RE: Cisco 2611XM as cheap border router

2005-01-15 Thread Majid Farid

Foundry routes fall into your 2 argument  :)

--
Majid


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Daniel Golding
Sent: Tuesday, January 11, 2005 12:52 PM
To: Rodney Dunn; Mark Bojara
Cc: [EMAIL PROTECTED]
Subject: Re: Cisco 2611XM as cheap border router



It would be fairly useful if Cisco had a published document that
detailed
the minimum configuration for each major router line to support BGP with
1
to 4 full views. Of course, this would have to be periodically updated.
By
this, I mean a separate overlay document for their entire router product
line. This would be very helpful to operators and integrators who get
asked
about minimum configurations fairly frequently...

(I'm only picking on Cisco because they are 1) big and 2) have routers
that
support BGP but don't have enough memory for full tables)

- Dan

On 1/11/05 12:21 PM, Rodney Dunn [EMAIL PROTECTED] wrote:

 
 This will not work for full routes.
 The memory upgrade is utilized for larger
 IOS images with new features.
 
 An update to the product bulletin is
 in the works to clarify it.
 
 Further specific questions in regards to
 the memory can be moved over to the
 cisco-nsp alias.
 
 Rodney
 
 On Tue, Jan 11, 2005 at 07:39:49AM +0200, Mark Bojara wrote:
 Hello people of nanog :)
 
 Ive been doing some reading up and I see that that 2600 series is now
 supporting 256MB of memory. Do you guys think this router could
handle
 3/4 peers a QoS setup (RSVP or something)?
 

http://www.cisco.com/en/US/products/hw/routers/ps259/products_qanda_item
0900a
 ecd800f71dd.shtml
 
 Regards
 Mark
 




RE: $50,000 reward for Verizon cable cutter

2005-01-15 Thread Church, Chuck

 Maybe a current Verizon employee looking for extra OT...


Chuck Church
Lead Design Engineer
CCIE #8776, MCNE, MCSE
Netco Government Services - Design  Implementation Team
1210 N. Parker Rd.
Greenville, SC 29609
Home office: 864-335-9473
Cell: 703-819-3495
[EMAIL PROTECTED]
PGP key: http://pgp.mit.edu:11371/pks/lookup?op=getsearch=0x4371A48D 


-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Joshua Brady
Sent: Friday, January 14, 2005 10:32 PM
To: Hannigan, Martin
Cc: [EMAIL PROTECTED]; nanog@merit.edu
Subject: Re: $50,000 reward for Verizon cable cutter


Your not giving customers enough credit, your a customer yourself
arn't you? Do you know how to cut those cables? Would anyone else on
the list who isn't a disgruntled verizon employee?


On Fri, 14 Jan 2005 22:26:04 -0500, Hannigan, Martin
[EMAIL PROTECTED] wrote:
 
 
 Disgruntled customers don't know how to cut X hundred pair cables.
 
 ---
 Martin Hannigan
 [EMAIL PROTECTED]
 Verisign, Inc.
 
 
 -Original Message-
 From: [EMAIL PROTECTED] [EMAIL PROTECTED]
 To: nanog@merit.edu nanog@merit.edu
 Sent: Fri Jan 14 19:10:35 2005
 Subject: Re: $50,000 reward for Verizon cable cutter
 
 Sean Donelan wrote:
 
 Verizon is offering a $50,000 reward for information about several
 acts of cut cables in the last couple of months.  At least three
lines
 were cut in the last week.
 

http://www.boston.com/news/local/massachusetts/articles/2005/01/13/veri
zon_
 seeking_information_about_cable_cutter/
 
 
 
 With a power saw?  Goodness, that sounds noisy in the middle of the
 night.  I'd have thought a low tech ax would do the job. :-)
 
 Probably a disgruntled customer, with cable bundles that repair says
 were supposed to be replaced 12 years ago, but engineering says isn't
 in the budget (like my SBC/Ameritech neighborhood in Ann Arbor).
 
 Sigh, not enough criminal instinct here.
 
