Detweiler abuse again

Hal hfinney at shell.portal.com
Mon Feb 14 18:11:32 PST 1994 

I got a lot of complaints today about copies of Tim's old "Blacknet" posting
being sent to inappropriate groups:

>  From paw at coos.dartmouth.edu  Mon Feb 14 09:34:13 1994
>  Date: Mon, 14 Feb 1994 12:31:44 -0500
>  From: paw at coos.dartmouth.edu (Pat Wilson)
>  To: hfinney at shell.portal.com, root at portal.com, postmaster at portal.com
>  Subject: Re: Introduction to Blacknet
>  Newsgroups: comp.sys.sun.admin
>  References: <199402120837.AAA22008 at jobe.shell.portal.com>
>  Status: R
>  
>  In comp.sys.sun.admin you write:
>  
>  >Introduction to BlackNet
>  
>  [etc]
>  
>  I believe that this is an illegal and unethical use of the Net 
>  for commercial purposes (to say nothing of bounds of decency).  
>  This posting lends credence to all sorts of (US) gov't paranoia.
>  Please cease and desist immediately.  
>  
>  Non-anonymously,
>  
>  -- 
>  Pat Wilson
>  Maanger, Academic Unix Systems Group
>  Dartmouth College
>  paw at northstar.dartmouth.edu
>  
>  From mcr at unison.com  Mon Feb 14 10:11:51 1994
>  Date: Mon, 14 Feb 1994 10:11:22 -0800
>  To: hfinney at shell.portal.com
>  From: mcr at unison.com (Michael Riehle)
>  X-Sender: mcr at hal822.unison.com
>  Subject: Introduction to Blacknet
>  Status: R
>  
>  This message appears to be from someone who is offering an illegal service
>  and is certainly not welcome.  I can't tell if this person is serious or if
>  this is just a sick joke.  It certainly isn't appropriate regardless.
>  
>  >Date:         Mon, 14 Feb 1994 00:50:01 +0000
>  >Reply-To: HP-3000 Systems Discussion <HP3000-L at UTCVM.UTC.EDU>
>  >Sender: HP-3000 Systems Discussion <HP3000-L at UTCVM.UTC.EDU>
>  >Comments:     This message is NOT from the person listed in the From line.  It
>  >is from an automated software remailing service operating at that address. 
>  >Please report problem mail to <hfinney at shell.portal.com>.
>  >Comments:     Warning -- original Sender: tag was NETNEWS at AUVM.AMERICAN.EDU
>  >From: nobody <nobody at SHELL.PORTAL.COM>
>  >Subject:      Introduction to Blacknet
>  >To: Multiple recipients of list HP3000-L <HP3000-L at UTCVM.UTC.EDU>
>  >
>  >Introduction to BlackNet
>  >
>  > [...]
>  
>  From kwthomas at nsslsun.nssl.uoknor.edu  Mon Feb 14 12:38:27 1994
>  Date: Mon, 14 Feb 94 14:37:01 CST
>  From: kwthomas at nsslsun.nssl.uoknor.edu (Kevin W. Thomas)
>  To: hfinney at shell.portal.com
>  Subject: Re: Introduction to Blacknet
>  Newsgroups: comp.sys.sun.admin
>  In-Reply-To: <199402120837.AAA22008 at jobe.shell.portal.com>
>  Organization: National Severe Storms Laboratory
>  Cc: root at shell.portal.com, root at jobe.shell.portal.com
>  Status: R
>  
>  In article <199402120837.AAA22008 at jobe.shell.portal.com> you write:
>  >Introduction to BlackNet
>  >
>  >BlackNet is currently building its information inventory. We are interested
>  >in information in the following areas, though any other juicy stuff is
>  >always welcome. "If you think it's valuable, offer it to us first."
>  >
>  >- trade secrets, processes, production methods (esp. in semiconductors)
>  >
>  >BlackNet can make anonymous deposits to the bank account of your choice,
>  >where local banking laws permit, can mail cash directly (you assume the
>  >risk of theft or seizure), or can credit you in "CryptoCredits," the
>  >internal currency of BlackNet (which you then might use to buy _other_
>  >information and have it encrypted to your special public key and posted in
>  >public place).
>  
>  This doesn't belong in "comp.sys.sun.admin", or any other Usenet group.  It's
>  postings like this that give Usenet a bad name.
>  
>  	Kevin W. Thomas
>  	National Severe Storms Laboratory
>  	Norman, Oklahoma
>  
>  From lab at biostat.mc.duke.edu  Mon Feb 14 14:05:15 1994
>  To: hfinney at shell.portal.com
>  Subject: Re: Introduction to Blacknet
>  In-reply-to: nobody at shell.portal.com's message of Mon, 14 Feb 1994 11:32:23 -0800
>  Date: Mon, 14 Feb 1994 17:04:09 -0500
>  From: "Lance A. Brown" <lab at biostat.mc.duke.edu>
>  Status: R
>  
>  What _IS_ this doing in misc.health.diabetes?
>  
>  Thanks,
>    Lance
>  
>  
>  nobody  <nobody at shell.portal.com> writes:
>  > Introduction to BlackNet
>  
>  
>  > Your name has come to our attention. We have reason to believe you may be
>  > interested in the products and services our new organization, BlackNet, has
>  > to offer.
>  > [...]
>  
>  From appel at cea.Berkeley.EDU  Mon Feb 14 14:24:03 1994
>  To: hfinney at shell.portal.com, root at shell.portal.com
>  Subject: Re: Introduction to Blacknet
>  In-reply-to: nobody at shell.portal.com's message of Sat, 12 Feb 1994 03:49:18 -0800
>  Date: Mon, 14 Feb 1994 14:23:06 -0800
>  From: Shannon Appel <appel at cea.Berkeley.EDU>
>  Status: R
>  
>  Please be aware that your anonymous remailer is being abused.  The
>  following inappropriate post was recently sent to a rec.games.frp
>  group.  Please see that this type of thing does not happen again.
>  
>  Shannon
>  --
>  > Introduction to BlackNet
>  > 
>  > 
>  > [...]

