- NANOG - lists.nanog.org

Re: adviCe on network security report
by dlr＠bungi.com 02 Nov '06

02 Nov '06

[In the message entitled "Re: adviCe on network security report" on Nov 2, 8:54, "J. Oquendo" writes:] > > Out of curiousity (and I doubt many will respond publicly to this) how many > people have had success versus failure when dealing with abuse issues. I'm > thinking for every answered message sent to abuse (non autoresponder), one > will likely see more than 7-10 failures. Failures include an autoresponse, > nothing ever done, no response ever returned, a response returned a quarter of > a century later... > I did a study on this a few years ago. I sent out about 20,000 abuse reports, all by hand, to various network around the world. They all came from this email address, and were clearly identified as non-robotic, personal messages. There were "many" bounces. Less that 5% received any response. Less than 1% received any action within 30 days. With apologies to Sean, I know that ISP abuse desks are overworked, and under-empowered. *MANY* of the abuse desks today use spam content filters (!) on their abuse desks, which certainly cut down on the number of spam reports they get! However, this is an unacceptable way to run, in my personal opinion. Part of the problem is scale. The industry has not given ISPs the tools to deal with masses of end user computers. The vast majority of the problems today are compromised end-user computers. Many ISPs are unaware, even at the abuse desk level, of the number of compromised computers on their networks. Some ISPs, the exception rather than the norm, do take an active role in monitoring their networks, and alerting customers to unusual behavior. Typically, this is done with custom applications, usually written in-house. And yes, the company I work for is working on solutions for this. --

2 1

Any aspadmin.com people here?
by S. Ryan 02 Nov '06

02 Nov '06

Any aspadmin.com mail folks on here? Please contact me offlist. It's regarding one of your MX's. Many thanks, SR

1 0

Re: adviCe on network security report
by J. Oquendo 02 Nov '06

02 Nov '06

Sean Donelan wrote: > Hint, hint, hint. When the abuse and security folks at ISPs give suggestions on how to best work with them, its sometimes a good idea > to listen. What happens when the security folks are absent? This seems to be somewhat of the case concerning contacting "abuse(a)SOMEWHERE_OVER_THE_RAINBOW.com". Many times it starts there where someone will contact an abuse apartment that is likely not monitored. Let's be realistic here... Before someone shoots of a "your-so-off-topic-whiny-whiny-whiny" response. How many here have contacted an abuse and simply gotten 1) an autoresponder 2) no reply 3) undeliverable 4) no such account exists as opposed to getting something useful. > ISP security and abuse folks generally know how bad the problems are. That > isn't useful to getting their jobs done. They usually have better information about how bad it is than most third-parties. See my previous sentence... What happens when they see it, shrug off a simple abuse message that may contain something useful because they're fending off a DDoS attack or something. Does an abuse message take less precendence than other security matters. What will ISP's do when someone lashes back and starts some form of class action lawsuit against an ISP whose engineers repeatedly sat around and <strike>read NANOG and whined</strike> and did nothing? Is that what it will take? So I contacted abuse(a)f00f00.org about some user there stealing my info, spamming me, doing something illegal, I messaged them 10 times, no response. How about... I sue them. > ISP security and abuse teams already receive reports from almost every group in existence. After they process the high priority work, e.g. court orders from countries around the world, reports from customers, etc; figuring out how to make the security and abuse teams lives easier is > the key to getting your complaints to the top of the pile. Rankings of other ISPs doesn't change their workload. Out of curiousity (and I doubt many will respond publicly to this) how many people have had success versus failure when dealing with abuse issues. I'm thinking for every answered message sent to abuse (non autoresponder), one will likely see more than 7-10 failures. Failures include an autoresponse, nothing ever done, no response ever returned, a response returned a quarter of a century later... -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey

3 2

advise on network security report
by Rick Wesson 01 Nov '06

01 Nov '06

I would appreciate a bit of advise on a service I am about to deploy. I've spoken at different venues (including nanog) on global infection rates of bots and the general degradation of well behaved hosts. I now track around 2.2M abuse events per day and now have the capability to produce reports for the community on which networks have the largest problems. I am prepared to make reports monthly to the community ordering networks by their volume of issues. I'd like some hints of which might be the most valuable to the community. o are hosts counts or issue counts more important o is a 7 or 30 day window sufficient for aggregation? o I'm not repaired for graphs yet so don't go there. o should I post sub-reports for regions, by RIR? o which kinds of abuse are more interesting. I'm expecting to post a weekly report once a month to nanog, would this be disruptive? We have a mailing list set up for weekly reports, once finalized I'll post the location for its list manager. The global report usually has about 6,000+ networks, the top 100 from last week are below. again, thanks for your feedback. -rick Table 1. Networks with abuse, ordered by #incidents +-------+-----------+------+-------------------------------------+ | asn | incidents | cc | left(asname,35) | +-------+-----------+------+-------------------------------------+ | 4134 | 517830 | CN | CHINANET-BACKBONE | | 9121 | 331955 | EU | TTNet | | 4837 | 289984 | CN | CHINA169-Backbone | | 3320 | 231516 | DE | Deutsche Telekom AG | | 3352 | 211504 | ES | TELEFONICA-DATA-ESPANA Internet Acc | | 5617 | 194685 | PL | TPNET | | 3215 | 181686 | FR | AS3215 | | 3269 | 175858 | EU | ASN-IBSNAZ | | 4766 | 129722 | KR | KIXS-AS-KR | | 19262 | 125003 | US | Verizon Internet Services | | 8551 | 116014 | EU | ISDN-NET-AS | | 3209 | 94981 | DE | UNSPECIFIED | | 3462 | 82089 | TW | HINET | | 9829 | 80538 | IN | BSNL-NIB | | 8151 | 79223 | EU | Uninet S.A. de C.V. | | 8359 | 73640 | RU | MTUONLINE | | 5486 | 65757 | EU | Euronet Digital Communications | | 12322 | 65638 | FR | PROXAD AS for Proxad ISP | | 4788 | 53863 | MY | TMNET-AS-AP | | 9116 | 53375 | IL | Goldenlines main autonomous system | | 4814 | 52712 | CN | CHINA169-BBN | | 22927 | 51899 | AR | Telefonica de Argentina | | 4812 | 46462 | CN | CHINANET-SH-AP | | 1680 | 45848 | IL | NETVISION | | 9105 | 44450 | UK | TISCALI-UK | | 15557 | 42792 | FR | LDCOMNET | | 9498 | 42774 | IN | BBIL-AP | | 8584 | 41914 | US | Barak AS | | 2856 | 41820 | EU | BT-UK-AS | | 13184 | 41688 | DE | HANSENET HanseNet Telekommunikation | | 9318 | 40930 | KR | HANARO-AS | | 12479 | 39009 | EU | UNI2-AS Uni2 Autonomous System | | 6147 | 38716 | US | Telefonica del Peru S.A.A. | | 3243 | 38586 | PT | RIPE NCC ASN block | | 6713 | 35777 | EU | IAM-AS | | 12876 | 35068 | FR | AS12876 | | 6739 | 32639 | ES | ONO-AS | | 8228 | 32352 | FR | CEGETEL-AS CEGETEL ENTREPRISES | | 1267 | 31869 | IT | ASN-INFOSTRADA Infostrada S.p.A. | | 7418 | 30221 | EU | Terra Networks Chile S.A. | | 5462 | 28861 | UK | CABLEINET Telewest Broadband | | 8708 | 28236 | EU | RDSNET | | 5430 | 27245 | DE | FREENETDE | | 7470 | 24729 | TH | ASIAINFO-AS-AP | | 5610 | 24279 | CZ | CZECHTELECOM CZECH TELECOM, a.s | | 16338 | 23956 | ES | AUNA_Telecom-AS | | 4713 | 23650 | JP | OCN NTT Communications Corporation | | 12424 | 22932 | ES | JAZZASN Autonomous System | | 5089 | 21322 | EU | NTL NTL Group Limited | | 17813 | 20792 | IN | MTNL-AP Mahanagar Telephone Nigam L | | 5483 | 20511 | EU | HTC-AS Hungarian Telecom | | 4755 | 19673 | UK | VSNL-AS | | 8764 | 19571 | LT | TELECOMLT-AS | | 28725 | 18369 | CZ | CZ-EUROTEL-AS AS of Eurotel Praha | | 6830 | 18360 | HU | UPC | | 12542 | 17893 | PT | TVCABO Autonomous System | | 9299 | 17854 | PH | IPG-AS-AP | | 18101 | 17325 | IN | RIL-IDC Reliance Infocom Ltd Intern | | 3257 | 16918 | DE | TISCALI-BACKBONE | | 1257 | 16418 | FI | TELE2 AB | | 8881 | 15944 | DE | VERSATEL | | 5713 | 15566 | XX | Telkom SA Ltd. | | 6855 | 15420 | SK | SK SLOVAK TELECOM, AS6855 | | 9304 | 15311 | HK | HUTCHISON-AS-AP | | 5391 | 14937 | EU | T-HT T-Com Croatia Internet network | | 9583 | 14785 | IN | SIFY-AS-IN | | 209 | 14678 | US | Qwest | | 22047 | 14499 | XX | VTR BANDA ANCHA S.A. | | 6849 | 14419 | EU | UKRTELNET | | 24863 | 13616 | EU | LINKDOTNET-AS LINKdotNET AS number | | 8167 | 13184 | BR | TELESC - Telecomunicacoes de Santa | | 20838 | 12898 | ES | YIF-AS | | 6400 | 12563 | XX | Codetel | | 2860 | 12467 | PT | NOVIS Novis Telecom, S.A. | | 13285 | 12347 | UK | OPALTELECOM-AS | | 18403 | 12230 | VN | FPT-AS-AP The Corporation for Finan | | 7132 | 12031 | US | SBC Internet Services | | 20115 | 11683 | US | Charter Communications | | 8452 | 11507 | EU | TEDATA TEDATA | | 4230 | 11385 | BR | Embratel | | 5384 | 10946 | EU | EMIRATES-INTERNET | | 1221 | 10629 | AU | ASN-TELSTRA | | 28573 | 10475 | BR | NET Servicos de Comunicao S.A. | | 8866 | 10434 | BG | BTC-AS | | 9506 | 10126 | SG | MAGIX-SG-AP | | 8997 | 10123 | RU | ASN-SPBNIT SPBNIT-RU Autonomous Sys | | 8404 | 9941 | EU | CABLECOM | | 7693 | 9719 | TH | COMNET-TH | | 12880 | 9663 | IR | DCI-AS | | 6057 | 9432 | XX | Administracion Nacional de Telecomu | | 8402 | 9224 | RU | CORBINA-AS | | 6478 | 8943 | XX | AT&T WorldNet Services | | 5603 | 8913 | SI | SIOL-NET SiOL Internet d.o.o. | | 6327 | 8912 | CA | Shaw Communications Inc. | | 3303 | 8823 | CH | SWISSCOM | | 7552 | 8770 | VN | VIETEL-AS-AP Vietel Corporation | | 11427 | 8757 | XX | Road Runner | | 5466 | 8736 | IE | EIRCOM Eircom | | 6799 | 8634 | GR | OTENET-GR OTEnet S.A. Multiprotocol | | 10318 | 8526 | XX | CABLEVISION S.A. | +-------+-----------+------+-------------------------------------+