 --
 William Allen Simpson
 Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C
32
 


-- 
Joshua Brady


Man accused of 'zombie' web blitz

2005-01-15 Thread Fergie (Paul Ferguson)


Given the amount of discussion on botnets and zombies,
I thought this article was rather interesting:

A man has been arrested on suspicion of launching attacks
over the internet after an operation between Scottish
police and the US Secret Service.

http://news.bbc.co.uk/2/hi/uk_news/scotland/4175801.stm

- ferg

--
Fergie, a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 [EMAIL PROTECTED] or
 [EMAIL PROTECTED]


panix.com hijacked

2005-01-15 Thread Steven M. Bellovin

panix.com has apparently been hijacked.  It's now associated with a 
different registrar -- melbourneit instead of dotster -- and a 
different owner.  Can anyone suggest appropriate people to contact to 
try to get this straightened out?

--Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb




Re: panix.com hijacked

2005-01-15 Thread Chris Adams

Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said:
 panix.com has apparently been hijacked.  It's now associated with a 
 different registrar -- melbourneit instead of dotster -- and a 
 different owner.  Can anyone suggest appropriate people to contact to 
 try to get this straightened out?

Good luck dealing with melbourneit.com; that's the place where domains
go to die.
-- 
Chris Adams [EMAIL PROTECTED]
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.


Re: panix.com hijacked

2005-01-15 Thread Mark Jeftovic


On Sat, 15 Jan 2005, Chris Adams wrote:


 Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said:
  panix.com has apparently been hijacked.  It's now associated with a
  different registrar -- melbourneit instead of dotster -- and a
  different owner.  Can anyone suggest appropriate people to contact to
  try to get this straightened out?

 Good luck dealing with melbourneit.com; that's the place where domains
 go to die.


I originally replied offlist, but...

Under the new ICANN transfer policy, this will most likely be
reversed if its shown to be an improper transfer. You need to
bring Dotster into this and they need to invoke a transfer dispute
under the new policy.

MelbourneIT needs to demonstrate a proper FOA (Form of Authorization)
to have initiated the transfer and if its found to be invalid the
domain will be re-instated and Melbourne-IT fined.

-mark

-- 
Mark Jeftovic [EMAIL PROTECTED]
Co-founder, easyDNS Technologies Inc.
ph. +1-(416)-535-8672 ext 225
fx. +1-(416)-535-0237


Re: panix.com hijacked

2005-01-15 Thread Perry E. Metzger


Mark Jeftovic [EMAIL PROTECTED] writes:
 Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said:
  panix.com has apparently been hijacked.  It's now associated with a
  different registrar -- melbourneit instead of dotster -- and a
  different owner.  Can anyone suggest appropriate people to contact to
  try to get this straightened out?

 Good luck dealing with melbourneit.com; that's the place where domains
 go to die.

 I originally replied offlist, but...

 Under the new ICANN transfer policy, this will most likely be
 reversed if its shown to be an improper transfer. You need to
 bring Dotster into this and they need to invoke a transfer dispute
 under the new policy.

Dotster isn't in a position to do anything. They don't show the domain
as being transfered. Someone managed to hack the system. They're
pretty upset by the situation, too.

The membourneit.com folks conveniently refuse to do anything over the
weekend. The bad guys struck around midnight Saturday, Australian
time, so as to make the damage as bad as possible.

Panix is highly screwed by this -- their users are all off the air,
and they can't really wait for an appeals process to complete in order
to get everything back together again.

Perry


Re: panix.com hijacked

2005-01-15 Thread bmanning

On Sat, Jan 15, 2005 at 10:27:31PM -0500, Steven M. Bellovin wrote:
 
 panix.com has apparently been hijacked.  It's now associated with a 
 different registrar -- melbourneit instead of dotster -- and a 
 different owner.  Can anyone suggest appropriate people to contact to 
 try to get this straightened out?
 
   --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb
 

calls have been initiated.

--bill


Re: panix.com hijacked

2005-01-15 Thread william(at)elan.net


On Sat, 15 Jan 2005, Mark Jeftovic wrote:

  Once upon a time, Steven M. Bellovin [EMAIL PROTECTED] said:
   panix.com has apparently been hijacked.  It's now associated with a
   different registrar -- melbourneit instead of dotster -- and a
   different owner.  Can anyone suggest appropriate people to contact to
   try to get this straightened out?
 
