SDF Punted, Due to DDOS

bullshizzle writes "The longest running Public Access UNIX System (SDF, running BSD) est. 1989 had their services terminated abruptly by NWLink because of a DDoS attack. Termination was carried out immediately without prior notification, which violates their contract (page1, page2). Complaints can be filed to the Washington State Attorney General's Office by filling out this simple form conveniently located online. You can follow the story at lonestar.org." While still bad, I've been corrected - SDF was *not* the longest running public access Unix - ArborNet (Located right here in my town) has been around for at least a number more years.

public access

like free shell account??

Easy to get rid of a company you don't like

Looks to me as if NWLink set an idiotic precedent. Someone attacks your site, they yank the plug.

The problem I have with the stories is that they are very brief, only giving one side. One wonders if there was more history here.

Re:You're missing the point

SDF was involved each and every time these events occurred. There were a 3 different attacks in 3 weeks. There was a 4th attack that was short lived that we were not able to confirm was directed at SDF. What course of action would have been more realistic when 12 million packets per second started hitting our network? We took the action we could. I would have loved to have kept SDF as a customer. However had this continued I would have explaining to do to other customers (which I spent most of yesterday doing following the attack). Doug Palin CEO - NWLink

hmmm

Got Net?

Seriously I never knew this existed :(

Now I want to check it out :(

Law suit?

Failing to understand how exactly the ownership of this public server is setup, I'm wondering if the owning body will be suing over the breach of contract? Or will something along the lines of the EFF be taking up the battle?

I can't think of any reasonable circumstances prior to this that I've heard of a host cutting your connection just because of one incident without talking first...

Denial of Service Attack?

NWLINK pulled SDF based off the fact that SDF was attacked by an outside hacker??? That's the kind of stupid stunt that invites a REAL denial of service attack:

The Slashdot Effect

Who can blame them?

Why is this such a horrific event? First it is the responsibility of the admins of the access provider to shut down access to the attackers. But if they don't do it.. why is it bad if someone upstreams kills all there access? If it stops a large scale DDoS attack.. it would be a good thing. Or maybe i've been drinking too much bacardi 151.

Their forum

They have a temporary forum [lonestar.org] for discussion (top comment atm is about making the front page at /.).

Sorry Won't Fly.

According to the copy of the agreement, "Northwest Linux may terminate the Agreement at any time and for any reason by prividing written notice of termination and refunding a pro rata portion of fees paid by Customer to Northwest Link for servies not yet rendered."

It doesn't say "prior written notice" but simply "written notice." That means that they can pull the plug on you at any time and tell you why afterwards.

It's interesting that the previous sentence says "either party" can terminate only for breaches of the contract that are not corrected within 15 days. In reality that only applies to Customer since the next sentence authorizes Northwest Link to do whatever it feels like doing.

Anyway, we only have half the story. It would be nice to see what Northwest Link has to say.

Tough luck.

Re:Sorry Won't Fly.

Northwest Link has this to say:

Posted to SDF message board by the owner of NWLink:

For starters let me say that I fully support SDF and what they are doing
as a long time net user and admin of public access unix boxes. Having been
the victim of multiple attacks over the past 15 years I know how much of a
pain they are.

Over the past 3 weeks SDF has been attacked 3 times that we can document,
we believe that one more network related issue was directed towards them
as well but we were not able track down the destination while it was occurring.

Yesterday morning as in the other events we shut down SDFs port and had the
IP blocked at each of our backbone providers (UUNet, Verio %26 ELI). This effectively
shutdown our entire customer base while the Distributed Denial of Service attack was
under way and until we had the ip blocked. During and Following these attacks we
receive notice from our large line customers that have Quality of Service provisions
in their contracts that they want credits.

These credits are somewhat substantial and which we are contractually obligated to
provide. We have issued over $30K in credits over the past 3 weeks when these attacks
occur. This coupled with the customers that cancel because of their inability to
use the service they are paying for has caused more then a little harm to my business.

Steven has full access to the equipment at this time, we are not holding it hostage
as the webpage page maintains. In fact we suggested he go to Semaphore directly, this
is where we have our network equipment in Seattle. This was following a move on Thursday
from our old Bellevue location. He acknowledged to me in a phone call a few minutes ago
that he is working with them to get a contract signed. It is going to cost more, however
I suspect the price that he is paying to them is more then fair for his bandwidth usage.
What NWlink was charging was an excellent deal for the bandwidth being used.

Steven explained to me that he was quite surprised by the direction this had taken when
I spoke to him a short time ago. He knew what we did and why we did it. I to am sorry
to see any customer go but had no choice in this matter to keep our other customers
functional who pay the bills and salarys of my staff.

