect to on this host is for the 
: internal use of Internet Direct only.  We ask that you do not 
: attempt to connect to it again.  

: All connection attempts are logged.  If unauthorized connection 
: attempts continue from a single source CERT/RCMP/CIA/Scotland Yard 
: will be informed.

: Thanks for your co-operation.

: -----
: Who do these people think they are?
: Finger is a *public* service, there is nothing "unauthorized" in using it.
: If they don't want the outside world to use it, they should just disable it.
: Would CERT even listen to Internet Direct?

: Internet Direct is a Canadian Internet provider.
: I could not do a whois on direct.ca, not being able to find the CA server.

: 	Eric Gisin (now an international Internet subversive), ericg@helix.net


Try connecting to the Internet provider hq.jcic.org.  Apparently one of the
students here at JHU has an account there and tried to telnet to it.  Since
we are not running identd on all of our systems (too much overhead on some
systems, not supported on others, some of the systems are PCs or Macs, etc),
the local sysadmins got back flames about our "illegal telnet access" from
their sysadmin Daniel Hollis.  You get a form letter response if you make
any tcp/ip connection to his system.  When I asked (very politely) for a copy
of identd to run on my system he shut off access to the entire .jhu.edu 
domain.  Now he will not even accept email from me.

Evidently, I am also an internet subversive :)

Doug
--
Douglas O'Neal, Senior Systems Programmer, Johns Hopkins University
Doug.ONeal@jhu.edu, doug@jhuvms.bitnet, mimsy!jhunix!doug 
"Unix is user-friendly, its just picky about who it's friends with."

Here's what you do for these folks.

Anonymous FTP to some site and find any file there.  Let's say it's
"/pub/README".

ftp> cd /pub
250 CWD command successful.
ftp> quote "port 199,60,228,1,0,79"
200 PORT command successful.
ftp> quote "retr README"
150 Opening ASCII mode connection ...

Wrap this up in a script, and let it run for a week.

-drumcrazy

John Bonham (ledzep@highway.org) wrote:
: Here's what you do for these folks.

: Anonymous FTP to some site and find any file there.  Let's say it's
: "/pub/README".

: ftp> cd /pub
: 250 CWD command successful.
: ftp> quote "port 199,60,228,1,0,79"
: 200 PORT command successful.
: ftp> quote "retr README"
: 150 Opening ASCII mode connection ...

: Wrap this up in a script, and let it run for a week.

: -drumcrazy

 This is even more interesting if the anonymous FTP site is ftp.cert.org :-)
(Don't do that too often...)

--
 Alain

Eric Gisin <ericg@trance.helix.net> wrote:
>$ finger @direct.ca

>attempts continue from a single source CERT/RCMP/CIA/Scotland Yard 
>will be informed.

>I could not do a whois on direct.ca, not being able to find the CA server.

Subdomain:      Direct.CA
Date-Received:  1994/08/23
Date-Approved:  1994/08/30
Date-Modified:  1994/09/23
Organization:   Internet Direct, Inc.
Type:           For-Profit Corporation
Description:    Internet Direct is an national firm based in Vancouver BC,
                with offices in Vancouver and Calgary.  Internet Direct is an 
                Internet provider serving dial-up users in Western Canada.
Admin-Name:     David Wolstenholme
Admin-Title:    General Manager
Admin-Postal:   Internet Direct, Inc.
                #1628 - 555 West Hastings
                Vancouver, BC
                Canada
                V6B 4N4
Admin-Phone:    +1 604 252-8320
Admin-Fax:      +1 604 691-1605
Admin-Mailbox:  dwolsten@unixg.ubc.ca
Tech-Name:      Eric Woodward
Tech-Title:     Network Administrator
Tech-Phone:     +1 604 252 8320
Tech-Postal:    Internet Direct, Inc.
                #1628 - 555 West Hastings
                Vancouver, BC
                Canada
                V6B 4N4
Tech-Fax:       +1 604 691-1605
Tech-Mailbox:   ejw@Direct.CA
Tech-Name:      Hector Herrera
Tech-Title:     Support Specialist
Tech-Phone:     +1 604 252 8320
Tech-Postal:    Internet Direct, Inc.
                #1628 - 555 West Hastings
                Vancouver, BC
                V6B 4N4
Tech-Fax:       +1 604 691-1605
Tech-Mailbox:   Hector@Direct.CA
Location:       49 10 59 N / 123 30 00 W
Net-Provider:   other
Forwarder:      Internet: DNS;