I set up a log file for "blacknet" postings, and got this:

> From hal at alumni.cco.caltech.edu  Mon Feb 14 17:46:41 1994
> Received: from nova.unix.portal.com (nova.unix.portal.com [156.151.1.101]) by jobe.shell.portal.com (8.6.4/8.6.4) with ESMTP id RAA11362 for <hfinney at shell.portal.com>; Mon, 14 Feb 1994 17:46:41 -0800
> Received: from punisher.caltech.edu (punisher.cco.caltech.edu [131.215.48.151]) by nova.unix.portal.com (8.6.4/8.6.4-1.13) with ESMTP id RAA03081 for <hfinney at shell.portal.com>; Mon, 14 Feb 1994 17:46:41 -0800
> Received: from alumni.cco.caltech.edu by punisher.caltech.edu with ESMTP 
> 	(8.6.4/DEI:4.41) id RAA14916; Mon, 14 Feb 1994 17:45:46 -0800
> Received: from localhost by alumni.cco.caltech.edu 
> 	(8.6.4/DEI:4.41) id RAA23534; Mon, 14 Feb 1994 17:45:42 -0800
> Received: from handel.cs.colostate.edu by alumni.cco.caltech.edu with SMTP
> 	(8.6.4/DEI:4.41) id RAA23522; Mon, 14 Feb 1994 17:45:34 -0800
> Message-Id: <199402150145.RAA23522 at alumni.cco.caltech.edu>
> Received: by handel.cs.colostate.edu
> 	(1.37.109.4/16.2) id AA28603; Mon, 14 Feb 94 18:45:32 -0700
> Date: Mon, 14 Feb 94 18:45:32 -0700
> From: lawrence detweiler <detweile at CS.ColoState.EDU>
> To: hfinney at shell.portal.com
> request-remailing-to: comp.sys.ti.explorer at news.cs.indiana.edu
> subject: Introduction to Blacknet
> 
> Introduction to BlackNet
> 
> 
> Your name has come to our attention. We have reason to believe you may be
> interested in the products and services our new organization, BlackNet, has
> to offer.
> [...]

It seems Larry is sending this posting to lots of inappropriate groups
using several different mail-to-news gateways.  This is a good way to
get remailers shut down, which may be his ultimate goal.

I call upon remailer operators to block incoming messages from Detweiler's
known aliases.  Thos using the slocal-based "cypherpunks" remailer perl
scripts can add the following lines near the front of their maildelivery
files.

# Filter Detweiler
>From ld231782 at longs.lance.colostate.edu  file  ?  /dev/null
>From 	an12070 at anon.penet.fi  		 file  ?  /dev/null
>From 	detweile			 file  ?  /dev/null

Unless his access to the remailer network is blocked, he will be able to
continue to abuse the system until it gets shut down.

The alternative would be to block my remailer's access to all known
mail-to-news gateways, but I am reluctant to take that step because of
the loss of this ability for those who legitimately need it.  If his abuse
keeps up, though, that may be the only choice left.

Hal Finney
hfinney at shell.portal.com

More information about the cypherpunks-legacy mailing list