Date: Fri, 15 Nov 2002 00:20:39 -0500 (EST) To: victims: ; From: Rob.Russell@Canada.Com Subject: Attempted network compromise. Hello there. For your reference, I am sending this EMail to the following addresses: security[at]gte.net, tudor[at]pcnet.ro, mihai[at]pcnet.ro, IHALLEY[at]cavaliertelephone.com, jberry[at]NETACS.NET, abuse[at]verizon.net, JuppP[at]ottawapolice.ca, nipc.watch[at]fbi.gov At [14/Nov/2002:22:24:40 -0500], I noticed a network intrusion attempt on my IP address 66.12.48.142. You are receiving this EMail because I believe that the attack originated from within your network, from a compromised computer within your scope of responsibility, or because I believe you to be an interested party. If I am in error, please accept my apologies. Based on my preliminary investigation, I believe that the culprit resides in Romania, on the PCNET network. I believe that the culprit is in the process of building a network of compromised hosts for resale for the purposes of distributed denial of service attacks, anonymous network intrusions, and other forms of childish fun. I have catalogued the intrusion attempt at http://administra.tion.ca/moron - with my server logs, including 3 IP addresses used in the attempt. One of these IP addresses, I believe to be the attacker's true source IP address, and the other two of compromised systems used as a staging point for further attacks. My contact information is as follows: Robert Russell 807-1725 Riverside Dr. Ottawa, ON, Canada K1G 0E6 (613) 261-7541 Please don't heasitate to contact me for further information or assistance. Thanks, -- Rob.Russell@Canada.Com, Unicorn of Usenet & Bastard of Bandwidth "If my son wants to be a pimp when he grows up, that's fine with me. I hope he's a good one and enjoys it and doesn't get caught. I'll support him in this. But if he wants to be a network administrator, he's out of the house and not part of my family." Steve Wozniak, http://www.woz.org