Spammers Hijacking IP Space 233
Ron Guilmette writes "As reported in the Washington Post's Security Fix blog, a substantial hunk of IP address space has apparently been taken over by notorious mass e-mailing company Media Breakaway, LLC, formerly known as OptInRealBig, via means that are at best questionable. The block in question is 134.17.0.0/16, which I documented in depth in an independent investigation. (Apparently, the President of Media Breakaway has now admitted to the Washington Post that his company has been occupying and using the 134.17.0.0/16 block and that front company JKS Media, which provides routing to the block, is actually owned by Media Breakaway.) Remarkably, the president of Media Breakaway, who happens to be an attorney, is trying to defend his company's apparent snatching of this block based upon his own rather novel legal theory that ARIN doesn't have jurisdiction over any IP address space that was handed out before ARIN was formed, in 1997."
I say we dust off and nuke the site from orbit (Score:3, Funny)
Even better. 134.17.0.0/16 /dev/null (Score:2)
Re: (Score:2)
This is almost as good as asking spammers to Set the Evil Bit, so we can filter them out. If all the spammers sign on for address space in this block, we can just route that block to /dev/null and be done with it. ;-)
Maybe. This would stop the questionable spammers. The ones that send the "opt in" crap that a lot of people fall for on web forms. Heck, some of them even want email like this.
Somehow I doubt the V14gr4 and P3n15 Enlargmenttt! stuff will go away by filtering these IPs. I may be wrong, but somehow I don't think your average zombie is routing through this space.
Re: (Score:2)
If only we could... (Score:3, Funny)
Hell, if there was any trouble, we could even transform into an angry lynch mob - THEN lets see who owns that space eh? EH? Whaddya say?
Re: (Score:2)
Wouldn't it be nice... (Score:4, Insightful)
There was a time when the Internet was a 'small' enough place that it would have even been feasible. Kind of like blacklisting a Usenet server for spam.
Re:Wouldn't it be nice... (Score:4, Insightful)
That would then lead to another group "claiming" another spot of space, and so on and so forth - until there was no legitimate or unused space left at all - then you would have to fight the same fight with many many people rather than one spamming company as we have now.
Re: (Score:2)
For now, I have blocked it in my firewalls.
Re:Wouldn't it be nice... (Score:4, Insightful)
Re: (Score:2)
Welcome to my firewall. I hope you rot in hell.
Re: (Score:2)
Re: (Score:2)
Huh? There certainly isn't enough "internet", if that includes IPv4 address space. We definitely don't have enough space if every jackass in the universe runs out and squats in the first
Hijacking the IP Space Owners, not just the Space (Score:3, Informative)
The rules for managing pre-ARIN space aren't totally clear, but nobody's worried about them too much because they were mostly owned by large reputable organizations, such as universities and government contractors. (Some of them may need to set the Evil Bit on their packets, but none of them needed to set the Stupid Bit.) In many cases, they've given most of their space back to IANA or ARIN - several universities
Re: (Score:2)
Re: (Score:2)
> it someday.
So why isn't SF Bay Packet Radio taking any action?
> It'd be an internet turf war of people were simply able to advertise the availability of
> a network they don't own.
Isn't that what is happening here?
Re: (Score:2)
I'm guessing the Packet radio org either no longer exists or is probably depopulated or disinterested in maintaining the IP space anymore.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You do have to get your transit providers or peers to recognize your route advertisement.
Re: (Score:2)
While I'm glad you've been able to work with organizations that filter prefixes properly, it doesn't always work out the way you've experienced.
Re: (Score:2)
Given how well the Pa
Re: (Score:2)
The spammers set up a front corporation in Nevada with a name that's basically identical to the now-defunct Ham radio club that got the block back in 1989. Then they just took control of it using that name; to a casual observer -- and apparently ARIN didn't bother to look too closely -- they looked like the legitimate owner. It's basically a social engineering exploit.
