Slashdot Mirror
SDF Punted, Due to DDOS
bullshizzle writes "The longest running Public Access UNIX System (SDF, running BSD) est. 1989 had their services terminated abruptly by NWLink because of a DDoS attack. Termination was carried out immediately without prior notification, which violates their contract (page1, page2). Complaints can be filed to the Washington State Attorney General's Office by filling out this simple form conveniently located online. You can follow the story at lonestar.org." While still bad, I've been corrected - SDF was *not* the longest running public access Unix - ArborNet (Located right here in my town) has been around for at least a number more years.
The problem I have with the stories is that they are very brief, only giving one side. One wonders if there was more history here.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Failing to understand how exactly the ownership of this public server is setup, I'm wondering if the owning body will be suing over the breach of contract? Or will something along the lines of the EFF be taking up the battle?
I can't think of any reasonable circumstances prior to this that I've heard of a host cutting your connection just because of one incident without talking first...
NWLINK pulled SDF based off the fact that SDF was attacked by an outside hacker??? That's the kind of stupid stunt that invites a REAL denial of service attack:
The Slashdot Effect
Life is short: void the warranty.
They have a temporary forum for discussion (top comment atm is about making the front page at /.).
According to the copy of the agreement, "Northwest Linux may terminate the Agreement at any time and for any reason by prividing written notice of termination and refunding a pro rata portion of fees paid by Customer to Northwest Link for servies not yet rendered."
It doesn't say "prior written notice" but simply "written notice." That means that they can pull the plug on you at any time and tell you why afterwards.
It's interesting that the previous sentence says "either party" can terminate only for breaches of the contract that are not corrected within 15 days. In reality that only applies to Customer since the next sentence authorizes Northwest Link to do whatever it feels like doing.
Anyway, we only have half the story. It would be nice to see what Northwest Link has to say.
Tough luck.
I have got my SDF public shell access at lonestar about two years ago, and I love it! It's (almost, because they required people to send in a buck to show they seriously want to use it and don't create lots of fake accounts) free, they have nice services, rely mostly on their users' affection and willingness to donate money or equipment to them, and you can upgrade for some money to use more features... I hope they will manage to migrate to their new hoster...
What puzzles me is that NWLink seemd to have disconnected SDF because they fell preyto some DDoS'ing, they were not actively involved in some (D)DoS towards other sites, at least that's how I read the announcement!
Consequently, this DDoS might have been one of the most successful one reported, since it not only hogged their connection and thus technically Dos'sed them for a while, but this led to some organizational DoS carried out by NWLink!
How can they dare blaming the victim? And how can they dare putting all the consequences (that is, disconnection) onto the victim as well? Is this legal? Is this good practice? And: Does it help stop the DDoS towards SDF? Okay, the target host(s) is/are down, but the packets might rush to the dangling patch cable end anyway, crossing NWLink's infrastructure...
All in all: Thanks to the DDoS people attacking a nice and free public service! :( (Not that I am some DDoS fan of any kind, but aren't there much more promising targets out there, both in terms of
popularity, evilness and challenging huge trunks? Or did some script kiddies just got their shell accounts revoked, and now they felt like stomping their virtual feet? I hope you have learnt to deal better with your frustration by the age of 12...)
And big thanks to NWLink for dealing with a customer's problem in a great and professional way by supporting a DDos through fully shutting down services!
--
"Where do you wanna go today / Somewhere you could never take me"
-- Chumbawamba
Clearly, if they started arresting the victims of crime, crime would instantly stop as all the victims would be in jail and safe from the criminals out roaming the streets. It's just another example of how the online world is showing society new and innovative ways to solve serious problems.
at long last an ISP starts to take ddos sources seriously and then they throw the baby out with the bath water.
if my link was being used to host a ddos attack I would hope I could get notified of the problem and some assistance in fixing it.
to clean up the net we have to educate the users not move them somewhere else, though not for one second am I sugesting that these perticular admins needed educating but they did need notifying.
--required "I remember when"
years ago I was network admin in the UK for a company our exchange server was managed by the US office (the whole globes exchange services where US managed)
I realised that our server was an open relay and notified my director in the US and was told that it didnt matter because nobody would scan us why would anybody scan an advertising agency.
a quick install of snort on another box and a week later I had proof that we were being scaned.
still no action
a couple of weeks later our ISP sent us an official letter in telling us to fix the relay or be booted.
they could have booted us at any time but they did the right thing and warned us first.
the relay was fixed.
**** lying is wrong even for sleeping dogs
I believe their *network connection* was cut, not the machine itself. Bandwidth is not immune to DDoS attacks.
(uugh, IHBT)
This wasn't a case of the attackers being hosted by SDF. They were attacked from the outside by some third party, and their provider unplugged them as a result.
This is similar to: if I wanted to shut down a local unpopular political organization's bookstore, so I picketed and made noise and made things unpleasant out in front of the bookstore, and the result was that the bookstore's lease was revoked by the owner of the building.
Now, due to a couple of kiddies that wanted to prove their `skills', SDF has to go offline, leaving thousands of users unable to access their email and contact friends, and several more thousands unable to access Web and Gopher resources hosted on SDF... giving commercial providers like AOL just one more argument in their favour. They can afford lawyers to take care of shit like this... we can only depend on community leverage. I hope it will be plentyful. Damn. I wanna play netris on sdf....
