- NANOG - lists.nanog.org

trying to move web site for New Orleans schools
by Mark Boolootian 01 Sep '05

01 Sep '05

Outside the NANOG charter, but given the current circumstances, this seemed to be a reasonable forum for suggestions on solving this problem. --- Subject: Web aid Date: Thu, 01 Sep 2005 09:05:22 -0500 >From: Paul Tatarsky <paul(a)tatarsky.com> This is something that until a few minutes ago I never even considered as part of this whole Hurricane fallout. I got a call from a high school friend who lived in New Orleans. He's in Florida now. There is a emerging need to use the web to help scattered folks get status from schools, businesses, etc. Many many servers are gone. People are at relatives homes and are trying to use the Internet to get status. They want to swing DNS for their kids school to a new server but cannot contact their sysadmin who has the accounts at Network Solutions. Does anybody have an idea how to solve that? But, I'm starting to setup a template BSD machine to provide basic web vhosts and squirrel mail. We're going to start with his kids school. Here's all that is currently left electronically: http://64.233.167.104/search?q=cache:009iQtpHviwJ:www.stuarthall.org/+&hl=e… -------------------------------------------------------------------- Paul Tatarsky paul(a)tatarsky.com Sysadmin Consultant (608) 441-7365 http://www.tatarsky.com/ --------------------------------------------------------------------

3 2

RE: trying to move web site for New Orleans schools
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Good advice. The miscreants have already been busy in that regard... - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > Outside the NANOG charter, but given the current > circumstances, this seemed > to be a reasonable forum for suggestions on solving this problem. I suggest everyone move with caution on making any unauthenticated changes on the fly for anyone claiming to be impacted by the storm. I know we all feel badly, but this is a good opportunity for miscreants, phishers, and scammers to wreak havoc. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: trying to move web site for New Orleans schools
by Hannigan, Martin 01 Sep '05

01 Sep '05

> > Outside the NANOG charter, but given the current > circumstances, this seemed > to be a reasonable forum for suggestions on solving this problem. I suggest everyone move with caution on making any unauthenticated changes on the fly for anyone claiming to be impacted by the storm. I know we all feel badly, but this is a good opportunity for miscreants, phishers, and scammers to wreak havoc. -M<

1 0

This fall in LA
by Susan Harris 01 Sep '05

01 Sep '05

Greetings everyone - registration is now open for the fall NANOG meeting, to be held Oct. 23-25 in Los Angeles. This is our fourth back-to-back meeting with ARIN - a joint venture that's proven very successful at giving operators direct access to the all-important folks who hand out IP addresses and ASNs in North America. ARIN meets just after NANOG, from Oct. 26-28. NEW THIS FALL: an in-depth "Getting Started With IPv6" workshop, to be held Sunday from 9am-4:30 p.m. Workshop info and registration is here: http://www.arin.net/ARIN-XVI/ipv6_workshop.html NANOG registration is here: https://www.merit.edu/nanog/registration.form.html See you in Los Angeles!

2 2

Re: Has someone in Asia exploited Cisco
by Robert Guess 01 Sep '05

01 Sep '05

Offhand, I would be tempted to say it is the activity of a not exceedingly competent attacker trying to exploit a very old bug. The sender is probing for the HTTP Authentication Bypass Issue from June 27 2001. Original Advisory http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html Malicious request: http://<device_addres>/level/16/exec/ Analyze the timing and source of log events to determine if it is an automated issue. Robert Guess Assistant Professor, Information Systems Technology Tidewater Community College (757) 822-5022 () ascii ribbon campaign /\ against html email >>> "J. Oquendo" <sil(a)politrix.org> 09/01/05 9:07 AM >>> After doing some logfile analysis briefly yesterday, I noticed what seems to be some form of bot, worm, something, searching for what could seems to point to a Cisco exploitation of sorts. (http://tinyurl.com/df9d8) All the hosts who've tried searching for the string are coming from APNIC. So I'm wondering... Has someone taken Michael Lynn's paper "Holy Grail" and produced a "DaVinci Code" to exploit the flaws Lynn spoke of... Code snippet below is of "cisco_scanner.c" which searches for the same particular /level/16/exec/-///pwd string however the code can be modified (obviously) and a search turns up less than one page of results on Google. Author's page seems to be gone like the wind... Anyhow. # grep "/level/16/exec/-///" access_log |awk '{print $1,"\t\t"$7}' 58.236.50.75 /level/16/exec/-///pwd 221.141.168.137 /level/16/exec/-///pwd 221.138.93.31 /level/16/exec/-///pwd 218.53.244.16 /level/16/exec/-///pwd 222.232.84.34 /level/16/exec/-///pwd 222.238.128.14 /level/16/exec/-///pwd 218.50.74.189 /level/16/exec/-///pwd 218.239.26.42 /level/16/exec/-///pwd 218.232.83.18 /level/16/exec/-///pwd 211.208.254.67 /level/16/exec/-///pwd whois.apnic.net $ABOVE_HOSTS Code snippet... /* Multi-thread Cisco HTTP vulnerable scanner v0.2 by Inode */ #define HTTP_REQUEST "GET /level/16/exec/-///pwd HTTP/1.0\n\n" So now I have yet another mod_security rule added ;) SecFilterSelective THE_REQUEST "/level/16" "redirect:http://www.cisco.com" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 It is much easier to suggest solutions when you know nothing about the problem. -- Niklaus Wirth

