🚀 go-pugleaf

Kevin McCormick (kmccorm@access.digex.net) wrote:

: Despite that reaction, Canter and Siegel announced last week they 
: are setting up a company called Cybersell to help other businesses 
: advertise on the Internet.

: - If they get a shell account, they'll be swamped with core dumps 
: and mail, nicely crashing the system they're on, much like Internet 
: Direct was crashed a couple of weeks ago.

I could set up an account with a daemon that simply drains my mailbox,
saying that "hate mail is ignored" or doing a fake "mail returned: 
message is too large", and returns the message if it's, say, longer than
1K, and keeping only the first 1K, deleting the rest.  If it's a
legitimate response, it won't be more than 1K, perhaps as small as 250
bytes.  Or simply strips everything after the first 1K, and discards the
rest, then archives the messages into a file for subsequent examination. 

And it caches your address and perhaps either mails you an advertisement 
back, or sends out a Dave Rhodes "MAKE.MONEY.FAST" letter with your name 
as the From: address on it, to several newsgroups chosen at random.

: - If they get a direct link, then they'll probably find 10,000 
: people FTPing their entire FTP section, slowing things down to a 
: crawl.  Not to mention that any core dumps they get in e-mail will 
: just swamp their own system.  How about setting a few telnet-based 
: password crackers in?  Can you imagine 500 or so login sessions?

I own the Internet domain TDR.COM.  If you do a whois on TDR-DOM you'll
find it.  You can do a traceroute to it, and do a NSLOOKUP and discover
it's a full "class A" address, and even send me mail to PAUL@TDR.COM
(actually, you can use anything except "postmaster" and "root" and I'll
get it).   Note any 'finger' requests get the same short shrift as finger 
requests to MCIMAIL.COM: they are refused, as would be ftp requests.
If a site can refuse finger, it can refuse everything else it does not 
want.  This is a standard practice for "firewall" sites that refuse all 
but incoming SMTP (E-Mail) connections.

It can refuse to accept telnet, rlogin, gopher, or anything else except 
the SMTP (E-Mail), FTP and FINGER ports.  And armor those against 
Denial-of-Service attacks by making the attacker suffer his own actions 
in return.

Canter and Siegel (or any other group sending out controvercial messages) 
can easily armor themselves against most brute force attacks.

1. Site refuses *all* incoming connections except E-Mail via SMTP (and FTP 
   and Finger if they want it).  Whether they provide files for FTP or not 
   is another issue.  You set the SMTP daemon to time out if each line 
   is not transmitted within 3 seconds, which thwarts Denial of Service 
   attacks by tying up daemon threads using E-Mail sent by someone 
   telnetting to the SMTP port and sitting there.

2. One network expert said that he could put an 80386/33 with Linux up and a 
   reasonably tuned FTPD and with a T1, it could easily support 400 
   simultaneous FTP connections with at least 14K speed each.  You can cause
   FTP requests to go to multiple servers.  (Netcom does this, 
   ftp.netcom.com goes to any of 11 server machines.)

3. One could write an FTPD that simply allows you access to one file, and 
   if you don't access it after 4 commands, drops the connection.  If you 
   take more than 15 or 30 seconds to issue a GET command, it drops the 
   connection.  If it drops you for timeouts, it refuses you for 1 hour.
   If it gets more than 3 bad hits from you, it will then refuse further 
   requests from your id as the password, and after say, 10 bad requests 
   from your domain, deny all connections from your site for one hour, thus 
   armoring itself against denial-of-service attacks though FTP.  

4. Set its name server to issue "do not cache" or "cache for 2 seconds"   
   answers for NSLookups on its FTP site (meaning the site's IP address
   is volatile and changes).  After 10 bad FTPs from a site, the NS 
   address given to that site only changes to, say, wuarchive.wustl.edu,
   is.internic.net or nic.ddn.mil for an hour, so as to cause your 
   attempts to deny them service to bounce to someone else.

5. Their mailer could check for incoming mail exceeding, say, 2K, and as 
   soon as the limit is passed, the mailer, instead of spooling the entire
   X11R6 file and deleting it, starts sending it *back* to you as "mail 
   rejected: file is too large" and thus you end up filling your *own* 
   mail spool.  All he has to cache is 2K of disk space for each process,
   which even if he allows 100 SMTP daemons to run, will not cause him major
   problems.

6. He can send back "undeliverable" messages to you saying the account is
   refusing further mail if you try to bomb him, making it look like his
   account was closed.

7. If you get marked as an attempt to bomb him, he can set up a fake 
   "finger" daemon to (a) return "not found" for everyone else but his 
   id (or return an advertisement); (b) for his finger account return 
   "shell: /usr/lib/cancelled" making it look like his account was 
   cancelled.  But if you're not on his shit list, you get another 
   advertisement.  Also, in either case his site does a reverse finger 
   to see who is fingering him and you get a personal advertisement 
   automailed to you.

: I'm sure someone would also whip up a program that would peruse the 
: newsgroups every hour or so looking for messages from "cseigel.com" or 
: whatever, and generate cancel messages for them...

That, IMO would be a more appropriate action than overloading network 
connections between one point and the offender.  

--
Reports on Security Problems: To Subscribe write PROBLEMS-REQUEST@TDR.COM
Paul Robinson - paul@tdr.com / tdarcos@MCIMail.com / tdarcos@access.digex.net
Voted "Largest Polluter of the (IETF) list" by Randy Bush <randy@psg.com>
Voted "Largest Polluter of digex.general" by Mike <voss@orange.digex.net>