Yes. I joined up when i heard about it in 99 and really cut my teeth on UNIX there, in spite of having been exposed to UNIX at least a year earlier. What makes SDF so great is that there is a real community of users who have their own chat app, their own "message board" app, all inside the shell. It reminded me of the community on the BBSes of old. Stephen (the sysadmin) regularly participates in user discussions and the opinions of the users help shape the direction of the system. In just the past few years i've seen it grow from a single system running Linux/i386 to seven or eight networked NetBSD/Alpha boxes with a user-built MUD, virtual hosting, special IRC bot accounts, all kinds of things. People who have been there since 1989 have seen it grow from SysV UNIX to 386BSD to Linux, on a dozen architectures.
This is nightmare for some of us regular users. I log on every day and rely on it for all my email, for my web page, for ICQ, for hundreds of personal files... SDF is my all-purpose scratchpad, and my $HOME contains so many little text files and projects i've worked on in the past four years. Some of the users have paid-for virtual host accounts and run business websites hosted on SDF. All these people are losing their business, their sites are inaccessible... It's a sad, sad day. I only recall one time in the past four years SDF has been down for longer than a few hours, and i believe that was due to a DDoS attack while they were located in Texas, and just before they moved from Linux to NetBSD.
*sigh* Some people just don't get it :-(
alison at sdf.lonestar.org
Personally I find the timing suspicious - the move was originally scheduled for earlier in the week, then was delayed at NWLink's request, then when it actually happened "Oh, we're disconnecting you." Did they decide some time ago to get rid of those pesky SDF people and just try to make it look like an SDF problem instead of a NWLink disconnect?
fencepost
just a little off
Not Found
The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you have it. Please inform the site administrator of the referring page.
As long as its in the best interests of the bandwidth providers (who get mega cash for all these GBs) this kind of crap will never stop.
And guess what, its EASY to stop! Simply require the netork borders to perform filtering on packets crossing the border. If your cable modem is spewing out packets addressed from China, and you're in Florida, SOMETHING IS WRONG. These packets should have never gotten into the internet in the first place.
Suddenly, when spoofing is no longer possible, DoS doesn't seem like such a great idea. Even with botnets and crap for DDoS usage, if you can be tracked back from a single trojaned box, you'd have to be stupid to try.
If I have been able to see further than others, it is because I bought a pair of binoculars.
I left NWLink DSL a couple of weeks ago over their mediocre uptime and high costs, especially bandwidth costs. They were down quite a few hours per month lately (that I noticed) and their tech support was not so good. They seemed to have a lot of router configuration problems: there were frequent router loops. This may have been partly due to their prime (only?) feed to most of the world being alter.net, which at least in this neck of the woods is quite slow and tangled. NWlink claimed at one point that they were just finishing up some big network reconfiguration, and things should get better: when things didn't seem to, that was the end for me. I should have waited to switch: it would be nice to dump them now in protest over their DDOSing of SDF :-).
I chose NWLink several years ago because at the time their prices were good, and my previous provider, NW Nexus, had been bought out twice and become expensive and quite unreliable in the process. Now I'm with DSL Only, and so far they seem great. ISP service is $18/month for 640/256 DSL, with no bandwidth charges, no restrictions on use, a static IP, and two mailboxes. It's been reliable so far, and they are direct to a local exchange that in turn is direct to my work and to Internet2, so ping times and bandwidth are excellent.
It would be nice to be done with ISP switches forever: maybe this is it. The other good news is that this was the easiest ISP switch so far: Qwest seems to have it figured out now, and it was completely routine.
FYI. As always, YMMV.
I used to have a dial-up account with Northwest Link circa 1998. They are quite possibly the rudest, most disorganized people I have ever worked with. They double billed me for the first three months of my service, and then they proceeded to bill me for 3 months of service after I cancelled my account.
I cancelled my account in mid 1999 because I got DSL. I received confirmation of this. Four months later I received a collection agency notice saying that I had not been paying my bill (on an account that I had cancelled). I responded with plenty of evidence that I had cancelled the account. The mailed response ignored any of my evidence and re-iterated the original claim. I finally called the NWLINK offices and talked to the NWLINK collections guy. I don't recall his name, but the collections guy sounded like the most crochety old man I had ever heard. I stated my case and his response was, "Pay your damn bill! We don't run a charity here!!!". It was as if he hadn't even heard a word I said, or as my father likes to say, "we were having two spearate conversations". I got the feeling that he thought I was some punk kid trying to scam NWLINK out of a few months of service.
I will never again do business with them. To those who have asked me about Internet Service Providers over the last 4 years, I have advised that they not do business with NWLINK either. I doubt I've made any impact on their bottom line, however I can assure you that the $75.00 they got out of me cost them at least ten customers. I mean really, all they had to do was treat me with a little respect regardless of who was right and who was wrong...
*Condense fact from the vapor of nuance*
Correct. M-Net went up under Unix in 1983. Chinet didn't go Unix until after that point, I think.
Both systems are still active, still public-access, and still run Unix -- so whichever one is oldest, it isn't SDF.
The correct link is http://www.wa.gov/ago/consumer/forms/ not the ./form/ that was in the original link.
Think we could drive NWLink out of business by simply attacking all their customers, one by one?
After all, if they drop customers just because they're being attacked..
At least mafia-owned pizzarias make excellent pizza. Compare to Bill Gates.
SDF was involved each and every time these events occurred. There were a 3 different attacks in 3 weeks. There was a 4th attack that was short lived that we were not able to confirm was directed at SDF. What course of action would have been more realistic when 12 million packets per second started hitting our network? We took the action we could. I would have loved to have kept SDF as a customer. However had this continued I would have explaining to do to other customers (which I spent most of yesterday doing following the attack). Doug Palin CEO - NWLink