And because of the way the ARIN's rules are set up, they don't pay anyt
Re: (Score:2)
Re: (Score:2)
SImple, blackhole the IP space (Score:2)
Re:SImple, blackhole the IP space (Score:4, Interesting)
Re: (Score:2)
Firewall Updated (Score:2)
[John]
I say they can have it... (Score:2)
# route -n
All good!
Re: (Score:2)
It needs to be policed NOT ignored.
Re: (Score:2)
[John]
Re: (Score:2)
*clap*
Blackhole == Defeat! (Score:5, Insightful)
Also, if we simply blackhole that IP, what's going to happen when a legitimate user tries to use that space. It's going to go to bollocks for them when they find that the rest of the net is ignoring them already.
Re: (Score:2)
Re: (Score:2)
That's like finding a squatter in a house on the street where the owners have gone on holiday
Huh? That's not squatting. If the premises are occupied then it is trespass. I know this must be hard to understand in the US where there are no sensible squatting laws, but in civilized world squatting is where you are living somewhere that is vacant without the authorization of the owner. Squatting serves an important purpose: to force property owners to develop the property. Otherwise all the buying up property for the purpose of speculating on an increase in the market would result in widespread h
Re: (Score:2)
> laws...
Google "adverse possession".
> Squatting serves an important purpose: to force property owners to develop the property.
Why is necessary that all property be "developed"?
> Otherwise all the buying up property for the purpose of speculating on an increase in
> the market would result in widespread homelessness.
You have a defective understanding of economics.
Re: (Score:2)
Quote:
squatting is where you are living somewhere that is vacant without the authorization of the owner
Yes, and the problem here is that when the owner comes to the squatter and says "I would like you to go somewhere else as I would like to [insert reason]." the squatter then replies with "But I have been living here for [insert length] and I ain't moving."
The IP address they have been using does not belong to them.
Rather than putting forward the
Re: (Score:2)
Re: (Score:2)
This is from Mirriam-Webster online -
Re: (Score:2)
So, by your reasoning, it's OK for SF Bay Packet Radio LLC to have the 134.17/16 block? They are using it apparently.
Re: (Score:2)
Comment removed (Score:4, Informative)
Blackholing this address space may not be wise (Score:5, Insightful)
What's been happening for years now is well-meaning admins blocking various IP addresses / blocks and/or domain names. Their motives are good, but after the address or domain name is blocked they almost never go back and recheck to see if the block is still needed. What this leads to over time are holes in the address space that can't be used, awkward or no routes to some addresses from some other addresses, etc. Especially in this time of zombie machines; blackhole that IP address and you've knocked some individual off line - but you've done nothing to reduce the amount of spam / viruses / worms / etc.
This is what killed ORBS and other services of that type. Easy to add domains / addresses to the blocklist, but difficult to remove them. Eventually the list becomes useless...
Much better solution: make an example out of the people who are squatting on this netblock. Break out the pitchforks and torches...
Re:Blackholing this address space may not be wise (Score:5, Insightful)
Re: (Score:3, Insightful)
If you're willing to pay enough for the bandwidth you will probably find a major provider to let you advertise your range.
For the origin of that range to get as far as they have, they clearly had paperwork to prove to their upstream that the range is assigned to them.
You're their customer. Without a very good reason to do so, they won't (can't) blackhole you without violating whatever interconnection agreement was signed.
Temporarily blocking a range should cause no permanent issue for the new own
Re: (Score:2)
For the origin of that range to get as far as they have, they clearly had paperwork to prove to their upstream that the range is assigned to them.
Except they don't. The IANA/ARIN records for that block show it being assigned to SF Bay Packet Radio in 1999. However, the nameservers appear to have been changed in October 2007 to sfbprservices.com, which is then registered by Media Breakaway (trying to pretend to be the original owner). Apparently, their upstreams (Level3, Cogent, and XO) did not do any checking, nor are they doing proper route filtering. IIRC all three of those companies are hurting finacially, so they probably just looked the oth
Re: (Score:2)
It's "JKS Media" and they have ASN 32311 [fixedorbit.com].
Peers include Cogent, XO, Level3, and 360Networks.
