October 2006 - NANOG - lists.nanog.org

ELI Issues in Seattle (Tukwila)?
by Bill Sehmel 30 Oct '06

30 Oct '06

Anyone else noticing ELI latency issues around the Seattle (Tukwila) area? Thanks Bill Sehmel -- Bill Sehmel - bsehmel(a)HopOne.net -- 1-206-242-2743 Systems Administrator, HopOne Internet Corp. SEA2 NOC Bandwidth & full range of carrier/web host colo + networking services: http://www.hopone.net#

1 0

RE: Sagonet - Failing miserably with network security Someone needs to handle this.
by Lasher, Donn 30 Oct '06

30 Oct '06

Not that this is his real name, or business, but a whois on the IP yields: [whois.arin.net] Sago Networks SAGO-20030401 (NET-65-110-32-0-1) 65.110.32.0 - 65.110.63.255 Anton Tenev SAGO-65-110-62-120 (NET-65-110-62-120-1) 65.110.62.120 - 65.110.62.129 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Chris Jester Sent: Sunday, October 29, 2006 11:29 AM To: nanog(a)nanog.org Cc: abuse(a)sagonet.com Subject: Sagonet - Failing miserably with network security Someone needs to handle this. 65.110.62.120 Sagonet, We have a serious hacker here who is ACTIVLY engaged in logins on our network (have him in a honeypot at the moment). He is running exploits from your network and also I have been hearing from others that you have been notified of this a few times yet have done nothing about it. Can we get someone to handle this immediately please? This hacker has rooted at least 35 servers on a friends network (friendly competitor) and now hes scanning ours... This is what was said by my friend after contacting you guys about this: "Good... They will not listen... I have provided them logs, screen shots, etc..." Additionally, I would LOVE to know what is on that server... this guy is not to be taken lightly, he is VERY methodical and patient. He's problably owning your network too. [root@mail /home]# netstat -an Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 :::38300 :::* LISTEN tcp 0 0 ::ffff:66.11.112.15:38300 ::ffff:65.110.62.120:59979 ESTABLISHED ESTABLISHED

3 2

Re: advise on network security report
by Scott Weeks 30 Oct '06

30 Oct '06

Rick Wesson <wessorh(a)ar.com> wrote: : I would appreciate a bit of advise on : a service I am about to deploy. Thank you for asking rather than just doing! :-) : I'm expecting to post a weekly report once a : month to nanog, would this be disruptive? Only if you don't tag the subject line. Please tag it with something so those not interested can filter it out. mahalo! scott

