Slashdot Mirror
SDF Punted, Due to DDOS
bullshizzle writes "The longest running Public Access UNIX System (SDF, running BSD) est. 1989 had their services terminated abruptly by NWLink because of a DDoS attack. Termination was carried out immediately without prior notification, which violates their contract (page1, page2). Complaints can be filed to the Washington State Attorney General's Office by filling out this simple form conveniently located online. You can follow the story at lonestar.org." While still bad, I've been corrected - SDF was *not* the longest running public access Unix - ArborNet (Located right here in my town) has been around for at least a number more years.
like free shell account??
-- -- --
Help my mini cause: My journal
The problem I have with the stories is that they are very brief, only giving one side. One wonders if there was more history here.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Got Net?
:(
:(
Seriously I never knew this existed
Now I want to check it out
Failing to understand how exactly the ownership of this public server is setup, I'm wondering if the owning body will be suing over the breach of contract? Or will something along the lines of the EFF be taking up the battle?
I can't think of any reasonable circumstances prior to this that I've heard of a host cutting your connection just because of one incident without talking first...
Disclaimer: I am not a lawyer, and I do not play one on TV. Having said that, based on a quick read of the contract, NWLink is on very shaky legal grounds, and SDF looks to have a very solid case against them.
NWLINK pulled SDF based off the fact that SDF was attacked by an outside hacker??? That's the kind of stupid stunt that invites a REAL denial of service attack:
The Slashdot Effect
Life is short: void the warranty.
Why is this such a horrific event? First it is the responsibility of the admins of the access provider to shut down access to the attackers. But if they don't do it.. why is it bad if someone upstreams kills all there access? If it stops a large scale DDoS attack.. it would be a good thing. Or maybe i've been drinking too much bacardi 151.
magnanomous.
They have a temporary forum for discussion (top comment atm is about making the front page at /.).
argh, anyone got a mirror?
I dont see the mian concern here, I blame MSFT anyway, look at their share prices, I hate them
According to the copy of the agreement, "Northwest Linux may terminate the Agreement at any time and for any reason by prividing written notice of termination and refunding a pro rata portion of fees paid by Customer to Northwest Link for servies not yet rendered."
It doesn't say "prior written notice" but simply "written notice." That means that they can pull the plug on you at any time and tell you why afterwards.
It's interesting that the previous sentence says "either party" can terminate only for breaches of the contract that are not corrected within 15 days. In reality that only applies to Customer since the next sentence authorizes Northwest Link to do whatever it feels like doing.
Anyway, we only have half the story. It would be nice to see what Northwest Link has to say.
Tough luck.
SEMAPHORE will cost SDF more than double its current rent, however, the technical team seem much more willing to help us. Please watch here for updates.
A breach of contract, a new ISP, and couple the costs for a public service that has been running for fifteen years all because of a dumb DoS attack. As they say, many people have come to rely on SDF. This is one of the dumbest stunts that I have seen an ISP pull in a long time and I hope that NWLink have apropriate and successful legal action taken against them.
I have got my SDF public shell access at lonestar about two years ago, and I love it! It's (almost, because they required people to send in a buck to show they seriously want to use it and don't create lots of fake accounts) free, they have nice services, rely mostly on their users' affection and willingness to donate money or equipment to them, and you can upgrade for some money to use more features... I hope they will manage to migrate to their new hoster...
What puzzles me is that NWLink seemd to have disconnected SDF because they fell preyto some DDoS'ing, they were not actively involved in some (D)DoS towards other sites, at least that's how I read the announcement!
Consequently, this DDoS might have been one of the most successful one reported, since it not only hogged their connection and thus technically Dos'sed them for a while, but this led to some organizational DoS carried out by NWLink!
How can they dare blaming the victim? And how can they dare putting all the consequences (that is, disconnection) onto the victim as well? Is this legal? Is this good practice? And: Does it help stop the DDoS towards SDF? Okay, the target host(s) is/are down, but the packets might rush to the dangling patch cable end anyway, crossing NWLink's infrastructure...
All in all: Thanks to the DDoS people attacking a nice and free public service! :( (Not that I am some DDoS fan of any kind, but aren't there much more promising targets out there, both in terms of
popularity, evilness and challenging huge trunks? Or did some script kiddies just got their shell accounts revoked, and now they felt like stomping their virtual feet? I hope you have learnt to deal better with your frustration by the age of 12...)
