- NANOG - lists.nanog.org

Drone Armies C&C Report - 19 Feb 2007
by c2report＠isotf.org 20 Feb '07

20 Feb '07

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 5730 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 15292 reported C&Cs. Of the suspect C&Cs surveyed, 682 reported as Open, 1990 reported as closed, and 749 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 7228 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 NJIIX-AS-1 - NEW JERSEY INTERN 133 16 88 13301 UNITEDCOLO-AS Autonomous System of 89 35 61 4766 KIXS-AS-KR 63 17 73 30058 FDCSE FDCservers.net LLC 45 14 69 23522 CIT-FOONET 45 24 47 7132 SBC Internet Services 41 3 93 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 39 8 79 8560 SCHLUND-AS 37 3 92 14779 INKT Inktomi Corporation 36 0 100 9318 HANARO-AS 35 2 94 33597 InfoRelay Online Systems, Inc. 31 0 100 174 Cogent Communications 31 27 13 4713 OCN NTT Communications Corporation 28 24 14 3561 Savvis 28 0 100 4134 CHINANET-BACKBONE 27 6 78 16265 LEASEWEB AS 26 5 81 24611 AS24611 Datacenter Luxembourg S.A. 26 0 100 12832 Lycos Europe 25 0 100 9121 TTNet 25 1 96 3786 ERX-DACOMNET 23 9 61 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 89 35 61 174 Cogent Communications 31 27 13 4713 OCN NTT Communications Corporation 28 24 14 23522 CIT-FOONET 45 24 47 25973 Mzima Networks, Inc. 20 18 10 4766 KIXS-AS-KR 63 17 73 30506 Blacksun Technologies 17 17 0 19318 NJIIX-AS-1 - NEW JERSEY INTERN 133 16 88 30058 FDCSE FDCservers.net LLC 45 14 69 23832 SPACELAN KANAZAWA CABLE TELEVISION 11 11 0 29339 MBBG-AS Markus Bach Betriebs Gesell 10 10 0 31103 KEYWEB-AS Keyweb AG 11 10 9 11260 Andara High Speed Internet c/o Hali 10 9 10 3786 ERX-DACOMNET 23 9 61 4837 CHINA169-Backbone 22 8 64 9800 UNICOM 18 8 56 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 39 8 79 24989 IXEUROPE-DE-FRANKFURT-ASN IX Europe 21 7 67 25761 STAMIN-2 Staminus Communications 21 7 67 8001 Net Access Corporation 13 7 46 A version of this report with addition rankings can be found via the isotf.org home page. Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

Road Runner (as10994) NOC contact?
by David Hubbard 19 Feb '07

19 Feb '07

All of their listed contact info is for abuse and that just gets you a voice greeting that tells you to email abuse and then hangs up on you. Trying to troubleshoot an issue between Road Runner Tampa and Level 3. Thanks, David

1 0

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> > Now, even those people have shifted to a hierarchical > architecture of > > instant-messaging servers. > > In what way is IM hierarchial? > Jabber/XMPP has a mesh-of-stars topology That is hierarchy. One level is a star topology, the next level is a mesh. > which is the same as email's > modulo some simplifications (mainly owing to the lack of forwarding). In other words, it is not the same as email's. Of course it may end up that way but we can hope. > ISTR that you were arguing in favour of a chain-of-trust > system for email > back in November on the IETF list. I pointed out that the > architecture you > are proposing is essentially the same as inter-domain routing > (IP & BGP) > and Usenet, and you failed to explain how your ideas would solve the > unwanted traffic problem for email given that the same architecture > doesn't solve the unwanted traffic problem for IP or NNTP. An abstract simplification of an architecture is not equal to the architecture itself. The fact that you can simplify different architectures into a similar abstract model, doesn't mean that they have the same problems. Problems often arise in the details of implementation, not in the theoretical models. I never claimed that my proposed email model would solve the unwanted mail problem. It was intended to carry authenticated sender info to the receiver, and to provide an authenticated reverse path for complaints to postmaster. And since it was based on negotiated bilateral email peering agreements, if the chain of trust was subverted at some point in the chain, the peer would have legal recourse to cut service. --Michael Dillon

