- NANOG - lists.nanog.org

Word file
by davidu 31 Jan '06

31 Jan '06

Please see the file. ********************************************************** ********************************************************** WARNING: WinProxy has detected a virus in file attached to this e-mail message! The attachment has been automatically removed to protect your network. WinProxy Administrator: gk_pkm(a)yahoo.com 01/31/06 11:56:02 WinProxy (Version 6.0 R1c (6.0.21.0)) - http://www.WinProxy.com/ Antivirus Vendor: Panda Software Scan Engine Version: 4.7.0.201_4.1.6.408 Pattern File Version: 3.109873 (Timestamp: 2006/01/30 17:00:31) Machine name: SYS1 Machine IP address: 202.141.22.146 Server: 198.108.1.26 Client: 192.168.0.11 Protocol: SMTP Virus: "W32/Tearec.A.worm!CM��" found! Attachment: New_Document_file.pif ********************************************************** **********************************************************

2 1

Comcast contact
by Jeffrey Sharpe 30 Jan '06

30 Jan '06

Looking for a Comcast contact. Please reply off-list. Jeff.

1 0

Re: CME-24 (BlackWorm) Users' FAQ
by Gadi Evron 30 Jan '06

30 Jan '06

> The FAQ can be found at: > http://isc.sans.org/blackworm > http://blogs.securiteam.org That's http://blogs.securiteam.com My apologies, and thanks to all those who notified me. Gadi.

1 0

CME-24 (BlackWorm) Users' FAQ
by Gadi Evron 30 Jan '06

30 Jan '06

This FAQ was authored by members of the TISF BlackWorm task force (specifically the MWP / DA groups and the SANS ISC handlers). The purpose is both to provide with a resource for concerned users and network administrators, as well as to be a level-headed myth-free source on the subject. There seems to be excessive media hype as well as some "end-of-the-world" type predictions. The end of the world is not coming and most of us will still be here after February 3rd, but this is a serious issue for those who *are* infected and we didn't manage to get to. The FAQ can be found at: http://isc.sans.org/blackworm http://blogs.securiteam.org -- "300,000 infected users worldwide is not a terribly large amount when compared to previous worms like Sober or Mydoom. However, with this worm it isn't the quantity of infected users, it is the destructive payload which is most concerning." -- Joe Stewart, LURHQ (http://www.lurhq.com/blackworm-stats.html) Gadi.

1 0

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 30 Jan '06

30 Jan '06

>the scheme that josh karlin has been advocating in pretty good bgp >involved only supressing a doubtful announcement when you have a >better, more trusted announcement. Not a doubtful announcement, a novel announcement. Not a better announcement, a more usual announcement. The trust part, like beauty, is in the eye of the beholder. Don't get me wrong - I think basing decision on some "trusted" summary of historical behavior is going to be important, unless and until we get some approach that gives a more deterministic answer. But I do believe that we need to consider carefully how this will play with dynamic, particularly unplanned, changes in who is announcing what. If there turn out to be cases where dynamic, particularly unplanned, changes get rejected by this technique in favor of stale data, then there should be consideration given to how to amend the scheme to prevent that or suggest operational practices to get around it. --Sandy

2 1

I never realized so many trains derailed until my Internet kept going out
by Sean Donelan 30 Jan '06

30 Jan '06

http://www.thedenverchannel.com/technology/6490915/detail.html It was the third multi-day outage experienced by Comcast Western Slope customers. The two previous also came as a result of train derailments. One Aspen Comcast customer told the Aspen Times that he learned a lot about train derailments as result of his service interruptions. "I never realized so many trains derailed until my Internet kept going out," said Michael McVoy.

5 5

New talks/tutorials for Dallas
by Susan Harris 29 Jan '06

29 Jan '06

We've scheduled two new presentations for NANOG36: - DNS Infrastructure Distribution Steve Gibbard, PCH - Responsive Yet Stable Traffic Engineering Srikanth Kandula, MIT The new tutorials are: - ISP Security 101 Primer Barry Greene, Cisco - L2VPN: Path to Convergence Muhammad Waris Sagheer and Syed Nawaz, Cisco More details at http://www.nanog.org/mtg-0602/topics.html

1 0

GoDaddy.com shuts down entire data center?
by Elijah Savage 28 Jan '06

28 Jan '06

Any validatity to this and if so I am suprised that our team has got no calls on not be able to get to certain websites. http://webhostingtalk.com/showthread.php?t=477562 -- http://www.digitalrage.org/ The Information Technology News Center

23 34

Current Blackworm numbers
by Fergie 28 Jan '06

28 Jan '06

Given all the noise that this issue has caused on the list, I thought I'd take a moment this afternoon and forward a URL that good folks over at LURHQ have made available with more realistic, and current, statistics on the BlackWorm cruft: http://www.lurhq.com/blackworm-stats.html Thanks to Joe Stewart at LURHQ. Cheers, - ferg -- Martin Hannigan <hannigan(a)world.std.com> wrote: [snip] The point I was trying to make before the thread went, East?, was that there is a perceived problem in the security community with approrpriate response. I'd tell you how I think that could have been avoided, but then my name would go up in the subject again. *cough full disclosure* [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

LimeLigh random Friday afternoon renumbering, anyone?
by Mike Lyon 28 Jan '06

28 Jan '06

Anyone else have LimeLight randomly decide to renumber their IP blocks on Friday afternoon without any heads up to anyone? Just curious to see who else had their connectivity go down because of it... Yay! -Mike

1 0