[PLUG-TALK] Ping [PONG]

[Rich Shepard]

On Fri, 9 Jan 2015, Keith Lofstrom wrote:

> Sorry - I apparently drove them away from my server to you guys.

Keith,

   Nah. Your actions have nothing to do with the renewed spam flood.

> From about the 1st through the 4th, I was getting two or three server
> exploit attempts per second, dozens of spams per minute. My server load
> average reached 50 at one point, exhausting http processes and memory,
> huge log files.

   I host my small Web site at my ISP; they have the time and expertise to
keep it secure. I could not afford the time to learn all that is required to
maintain a secure sever with sufficient available capacity.

> I blocked large IP address ranges with iptables. Many blocks of hundreds
> of consecutive addresses in China.

   For reducing spam mail I have quite a few lists of country-specific IP
blocks by CIDR, as well as individual ranges for servers passing too much
spam or rejecting reports to their abuse@ address because the report
contains spam. Duh! Really?

> The internet is becoming a war zone. At some point, somebody is going to
> shoot back (with copper-jacketed lead) and all hell is going to break
> loose.

   Lemme' know when the posse is formed. :-) I've become a regular reader of
Brian Krebs' blog (www.krebsonsecurity.com) as well as having read his book.
In yestoday's post he memtions that the Lizard Squad who ran a DDoS against
the Sony and Microsoft game servers is hosted at a Bosnian ISP that hosts
many cybercriminal operations. This raises the question of why these servers
cannot be blocked. At some point packets need to leave their protected home
turf. Since it's not my area of expertise I hope someone's working out how
to shut these folks off.

   BTW, germane to Krebs' blog, today's post points out the vulnerability of
home routers (wired and wireless) whose owners do not change factory default
usernames and passwords. Many have been taken over for criminal purposes.
This exposes linux systems, too, to exploits and incorporation into a
malware bot network.

Carpe weekend,

Rich