8 10

RE: advise on network security report
by Mike Callahan 01 Nov '06

01 Nov '06

>I beg to differ, wither I aggregate my announcements does not impact the >$50B charge identity theft puts on the US economy. Perhaps a better start on impacting this would be for the credit card companies to pursue the people that abuse their cards/systems instead of just writing fraudulent purchases off as a loss and not pursuing them any further. I been through it myself and I know for a fact that at least one major cc company operates in this way. In this model there's nothing to discourage someone from using stolen numbers. Just my $.02 ~M -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Rick Wesson Sent: Tuesday, October 31, 2006 8:02 PM To: Barry Greene (bgreene) Cc: nanog(a)merit.edu Subject: Re: advise on network security report Barry Greene (bgreene) wrote: > Postings like this to NANOG will not have any impact. So if your goal is > instigate action, posting is not going to work. The core data point is > the weekly CIDR report. It only works if you have peers using the weekly > list to apply peer pressure to the networks listed to act. I beg to differ, wither I aggregate my announcements does not impact the $50B charge identity theft puts on the US economy. would it assist if I associated a dollar value for each bot hosted, we can estimate the number of credit cards stolen per bot and extrapolate in to something with some zeros on it. > Sharing summaries to communities like dshield, NSP-SEC, DA, SANs and > other security mitigation communities along with a subscription web page > that would allow an organization to get enough details to take action. nsp-sec players still won't let us in their sand-box... but we will share to the communities you have enumerated. -rick

2 1

rbnnetwork.org
by Alexander Harrowell 01 Nov '06

01 Nov '06

Is hosting a phishing site and bouncing abuse reports.. ---------- Forwarded message ---------- From: Alexander Harrowell <a.harrowell(a)gmail.com> Date: Oct 31, 2006 2:38 PM Subject: Phisher To: abuse(a)rbnnetwork.org We're receiving large volumes of comments spam advertising a site hosted in your network. http://onlineinvestmentworld.com is located at 81.95.146.166, which is your netblock: inetnum: 81.95.144.0 - 81.95.147.255 netname: RBNET descr: Russian Business Network admin-c: RBNR-ORG tech-c: RBNR-ORG mnt-by: RBN-MNT status: ASSIGNED PA country: RU remarks: INFRA-AW changed: noc(a)rbnnetwork.com 20060 Tracert: 1 0 1 1 0.6 ms 66.36.240.2 AS14361 HOPONE-DCA c-vl102-d1.acc.dca2.hopone.net. 255 US Unix: 14:38:16.496 2 0 2 6 0.6 ms [+0ms] 66.36.224.232 AS0 IANA-RSVD-0 gec2.core1.dca2.hopone.net. 0 miles [+0] 254 US Unknown: 833f257b 3 0 0 1 0.7 ms [+0ms] 66.36.224.233 AS0 IANA-RSVD-0 gec2.core2.dca2.hopone.net. 0 miles [+0] 254 US Unix: 14:07:58.580 4 6 8 6 6.5 ms [+5ms] 198.32.160.102 AS0 IANA-RSVD-0 gi3-0.nyc-002-inter-1.interoute.net. 0 miles [+0] 253 US Unix: 14:37:46.936 5 * 75 77 74 ms [+67ms] 212.23.43.177 AS8928 INTEROUTE gi0-0.nyc-002-inter-1.interoute.net. 0 miles [+0] 248 GB Unix: 14:37:47. 45 6 * 75 75 74 ms [+0ms] 212.23.43.150 AS8928 INTEROUTE po3-0.lon-wal-core-2.interoute.net. 0 miles [+0] 250 GB Unix: 14:37:47.128 7 * 74 74 74 ms [+0ms] 217.118.119.26 AS8928 INTEROUTE te9-1.lon-wal-access-4.interoute.net. 0 miles [+0] 250 GB Unix: 14:37:47.162 8 * 85 78 78 ms [+3ms] 84.233.231.138 AS8928 INTEROUTE unknown.net.uk 0 miles [+0] 248 GB Unknown: 8100e8e2 9 * 124 125 124 ms [+46ms] 81.95.156.34 AS0 IANA-RSVD-0 gbit-eth-34-uk.sbttel.com. 0 miles [+0] 247 RU Unix: 14:37:16.972 10 * 125 124 124 ms [+0ms] 81.95.156.58 AS0 IANA-RSVD-0 oc-3-sbttel.rbnnetwork.com. 0 miles [+0] 55 RU Unix: 14:35:47.772 11 * 143 149 143 ms [+19ms] 81.95.146.166 ASN=40989[Destination Unreachable] ip-146-166.rbnnetwork.com.