And big thanks to NWLink for dealing with a customer's problem in a great and professional way by supporting a DDos through fully shutting down services!
--
"Where do you wanna go today / Somewhere you could never take me"
-- Chumbawamba
In related news. sdf gets slashdotted and their service provider shuuts them down because they thougt it was a DDOS.
Clearly, if they started arresting the victims of crime, crime would instantly stop as all the victims would be in jail and safe from the criminals out roaming the streets. It's just another example of how the online world is showing society new and innovative ways to solve serious problems.
(I assume that Slashdot and the poster did check this link before...)
Mike
have you ever heard the word "bandwith"?
There's a little more to just losing access to a shell account. I happen to host my website and email with SDF. I've been without email since they pulled the plug. No email means I am not recieving job notifications, nor payment from clients.
Ever Onward, Forward Bound
The president of SDF can be found at on yahoo
Oh, man. I hope the recent DDoS attacks against Slashdot result in THIS site getting pulled.
What will michael do when he's unemployed? We all know CmdrTaco's coding skills suck, so he'll just turn into a bum... but I bet he'll still complain about SPAM.
at long last an ISP starts to take ddos sources seriously and then they throw the baby out with the bath water.
if my link was being used to host a ddos attack I would hope I could get notified of the problem and some assistance in fixing it.
to clean up the net we have to educate the users not move them somewhere else, though not for one second am I sugesting that these perticular admins needed educating but they did need notifying.
--required "I remember when"
years ago I was network admin in the UK for a company our exchange server was managed by the US office (the whole globes exchange services where US managed)
I realised that our server was an open relay and notified my director in the US and was told that it didnt matter because nobody would scan us why would anybody scan an advertising agency.
a quick install of snort on another box and a week later I had proof that we were being scaned.
still no action
a couple of weeks later our ISP sent us an official letter in telling us to fix the relay or be booted.
they could have booted us at any time but they did the right thing and warned us first.
the relay was fixed.
**** lying is wrong even for sleeping dogs
I believe their *network connection* was cut, not the machine itself. Bandwidth is not immune to DDoS attacks.
(uugh, IHBT)
Well, I went ahead and RTFA, and it turns out that the machine *was* shut off, but it sounds like it would have happened no matter what the OS.
This was the first space shuttle flight to carry an Israeli astronaut. Could it be the work of anti-Zionist liberalist terrorists?
ABC radio is reporting that some eyewitnesses claim to have seen flaming debris falling to the Earth and that the shuttle hasn't been heard from in an unusually long time. Here's something to get you started. Whoever they're interviewing now is talking about investigating terrorism. We sure are f'ing paranoid these days. Now mod me down, please.
The pieces are falling in the Central/
North Texas region... Possibly in Dallas/Ft.Worth
-brandon
Quitters never win, Winners never quit, But those who never win and never quit are idiots.
Now, due to a couple of kiddies that wanted to prove their `skills', SDF has to go offline, leaving thousands of users unable to access their email and contact friends, and several more thousands unable to access Web and Gopher resources hosted on SDF... giving commercial providers like AOL just one more argument in their favour. They can afford lawyers to take care of shit like this... we can only depend on community leverage. I hope it will be plentyful. Damn. I wanna play netris on sdf....
Well apparently you have figured out that a good DOS attack can flood the box with packets effectivly flooding out the valid incomming packets you need something like local QOS to fix this and it has to be set up correctly.
Next step is the switch in front again dependant on the type of switch it may have problems with a DOS attack as far as management goes.
The router above That may hav it's wan links flooded effectivly edging out valid traffic again and dependant on the router type taking up enormous ammounts of CPU time.
Then there are all the upstreams. When you buy bandwith from some local provider like they have they dont have the capacity to deal with the attack nessicarily and at minimum it may be degrading there network.
The only good solution to fix these things is source address verification from ALL ISP's (ok not happening any time soon) and oh that breaks mobil IP and some multi homes sites even the cheasy multiple DSL and cable modem setups for more bandwith and reliability configs.
No sir I dont like it.
the man is always trying to shut us down because we are freedom and the man cant stand freedom.
how many ghetto kids will die today?
