Subject: a new attack?
To: None <current-users@netbsd.org>
From: John F. Woods <jfw@jfwhome.funhouse.com>
List: current-users
Date: 08/02/2001 08:39:48
Or possibly someone's just automated a traditional one.  According to my
log files last night:

    Aug  2 05:50:44 jfwhome ftpd[960]: connection from ACAD41B0.ipt.aol.com to jfwhome.funhouse.com
    Aug  2 05:50:46 jfwhome ftpd[960]: ANONYMOUS FTP LOGIN FROM ACAD41B0.ipt.aol.com, IEUser@ (class: guest, type: GUEST)
    Aug  2 05:50:52 jfwhome ftpd[962]: connection from ACAD41B0.ipt.aol.com to jfwhome.funhouse.com
    Aug  2 05:50:54 jfwhome ftpd[962]: ANONYMOUS FTP LOGIN FROM ACAD41B0.ipt.aol.com, IEUser@ (class: guest, type: GUEST)
    Aug  2 05:50:57 jfwhome ftpd[962]: get /etc/passwd = 297 bytes in 0.000 seconds
    Aug  2 05:51:29 jfwhome ftpd[963]: connection from ACAD41B0.ipt.aol.com to jfwhome.funhouse.com
    Aug  2 05:51:30 jfwhome ftpd[964]: connection from ACAD41B0.ipt.aol.com to jfwhome.funhouse.com
    Aug  2 05:51:33 jfwhome ftpd[965]: connection from ACAD41B0.ipt.aol.com to jfwhome.funhouse.com
    Aug  2 05:51:34 jfwhome ftpd[966]: connection from ACAD41B0.ipt.aol.com to jfwhome.funhouse.com
    Aug  2 05:51:36 jfwhome ftpd[966]: FTP LOGIN FAILED FROM ACAD41B0.ipt.aol.com

There then follow a couple of hundred lines of connection and
login-failed reports regarding the same AOL host.  Fortunately, the
/etc/passwd which is visible to anonymous ftp users on my system is a
dummy file, present only to make ~ftp/bin/ls happy.  (I guess,
however, that I should get around to modifying ftp to deliver random
data as the contents of "/etc/passwd", like I've always been meaning
to.)

The only result of this attack seems to have been to make inetd shut
down ftp for a while, due to the number of requests in such a short
span of time.  Peering through the logs, I see a couple of cases where
it looks like someone did an anonymous ftp connect (with no data
transfer) every few seconds for an extended period; possibly a pure
denial of service attack?

I miss the ARPANET.