4 3

RE: Cogent now peering with Sprint?
by Bob Collie 01 Nov '06

01 Nov '06

That looks like a transit connection that Cogent bought at Ashburn, VA, not SFI peering connection. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Ed Ray Sent: Tuesday, October 31, 2006 12:11 AM To: nanog(a)merit.edu Subject: Cogent now peering with Sprint? I never thought Sprint would ever renew its relationship with Sprint: Tracing the route to portus.netsecdesign.com (66.6.208.6) 1 sl-bb24-rly-9-0.sprintlink.net (144.232.14.122) 0 msec 0 msec 0 msec 2 sl-st22-ash-6-0.sprintlink.net (144.232.20.189) 0 msec 4 msec 0 msec 3 p15-2.core01.iad01.atlas.cogentco.com (154.54.13.61) [AS 174] 4 msec 4 msec 0 msec 4 v3492-mpd01.iad01.atlas.cogentco.com (154.54.3.222) [AS 174] 16 msec 80 msec 196 msec 5 v3497.mpd01.dca01.atlas.cogentco.com (154.54.5.65) [AS 174] 4 msec 4 msec 4 msec 6 t9-3.mpd01.iah01.atlas.cogentco.com (154.54.2.222) [AS 174] 44 msec 44 msec 48 msec 7 t2-3.mpd01.lax01.atlas.cogentco.com (154.54.3.186) [AS 174] 72 msec 72 msec 72 msec 8 g2-0-0.core01.lax01.atlas.cogentco.com (154.54.2.101) [AS 174] 72 msec 72 msec 72 msec 9 g49.ba01.b002698-1.lax01.atlas.cogentco.com (66.250.12.130) [AS 174] 72 msec 72 msec 72 msec 10 PAJO-Networks.demarc.cogentco.com (38.112.9.190) [AS 174] 72 msec 76 msec 72 msec 11 dcap04.pcap.lax01.tierzero.net (216.31.128.14) [AS 11509] 72 msec 76 msec 72 msec 12 mmic-gw.dcap6.lax.us.tierzero.net (216.31.188.94) [AS 11509] 76 msec 80 msec 80 msec 13 dazedandconfused.netsecdesign.com (66.6.208.4) [AS 11509] 84 msec 84 msec 88 msec 14 portus.netsecdesign.com (66.6.208.6) [AS 11509] 84 msec 84 msec 88 msec Next I will see pigs flying :) Wonder how long it will last based on Cogent's past behavior as noted here. Edward Ray ------------------------------------------------------------- This mail was scanned by BitDefender For more informations please visit http://www.bitdefender.com -------------------------------------------------------------

7 6

FYI: Explosions Reported At eBay PayPal Building In SJ, All Cool Now
by Fergie 01 Nov '06

01 Nov '06

No one injured, no operations interrupted on this, Oidhche Shamhna. http://cbs5.com/local/local_story_305004735.html Cheers, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

(OT)MSN/hotmail postmaster contact
by Edward F. Klimowicz 01 Nov '06

01 Nov '06

Is there a postmaster from MSN/Hotmail out there? Mail from my domain to any of yours is being junked and randomly blackholed. No progress has been made yet with the normal tech support. Please reply off list if you can help. -- Edward F. Klimowicz Voicenet Systems Administration edwardk(a)voicenet.com 215.259.2131

5 5

Reciprocal billing by independent LECs
by Ashe Canvar 31 Oct '06

31 Oct '06

Hi all, I am investigatng the reciprocal compensation model in use today between the ILECs and some independents. Specifically, many companies are offering multi party conferencing for free as a side effect of of this reciprocity fee. Seems like there were some disputes about it in the past : http://telephonyonline.com/mag/telecom_draining_incumbent_us/ So is this still a valid business model or is a crackdown by the ILECs in the cards ? All info appreciated. Thanks, Ashe Canvar.

1 0