  Good luck dealing with melbourneit.com; that's the place where domains
  go to die.

 I originally replied offlist, but...
 
 Under the new ICANN transfer policy, this will most likely be
 reversed if its shown to be an improper transfer. You need to
 bring Dotster into this and they need to invoke a transfer dispute
 under the new policy.

The problem is that during that time panix and its users have suffered 
serious losses. They should never have allowed the transfer in the first
place without authorization, so new ICANN policy is a problem, not a
solution.
 
 MelbourneIT needs to demonstrate a proper FOA (Form of Authorization)
 to have initiated the transfer and if its found to be invalid the
 domain will be re-instated and Melbourne-IT fined.

That means at least 24 hours for initial investigation and it likely will 
not happen until Monday (bad guys do these sort of things on weekends
for a reason ...) and they probably will not act until Monday evening or 
longer (and that is at the same time when Verisign now allows rapid 
updates to zone file and could fix it very quickly). If I were Panix, I 
would get lawyers to draft and fax a nastygram letter to MelburneIT and 
somewhat similar letter to Verisign warning them of the liabilities 
involved in being accomplices to such a such a fraudulent and illegal 
actions and saying that every hour the  situation is not fixed Panix 
losses continue to increase and somebody would have to pay, etc...

But more important would be to actually call Verisign (their NOC) and
complain loud and clear - if I remember when something like this happened
about 2-3 years ago to another bix company they fixed it in  12 hours.

-- 
William Leibzon
Elan Networks
[EMAIL PROTECTED]



Re: panix.com hijacked

2005-01-15 Thread Eric Brunner-Williams in Portland Maine

I've forwared to Bruce Tonkin, who I know personally, at MIT,
and Cliff Page, who I don't know as well, at Dotster, Steve's
note. These are the RC reps for each registrar.


Re: panix.com hijacked

2005-01-15 Thread Chris Adams

Once upon a time, Robert Kryger [EMAIL PROTECTED] said:
 On Sat, 15 Jan 2005, Chris Adams wrote:
 Good luck dealing with melbourneit.com; that's the place where domains
 go to die.
 
 Can you be a little more specific?
 You imply that you have experience or anecdotes about this outfit and 
 this sort of situation.

Not exactly this sort of situation, no.  I do know that we've had
hosting customers that have had domains with melbourneit.com as the
registrar that they were unable to ever transfer to another registrar
(despite emails, faxes, and phone calls; IIRC one customer tried for
most of a year to transfer a domain to another registrar or at least get
the nameservers changed without success).

-- 
Chris Adams [EMAIL PROTECTED]
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.


Re: panix.com hijacked

2005-01-15 Thread Eric Brunner-Williams in Portland Maine


 If I were Panix ...

Free advice. Bruce, Cliff and Chuck are people. Yes, even Chuck is a people.
You want prompt service, you ask nice and you ask the right people and you
don't assume there are facts not in evidence, like errors or malfeasence,
when you could be solving the problem, before the facts could be in evidence.

My phone isn't going to ring, so I'm going to bed.

Eric
registrar_hat=off/


Re: panix.com hijacked

2005-01-15 Thread Steven M. Bellovin

In message [EMAIL PROTECTED], Eric Brunner-Williams in 
Portland Maine writes:


 If I were Panix ...

Free advice. Bruce, Cliff and Chuck are people. Yes, even Chuck is a people.
You want prompt service, you ask nice and you ask the right people and you
don't assume there are facts not in evidence, like errors or malfeasence,
when you could be solving the problem, before the facts could be in evidence.


Agreed.  At the moment, we don't know all the details of what happened; 
what's important is for Panix to get back on the air.  We can sort out 
the blame later, when we have all the facts.

--Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb




Re: panix.com hijacked

2005-01-15 Thread Perry E. Metzger


Eric Brunner-Williams in Portland Maine [EMAIL PROTECTED] writes:
 If I were Panix ...

 Free advice. Bruce, Cliff and Chuck are people. Yes, even Chuck is a people.
 You want prompt service, you ask nice and you ask the right people and you
 don't assume there are facts not in evidence, like errors or malfeasence,
 when you could be solving the problem, before the facts could be in evidence.

