SDF Punted, Due to DDOS

bullshizzle writes "The longest running Public Access UNIX System (SDF, running BSD) est. 1989 had their services terminated abruptly by NWLink because of a DDoS attack. Termination was carried out immediately without prior notification, which violates their contract (page1, page2). Complaints can be filed to the Washington State Attorney General's Office by filling out this simple form conveniently located online. You can follow the story at lonestar.org." While still bad, I've been corrected - SDF was *not* the longest running public access Unix - ArborNet (Located right here in my town) has been around for at least a number more years.

Comments

Denial of Service Attack?

[gunnk]

NWLINK pulled SDF based off the fact that SDF was attacked by an outside hacker??? That's the kind of stupid stunt that invites a REAL denial of service attack:

The Slashdot Effect

Their forum

[Some Bitch]

They have a temporary forum for discussion (top comment atm is about making the front page at /.).

Sorry Won't Fly.

[linuxdoctor]

According to the copy of the agreement, "Northwest Linux may terminate the Agreement at any time and for any reason by prividing written notice of termination and refunding a pro rata portion of fees paid by Customer to Northwest Link for servies not yet rendered."

It doesn't say "prior written notice" but simply "written notice." That means that they can pull the plug on you at any time and tell you why afterwards.

It's interesting that the previous sentence says "either party" can terminate only for breaches of the contract that are not corrected within 15 days. In reality that only applies to Customer since the next sentence authorizes Northwest Link to do whatever it feels like doing.

Anyway, we only have half the story. It would be nice to see what Northwest Link has to say.

Tough luck.

Re:Sorry Won't Fly.

[innate]

Northwest Link has this to say:

Posted to SDF message board by the owner of NWLink:

For starters let me say that I fully support SDF and what they are doing
as a long time net user and admin of public access unix boxes. Having been
the victim of multiple attacks over the past 15 years I know how much of a
pain they are.

Over the past 3 weeks SDF has been attacked 3 times that we can document,
we believe that one more network related issue was directed towards them
as well but we were not able track down the destination while it was occurring.

Yesterday morning as in the other events we shut down SDFs port and had the
IP blocked at each of our backbone providers (UUNet, Verio %26 ELI). This effectively
shutdown our entire customer base while the Distributed Denial of Service attack was
under way and until we had the ip blocked. During and Following these attacks we
receive notice from our large line customers that have Quality of Service provisions
in their contracts that they want credits.

These credits are somewhat substantial and which we are contractually obligated to
provide. We have issued over $30K in credits over the past 3 weeks when these attacks
occur. This coupled with the customers that cancel because of their inability to
use the service they are paying for has caused more then a little harm to my business.

Steven has full access to the equipment at this time, we are not holding it hostage
as the webpage page maintains. In fact we suggested he go to Semaphore directly, this
is where we have our network equipment in Seattle. This was following a move on Thursday
from our old Bellevue location. He acknowledged to me in a phone call a few minutes ago
that he is working with them to get a contract signed. It is going to cost more, however
I suspect the price that he is paying to them is more then fair for his bandwidth usage.
What NWlink was charging was an excellent deal for the bandwidth being used.

Steven explained to me that he was quite surprised by the direction this had taken when
I spoke to him a short time ago. He knew what we did and why we did it. I to am sorry
to see any customer go but had no choice in this matter to keep our other customers
functional who pay the bills and salarys of my staff.

Doug Palin
CEO

What a shame! And who's to blame?

[teqo]

I have got my SDF public shell access at lonestar about two years ago, and I love it! It's (almost, because they required people to send in a buck to show they seriously want to use it and don't create lots of fake accounts) free, they have nice services, rely mostly on their users' affection and willingness to donate money or equipment to them, and you can upgrade for some money to use more features... I hope they will manage to migrate to their new hoster...

What puzzles me is that NWLink seemd to have disconnected SDF because they fell preyto some DDoS'ing, they were not actively involved in some (D)DoS towards other sites, at least that's how I read the announcement!

Consequently, this DDoS might have been one of the most successful one reported, since it not only hogged their connection and thus technically Dos'sed them for a while, but this led to some organizational DoS carried out by NWLink!