IMO, it's the networks peering with JKS that need to pull the plug, rather than having every sysop on the net blacklist either the ASN or the IP address range.
Re: (Score:2)
AS32311 SPARTACUS
Re: (Score:2)
See here! [slashdot.org]
Re: (Score:2)
I already considered it. For about 60 seconds as I watched an inordinate number of spam attempts on my mail servers. Took me less than 5 seconds to add 134.17.0.0./16 to the firewall. I felt sorry for the eventually leg
Spammers know no limits (Score:5, Insightful)
It's good that I do not own any firearms and good that I do not know where these people live and good that I lack the means to get there. If I had those things and an air-tight alibi, I wouldn't hesitate to make my first murder one of these people.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
We do definitely treat spammers (and lawyers) with far too much leniency in society. Spammers, direct marketers, viral marketers should all be in prison for a very, very long time. If
Re: (Score:2)
Re: (Score:2)
"Hijack?" (Score:5, Interesting)
If he is president of a company that owns the company that provides routing for the block, doesn't that mean he has legal ownership of that block?
Yes, if the block is used primarily for spam, I'm all for people blackholing the range. And if he's using it for illegal purposes, yes, he should be punished (and the range appropriated). But I don't see where the term "hijacking" could be applied at all.
If I own some cars and use them in crimes, I haven't "hijacked" anyone.
What am I missing?
Re: (Score:2)
Just becuase you squat doesn't mean you own.
Quote:
Remarkably, the president of Media Breakaway, who happens to be an attorney, is trying to defend his company's apparent snatching of this block based upon his own rather novel legal theory that ARIN doesn't have jurisdiction over any IP address space that was handed out before ARIN was formed, in 1997.
Re:"Hijack?" (Score:5, Informative)
$ whois 134.17.0.0
OrgName: SF Bay Packet Radio
OrgID: SBPR-1
Address: 1490 W 121st Ave
Address: Suite 201
City: Westminster
StateProv: CO
PostalCode: 80234
Country: US
NetRange: 134.17.0.0 - 134.17.255.255
CIDR: 134.17.0.0/16
NetName: BAY-PR-NET
NetHandle: NET-134-17-0-0-1
Parent: NET-134-0-0-0-0
NetType: Direct Assignment
NameServer: NS1.SFBPRSERVICES.COM
NameServer: NS2.SFBPRSERVICES.COM
Comment:
RegDate: 1989-04-12
Updated: 2007-10-05
Re:"Hijack?" (Score:4, Interesting)
It looks like what they did was just register a company with a similar-sounding name to a defunct organization that had an old
Then they had another front company obtain an AS number and provide routing, and suddenly they have lots of IPs from which to send spam.
The even-creepier part is that it looks like they have another block stolen through similar means (currently registered to a P.O. box in NYC) and possible connections to Russian spammers, which means basically the Russian mafia.
Here's hoping that when the whole thing falls apart, the Russian mob comes calling for this guy's head. Ironically they're the best chance for this guy getting the slow, painful death he so richly deserves.
To read this comment (Score:2, Funny)
A lack of ethics (Score:5, Interesting)
We need a strong societal repudiation of the violation of ethics. Organizations like Microsoft, SCO, and the like and people like Bill Gates, Darl McBride, etc. need to be made pariahs for the shameless unethical and illegal behavior.
"Spamming" is unethical. The only reason why it is done is because their unethical behavior is not shunned.
And what is spam? (Score:2)
Re: (Score:2)
Re: (Score:2)
I might agree with you that even legal bulk mail is annoying... but if it is that annoying, then we should change the law, yes?
Re: (Score:2)
The fact that the U.S. Congress -- a pretty t
Re: (Score:2)
Except, perhaps, for the "free shot" thing. I do not think that allowing a company to make a single, one-shot email to your email address is necessarily unreasonable... *IF* it is truly only one email per company, which does not then sell your address to others who do the same thing.
But even that can be annoying, I grant you. Since I am definitely against bulk commercial snail-mail, I suppose I should also be opposed to bulk commercial email, in any form.