Alexis Rosen of Panix was on the phone earlier today with the company
attorney for melbourneit -- reputedly he was informed that even if the
police called, they would not do anything about the problem until
Monday their time.

Alexis is a bit on the upset side, naturally -- his company is in
serious trouble because of very obvious fraud, and waiting a few days
isn't really something he can afford to do. (If you look at the whois
records now in place for panix.com they're pretty clearly the result
of fraudulent activity. There is a pretty clear attempt there to
maximally obscure who has stolen the domain name -- this is clearly
not an innocent mistake.)

Perry


Re: panix.com hijacked

2005-01-15 Thread Eric Brunner-Williams in Portland Maine

Howdy Perry,

 Alexis Rosen of Panix was on the phone earlier today with the company
 attorney for melbourneit -- reputedly he was informed that even if the
 police called, they would not do anything about the problem until
 Monday their time.

(a) I don't know MIT's attorney, and (b) I wouldn't ever call him or her
when I could reach someone I know, and (c) what would you expect an attorney
to say?

 Alexis is a bit on the upset side, naturally -- his company is in
 serious trouble because of very obvious fraud, and waiting a few days
 isn't really something he can afford to do. (If you look at the whois
 records now in place for panix.com they're pretty clearly the result
 of fraudulent activity. There is a pretty clear attempt there to
 maximally obscure who has stolen the domain name -- this is clearly
 not an innocent mistake.)

Yeah, but, home truths. There are registrars who will get out of bed at
night for a customer, and registrars who could give a shit if hell froze.
Just like ISPs and LEOs, neh?

Picking a registrar with a market share in the top 10 means that you get
1/share's worth of attention, which means 1/1488700 of Dotster's attention
(using 1/15 daily market share graph). Now, was that at the NetSol $35/yr
price point for customer care, or the GoDaddy $6.95/yr price point for
customer care.

I suppose everyone thinks that it (for some value of it) can't happen
to them, and that if it does, a wicked small amount of money will still
do more than the oil that lights the lamps at Hanukkah, because bad acts
are rare and all the dimes pile up into a shared fate insurance fund.

Well, now I'm really going to bed.

Eric


Re: panix.com hijacked

2005-01-15 Thread Mark Jeftovic


On Sat, 15 Jan 2005, Steven M. Bellovin wrote:
 MelbourneIT needs to demonstrate a proper FOA (Form of Authorization)
 to have initiated the transfer and if its found to be invalid the
 domain will be re-instated and Melbourne-IT fined.

 Thanks.  I'm told that dotster says they have no record of anything
 resembling this request


Anyone happen to know if panix.com had their registrar-lock set
when this happened?

-mark

-- 
Mark Jeftovic [EMAIL PROTECTED]
Co-founder, easyDNS Technologies Inc.
ph. +1-(416)-535-8672 ext 225
fx. +1-(416)-535-0237


Re: panix.com hijacked

2005-01-15 Thread Richard Cox

On Sat, 15 Jan 2005 22:05:47 -0600
Chris Adams [EMAIL PROTECTED] wrote:

 I do know that we've had hosting customers that have had domains with
 melbourneit.com as the registrar that they were unable to ever transfer
 to another registrar (despite emails, faxes, and phone calls; IIRC one
 customer tried for most of a year to transfer a domain to another
 registrar or at least get the nameservers changed without success).

We have had a comparable experience and now, on checking the DNS for
the hijacked panix domain, I see name-servers similar to those I noted
on that previous occasion.  Known under various names that infer a UK
connection, (such as Fibranet Services Ltd/freeparking.co.uk) but in
fact seem to be Activebytes Software of 2530 Channin Drive Wilmington
Delaware, with servers routed via Koallo Inc in Canada!

So far as we were able to determine, there was no actual UK presence.

ns1.ukdnsservers.co.uk has address 142.46.200.67
ns2.ukdnsservers.co.uk has address 207.61.90.196
ns3.ukdnsservers.co.uk has address 142.46.200.68
ns4.ukdnsservers.co.uk has address 207.61.90.197

MelbourneIT appear to have a U.S. Office near San Francisco:
  2200 Powell Street, Sixth Floor, Suite 690, Emeryville CA 94608
which would be slightly more accessible for service of writs, etc ...