You probably don't. So I'll tell you.
I woudn't be surprised if the DDOSers were in league with NWLink. Or maybe I'm just paranoid or something. Or maybe, as a member of SDF myself, I'm more than a little annoyed at this incidentr. It is SO WRONG.
We just need a list of other sites hosted by NWlink. Apply a DDoS against each customer, one at a time, and eventually they'll have no customers left.
Seriously though, their other customers ought to be warned that their contracts are meaningless.
Hasn't M-Net been around a whole lot longer than SDF? I remember dialing into M-Net (on a 300 baud acoustic coupler!) in 1983 when it was running System 3 on an Altos 68000.
Personally I find the timing suspicious - the move was originally scheduled for earlier in the week, then was delayed at NWLink's request, then when it actually happened "Oh, we're disconnecting you." Did they decide some time ago to get rid of those pesky SDF people and just try to make it look like an SDF problem instead of a NWLink disconnect?
fencepost
just a little off
Is there a standard letter of complaint somewhere to send to the appropriate authorities? I don't have a clue as to what to say to whom and how, but I'd like to express my dismay at NWLINK's actions to someone in power. (I am in NL, by the way.)
Sentimentality is merely the Bank Holiday of cynicism.
- Oscar Wilde
email *to* Nwlink:
A customer of yours gets attacked and you drop their services with no warning? That is outright despicable. I manage my organization's firewalls. Internet attacks go on all the time, directed and undirected. Dealing with it that way, you won't have any customers both from nwlink.com turning them off and from the lost trust of your customers. If the information is incorrect, you should post that information on your website.
Not Found
The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you have it. Please inform the site administrator of the referring page.
As long as its in the best interests of the bandwidth providers (who get mega cash for all these GBs) this kind of crap will never stop.
And guess what, its EASY to stop! Simply require the netork borders to perform filtering on packets crossing the border. If your cable modem is spewing out packets addressed from China, and you're in Florida, SOMETHING IS WRONG. These packets should have never gotten into the internet in the first place.
Suddenly, when spoofing is no longer possible, DoS doesn't seem like such a great idea. Even with botnets and crap for DDoS usage, if you can be tracked back from a single trojaned box, you'd have to be stupid to try.
If I have been able to see further than others, it is because I bought a pair of binoculars.
I left NWLink DSL a couple of weeks ago over their mediocre uptime and high costs, especially bandwidth costs. They were down quite a few hours per month lately (that I noticed) and their tech support was not so good. They seemed to have a lot of router configuration problems: there were frequent router loops. This may have been partly due to their prime (only?) feed to most of the world being alter.net, which at least in this neck of the woods is quite slow and tangled. NWlink claimed at one point that they were just finishing up some big network reconfiguration, and things should get better: when things didn't seem to, that was the end for me. I should have waited to switch: it would be nice to dump them now in protest over their DDOSing of SDF :-).
I chose NWLink several years ago because at the time their prices were good, and my previous provider, NW Nexus, had been bought out twice and become expensive and quite unreliable in the process. Now I'm with DSL Only, and so far they seem great. ISP service is $18/month for 640/256 DSL, with no bandwidth charges, no restrictions on use, a static IP, and two mailboxes. It's been reliable so far, and they are direct to a local exchange that in turn is direct to my work and to Internet2, so ping times and bandwidth are excellent.
It would be nice to be done with ISP switches forever: maybe this is it. The other good news is that this was the easiest ISP switch so far: Qwest seems to have it figured out now, and it was completely routine.
FYI. As always, YMMV.
.. like their backup generator failing to kick in, UPS/battery back-up systems being sorely inadequate and unable to handle the slightest brown-outs, a cable being mysteriously unplugged (in the secure datacenter), and various networking issues; like some testing or maintenance somewhere upstream, to "Oh It's A DDoS", and then internal routing problems at the new location (delaying the return of the SDF online after the move requested by them).
Thanks NWLink, as an indirect customer, it will be my pleasure to spread the word of your top-notch services.
Probably a nice system, but no where NEAR the oldest. http://chinet.com was started in 1982 with m-net following soon afterward.
there goes my hosted immages, FUCKING A. I need a new fucking free shell provider now. Any ideas??
