Subject: How to deal with WareZ?

From: [email-masked] (Yuan John Jiang)
Date: Tue, 2 Dec 1997 13:26:33 -0500

How do I figure out whether a record in xferlog is GET or PUT?
The following lines are the beginning of my latest WareZ episode.
I'm using DOMAIN1 and DOMAIN hide the real domains.  What are the
typical procedures people take when it happens?  Should I contact
the domains' administrators?  I assume the attackers are not
the administrators considering they used dialup accounts.
My server was bogged down for several days.  I don't want to
punish them too harsh considering they might be a few kids.
But I'm angry.

John

Sat Nov 22 20:04:53 1997 5 asnd34.DOMAIN1.net 4921 /incoming/_ZW_/zerawleetz.nfo b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:05:01 1997 1 asnd34.DOMAIN1.net 4921 /incoming/_ZW_/zerawleetz.nfo b _ o a [email-masked] ftp 0 *
Sat Nov 22 20:05:44 1997 16 asnd34.DOMAIN1.net 4921 /incoming/_ZW_/ZerawleetZ/zerawleetz.nfo b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:11:17 1997 1 asnd34.DOMAIN1.net 3933 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/risc97.nfo b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:11:19 1997 1 asnd34.DOMAIN1.net 5000 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/HYBRID.NFO b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:11:48 1997 28 asnd34.DOMAIN1.net 770766 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as14.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:12:38 1997 50 asnd34.DOMAIN1.net 1436639 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as13.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:13:28 1997 50 asnd34.DOMAIN1.net 1432319 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as12.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:14:09 1997 40 asnd34.DOMAIN1.net 1441719 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as11.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:14:51 1997 41 asnd34.DOMAIN1.net 1439309 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as10.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:15:15 1997 1 ppp50.respool1.medina.DOMAIN2.net 51 /incoming/_ZW_/ZerawleetZ/Longbow_2-MAFIA/FILE_ID.DIZ b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:15:29 1997 37 asnd34.DOMAIN1.net 1442947 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as09.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:15:34 1997 17 ppp50.respool1.medina.DOMAIN2.net 1464772 /incoming/_ZW_/ZerawleetZ/Longbow_2-MAFIA/lb2mfa01.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:15:51 1997 16 ppp50.respool1.medina.DOMAIN2.net 1464772 /incoming/_ZW_/ZerawleetZ/Longbow_2-MAFIA/lb2mfa02.zip b _ i a [email-masked] ftp 0 *
Sat Nov 22 20:16:04 1997 34 asnd34.DOMAIN1.net 1442978 /incoming/_ZW_/ZerawleetZ/actua_soccer_2-hybrid/hbd-as08.zip b _ i a [email-masked] ftp 0 *

---

From: Mike Hedlund <[email-masked]>
Date: Tue, 2 Dec 1997 10:46:31 -0800 (PST)

On Tue, 2 Dec 1997, Yuan John Jiang wrote:

> Sat Nov 22 20:04:53 1997 5 asnd34.DOMAIN1.net 4921 
> /incoming/_ZW_/zerawleetz.nfo b _ i a [email-masked] ftp 0 *

The 'i' after the '_' would indicate that the file was incoming. An
'o' in place of the 'i' would represent a file sent from the server to the
client; ie and outgoing file.

-mike

---

From: Subu Rama <[email-masked]>
Date: Tue, 2 Dec 1997 13:47:39 -0500 (EST)

This doesn't directly relate to wu-ftpd but since the members are knowledgeable
ftp'ers here goes my question:

I want to ftp a file to a remote site where a program will automatically
process it once it's transferred. What are the different ways that the
remote program can know that the transfer is complete ? (I obviously don't want
the program to pick up the file in the midst of the transfer)

Thank you

Subu Rama
[email-masked]

---

From: "T's Mailing Lists" <[email-masked]>
Date: Wed, 3 Dec 1997 11:06:33 +0000 (GMT)

> punish them too harsh considering they might be a few kids.

Most people are human and understand such things. On top you can allways
control what information you give out. It should be in every sysadmin's
interest not to have his users do stupid stuff, because in the end it
might be himself who's the victim. So I would call the admin and talk and
see...
*
t

--------------------------------------------------------------------------------
                   Tomas Pospisek's mailing-lists mailbox   
           www.SPIN.ch - Internet Services in Graubuenden/Switzerland
--------------------------------------------------------------------------------

---

From: Subu Rama <[email-masked]>
Date: Sat, 20 Dec 1997 11:55:11 -0500 (EST)

I would like to gather opinions on preventing one guest user from logging in
multiple times (via ftp) and running multiple ftp sessions at a time. 

Thank you for sharing your thoughts

Subu Rama
[email-masked]

---

From: Kent Landfield <[email-masked]>
Date: Sat, 20 Dec 1997 11:14:09 -0600 (CST)

# I would like to gather opinions on preventing one guest user from logging in
# multiple times (via ftp) and running multiple ftp sessions at a time. 
# 
# Thank you for sharing your thoughts

What are your thoughts on why you asked the question ?  Do you feel that
one FTP session is enough ?  Is it a performance issue ?  Other than that
why would you care since you have already given them access to your system
with the guest account ?

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Email: [email-masked]                   http://www.nfr.net/
Please send comp.sources.misc related mail to [email-masked]
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: Subu Rama <[email-masked]>
Date: Sat, 20 Dec 1997 12:32:54 -0500 (EST)

We have a version of ftpd that lets a child process actually perform the
transfer and once the session is done lets the parent process the files
transferred. (The parent just processes everything there's a directory
entry for)

We deal with very "primitive" users on the remote (client) end and don't
want them overwriting files etc. (or the parent process pick up files not yet
fully transferred from another session).

Thank you

Subu Rama
[email-masked]