1 0

Hackers hit key Internet traffic computers
by Roy 19 Feb '07

19 Feb '07

Its amazing how reporters has to butcher technology information to make it understood by their editors http://www.cnn.com/2007/TECH/internet/02/06/internet.attacks.ap/index.html?…

28 43

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> I look forward to your paper on "the end to end concept, and > why it doesn't > apply to email" ;) Clearly the answer is that it never has applied to email in the pasts. Hosts don't email each other, people do. People have always relied on Internet postmaster services to enable Internet email. Given that we have already thrown out the end-to-end concept from day one, why must we maintain such a brain-dead flat architecture. People who wanted the end-to-end concept used to use "talk" on UNIX and Windows popup messages until recently. Now, even those people have shifted to a hierarchical architecture of instant-messaging servers. > I'm not convinced there is an email architecture problem of > relevance to the > discussion. People mistake a security problem for its most > visible symptoms. There is more than one security problem here. A well-thought-out email architecture will only address one of those security problems. > The SMTP based email system has many faults, but it seems > only mildly stressed > under the onslaught of millions of hosts attempting to > subvert it. It depends where you measure that stress. The decline of Internet email mindshare in favour of IM and Web forums indicates to me that it is severely stressed at the user level. > We may need a trust system to deal with identity within the > existing email > architecture, Bingo! > but I see no reason why that need be > hierarchical, indeed > attempts to build such hierarchical systems have often failed > to gather a > critical mass, but peer to peer trust systems have worked > fine for decades > for highly sensitive types of data. Peer-to-peer is a form of hierarchy. If you decide to trust X, Y, and Z and also trust all the hosts that X, Y and Z trust, then you have a trust hierarchy carved out of the peer-to-peer space. So if I trust AOL, Earthlink and Verizon, and I also trust all those trusted by these three, then you can't talk to my mail server until you arrange trust with me, or with one of the three trusted mail systems. Fact is that the email architecture does not include any form of trust and things like Sender-ID and DKIM are only bandaids that don't solve the problem and introduce additional insecurities. Additionally, if we can introduce hierarchy into the mail flow, we also introduce points at which cost-based models of spam prevention can be tried. If you can pay a penny a message to guarantee that your mail gets delivered quickly, bypassing any spam-filtering checkpoints, then that is something that the majority of users would buy into and the money provides grease for the wheels of the system, making it worthwhile to do things like set up an email peering agreement. Let's face it, the Internet of the early 90's is gone. It won't be coming back either. The challenge now is to operate a network that is capable of being *THE* global communications infrastructure. If the public Internet doesn't adapt to this job, then other networks will leverage the IETF's technology to do so. --Michael Dillon

3 2

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> NATting firewalls don't help at all with email-delivered malware, > browser exploits, etc. If the firewall is configured to block all outgoing traffic to port 25 servers, then it helps considerably. After all outgoing email should be going to port 587. And if the system designer is creative enough, then this firewall thingy which is reputed to protect you from bad stuff, would also download and install the latest patches to protect against browser exploits. If this is all run on a separate CPU it can also do some pretty in-depth inspection and do things like block .exe attachements in email. None of this is rocket science. The hardware available today can do this. This hardware is not expensive. It does, however, require systems vendors to have a bit of imagination and that seems to be in rather short supply in the modern world. --Michael Dillon

2 1

Re: Measurement data on transit traffic in IP routers?
by Frank Coluccio 19 Feb '07