FUCK FUCK FUCK FUCK SHIT FUCKING A!
IANAL but notice does imply being told first, not after disconnection.
No, it wasn't running NT.
I used to have a dial-up account with Northwest Link circa 1998. They are quite possibly the rudest, most disorganized people I have ever worked with. They double billed me for the first three months of my service, and then they proceeded to bill me for 3 months of service after I cancelled my account.
I cancelled my account in mid 1999 because I got DSL. I received confirmation of this. Four months later I received a collection agency notice saying that I had not been paying my bill (on an account that I had cancelled). I responded with plenty of evidence that I had cancelled the account. The mailed response ignored any of my evidence and re-iterated the original claim. I finally called the NWLINK offices and talked to the NWLINK collections guy. I don't recall his name, but the collections guy sounded like the most crochety old man I had ever heard. I stated my case and his response was, "Pay your damn bill! We don't run a charity here!!!". It was as if he hadn't even heard a word I said, or as my father likes to say, "we were having two spearate conversations". I got the feeling that he thought I was some punk kid trying to scam NWLINK out of a few months of service.
I will never again do business with them. To those who have asked me about Internet Service Providers over the last 4 years, I have advised that they not do business with NWLINK either. I doubt I've made any impact on their bottom line, however I can assure you that the $75.00 they got out of me cost them at least ten customers. I mean really, all they had to do was treat me with a little respect regardless of who was right and who was wrong...
*Condense fact from the vapor of nuance*
I think it was correctly stated on www.lonestar.org that SDF was one of the oldest and longest serving of its kind.
The point was, SDF was cut off without adequate and/or written notice. If NWLink knew that the attacks on SDF were causing problems three weeks prior to this, then the very least NWLink could have done was provided notice.
NWLink certainly owes SDF an apology, at the very least.
Mod parent down as TROLL!!!!!
Except Chinet went Unix after M-Net went up. NATCH!
SDF has over 20,000 users including myself. I started using UNIX because of them. They are a non-profit organization. NWLINK obviously does no support non-profit organizations, even their customers. They told sdf they had to protect their customers. SDF was their customer.
The correct link is http://www.wa.gov/ago/consumer/forms/ not the ./form/ that was in the original link.
PEOPLE .. Please stop threatening NWLINK. Yes, they could have handled this situation better, but the point is they didn't and that isn't going to change. We need to look toward the future now. If any host can be shutdown like this, then no hosts are safe. I think the thread here should go to POSITIVE WAYS to do successful tracebacks so that DDoSing will stop for everyone. I don't want to see SDF become the scapegoat for this, it really doesn't solve anything for the long term. I've talked with the CEO of NWLINK and he is a nice guy, but he has his hands full as it is. Lets not look back and think of the future.
Stephen Jones
Caretaker
SDF Public Access UNIX System
If you need that in hypertext:
Complaint Form
sig not found
I'm curious... for NWLink, what would have been the right way for fending off the DoS attacks? Dropping their client in the hope that the kiddies will stop is a bit of a kludge. The existence of their business still depends on the mercy of anonymous criminals.
There appears to be a pretty big need for a form of accountability.. right now, you can get almost any small site/organization off the net, simply by flooding them and getting them to run up their ISP bill. What would be the appropriate course of action for victims to such attacks?
see a Text Widget
Now, it'd just be morally wrong to go on a crusade to carefully inform the world of what we think of NWLinks actions, Quality of Service, or other issues we have with them....w/o contacting them first to share our love and affection..
http://www.nwlink.com/contact/index.php
"It is morally wrong to initiate the aggressive use of force.." Of course, defensive force is fair game...
NY switches to 11 digit phone numbers.
The world loses another (virtual) PDP-10
twenex.org: No address associated with hostname
(That was part of SDF if you didn't already know)
8000 people die of AIDS as usual.
And the space shuttle doesn't make it back.
(I know I shouldn't begin sentances with and)
A DDOS attack is an attack on bandwidth, not an attack on an operating system.
If I was more cynical...wait I am more cynical: I think its just because either Hemos doesn't understand the difference, or more likely, just wants to jump at a chance to badmouth that other operating system that he knows is so much of a threat to their treasured linux.