1 0

Re: advise on network security report
by Fergie 30 Oct '06

30 Oct '06

Rick, It would interesting to know how you classify "incidents" in the table below.... - ferg -- Rick Wesson <wessorh(a)ar.com> wrote: I would appreciate a bit of advise on a service I am about to deploy. I've spoken at different venues (including nanog) on global infection rates of bots and the general degradation of well behaved hosts. I now track around 2.2M abuse events per day and now have the capability to produce reports for the community on which networks have the largest problems. I am prepared to make reports monthly to the community ordering networks by their volume of issues. I'd like some hints of which might be the most valuable to the community. o are hosts counts or issue counts more important o is a 7 or 30 day window sufficient for aggregation? o I'm not repaired for graphs yet so don't go there. o should I post sub-reports for regions, by RIR? o which kinds of abuse are more interesting. I'm expecting to post a weekly report once a month to nanog, would this be disruptive? We have a mailing list set up for weekly reports, once finalized I'll post the location for its list manager. The global report usually has about 6,000+ networks, the top 100 from last week are below. again, thanks for your feedback. -rick Table 1. Networks with abuse, ordered by #incidents +-------+-----------+------+-------------------------------------+ | asn | incidents | cc | left(asname,35) | +-------+-----------+------+-------------------------------------+ | 4134 | 517830 | CN | CHINANET-BACKBONE | | 9121 | 331955 | EU | TTNet | | 4837 | 289984 | CN | CHINA169-Backbone | | 3320 | 231516 | DE | Deutsche Telekom AG | | 3352 | 211504 | ES | TELEFONICA-DATA-ESPANA Internet Acc | | 5617 | 194685 | PL | TPNET | | 3215 | 181686 | FR | AS3215 | | 3269 | 175858 | EU | ASN-IBSNAZ | | 4766 | 129722 | KR | KIXS-AS-KR | | 19262 | 125003 | US | Verizon Internet Services | | 8551 | 116014 | EU | ISDN-NET-AS | | 3209 | 94981 | DE | UNSPECIFIED | | 3462 | 82089 | TW | HINET | | 9829 | 80538 | IN | BSNL-NIB | | 8151 | 79223 | EU | Uninet S.A. de C.V. | | 8359 | 73640 | RU | MTUONLINE | | 5486 | 65757 | EU | Euronet Digital Communications | | 12322 | 65638 | FR | PROXAD AS for Proxad ISP | | 4788 | 53863 | MY | TMNET-AS-AP | | 9116 | 53375 | IL | Goldenlines main autonomous system | | 4814 | 52712 | CN | CHINA169-BBN | | 22927 | 51899 | AR | Telefonica de Argentina | | 4812 | 46462 | CN | CHINANET-SH-AP | | 1680 | 45848 | IL | NETVISION | | 9105 | 44450 | UK | TISCALI-UK | | 15557 | 42792 | FR | LDCOMNET | | 9498 | 42774 | IN | BBIL-AP | | 8584 | 41914 | US | Barak AS | | 2856 | 41820 | EU | BT-UK-AS | | 13184 | 41688 | DE | HANSENET HanseNet Telekommunikation | | 9318 | 40930 | KR | HANARO-AS | | 12479 | 39009 | EU | UNI2-AS Uni2 Autonomous System | | 6147 | 38716 | US | Telefonica del Peru S.A.A. | | 3243 | 38586 | PT | RIPE NCC ASN block | | 6713 | 35777 | EU | IAM-AS | | 12876 | 35068 | FR | AS12876 | | 6739 | 32639 | ES | ONO-AS | | 8228 | 32352 | FR | CEGETEL-AS CEGETEL ENTREPRISES | | 1267 | 31869 | IT | ASN-INFOSTRADA Infostrada S.p.A. | | 7418 | 30221 | EU | Terra Networks Chile S.A. | | 5462 | 28861 | UK | CABLEINET Telewest Broadband | | 8708 | 28236 | EU | RDSNET | | 5430 | 27245 | DE | FREENETDE | | 7470 | 24729 | TH | ASIAINFO-AS-AP | | 5610 | 24279 | CZ | CZECHTELECOM CZECH TELECOM, a.s | | 16338 | 23956 | ES | AUNA_Telecom-AS | | 4713 | 23650 | JP | OCN NTT Communications Corporation | | 12424 | 22932 | ES | JAZZASN Autonomous System | | 5089 | 21322 | EU | NTL NTL Group Limited | | 17813 | 20792 | IN | MTNL-AP Mahanagar Telephone Nigam L | | 5483 | 20511 | EU | HTC-AS Hungarian Telecom | | 4755 | 19673 | UK | VSNL-AS | | 8764 | 19571 | LT | TELECOMLT-AS | | 28725 | 18369 | CZ | CZ-EUROTEL-AS AS of Eurotel Praha | | 6830 | 18360 | HU | UPC | | 12542 | 17893 | PT | TVCABO Autonomous System | | 9299 | 17854 | PH | IPG-AS-AP | | 18101 | 17325 | IN | RIL-IDC Reliance Infocom Ltd Intern | | 3257 | 16918 | DE | TISCALI-BACKBONE | | 1257 | 16418 | FI | TELE2 AB | | 8881 | 15944 | DE | VERSATEL | | 5713 | 15566 | XX | Telkom SA Ltd. | | 6855 | 15420 | SK | SK SLOVAK TELECOM, AS6855 | | 9304 | 15311 | HK | HUTCHISON-AS-AP | | 5391 | 14937 | EU | T-HT T-Com Croatia Internet network | | 9583 | 14785 | IN | SIFY-AS-IN | | 209 | 14678 | US | Qwest | | 22047 | 14499 | XX | VTR BANDA ANCHA S.A. | | 6849 | 14419 | EU | UKRTELNET | | 24863 | 13616 | EU | LINKDOTNET-AS LINKdotNET AS number | | 8167 | 13184 | BR | TELESC - Telecomunicacoes de Santa | | 20838 | 12898 | ES | YIF-AS | | 6400 | 12563 | XX | Codetel | | 2860 | 12467 | PT | NOVIS Novis Telecom, S.A. | | 13285 | 12347 | UK | OPALTELECOM-AS | | 18403 | 12230 | VN | FPT-AS-AP The Corporation for Finan | | 7132 | 12031 | US | SBC Internet Services | | 20115 | 11683 | US | Charter Communications | | 8452 | 11507 | EU | TEDATA TEDATA | | 4230 | 11385 | BR | Embratel | | 5384 | 10946 | EU | EMIRATES-INTERNET | | 1221 | 10629 | AU | ASN-TELSTRA | | 28573 | 10475 | BR | NET Servicos de Comunicao S.A. | | 8866 | 10434 | BG | BTC-AS | | 9506 | 10126 | SG | MAGIX-SG-AP | | 8997 | 10123 | RU | ASN-SPBNIT SPBNIT-RU Autonomous Sys | | 8404 | 9941 | EU | CABLECOM | | 7693 | 9719 | TH | COMNET-TH | | 12880 | 9663 | IR | DCI-AS | | 6057 | 9432 | XX | Administracion Nacional de Telecomu | | 8402 | 9224 | RU | CORBINA-AS | | 6478 | 8943 | XX | AT&T WorldNet Services | | 5603 | 8913 | SI | SIOL-NET SiOL Internet d.o.o. | | 6327 | 8912 | CA | Shaw Communications Inc. | | 3303 | 8823 | CH | SWISSCOM | | 7552 | 8770 | VN | VIETEL-AS-AP Vietel Corporation | | 11427 | 8757 | XX | Road Runner | | 5466 | 8736 | IE | EIRCOM Eircom | | 6799 | 8634 | GR | OTENET-GR OTEnet S.A. Multiprotocol | | 10318 | 8526 | XX | CABLEVISION S.A. | +-------+-----------+------+-------------------------------------+ -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