19 Feb '07

>Your statement makes something of a presumption >as to the architecture of a network. In many >networks, edge aggregation devices do not >participate in backbone routing, but simply >pass the traffic they are aggregating into the core. My first reaction, as well. However, I was reminded by Andrew Odlyzko that the cable tv industry's (MSOs') peering universe constitute a form of flattened 'edge', if one were to consider the larger Internet's core against the MSO community, which makes for another form of interesting analysis, since much of today's (especially more capacious) residential "broadband" flows begin and end on MSOs' networks, and sometimes never touch the larger core, fwiw. And this opens the door to other forms of "walled garden" environments, including intranets, some providers' CDNs, extranets, and so on. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile On Sun Feb 18 10:54 , Andrew Lee sent: > >Hi Chris > >Your statement makes something of a presumption as to the architecture >of a network. In many networks, edge aggregation devices do not >participate in backbone routing, but simply pass the traffic they are >aggregating into the core. > >One fairly well instrumented network that does have this edge/core >collapsed model is the Internet2 network. You can find a lot of traffic >and other data for the network at: >http://noc.net.internet2.edu/i2network/live-network-status.html >You should be able to extract all the info you need from there. > >/Andrew > >Chris Develder wrote, On 2/18/07 5:46 AM: >> >> Hi All, >> >> In preparation of a course, I'm looking for reference material (paper, >> report, talk...) giving real world data on the amount of transit traffic >> (ie. not locally dropped or added, but passing through to other >> (backbone) routers) in a "typical" edge router of a core network, esp. >> ratio of local vs passthrough traffic (is it 30%, 40%...?) -- I don't >> need absolute figures, just realistic estimates of that ratio. >> >> Any help in locating such references would be highly appreciated. >> >> Kind regards, >> Chris >>

1 0

wifi for 600, alex
by Carl Karsten 19 Feb '07

19 Feb '07

Hi list, I just read over: http://www.nanog.org/mtg-0302/ppt/joel.pdf because I am on the PyCon ( http://us.pycon.org ) team and last year the hotel supplied wifi for the 600 attendees was a disaster (they probably were not expecting every single one to have and use a laptop the whole time). Joel's pdf was for a conference in 2002 or 3, so I am hoping much has changed. But from what I have found, I think my hopes may be just a dream. Does anyone have any advice or URLs of more recent case studdies in supplying wifi for 600 laptop wielding geeks? Thanks, Carl K ps, Google is one of our sponsors, and I see that they want to be the next inertube or something - maybe we can get them to do it :)

12 18

Datapipe.net
by Eric Ortega 19 Feb '07

19 Feb '07

Can someone from Datapipe.net contact me off list? Thanks, Eric Ortega Midcontinent Communications Network Engineer 605.357.5720 eric.ortega(a)midco.net -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.441 / Virus Database: 268.18.2/692 - Release Date: 2/18/2007 4:35 PM

1 0

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> > It is regularly done with servers connected to the Internet. > > There is no *COMPUTING* problem or technical problem. > > I beg to differ. Yes, it is possible for tech-savvy users to secure > their machines pretty effectively. But the level of technical > knowledge required to do so is completely out of line with, say, the > level of automotive knowledge required to safely operate an > automobile. You need, at minimum, weeks of training in order to safely operate an automobile. But to safely operate on the Internet, you simply open the box, plug the DSL cable into the DSL port of the NAT/firewall/switch/gateway box, plug the brand new unsecured computer into the Ethernet port, and you can now safely operate on the Internet. The technical problem has been solved for a long, long time. The same factors which drive down the cost of computers, have also driven down the cost of NAT/firewall devices to the point where they could actually be integrated right into the PC's hardware. > We know how -people with specialized knowledge- can secure them, not > ordinary people - and I submit that we in fact do not know how to > clean and validate compromised systems running modern > general-purpose > operating systems, that the only sane option is > re-installation of OS > and applications from scratch. This is an entirely different issue. It's like trying to cure AIDS and syphilis. Maybe prevention is an easier problem to tackle. Condoms are also fairly simple technology that works. --Michael Dillon

2 1