Doug Palin
CEO

Dissapointing to see

SEMAPHORE will cost SDF more than double its current rent, however, the technical team seem much more willing to help us. Please watch here [lonestar.org] for updates.
A breach of contract, a new ISP, and couple the costs for a public service that has been running for fifteen years all because of a dumb DoS attack. As they say, many people have come to rely on SDF. This is one of the dumbest stunts that I have seen an ISP pull in a long time and I hope that NWLink [nwlink.com] have apropriate and successful legal action taken against them.

What a shame! And who's to blame?

I have got my SDF public shell access at lonestar about two years ago, and I love it! It's (almost, because they required people to send in a buck to show they seriously want to use it and don't create lots of fake accounts) free, they have nice services, rely mostly on their users' affection and willingness to donate money or equipment to them, and you can upgrade for some money to use more features... I hope they will manage to migrate to their new hoster...

What puzzles me is that NWLink seemd to have disconnected SDF because they fell preyto some DDoS'ing, they were not actively involved in some (D)DoS towards other sites, at least that's how I read the announcement!

Consequently, this DDoS might have been one of the most successful one reported, since it not only hogged their connection and thus technically Dos'sed them for a while, but this led to some organizational DoS carried out by NWLink!

How can they dare blaming the victim? And how can they dare putting all the consequences (that is, disconnection) onto the victim as well? Is this legal? Is this good practice? And: Does it help stop the DDoS towards SDF? Okay, the target host(s) is/are down, but the packets might rush to the dangling patch cable end anyway, crossing NWLink's infrastructure...

All in all: Thanks to the DDoS people attacking a nice and free public service! :( (Not that I am some DDoS fan of any kind, but aren't there much more promising targets out there, both in terms of popularity, evilness and challenging huge trunks? Or did some script kiddies just got their shell accounts revoked, and now they felt like stomping their virtual feet? I hope you have learnt to deal better with your frustration by the age of 12...)

And big thanks to NWLink for dealing with a customer's problem in a great and professional way by supporting a DDos through fully shutting down services!

--
"Where do you wanna go today / Somewhere you could never take me"
-- Chumbawamba

Why don't the police think of this?

Clearly, if they started arresting the victims of crime, crime would instantly stop as all the victims would be in jail and safe from the criminals out roaming the streets. It's just another example of how the online world is showing society new and innovative ways to solve serious problems.

why oh why

at long last an ISP starts to take ddos sources seriously and then they throw the baby out with the bath water.

if my link was being used to host a ddos attack I would hope I could get notified of the problem and some assistance in fixing it.

to clean up the net we have to educate the users not move them somewhere else, though not for one second am I sugesting that these perticular admins needed educating but they did need notifying.

--required "I remember when"

years ago I was network admin in the UK for a company our exchange server was managed by the US office (the whole globes exchange services where US managed)

I realised that our server was an open relay and notified my director in the US and was told that it didnt matter because nobody would scan us why would anybody scan an advertising agency.

a quick install of snort on another box and a week later I had proof that we were being scaned.

still no action

a couple of weeks later our ISP sent us an official letter in telling us to fix the relay or be booted.

they could have booted us at any time but they did the right thing and warned us first.

the relay was fixed.

Thoughts from a member...

I have been a member of SDF for one and a half years, and I am very disappointed to see this piece of Internet history on the verge of becoming history. It has been a very successful form of what people have been calling the `digital commons' -- proving that the Internet can be something that commercial providers can never offer: a place in which to cooperate, make friends, help others... (sounds cheesy, but it's true)

Now, due to a couple of kiddies that wanted to prove their `skills', SDF has to go offline, leaving thousands of users unable to access their email and contact friends, and several more thousands unable to access Web and Gopher resources hosted on SDF... giving commercial providers like AOL just one more argument in their favour. They can afford lawyers to take care of shit like this... we can only depend on community leverage. I hope it will be plentyful. Damn. I wanna play netris on sdf....

You know my thoughts on this?

You probably don't. So I'll tell you.

I woudn't be surprised if the DDOSers were in league with NWLink. Or maybe I'm just paranoid or something. Or maybe, as a member of SDF myself, I'm more than a little annoyed at this incidentr. It is SO WRONG.

M-Net?

Hasn't M-Net [arbornet.org] been around a whole lot longer than SDF? I remember dialing into M-Net (on a 300 baud acoustic coupler!) in 1983 when it was running System 3 on an Altos 68000.

SDF was moving

The interesting thing about this is that SDF was down on Thursday for a scheduled move to a new location (still on NWLink, but a better facility) and simply never came back up. First it was delayed due to instability in NWLink's internal network, then apparently by just being disconnected.

Personally I find the timing suspicious - the move was originally scheduled for earlier in the week, then was delayed at NWLink's request, then when it actually happened "Oh, we're disconnecting you." Did they decide some time ago to get rid of those pesky SDF people and just try to make it look like an SDF problem instead of a NWLink disconnect?

