<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Is it coming from a single client IP address, or do they have a botnet driving this?
<div><br></div><div>Since UNDEFINED is not a valid callsign, can the backbone servers blacklist this?</div><div><br></div><div>Perhaps the servers need a patch so that the callsign-SSID has to look semi-legitimate (digits and letters, part preceding a hyphen limited to 6 or 7 characters, etc.). Of course, that level of hardening would be easy for the evil one to work around by just forging a legitimate callsign. But let's not document it, since legitimate users would never be hindered by the constraint.</div><div><br></div><div>Andrew, KA2DDO</div><div>author of YAAC</div><div><br></div><br><br>-------- Original message --------<br>From: John Langner WB2OSZ <wb2osz@comcast.net> <br>Date: 4/30/20 10:49 (GMT-05:00) <br>To: aprssig@lists.tapr.org <br>Subject: [aprssig] UNDEFINED? <br><br>This looks like a deliberate attack, not an innocent accidental<br>misconfiguration.<br><br>It appears to be scanning thru a large number of T2 servers, around the<br>world. The location is bouncing all over the place, perhaps to thwart<br>duplicate removal and fill up the database.<br><br><br>At http://ontario.aprs2.net:14501/ we find:<br><br><br>187.210.189.241 UNDEFINED true gpserver corget.cn No filter<br>set 0d1h0m4.17s 121 2,402 7,676 184,425 21 512<br>0d0h0m4.249s<br><br>2400 packets per hour to the Ontario server alone. <br><br>This might be an attempt at a denial of service attack.<br><br><br><br><br>_______________________________________________<br>aprssig mailing list<br>aprssig@lists.tapr.org<br>http://lists.tapr.org/mailman/listinfo/aprssig_lists.tapr.org<br></body></html>