Slashdot Mirror
Spammers Hijacking IP Space
Ron Guilmette writes "As reported in the Washington Post's Security Fix blog, a substantial hunk of IP address space has apparently been taken over by notorious mass e-mailing company Media Breakaway, LLC, formerly known as OptInRealBig, via means that are at best questionable. The block in question is 134.17.0.0/16, which I documented in depth in an independent investigation. (Apparently, the President of Media Breakaway has now admitted to the Washington Post that his company has been occupying and using the 134.17.0.0/16 block and that front company JKS Media, which provides routing to the block, is actually owned by Media Breakaway.) Remarkably, the president of Media Breakaway, who happens to be an attorney, is trying to defend his company's apparent snatching of this block based upon his own rather novel legal theory that ARIN doesn't have jurisdiction over any IP address space that was handed out before ARIN was formed, in 1997."
It's the only way to be sure...
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
Form an agry mob, arm ourselves with pitchforks and flaming brands, and the chase those rascals way out to the outskirts of town.
Hell, if there was any trouble, we could even transform into an angry lynch mob - THEN lets see who owns that space eh? EH? Whaddya say?
Moved to http://soylentnews.org/. You are invited to join us too!
...if everyone just blocked that IP range entirely at their routers, shutting off their connectivity?
There was a time when the Internet was a 'small' enough place that it would have even been feasible. Kind of like blacklisting a Usenet server for spam.
If the IP is simply blackholed, you are by lack of argument allowing this Spammer to put some sort of credible hold on that IP. That's like finding a squatter in a house on the street where the owners have gone on holiday - and simply putting a peice of tape across the driveway - it doesn't solve the bigger problem which is that someone walked into the house and started living there without any credible reason of doing so. It doesn't solve the problem of what's going to happen when the people return from holidays and find this squatter in their house.
Also, if we simply blackhole that IP, what's going to happen when a legitimate user tries to use that space. It's going to go to bollocks for them when they find that the rest of the net is ignoring them already.
Moved to http://soylentnews.org/. You are invited to join us too!
OptinRealBig belongs to none other than Snotty Scotty Richter. I haven't heard of that guy in a while. I was hoping he had been hit by a bus or something.
Web consulting +
What's been happening for years now is well-meaning admins blocking various IP addresses / blocks and/or domain names. Their motives are good, but after the address or domain name is blocked they almost never go back and recheck to see if the block is still needed. What this leads to over time are holes in the address space that can't be used, awkward or no routes to some addresses from some other addresses, etc. Especially in this time of zombie machines; blackhole that IP address and you've knocked some individual off line - but you've done nothing to reduce the amount of spam / viruses / worms / etc.
This is what killed ORBS and other services of that type. Easy to add domains / addresses to the blocklist, but difficult to remove them. Eventually the list becomes useless...
Much better solution: make an example out of the people who are squatting on this netblock. Break out the pitchforks and torches...
There's only one true solution to the problem of spammers. Death. I'm not joking. These people that create botnets, hijack networks and servers so that they can sell advertising are creating problems on a global scale for money. Nothing but death will stop or deter them. They need to die.
It's good that I do not own any firearms and good that I do not know where these people live and good that I lack the means to get there. If I had those things and an air-tight alibi, I wouldn't hesitate to make my first murder one of these people.
If he is president of a company that owns the company that provides routing for the block, doesn't that mean he has legal ownership of that block?
Yes, if the block is used primarily for spam, I'm all for people blackholing the range. And if he's using it for illegal purposes, yes, he should be punished (and the range appropriated). But I don't see where the term "hijacking" could be applied at all.
If I own some cars and use them in crimes, I haven't "hijacked" anyone.
What am I missing?
Love many, trust a few, do harm to none.
I'm sorry but to read this comment you must accept the terms of service of my crappy comment. Please click your back button to accept terms of service.
I will continue to say it every time I can.
We need a strong societal repudiation of the violation of ethics. Organizations like Microsoft, SCO, and the like and people like Bill Gates, Darl McBride, etc. need to be made pariahs for the shameless unethical and illegal behavior.