-- 
Richard Cox


Re: panix.com hijacked

2005-01-15 Thread Valdis . Kletnieks
On Sun, 16 Jan 2005 01:32:46 EST, Henry Yen said:

 from panix shell hosts motd:
 
 . panix.net usable as panix.com (marcotte) Sat Jan 15 10:44:57 2005

So let's see.. the users will see this when they log into shell.panix.net
(since shell.panix.com is borked).. Somehow, that doesn't seem to help much..

Not that there's any *better* solution, other than changing the top level of the
phone tree to say:

Hi, we're out with baseball bats looking for the guys who broke panix.com.
In the meantime, you can use 'panix.net' as a temporary solution.  If you've
tried this already and it still doesn't work, or if you have some *other* issue,
please press '9' now...

(Been there, done that - we had a major mail hub outage a while ago, and tried
to get the word out by sending everybody a voice mail message, which our phone
system vendor *said* should work.  We resisted the temptation to send everybody
e-mail saying the voice mail system was down... ;)


pgp01bffJAmeS.pgp
Description: PGP signature


Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Thor Lancelot Simon

Alexis Rosen tried to send this to NANOG earlier this evening but it
looks like it never made it.  Apologies if it's a duplicate; we're
both reduced to reading the list via the web interface since the
legitimate addresses for panix.com have now timed out of most folks'
nameservers and been replaced with the hijacker's records.

Note that we contacted VeriSign both directly and through intermediaries
well known to their ops staff, in both cases explaining that we suspect
a security compromise (technical or human) of the registration systems
either at MelbourneIT or at VeriSign itself (we have reasons to suspect
this that I won't go into here right now).  We noted that after calling
every publically available number for MelbourneIT and leaving polite
messages, the only response we received was a rather rude brush-off from
MelbourneIT's corporate counsel, who was evidently directed to call us
by their CEO.

We are also told that law enforcement separately contacted VeriSign on
our behalf, to no avail.

Below please find VeriSign's response to our plea for help.  We're rather
at a loss as to what to do now; MelbourneIT clearly are beyond reach,
VeriSign won't help, and Dotster just claim they still own the domain and
that as far as they can tell nothing's wrong.  Panix may not survive this
if the formal complaint and appeal procedure are the only way forward.

 Date: Sun, 16 Jan 2005 00:21:33 -0500
 To: [EMAIL PROTECTED], NOC Supervisor [EMAIL PROTECTED]
 Subject: Re: FW: [EMAIL PROTECTED]: Brief summary of panix.com hijacking 
 incident]  (KMM2294267V49480L0KM)
 From: VeriSign Customer Service [EMAIL PROTECTED]
 X-Mailer: KANA Response 7.0.1.127
 
 Dear Alexis,
 
 Thank you for contacting VeriSign Customer Service.
 
 Unfortunately there is little that VeriSign, Inc. can do to rectify this
 situation.  If necessary, Dotster (or Melbourne) is more than welcome to
 contact us to obtain the specific details as to when the notices were
 sent and other historical information about the transfer itself.
 
 Dotster can file a Request for Enforcement if Melbourne IT contends that
 the request was legitimate and we will review the dispute and respond
 accordingly.  Dotster can also contact Melbourne directly and if they
 come to an agreement that the transfer was fraudulent they can file a
 Request for Reinstatement and the domain would be reinstated to its
 original Registrar.  Dotster could submit a normal transfer request to 
 Melbourne IT for the domain name and hope that Melbourne IT agrees to
 transfer the name back to them outside of a dispute having been filed. 
 In order to expedite processing the transfer or submitting a Request for
 Reinstatement however Dotster will need to contact Melbourne IT
 directly.  If Dotster is unable to get in touch with anyone at Melbourne
 IT we can assist them directly if necessary.
 