How can they dare blaming the victim? And how can they dare putting all the consequences (that is, disconnection) onto the victim as well? Is this legal? Is this good practice? And: Does it help stop the DDoS towards SDF? Okay, the target host(s) is/are down, but the packets might rush to the dangling patch cable end anyway, crossing NWLink's infrastructure...

All in all: Thanks to the DDoS people attacking a nice and free public service! :( (Not that I am some DDoS fan of any kind, but aren't there much more promising targets out there, both in terms of popularity, evilness and challenging huge trunks? Or did some script kiddies just got their shell accounts revoked, and now they felt like stomping their virtual feet? I hope you have learnt to deal better with your frustration by the age of 12...)

And big thanks to NWLink for dealing with a customer's problem in a great and professional way by supporting a DDos through fully shutting down services!

--
"Where do you wanna go today / Somewhere you could never take me"
-- Chumbawamba

Why don't the police think of this?

[pyramid termite]

Clearly, if they started arresting the victims of crime, crime would instantly stop as all the victims would be in jail and safe from the criminals out roaming the streets. It's just another example of how the online world is showing society new and innovative ways to solve serious problems.

SDF was moving

[Fencepost]

The interesting thing about this is that SDF was down on Thursday for a scheduled move to a new location (still on NWLink, but a better facility) and simply never came back up. First it was delayed due to instability in NWLink's internal network, then apparently by just being disconnected.

Personally I find the timing suspicious - the move was originally scheduled for earlier in the week, then was delayed at NWLink's request, then when it actually happened "Oh, we're disconnecting you." Did they decide some time ago to get rid of those pesky SDF people and just try to make it look like an SDF problem instead of a NWLink disconnect?

Re:Easy to get rid of a company you don't like

[innate]

Doug Palin, owner of NWLink, posted his explanation to the Lonestar message board (I won't Slashdot it, you can find it yourself).

NWLink (aka Pacifier aka Europa) has tens of thousands of customers here in the Northwest, including me, and the DoS effectively shut down their entire customer base -- 3 times over the past 3 weeks.

Either they were going to get complaints from one customer, lonestar.org, or they were going to get complaints from thousands of other customers (many of whom they had to pay monetary damages to make up for the loss of service). I can put up with my Internet access being cut off once, twice, but the 3rd time it happens I'm going to seriously consider switching providers. NWLink did what they had to do to save most of their customer base.

Northwest Link

[chuckw]

I used to have a dial-up account with Northwest Link circa 1998. They are quite possibly the rudest, most disorganized people I have ever worked with. They double billed me for the first three months of my service, and then they proceeded to bill me for 3 months of service after I cancelled my account.

I cancelled my account in mid 1999 because I got DSL. I received confirmation of this. Four months later I received a collection agency notice saying that I had not been paying my bill (on an account that I had cancelled). I responded with plenty of evidence that I had cancelled the account. The mailed response ignored any of my evidence and re-iterated the original claim. I finally called the NWLINK offices and talked to the NWLINK collections guy. I don't recall his name, but the collections guy sounded like the most crochety old man I had ever heard. I stated my case and his response was, "Pay your damn bill! We don't run a charity here!!!". It was as if he hadn't even heard a word I said, or as my father likes to say, "we were having two spearate conversations". I got the feeling that he thought I was some punk kid trying to scam NWLINK out of a few months of service.

I will never again do business with them. To those who have asked me about Internet Service Providers over the last 4 years, I have advised that they not do business with NWLINK either. I doubt I've made any impact on their bottom line, however I can assure you that the $75.00 they got out of me cost them at least ten customers. I mean really, all they had to do was treat me with a little respect regardless of who was right and who was wrong...

Re:You're missing the point

[dpalin]

SDF was involved each and every time these events occurred. There were a 3 different attacks in 3 weeks. There was a 4th attack that was short lived that we were not able to confirm was directed at SDF. What course of action would have been more realistic when 12 million packets per second started hitting our network? We took the action we could. I would have loved to have kept SDF as a customer. However had this continued I would have explaining to do to other customers (which I spent most of yesterday doing following the attack). Doug Palin CEO - NWLink