"Spamming" is unethical. The only reason why it is done is because their unethical behavior is not shunned.
Boy, that was a cheezy joke huh?
-ted
It really isn't that simple. I'd refer you to my own work (http://www.usenix.org/media/events/lisa07/tech/videos/josephsen.mp4, and http://media.defcon.org/dc-15/video/Defcon15-Dave_Josephsen-Homeless_Vikings.mp4 ) or that of Nick Feamster at Georgia tech. They've been hijacking address space via short-lived BGP prefix hijacks for at least 5 years now, and It is exactly the attitude of "we'll just block X" that got us here in the first place. If you use RBL's and make the arms race about IP's , then the most direct response is to attack the network layer and/or IP space. Further there are real world reasons why IP filters just aren't going to work on a global scale. For that I'd refer you to the work of Mohit Lad at UCLA. There is an economic layer on top of BGP. The effect of no-valley routing is that you're going to get route propagation from folks you think you can trust but cannot. It's a bit much to get into here, but off-handedly blacklisting more shit isn't the answer here, it's the problem.
Um no. Everyone else knows this. But might as well clue you in. They've claimed 134.17.*.* - all of it.
"with their freedom lost all virtue lose" - Milton
because that's all it is, a mid level isp has added someone to their routing tables with ip's that they have no right to. simply telling their provider to correct their configurations or all their traffic will be dropped should be enough, indeed it should be mandatory for backbone providers to do this in order for them to legally keep their own ip ranges. anything else is asking for people to start claiming ip's all over the place and before you know it each isp will route you to a different site for the same ip, making the internet useless.
If you mod me down, I will become more powerful than you can imagine....
The "/16" means they claimed the remaining 16 bits of the 32-bit IP address whose first 2 bytes are 134.17 in decimal- everything from 134.17.0.0 to 134.17.255.255. That's one of only 65,000 blocks of its class available and is the sort of range that would be owned by a large corporation or university.
" I felt a great disturbance in the internet, as if 65535 ip addresses suddenly cried out in terror and were suddenly silenced. I fear something terrible has happened. "
iptables -A spam -s 134.17.0.0/16 -j DROP
Lawyers, MBA's, RIAA? A jedi fears not these things!
The very first evidence I can find of the 134.17.0.0 being reserved is referenced in RFC 1166 to BAY-PR-NET with a contact of a Mr. Milo Medin of NASA Science Internet Program Office (MEDIN@NSIPO.NASA.GOV), who This RFC is obviously outdated (July 1990), but government agencies usually don't give up their IP space. Initial impression is that NASA was/is involved in providing connectivity to the Pacific Rim; in some ways with AX.25. If this is still the case, then the US Government should have a little talk with whoever gave/sold one of their /16 nets to some lady in Colorado who is the CIO for one of the most notorious spammers in the world.
The rules for managing pre-ARIN space aren't totally clear, but nobody's worried about them too much because they were mostly owned by large reputable organizations, such as universities and government contractors. (Some of them may need to set the Evil Bit on their packets, but none of them needed to set the Stupid Bit.) In many cases, they've given most of their space back to IANA or ARIN - several universities have returned their Class A
But there have been a few early-adopters that are no longer in business - and in some cases their IP address space was worth more than their remaining furniture and intellectual property. Does the space revert to IANA if the organization is gone? Probably, but if you can pretend the organization is Not Dead Yet, you might get away with keeping their space. In some cases, you can do that more legitimately than in other cases. (A friend of a friend was the former sysadmin from a defunct early-adopter company that had had a Class B
OptInRealBig and their corporate-shell sock puppets have owned large IP spaces before. It's been a while, so I may have details wrong; if I remember correctly, one of the sock puppets was a "web hosting" company, with lots of "customers", and if one of those "customers" got caught spamming, then they'd get spanked for violating the AUP ("Bad! Bad customer!") - and there was enough IP space that they could keep playing this game for a long time.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks