MCI/CW Security

Steven J. Sobol sjsobol at
Wed Jan 20 00:10:48 UTC 1999

On Tue, Jan 19, 1999 at 01:10:20PM -0600, James Rishaw wrote:
> What a laugh..
>   We were just smurfed from what appears to be an MCI router as a relay..
>   Their voice menu at 888-860-3382 says:
>   "If you are reporting a security issue please fill out an incident
> report on our web page at security at under 'Report an incident' " 

Last week we were experiencing what ended up being a DoS attack on a mail
server at NACS (probably not intended that way, but...)

It was from a Willow Springs CW (former InterNetMCI) dialup.

Called the number I got from Jared Mauch's NetOps list, was redirected
to an 800 number (because the NOC in Virginia that Jared lists doesn't
handle "Internet" customers). Called the 800 number, and the guy who answered
the phone said to fill out the incident report on their web site - a page
which, by the way, won't let you enter an e-mail address because the Java-
Script on the page is broken.

"We need you to disconnect the dialup user."

"Well, just fill out the web page..."

I hung up, yelled something about C&W's NOC out of sheer frustration
(something like "Cable and Clueless sucks") and the guy I was working with
said he'd take care of the problem... did a whois on and called someone
there and asked for security...

>   With the lack of voice menu clue, I went to
> and found a form.. assigned ticket number "18".. makes me feel really
> good, to have a global company assign me a two-digit ticket.. but hey..
>   Is it just me ?

No. C&W security seems to be clueful once you get in touch with them, but
getting to the right place over the phone seems to be a major issue.

Steve Sobol sjsobol at (AKA support at and abuse at

"How you gonna win, when you ain't right within?"
   --Laurynn Hill - "Doo-Wop (That Thing)"

More information about the NANOG mailing list