** Surviving the ongoing sci.crypt cancel/REPORT war **

From: Francois Grieu (fgrieu_at_francenet.fr)
Date: 10/27/05 

Date: Thu, 27 Oct 2005 16:37:07 +0200

[updated 05/10/27 14:30 GMT]

This newsgroup, sci.crypt, is under attack. This week it received
thousands of systematic "cancel" messages. When reading the group
thru a server then honors these cancels, the messages they cancel
do not show.

An individual using a tool called "Guido the Resurrector"
"REPOST" the cancelled messages. When using a server that honors
these reposts, this show as titles starting with "REPOST".
These messages get cancelled, then reposted..

To survive this, my strategy is to:

- use an open nntp server that ignores the rogue cancels
nntp://nntp.cquest.utoronto.ca/sci.crypt

- filter out the reposts by killing articles with
@news.noc.cabal.int in the Message-ID header

- post messages using my usual ISP's nntp server

- make sure to NOT include REPOST in the title of
reply messages (since some filters might operate on REPOST
in the title)

An alternative would be to use an nntp server that filters
unwanted cancels and the corresponding reposts; but these
are commercial.

A recent sampling of about 5 days worth of cancels (obtained on
the group control.cancel) shows 5045 cancels concerning the
group sci.crypt (approximatly 1/4 of the total cancel traffic)
since Sat, 22 Oct 2005 03:00 GMT

These seem to be generated by a handfull of "zombie" machines
located at several ISP. As of now, the two active zombies are

64.121.22.24 64-121-22-24.c3-0.lang-ubr11.lang.ca.cable.rcn.com
82.34.186.178 82-34-186-178.cable.ubr02.sout.blueyonder.co.uk

I have warned the abuse contact at three ISPs, so far one
answered with a completly generic email.

You might want to second my complaints, in particular if you are
a customer of said ISP.

  Francois Grieu

Relevant Pages

  • Re: Finding a Newsgroup for sci.astro.amateur
    ... I wonder how much longer Usenet will last - traffic analysis of once major groups shows they are now just shadows of their former selves. ... Sporge is a neologism coined by German software developer Tilman Hausherr; it's a contraction of "spammed forgery". ... NewsAgent was originally created as a power-cancel tool, to let anybody pretend to be anybody else and spawn lots and lots of cancel messages, or "cancels". ... Cancels propagate through the Usenet network just like regular messages, except that a server that pays attention to a cancel will delete a message, specified in the cancel, instead of adding a message to its database. ...
    (sci.astro.amateur)
  • Re: Finding a Newsgroup for sci.astro.amateur
    ... I wonder how much longer Usenet will last - traffic analysis of once major groups shows they are now just shadows of their former selves. ... Sporge is a neologism coined by German software developer Tilman Hausherr; it's a contraction of "spammed forgery". ... NewsAgent was originally created as a power-cancel tool, to let anybody pretend to be anybody else and spawn lots and lots of cancel messages, or "cancels". ... Cancels propagate through the Usenet network just like regular messages, except that a server that pays attention to a cancel will delete a message, specified in the cancel, instead of adding a message to its database. ...
    (sci.astro.amateur)
  • ** Surviving the ongoing sci.cypt cancel/REPORT war **
    ... group thru a server then honors these cancels, ... "REPOST" the cancelled messages. ... honors these repost, this show as titles starting "REPOST". ...
    (sci.crypt)
  • Re: Another massive spaming by the parrot turks for the Armenian Genocide Bill
    ... they'd put the server he is misusing on their black list, ... net doesn't accept the cancels. ... One for reading and one for posting. ... of others because of the cancels of babaturd. ...
    (soc.culture.greek)
  • REPOST: ** Surviving the ongoing sci.cypt cancel/REPORT war **
    ... group thru a server then honors these cancels, ... "REPOST" the cancelled messages. ... honors these repost, this show as titles starting "REPOST". ...
    (sci.crypt)
Quantcast