 Best Regards,
 
 Melissa Blythe
 Customer Service
 VeriSign, Inc.
 www.verisign.com
 [EMAIL PROTECTED]



Re: panix.com hijacked

2005-01-15 Thread Christopher L. Morrow



On Sun, 16 Jan 2005 [EMAIL PROTECTED] wrote:

 On Sun, 16 Jan 2005 01:32:46 EST, Henry Yen said:

  from panix shell hosts motd:
 
  . panix.net usable as panix.com (marcotte) Sat Jan 15 10:44:57 2005

 So let's see.. the users will see this when they log into shell.panix.net
 (since shell.panix.com is borked).. Somehow, that doesn't seem to help much..


and the hijackers could be, potentially, running a box pretending to be
shell.panix.com, gathering userids and passwds :(



Re: panix.com hijacked

2005-01-15 Thread Thor Lancelot Simon

Apologies for what may be another duplicate message, probably with broken
threading.  This is Alexis Rosen's original posting to this thread; we
think the mail chaos caused by the hijacking of panix.com kept it from
ever reaching the list (but, flying mostly-blind, we aren't sure).


 On Sat, Jan 15, 2005 at 10:27:31PM -0500, Steven M. Bellovin said:
  panix.com has apparently been hijacked.  It's now associated with a 
  different registrar -- melbourneit instead of dotster -- and a 
  different owner.  Can anyone suggest appropriate people to contact to 
  try to get this straightened out?
 
 Hi, all.
 
 I hate to pop my head up after years of lurking, only when things are
 going bad, but probably better that than remaining silent.
 
 First of all, I'm going to be bounced from this list once its cache of
 my DNS times out, which will probably be in about 2-3 hours, so if you have
 anything to say that you'd like me to see, please copy me. We're temporarily
 accepting mail at panix.net in addition to panix.com, so use alexis (at)
 panix.net.
 
 A few points to respond to:
 First, Eric, thanks for contacting Bruce and Eric on my behalf. While
 nothing has happened so far, I hope that it will soon, and in any case
 I appreciate your efforts to help a total stranger.
 
 Someone asked if we had registrar-lock set. It's not clear to me what
 happened. Our understanding is that we had locks on all of our domains.
 However, when we looked, locks were off on panix.net and panix.org, which
 we own but don't normally use. It's not clear how that happened; dotster
 has yet to contact us with any information about, well, anything at all.
 They did answer a call this morning; they're apprently in the middle of
 an ice storm. All I was able to larn from them is that according to the
 person I talked to, they had no records of any transfer requests on our
 domain from today back through last October.
 
 Someone suggested invoking a dispute procedure. We'll do that, as soon as
 we can get someone to actually accept the dispute, but if it goes through
 that process to completion, many people will suffer, and Panix itself will
 be tremendously damaged. How long do you think even our customers will
 stay loyal? (Forever, for many of them, but that doesn't mean the won't be
 forced to start using a different service.)
 
 While it's true that MelbourneIT won't do anything before (their) Monday
 morning, I don't want to paint them as bad guys in this drama. I don't
 know how they're organized and I don't know how difficult it is for them
 logistically. Of course I want them to move faster. Much faster. But I'll
 take what I can get.
 
 And speaking of MIT,  I don't intend to send them nastygrams - nor NSI
 either. Neither of them owes me anything (at least directly) and being
 heavyhanded would not be a good way to get what I want (restoral of the
 panix.com domain to dotster) even if I thought they deserved it. I expect
 that there will be criminal prosecutions arising out of this, but the time
 for that sort of thing is later, when things are back to normal, and we've
 fixed any systemic vulnerabilities that can be fixed before they're used
 to wreak mass havoc. And it's anyone's guess who the target of those
 prosecutions will be, but I doubt MIT or NSI will be among them.
 
 Lastly, someone expressed surprise that I'd call MIT's lawyer directly.
 I didn't. I spent *hours* trying to find working contact info for MIT and
 Dotster. I didn't find useful 24-hour NOC-type info anywhere. (Someone
 obviously has this info; I expect it's restricted to a list of registrars.)
 I reached Dotster's customer support when they opened for business Saturday
 morning; the guy was polite, and did what he could, but I saw no evidence
 whatsoever of the promised attempt to assist me after he got off the phone.
 MIT apparently has no weekend support at all; I finally located their CEO's
 cellphone in an investor-relations web page. I caled him, and he had his
 lawyer call me back. That was his choice. FWIW, she's not just a lawyer;
 she's apparently the person who has to make decisions about reverting
 control of the domain. So she at least needs to be aware of our position.
 My impression is that she didn't fully grasp the gravity of the situation,
 and so treated us like she'd treat any other annoying customer who managed
 to track her down on her day off. This is somewhat understandable (though
 infuriating) which is why I'd hoped to talk to someone on their tech side
 first. No luck there, but if any of this reaches them, maybe that will
 start things going.
 
