Politech: FC: Is Comcast ignoring denial-of-service attack from its customer?

[Declan McCullagh <declan () well com>]

[Jericho is a very reliable source. I invite Comcast to reply. --Declan]

---

Date: Wed, 16 Jul 2003 00:03:35 -0400 (EDT)
From: security curmudgeon <jericho () attrition org>
To: <abuse () comcast net>, <legal () comcast net>, <domregadmin () comcast net>
cc: Better Business Bureau <bnd () bbb org>, Declan McCullagh <declan () well com>
Subject: Continued attacks from your network.

I contacted abuse () comcast net as well as legal () comcast net on Jul 9, 2003
with a complaint about a sustained Denial of Service attack from your
network. Since then, it has not been addressed or resolved. My last mail
to you made it very clear that unless resolved, it showed Comcast was
aware of the problem and chose not to handle it. In short, they condoned
the attack, and that their AUP and Abuse Policy was for show, not taken
seriously.

Over the last twenty four hours, these attacks have resumed.

On July 7, 2003, we put in a custom sendmail block to deny all traffic
from "NIESY100 () comcast net" due to a flood of spam.

On July 9, 2003, the spam flood continued and a complaint was mailed.

July 15, 2003, and the spam flood is still going with no resolution from
Comcast.

After this mail is sent, I will be forwarding the relevant logs to the
appropriate law enforcement agency (FBI), along with copies of our
correspondance indicating you were made aware of the attacks. I have also
CC'd Declan McCullagh in hopes that he will forward this on to his
Politech mail list, as well as BCC'd several administrators and colleagues
to warn them of these attacks.


Jul 15 15:42:53 forced sendmail[22712]: h6FJgqo22712: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:43:13 forced sendmail[22745]: h6FJhDo22745: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:43:37 forced sendmail[22775]: h6FJhbo22775: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:44:10 forced sendmail[22836]: h6FJiAo22836: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:44:26 forced sendmail[22853]: h6FJiQo22853: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:44:37 forced sendmail[22855]: h6FJiTo22855: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:45:04 forced sendmail[22926]: h6FJj4o22926: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:45:22 forced sendmail[22941]: h6FJjMo22941: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:45:50 forced sendmail[22954]: h6FJjoo22954: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:45:52 forced sendmail[22964]: h6FJjqo22964: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:46:17 forced sendmail[22980]: h6FJkHo22980: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:46:34 forced sendmail[22990]: h6FJkYo22990: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:46:56 forced sendmail[23027]: h6FJkto23027: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:47:15 forced sendmail[23047]: h6FJlFo23047: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:47:17 forced sendmail[23048]: h6FJlHo23048: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:47:19 forced sendmail[23049]: h6FJlJo23049: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:48:07 forced sendmail[23123]: h6FJm7o23123: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:48:09 forced sendmail[23125]: h6FJm8o23125: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:48:45 forced sendmail[23128]: h6FJmio23128: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc11.comcast.net [204.127.202.55], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:49:02 forced sendmail[23135]: h6FJn2o23135: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:49:23 forced sendmail[23143]: h6FJnNo23143: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:49:42 forced sendmail[23177]: h6FJnfo23177: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc13.comcast.net [204.127.202.64], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:49:59 forced sendmail[23184]: h6FJnxo23184: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:50:01 forced sendmail[23185]: h6FJo1o23185: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=sccrmhc12.comcast.net [204.127.202.56], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:51:05 forced sendmail[23270]: h6FJp5o23270: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc11.comcast.net [204.127.198.35], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:52:01 forced sendmail[23303]: h6FJq1o23303: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc13.comcast.net [204.127.198.39], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:52:41 forced sendmail[23401]: h6FJqfo23401: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:54:00 forced sendmail[23457]: h6FJrko23457: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc11.comcast.net [204.127.198.35], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:54:19 forced sendmail[23469]: h6FJs2o23469: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc11.comcast.net [204.127.198.35], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:56:18 forced sendmail[23644]: h6FJuHo23644: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:57:08 forced sendmail[23807]: h6FJv8o23807: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 15:58:42 forced sendmail[23892]: h6FJwgo23892: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc13.comcast.net [204.127.198.39], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:03:04 forced sendmail[24198]: h6FK34o24198: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc13.comcast.net [204.127.198.39], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:04:18 forced sendmail[24242]: h6FK4Ho24242: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:05:34 forced sendmail[24345]: h6FK5Yo24345: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc13.comcast.net [204.127.198.39], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:06:35 forced sendmail[24380]: h6FK6Zo24380: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:07:31 forced sendmail[24466]: h6FK7Uo24466: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc11.comcast.net [204.127.198.35], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:07:34 forced sendmail[24467]: h6FK7Xo24467: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc11.comcast.net [204.127.198.35], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:09:07 forced sendmail[24543]: h6FK97o24543: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:10:11 forced sendmail[24605]: h6FKAAo24605: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc12.comcast.net [216.148.227.85], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:11:10 forced sendmail[24646]: h6FKBAo24646: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc11.comcast.net [204.127.198.35], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:11:57 forced sendmail[24756]: h6FKBvo24756: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc13.comcast.net [204.127.198.39], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
Jul 15 16:12:47 forced sendmail[24768]: h6FKCdo24768: ruleset=check_mail, 
arg1=<NIESY100 () comcast net>, relay=rwcrmhc13.comcast.net [204.127.198.39], 
reject=553 5.3.0 <NIESY100 () comcast net>... - 550 Piss off spamming cunt
[snipped because it's a little, ah, repetitive. --Declan]




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
-------------------------------------------------------------------------
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
Declan McCullagh's photographs are at http://www.mccullagh.org/
Like Politech? Make a donation here: http://www.politechbot.com/donate/
-------------------------------------------------------------------------