[16110] in North American Network Operators' Group
Re: SMURF amplifier block list
daemon@ATHENA.MIT.EDU (Craig A. Huegen)
Sun Apr 12 15:38:11 1998
Date: Sun, 12 Apr 1998 12:35:44 -0700 (PDT)
From: "Craig A. Huegen" <chuegen@quadrunner.com>
To: "Alex P. Rudnev" <alex@Relcom.EU.net>
cc: Michael Dillon <michael@memra.com>, nanog@merit.edu
In-Reply-To: <Pine.SUN.3.91.980412212953.18082M-100000@virgin.relcom.eu.net>
On Sun, 12 Apr 1998, Alex P. Rudnev wrote:
==>Remember, this intruders use small ISP as their service providers, not
==>huge MCI or SPRINT.
Actually, the majority of these people use compromised root accounts in
educational institutions, educational residence halls w/ Ethernet,
enterprises w/o decent firewalls, and co-location machines.
There are lists which exist of over 200-300 compromised root accounts and
access capabilities from which someone can launch an attack.
/cah