From: smee@bristol.ac.uk (Paul Smee)
Newsgroups: news.admin
Subject: What a sendsys bomb actually is...
Date: 10 Apr 92 09:49:52 GMT
Reply-To: P.Smee@bristol.ac.uk (Paul Smee)
Organization: University of Bristol

In article <1992Apr8.202016.10359@cunixf.cc.columbia.edu> cmm1@cunixa.cc.columbia.edu (Christopher M Mauritz) writes:
>I just started my own small public access unix site, but I must confess
>that I have no idea what you guys are talking about.  What exactly IS
>a "sendsys bomb?"

Spotted two of these in here today (sometimes I wish trn would let me
'chain' a reply onto multiple threads).  I've had several people ask me
this by mail, and I've got my answer to the first one lying around in
my out-box, so here it is.  (Also answers a couple other questions
related to the current hubbub.  Quoted bits are from the first piece of
mail I got which asked the question.  I wondered a bit about sending it,
but in the end decided it doesn't actually contain any info which hasn't
already appeared here.  Bits in []'s were added for this article.)

|> 1) What is a "sendsys bomb" and what does it actually do?

In addition to 'readable' newsgroups/articles, news has a special
newsgroup whose main characteristic is that messages sent to it are
acted on automatically by the machines that receive it.  ('Cancel' uses
this, for example.  If you put in an article, decide you don't like it,
and 'Cancel' it, what really happens is that your news software sends a
control article which means 'cancel X in newsgroup Y', which then goes
chasing out around the net.  When sites receive this, they then delete
the original article to which it refers.)

'Sendsys' is another form of control request.  News systems have a file
called the 'sys' file, which is basically a list of what sites you get
news from, what groups you get from them, what sites you send news to
and what groups you send them.  Not for the whole net, but just those
sites you talk to directly.  A 'sendsys' requests asks your news
software to reply to the person who sent it, sending them a copy of
your sys file.  By correlating these, it is possible (at least in
principle) to map the entire network, or to check particular
'distributions' to make sure they aren't leaking out of the areas they
are supposed to go to.  

No one is sure how many total sites there are on the net, and some
don't support (respond to) sendsys requests, but it's probably a
reasonable guess (mine) that the response to a global 'sendsys' (one
sent with no distribution limits) would total 20-40 Megabytes or more,
in maybe 10000-20000 messages.  That's a LOT of mail, even if you are
expecting it.  [Maybe someone who has legitimately used a global
sendsys could provide a more accurate set of numbers.]

Now, a 'sendsys bomb' is basically a normal sendsys request, with a
forged identification of the sender, to make it look like it comes from
the intended victim.  So, this poor sod gets an avalanche of trash
tipped into his mailbox, without ever expecting it.  If he's on a small
system (and most are) this may bring his machine to a screeching halt,
as the transfer software tries to cope with the huge rush of incoming
mail.  

It also puts huge transient loads on various gateways and sections of
the net, so it's NOT a clever way of getting back at someone you don't
like -- it screws up a lot of innocent bystanders as well.  It's a bit
like dropping a nuke on your next-door neighbor because they've done
something to piss you off.  Yeah, sure, it'll inconvenience them, but
it won't do you much good either, not to mention everyone else for
miles around.  (It's also probably a criminal offense, at least in the
US and the UK.)

|> 2) Who is the Dark One (or Aritmus) for that matter?

Folk who don't want people to know who they are.  Artimus appears to be
waging a hate campaign against gays.  Most of the time he appears to
hang out in the 'gay' and 'bisexual' newsgroups, taking potshots.
(Seems to me that if he dislikes talking to them so much, he might just
unsubscribe from those groups, but then what do I know?  Would sure save
everyone a lot of bother if he did.)  He popped up for a while in
misc.misc a few months ago, which is where I ran across him.  Not at
all clear to me what Dark's problem is, but he appears to feel called
to some similar personal crusade.  (They might even be the same
person.  Or, either or both of them might be groups of people.)

|> 3) How do they keep their posting anonymous? (I have a good deal of
|>    experience in UNIX, but not that much, I'm afraid)

You'll forgive me if I don't go into great detail in this one.  Two
reasons.  First, since I've got enough privileges to do them trivially,
I've never bothered to try to investigate devious methods.  And second,
I don't like talking security details over the net, except along a few
paths I trust, to people I know personally.  

Basically, though, there are a lot of security loopholes in Unix, and
all you need to do is to find a site where you can get something that's
in the right shape to be a usenet article onto their machine, in a
place in the filestore so that their news software believes it arrived
via normal legitimate channels and will then pass it on; or, by network
spoofing, manage to inject it into a suitable segment of the net as
apparently coming from some machine other than the one it is really
coming from.  

If a site hasn't been careful in setting itself up, it's entirely
possible that you can do this using normal network software.  At many
sites, for example, it is trivial to create mail with forged sender
id's.  [If you DO any of these things, it is very likely that you are
violating the law, at least in the US and the UK, and almost certain
that you are violating the terms and conditions of use which you agreed
to when you got your computer account or your net connection.]

If you need more details, then sorry but you will have to find someone
knowledgeable at your site who knows you well enough to be willing to
explain them to you.

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.Smee@bristol.ac.uk - ..!uunet!uknet!bsmail!p.smee - Tel +44 272 303132
Newsgroups: news.admin