Personally I don't think this story comes under the heading of "News that matters", and even if it was worthy, it should have been put under the 'Security' heading, not "BSD".
Perhaps we can get a new section for Denial of Services, or perhaps, a wider umbrella would be a 'teenage HaX0r' section where we can put DDOSs, Web Defacements and Case Mods all together. (That way, people who have lives can choose the option not to display any of that shit on the front page)
Thanks, majestynine.
Think we could drive NWLink out of business by simply attacking all their customers, one by one?
After all, if they drop customers just because they're being attacked..
At least mafia-owned pizzarias make excellent pizza. Compare to Bill Gates.
I'm going through withdrawal pangs without my shell account. I've heard NWLINK's explanation but the timing and the anecdotes of former customers cast a pall over their credibility. My take on this is they were just covering their butts. As a result, thousands of us who rely on our accounts for email and more are high and dry. If what NWLINK said is true, the script kiddies won. That's the best that I can say for them.
Long live the Super Dimensional Fortress!
Wansu, th' chinese sailor
Dude, you're the CEO of a company, making a major PR statement (which is what this amounts to), and you can't be bothered to spell I to am pluralize salarys of my stuff or capitalize public access unix correctly?
Your statement makes sense, but you should fire yourself as PR jockey.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
the net will continue to suffer from denial of service attacks because it is designed to facilitate such attacks. the control packets (ip headers and such) which are part of the TCP/IP protocol are sent on the same bandwidth as the data, therefore effectively clogging up bandwidth that could be used for non-ddos traffic. simply by responding to every dos request, the bandwidth is wasted. the same was possible with 'blue boxing', 'red boxing', whatevercolor boxing on the phone systems some 15-20 years ago and the phone companies figured it out and changed their signaling to be 'out of band', that is out of the voice band, thus deeming all '*boxing' useless. the net needs a similar revamp, but who's ready to do it, and migrate everything to a new system,and what will be the cost involved?
Ddos wont be stopped because in its current form, the net facilitates it....
'A lie if repeated often enough, becomes the truth.' - Goebbels
Let's see, this one liner:
echo 'main(){printf("according to my calculations \"a number more years\" is: %d.\n",0xa);}'>./a.c;gcc ./a.c;./a.out
seems to produce the following output:
according to my calculations "a number more years" is: 10.
Must have been! We should let the US government do anything it wants! They will keep us safe by killing ALL OTHER LIFE IN THE WHOLE WORLD.
I've been a Lonestar user for 7 around years, it is an extremely useful service and a great community. I pay a nominal amount for what is called an "ARPA" (meaning fully featured) shell account that is at least as good as other shell accounts that I hold with commercial providers.
One of the commercial providers that I use explicity disallows users from using IRC or running bots from their account, for the reason that IRC attracts DDoS. Some user gets into a disagreement with some little script kiddie fuckhead then Wham-O! The systems are knocked over or inaccessible and lots of users are inconvenienced. In this case, inconvenienced beyond the script kiddies wildest dreams. Right now the culprits will be laughing about it between frantic bouts of mutual masturbation.
Once Lonestar is moved to it's new provider or an amiable solution is found with it's current provider, I think it would be wise for to cease all IRC activity so that it can minimise the chances of this happening again.
The ISP has other customers who were being affected by the DOS attacks. They had to act in the interests of the greater good over that of the individual.
Mac OS X and Windows XP working side by side to fight back the night.
SDF ruels. I'm glad I got my freeshell webpage mirrored on my firewall.
And they finally had fast shell access.
A similar thing is happening to Dalnet - due to the DDOS attacks (since Dec 8th!) many servers are just dropping out because of the high bandwidth. According to the site, many ISPs are making the decision not to host irc servers at all due to the risk. Sad...
I can ssh to sdf.lonestar.org.
/etc/hosts file, and just retrieved my accumulated email. I'm sure SDF will be under strain as people catch up today and tomorrow, so I'll refrain from bogging things down.
I can't resolve pop.freeshell.org from my machine, but I can resolve it from the shell on sdf.lonestar.org, so I presume that is a DNS propagation thing.
I took the IP address as found on sdf and put it in my
Woohoo !
I'll be checking the bboard later to see what this has cost SDF, and see if I should be sending them a little bit more money.