Sagonet - Failing miserably with network security Someone needs to handle this.
by Chris Jester 29 Oct '06

29 Oct '06

65.110.62.120 Sagonet, We have a serious hacker here who is ACTIVLY engaged in logins on our network (have him in a honeypot at the moment). He is running exploits from your network and also I have been hearing from others that you have been notified of this a few times yet have done nothing about it. Can we get someone to handle this immediately please? This hacker has rooted at least 35 servers on a friends network (friendly competitor) and now hes scanning ours... This is what was said by my friend after contacting you guys about this: "Good... They will not listen... I have provided them logs, screen shots, etc..." Additionally, I would LOVE to know what is on that server... this guy is not to be taken lightly, he is VERY methodical and patient. He's problably owning your network too. [root@mail /home]# netstat -an Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 :::38300 :::* LISTEN tcp 0 0 ::ffff:66.11.112.15:38300 ::ffff:65.110.62.120:59979 ESTABLISHED ESTABLISHED

3 2

Re: Sagonet - Failing miserably with network security Someone needs to handle this.
by Chris Jester 29 Oct '06

29 Oct '06

> Chris, > > What kind of activity are you seeing once he's in the servers? At > Webair we're primarily web hosting, and some customer boxes were > compromised over recent months. > > I'm curious because you say he was very patient and methodical. I've asked > around with a few friends and they have seen this guy too.. just as in > your case > > Anyway, it fits the profile of the guy we had. He was inserting references > to megacount.net, and some obfuscated javascript code. He has been hard to > get rid of.. > > Sincerely, > > ---------------------------------------- > Brian Hourigan > Lead Technical Support Specialist/ > Programming Development Team > Webair Internet Development, Inc. > Fax: 516.938.5100 > http://www.webair.com > ---------------------------------------- > We are interested in any feedback you might have about the service > you received. Please contact our technical support consumer care manager > directly 1.866.WEBAIR1 or e-mail customercare(a)webair.com > > On Sun, 29 Oct 2006, Chris Jester wrote: > >> >> 65.110.62.120 >> >> Sagonet, >> >> We have a serious hacker here who is ACTIVLY engaged in logins >> on our network (have him in a honeypot at the moment). He is running >> exploits from your network and >> also I have been hearing from others that you have been notified of this >> a few times yet have done nothing about it. Can we get someone to >> handle >> this immediately please? >> >> This hacker has rooted at least 35 servers on a friends network >> (friendly >> competitor) and now hes scanning ours... >> >> This is what was said by my friend after contacting you guys about this: >> "Good... They will not listen... I have provided them logs, screen >> shots, >> etc..." >> >> Additionally, I would LOVE to know what is on that server... this guy is >> not to be taken lightly, he is VERY methodical and patient. He's >> problably >> owning your network too. >> >> [root@mail /home]# netstat -an >> Active Internet connections (servers and established) >> Proto Recv-Q Send-Q Local Address Foreign Address >> State >> tcp 0 0 0.0.0.0:21 0.0.0.0:* >> LISTEN >> tcp 0 0 :::38300 :::* >> LISTEN >> tcp 0 0 ::ffff:66.11.112.15:38300 >> ::ffff:65.110.62.120:59979 >> ESTABLISHED >> ESTABLISHED >> >> > In the honeypot server we have him in, he is storing files in /dev/k4rd Bash has been replaced with a "key logging" bash, het gets everything you type, passwords included, emailed back to him at root(a)65.110.62.120 There seems to be ALOT of files in /dev/k4rd, a bin directory and etc. He hacked the kernel so good that its VERY difficult to track his moves without booting off another drive first. We boot off a live linux cd enviornment to do studies on what he is up to, but before we do that we let him hack it up nicely so we get all his tricks. Note: he cannot really touch any other servers as he is stuck in a faked network enviornment at this moment. Pinging yahoo.com for example will generate a reply and a faked dns entry, but the packets never leave the zone he is in. His motivation seems to be to gather nats affilaite and customer data. He has an exploit that works on any and all nats installations. Were not going to release that until nats has been notified and had time to secure it. Were also seeing "traffic skimming" being attempted. He is searching for scripts (that we put there just to see what he does with them) that log traffic hits and etc.... He modifies these scripts so that randomly, but rarely, hits are re-directed to a web site called cgi-dnsl.com ( porn ). I dont mean to be a brat to Sagonet, but this is always the source of this hacker and his home never changes, its always on that single ip. Chris Jester NJesterIII

1 0

Re: BCP38 thread 93,871,738,435 (was Re: register.com down sev0?)
by Fergie 29 Oct '06

29 Oct '06

No. I think that is indicative of the problem. Don't you? - ferg -- Sean Donelan <sean(a)donelan.com> wrote: On Thu, 26 Oct 2006, Fergie wrote: > I don't want to detract from the heat of this discussion, as > important as it is, but it (the discussion) illustrates a point > that RIPE has recognized -- and is actively perusing -- yet, ISPs > on this continent seem consistently to ignore: The consistent > implementation of BCP 38. > > It is nothing less than irresponsible, IMO... > > Why _is_ that? Do you have any data concerning the actual consistent deployment of BCP38++ in different parts of the world? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

14 23

RE: Reclassification of NON-PORTABLE address space?
by John van Oppen 29 Oct '06

29 Oct '06

Are you referring to space you got directly from ARIN? If so, it is by definition portable. If it is space from a provider it belongs to the provider, not you and is thus not portable. john ________________________________ From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Roldan, Brad Sent: Friday, October 27, 2006 4:52 PM To: nanog(a)merit.edu Subject: Reclassification of NON-PORTABLE address space? Anyone know if there is a precedent for reclassifying blocks of non-portable address space to portable? I didn't see anything in ARIN archives (maybe I didn't look hard enough). Bribery? Threats? Acquisition of the assignor by the assignee? If such a reclassification were simple, I expect that the process would be heavily abused by smaller networks that would like to avoid renumbering. Brad -- Covad Communications 2510 Zanker Road San Jose, CA 95131 +1-408-434-2048

1 0

power cords for .nl
by matthew zeier 29 Oct '06

29 Oct '06

Mozilla going to be opening a POP in Amsterdam in December and I'm trying to get gear and power cords ordered before then (haven't yet figured out where we're going but some of my gear has long lead times). Can anyone help me figure out what sort of power cords I need? I'm interested in using Server Tech's 208-240V/20A PDUs which, according to their datasheet, have IEC603320/C20 inlets with 320/C13 outlets. Is that what I'll find out there? What sort of cords am I looking at for my 6503-Es (Cisco shipped me US cords)? Thanks! -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

3 2

register.com down sev0?
by alex＠pilosoft.com 28 Oct '06

28 Oct '06

I'm seeing *.register.com down (including ns*) from everywhere. Just a heads-up. Would be interesting to see the RFO for that one, including the "why we didn't have any DNS servers offsite or used anycast to at least limit amount of damage". -alex

20 30