Re: News DoS using sendsys

• Previous message: Rude Yak: "Re: Webmail.bellsouth.net security problems"
• Maybe in reply to: Walter Hafner: "News DoS using sendsys"
• Next in thread: Pat Barron: "Re: News DoS using sendsys"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, Aug 26, 1998 at 11:50:15AM +0200, Walter Hafner wrote:
> I think we (a local ISP in Augsburg/Germany ...) are hit by an DoS that
> wasn't described here before:
>
> Our newsserver (INN) all of a sudden gets several 100 'sendsys' requests
> per day. The addresses of the people requesting the sendsys seem to be
> completely random. They all seem to be normal user-accounts. We see
> these sendsys requests for about a week now.
>
> Since our INN is configured to report all 'unusual' control messages to
> the news-administrators, rather than to execute it, the DoS doesn't hurt
> us very much. My Mailfolder now usually looks like:
>
>   N  2   Aug 26 News Subsystem     (74)   sendsys by ktakamuraat_private
>   N  3   Aug 26 News Subsystem     (53)   sendsys by ritchieat_private
>   N  4   Aug 26 News Subsystem     (64)   sendsys by ritchieat_private
>   N  5   Aug 26 News Subsystem     (64)   sendsys by flaaggat_private
>   N  6   Aug 26 News Subsystem     (66)   sendsys by ktakamuraat_private

This looks like the actions of the "Meowers". I'm not totally up to speed
with their antics -- as far as I can gather they have been cross-posting
junk in to the newsgroup demon.local (which is propogated worldwide).

They've taken exception to recent actions by Demon (instigated by request
from some of Demon's customers) to fence off cross-posts to demon.local
that originated outside of Demon's newsservers. The use of 'dennon' in
the domain above is what tipped me off to this.

Since you're not linked with Demon (as far as I can tell) I'd guess that one
of your users/customers has made discouraging comments about the "Meowers"
(I have no idea why they chose that name) in the demon.local or demon.news
newsgroup, and the "Meowers" have decided to retaliate.

If you do a DejaNews search for

    ~g demon.news sendsys

you'll see some complaints from people saying they've been sendsys bombed
after expressing an opinion on this.

If you search for

    ~g demon.news sendsys ~a nthornleyat_private

you'll find (at least) one message from Nigel Thornley, who purports to
be nthornleyat_private By looking at this message you should quickly
get an idea why some of us want the cross-posting stopped.

N
--
--+==[ Nik Clayton becomes Just Another Perl Contractor in 17 days. ]==+--
                      She's still dead. Deal with it.

• Next message: Pat Barron: "Re: News DoS using sendsys"
• Previous message: Rude Yak: "Re: Webmail.bellsouth.net security problems"
• Maybe in reply to: Walter Hafner: "News DoS using sendsys"
• Next in thread: Pat Barron: "Re: News DoS using sendsys"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:13:37 PDT