 Thanks again to everyone who has tried to help us today.
 
 /a



Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Thor Lancelot Simon

On Sun, Jan 16, 2005 at 02:22:59AM -0500, Paul G wrote:
 
 
 - Original Message - 
 From: Thor Lancelot Simon [EMAIL PROTECTED]
 To: nanog@merit.edu
 Sent: Sunday, January 16, 2005 2:04 AM
 Subject: Re: panix.com hijacked (VeriSign refuses to help)
 
 
 
  Alexis Rosen tried to send this to NANOG earlier this evening but it
  looks like it never made it.  Apologies if it's a duplicate; we're
 
 --- snip ---
 
 how about trying to get in touch with the folks hosting the dns (on the off
 chance that they are honest and willing to help) and asking them to put up
 the correct panix.com zone?

The purported current admin contact appears to be a couple in Las Vegas
who are probably the victims of a joe job.  A little searching will
reveal that people by that name really *do* live at the address given,
and that one of the phone numbers given is a slightly obfuscated form
of a Las Vegas number that either now or in the recent past belonged to
one of them.

Suffice to say it doesn't seem to be possible to get them to change the
DNS.

Chasing down the records for the tech contact, and the allocated party
for the IP addresses now returned for various panix.com hosts (e.g.
142.46.200.72 for panix.com itself), and doing a little gumshoe work,
seems to show that they're all in some way associated with a UK holding
company that, when contacted by phone, claims no knowledge of today's
mishap involving Panix.com.  It's possible that this set of entities was
chosen specifically *because* its convoluted ownership structure would
make getting it to let go of a domain it may or may not know it now is
the tech contact for as difficult as possible.

Beyond the above, it's basically a matter for law enforcement.  Who is
really behind the malfeasance here is not clear, but what is clear
enough to me at this point is that there is, in fact, some deliberate
wrongdoing going on.  Whether the point is just to harm Panix or
to actually somehow profit by it I don't know, but I do note that
an earlier message in this thread pointed out a very similar earlier
incident involving MelbourneIT as the registrar, the same bogus new
domain contacts, and another hapless U.S. corporate victim.

I don't know if these are merely isolated attempts at harassment and
mischief or the precursors to a more widespread attack.  What I do know
is that I'm very concerned, Panix is quite literally fighting for its
life, everyone we've shown details of the problem to is concerned --
including CERT, AUSCERT, and knowledgeable law enforcement personnel --
with the notable exception of MelbourneIT, whose sole corporate response
has been one of decided unconcern, and VeriSign, who seem entirely
determined to pass the buck instead of investigating, fixing, or helping.

And so it goes.

Thor


Re: panix.com hijacked (VeriSign refuses to help)

2005-01-15 Thread Paul G


- Original Message - 
From: Thor Lancelot Simon [EMAIL PROTECTED]
To: Paul G [EMAIL PROTECTED]
Cc: nanog@merit.edu
Sent: Sunday, January 16, 2005 2:40 AM
Subject: Re: panix.com hijacked (VeriSign refuses to help)

--- snip ---

 I don't know if these are merely isolated attempts at harassment and
 mischief or the precursors to a more widespread attack.  What I do know
 is that I'm very concerned, Panix is quite literally fighting for its
 life, everyone we've shown details of the problem to is concerned --
 including CERT, AUSCERT, and knowledgeable law enforcement personnel --
 with the notable exception of MelbourneIT, whose sole corporate response
 has been one of decided unconcern, and VeriSign, who seem entirely
 determined to pass the buck instead of investigating, fixing, or helping.

 And so it goes.

i know people from verisign (used to?) read nanog-l. perhaps some sort of a
deus ex machina intervention may be forthcoming? one can hope.

-p

---
paul galynin