How to complain?

Is there a standard letter of complaint somewhere to send to the appropriate authorities? I don't have a clue as to what to say to whom and how, but I'd like to express my dismay at NWLINK's actions to someone in power. (I am in NL, by the way.)

Trying to link the WA consumer complaint form

produces this error. Is this a /. problem or a problem with their link?

Not Found
The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you have it. Please inform the site administrator of the referring page.

This kind of crap will continue

As long as its in the best interests of the bandwidth providers (who get mega cash for all these GBs) this kind of crap will never stop.

And guess what, its EASY to stop! Simply require the netork borders to perform filtering on packets crossing the border. If your cable modem is spewing out packets addressed from China, and you're in Florida, SOMETHING IS WRONG. These packets should have never gotten into the internet in the first place.

Suddenly, when spoofing is no longer possible, DoS doesn't seem like such a great idea. Even with botnets and crap for DDoS usage, if you can be tracked back from a single trojaned box, you'd have to be stupid to try.

FUCKING A!!

there goes my hosted immages, FUCKING A. I need a new fucking free shell provider now. Any ideas??

FUCK FUCK FUCK FUCK SHIT FUCKING A!

Northwest Link

I used to have a dial-up account with Northwest Link circa 1998. They are quite possibly the rudest, most disorganized people I have ever worked with. They double billed me for the first three months of my service, and then they proceeded to bill me for 3 months of service after I cancelled my account.

I cancelled my account in mid 1999 because I got DSL. I received confirmation of this. Four months later I received a collection agency notice saying that I had not been paying my bill (on an account that I had cancelled). I responded with plenty of evidence that I had cancelled the account. The mailed response ignored any of my evidence and re-iterated the original claim. I finally called the NWLINK offices and talked to the NWLINK collections guy. I don't recall his name, but the collections guy sounded like the most crochety old man I had ever heard. I stated my case and his response was, "Pay your damn bill! We don't run a charity here!!!". It was as if he hadn't even heard a word I said, or as my father likes to say, "we were having two spearate conversations". I got the feeling that he thought I was some punk kid trying to scam NWLINK out of a few months of service.

I will never again do business with them. To those who have asked me about Internet Service Providers over the last 4 years, I have advised that they not do business with NWLINK either. I doubt I've made any impact on their bottom line, however I can assure you that the $75.00 they got out of me cost them at least ten customers. I mean really, all they had to do was treat me with a little respect regardless of who was right and who was wrong...

Complaint form link

The correct link is http://www.wa.gov/ago/consumer/forms/ [wa.gov] not the ./form/ that was in the original link.

PLEASE .. BE SENSIBLE! FOR THE SAKE OF SDF!

PEOPLE .. Please stop threatening NWLINK. Yes, they could have handled this situation better, but the point is they didn't and that isn't going to change. We need to look toward the future now. If any host can be shutdown like this, then no hosts are safe. I think the thread here should go to POSITIVE WAYS to do successful tracebacks so that DDoSing will stop for everyone. I don't want to see SDF become the scapegoat for this, it really doesn't solve anything for the long term. I've talked with the CEO of NWLINK and he is a nice guy, but he has his hands full as it is. Lets not look back and think of the future.

Stephen Jones
Caretaker
SDF Public Access UNIX System

Is there a right way to deal with a DDoS ??

I'm curious... for NWLink, what would have been the right way for fending off the DoS attacks? Dropping their client in the hope that the kiddies will stop is a bit of a kludge. The existence of their business still depends on the mercy of anonymous criminals.

There appears to be a pretty big need for a form of accountability.. right now, you can get almost any small site/organization off the net, simply by flooding them and getting them to run up their ISP bill. What would be the appropriate course of action for victims to such attacks?

what a bad day

NY switches to 11 digit phone numbers.

The world loses another (virtual) PDP-10
twenex.org: No address associated with hostname
(That was part of SDF if you didn't already know)

8000 people die of AIDS as usual.

And the space shuttle doesn't make it back.

(I know I shouldn't begin sentances with and)

Can someone please explain...

Can someone please explain why this was put under the topic of "BSD", and why such a thing was even mentioned in the "article" by Hemos?

A DDOS attack is an attack on bandwidth, not an attack on an operating system.

If I was more cynical...wait I am more cynical: I think its just because either Hemos doesn't understand the difference, or more likely, just wants to jump at a chance to badmouth that other operating system [freebsd.org] that he knows is so much of a threat to their treasured linux.

Personally I don't think this story comes under the heading of "News that matters", and even if it was worthy, it should have been put under the 'Security' heading, not "BSD".