Re: (Score:2)
Re: (Score:2)
You, sir miss the obvious.
The, ah, "only reason why it is done" is because there's money in it.
Re: (Score:3, Insightful)
Re: (Score:2)
If they were shunned by business, then it could not generate large amounts of revenue. Which is the point of my post.
Ethics are not considered anymore, people don't even care. We applaud the balls it takes to do the most obviously unethical deeds in public, and not say to the effect: "I can't do business with you, my reputation is too important."
That is why spam is profitable. That
Comment removed (Score:3, Funny)
what's the big deal? (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Ron
Re: (Score:3, Informative)
who is linking this to the backbone? (Score:3, Insightful)
because that's all it is, a mid level isp has added someone to their routing tables with ip's that they have no right to. simply telling their provider to correct their configurations or all their traffic will be dropped should be enough, indeed it should be mandatory for backbone providers to do this in order for them to legally keep their own ip ranges. anything else is asking for people to start claiming ip's all over the place and before you know it each isp will route you to a different site for the same ip, making the internet useless.
This is good news (Score:2)
By George he's got something there (Score:2)
By George he's right! I'm gonna lay claim to 127.0.0.1. oh wait I already seem to own it...
Re: (Score:2)
Re: (Score:2)
I wish it weren't illegal (Score:2)
I'm All For It (Score:2)
If ARIN doesn't control IP addresses assigned before it started, then it basically means a return to classful routing. And then everyone would be pretty much forced to use IPv6.
I say go for it.
easily fixed...... (Score:3, Funny)
iptables -A spam -s 134.17.0.0/16 -j DROP
Re: (Score:2)
OrgName: SF Bay Packet Radio
NetRange: 134.17.0.0 - 134.17.255.255
CIDR: 134.17.0.0/16
What do you have against the SF Bay Packet Radio?
Their upstream providers shouldn't be routing it, but you shouldn't blackhole it either...
Re: (Score:2)
Running out of IP Addresses? (Score:2)
And what ever happened to the alleged impending crisis of the world running out of IP addresses? If phantom companies, operating out of P.O. boxes, and lacking any real existence whatsoever... except on paper... can get their own /16s and /18s every day of the week, then it's no wonder the world is running out of IP addresses.
Seriously.
So I'm bored... (Score:2, Informative)
Re: (Score:2, Informative)
Isn't this (cough) terrorism? (Score:2)
Andy
What the heck? (Score:2)
(No Cookies)
We're sorry, but it appears that you have cookies disabled in your browser.
In order to access this site, you must have cookies enabled in your browser, at least for this site (47-usc-230c2.org).
Please enable cookies in your browser, and then use your BACK button to try your request again.
==> if you don't have anything to say, don't put your link on Slashdot.
ROKSO (Score:2)
death penalty (Score:2)
We, as a society, accept way too many crimes against us, the society. Crimes against individuals are punished much harsher. Crimes against virtual entities (corporations, money, information) even more so.
Doesn't anyone else think we have this kind of backwards?
Re: (Score:2)
pot calling kettle black.
Re: (Score:2)
These guys ARE CRIMINALS. They are committing telephone fraud and this idiot judge just bought their snakewater.
If my online co. was attacked with this crap I would sue but also contact FBI or local police and arrest these fools.
Re:Here's an idea. Lets start by makeing spam ille (Score:2)
The law Congress passed, called CAN-SPAM Act [wikipedia.org], was pretty quickly called the "YOU CAN SPAM Act" and for good reason. It has so many loopholes and outright legitimizations of spam that it's basically worse than useless.
As a bonus, as if greenlighting spam at the Federal level weren't enough, when they passed it they invalidated all the state laws that were tougher on spam, and also prevented any state from
Re: (Score:2)
I don't know if he's doing that to avoid giving them the link or what. (Seems to me he'd be better just not linking at all, but what do I know.)
But the site that pops up that weird disclaimer and requires you to agree before you can get to the actual site -- that's the site for the spammer's front company that pro
Re: (Score:2)
FYI,