Perhaps we can get a new section for Denial of Services, or perhaps, a wider umbrella would be a 'teenage HaX0r' section where we can put DDOSs, Web Defacements and Case Mods all together. (That way, people who have lives can choose the option not to display any of that shit on the front page)

Thanks, majestynine.

SDF withdrawal

I'm going through withdrawal pangs without my shell account. I've heard NWLINK's explanation but the timing and the anecdotes of former customers cast a pall over their credibility. My take on this is they were just covering their butts. As a result, thousands of us who rely on our accounts for email and more are high and dry. If what NWLINK said is true, the script kiddies won. That's the best that I can say for them.

Long live the Super Dimensional Fortress!

this will happen again..

the net will continue to suffer from denial of service attacks because it is designed to facilitate such attacks. the control packets (ip headers and such) which are part of the TCP/IP protocol are sent on the same bandwidth as the data, therefore effectively clogging up bandwidth that could be used for non-ddos traffic. simply by responding to every dos request, the bandwidth is wasted. the same was possible with 'blue boxing', 'red boxing', whatevercolor boxing on the phone systems some 15-20 years ago and the phone companies figured it out and changed their signaling to be 'out of band', that is out of the voice band, thus deeming all '*boxing' useless. the net needs a similar revamp, but who's ready to do it, and migrate everything to a new system,and what will be the cost involved?

Ddos wont be stopped because in its current form, the net facilitates it....

"at least a number more years" is defined as:

As regards this quote:

ArborNet (Located right here in my town) has been around for

at least a number more years

Let's see, this one liner:

echo 'main(){printf("according to my calculations \"a number more years\" is: %d.\n",0xa);}'>./a.c;gcc ./a.c;./a.out

seems to produce the following output:

according to my calculations "a number more years" is: 10.

Shell provider + IRC = DDoS inevitability

I've been a Lonestar user for 7 around years, it is an extremely useful service and a great community. I pay a nominal amount for what is called an "ARPA" (meaning fully featured) shell account that is at least as good as other shell accounts that I hold with commercial providers.

One of the commercial providers that I use explicity disallows users from using IRC or running bots from their account, for the reason that IRC attracts DDoS. Some user gets into a disagreement with some little script kiddie fuckhead then Wham-O! The systems are knocked over or inaccessible and lots of users are inconvenienced. In this case, inconvenienced beyond the script kiddies wildest dreams. Right now the culprits will be laughing about it between frantic bouts of mutual masturbation.

Once Lonestar is moved to it's new provider or an amiable solution is found with it's current provider, I think it would be wise for to cease all IRC activity so that it can minimise the chances of this happening again.

Same with Dalnet

A similar thing is happening to Dalnet - due to the DDOS attacks (since Dec 8th!) many servers are just dropping out because of the high bandwidth. According to the site, many ISPs are making the decision not to host irc servers at all due to the risk. Sad...

It's back !

I can ssh to sdf.lonestar.org.

I can't resolve pop.freeshell.org from my machine, but I can resolve it from the shell on sdf.lonestar.org, so I presume that is a DNS propagation thing.

I took the IP address as found on sdf and put it in my /etc/hosts file, and just retrieved my accumulated email. I'm sure SDF will be under strain as people catch up today and tomorrow, so I'll refrain from bogging things down.

Woohoo !

I'll be checking the bboard later to see what this has cost SDF, and see if I should be sending them a little bit more money.

Re:I don't understand this.

I believe their *network connection* was cut, not the machine itself. Bandwidth is not immune to DDoS attacks.

(uugh, IHBT)

Re:slashdotted

The sdf.lonestar.org link isn't slashdotted, that's the server that's had it's link terminated. Don't ask me why the link was included in the writeup...

Re:I don't understand this.

Well apparently you have figured out that a good DOS attack can flood the box with packets effectivly flooding out the valid incomming packets you need something like local QOS to fix this and it has to be set up correctly.

Next step is the switch in front again dependant on the type of switch it may have problems with a DOS attack as far as management goes.

The router above That may hav it's wan links flooded effectivly edging out valid traffic again and dependant on the router type taking up enormous ammounts of CPU time.

Then there are all the upstreams. When you buy bandwith from some local provider like they have they dont have the capacity to deal with the attack nessicarily and at minimum it may be degrading there network.

The only good solution to fix these things is source address verification from ALL ISP's (ok not happening any time soon) and oh that breaks mobil IP and some multi homes sites even the cheasy multiple DSL and cable modem setups for more bandwith and reliability configs.

Re:Link for the online form ?

I just gave the "form" link a try and got the complaint from the server, BUT when I backed up a level at the server and linked to it from one of THEIR (Washington state's) pages it worked fine ...

Looks like the server has been told to block /. ?

Tom

Re:Link for the online form ?

Eh, it's /forms/ ... s plural. Not /form/