1 0

Has someone in Asia exploited Cisco
by J. Oquendo 01 Sep '05

01 Sep '05

After doing some logfile analysis briefly yesterday, I noticed what seems to be some form of bot, worm, something, searching for what could seems to point to a Cisco exploitation of sorts. (http://tinyurl.com/df9d8) All the hosts who've tried searching for the string are coming from APNIC. So I'm wondering... Has someone taken Michael Lynn's paper "Holy Grail" and produced a "DaVinci Code" to exploit the flaws Lynn spoke of... Code snippet below is of "cisco_scanner.c" which searches for the same particular /level/16/exec/-///pwd string however the code can be modified (obviously) and a search turns up less than one page of results on Google. Author's page seems to be gone like the wind... Anyhow. # grep "/level/16/exec/-///" access_log |awk '{print $1,"\t\t"$7}' 58.236.50.75 /level/16/exec/-///pwd 221.141.168.137 /level/16/exec/-///pwd 221.138.93.31 /level/16/exec/-///pwd 218.53.244.16 /level/16/exec/-///pwd 222.232.84.34 /level/16/exec/-///pwd 222.238.128.14 /level/16/exec/-///pwd 218.50.74.189 /level/16/exec/-///pwd 218.239.26.42 /level/16/exec/-///pwd 218.232.83.18 /level/16/exec/-///pwd 211.208.254.67 /level/16/exec/-///pwd whois.apnic.net $ABOVE_HOSTS Code snippet... /* Multi-thread Cisco HTTP vulnerable scanner v0.2 by Inode */ #define HTTP_REQUEST "GET /level/16/exec/-///pwd HTTP/1.0\n\n" So now I have yet another mod_security rule added ;) SecFilterSelective THE_REQUEST "/level/16" "redirect:http://www.cisco.com" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 It is much easier to suggest solutions when you know nothing about the problem. -- Niklaus Wirth

1 0

Boing Boing: Clearinghouse for Katrina tech assistance contacts
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Since gripes here on the list about opsts regarding the Hurricane Katrina aftermath issues, I just wanted to point out that Bong Boing has seemingly become the clearinghouse for much tech info on efforts to provide some sort tech and communications assistance in the Gulf Coast region. So, I'd stay tuned over on Boing Boing if you want to stay in the loop on that particular issue: http://boingboing.net/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: August 2005: Drone Army Botnet C&C listing
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Yes. And thanks. - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > 30058 FDCSERVERS - FDCservers.net LL 123 43 > 21840 SAGONET-TPA - Sago Networks 53 26 > Much better. And no IL-CERT. :-) Is it safe to say the resolutions, at least in these two cases, are because of others mitigation activities i.e. snatching back the RR's, shutting off the domain, black holes, etc? -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

August 2005: Drone Army Botnet C&C listing
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Keeping is step with Gadi's language from last month: Below is a periodic public report from the Drone Army(DA)/Botnet Research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our analysis of information we have conducted thus far, we are now publishing our regular reports, with some additional information, which may vary from time to time, as needed. As of this July 2005, any responsible party that wishes to receive information about botnet C&C's in their net space can contact us and be added to our notification list. The principle contact is Paul Ferguson (Fergie). - ferg ==== Special appreciation is due to Staminus who took quick action to resolve the suspect C&Cs of the last report and rapidly resolved all of the suspect C&Cs which appeared during this current survey. AS responsible Parties ranked by top 10 open unresolved suspect C&Cs: ASN Responsible Party Total Open 30058 FDCSERVERS - FDCservers.net LL 123 43 21840 SAGONET-TPA - Sago Networks 53 26 13680 AS13680 Hostway Corporation Ta 23 23 15083 INFOLINK-MIA-US - Infolink Inf 37 21 6461 MFNX MFN - Metromedia Fiber Ne 28 17 8560 SCHLUND-AS Schlund + Partner A 26 17 30083 SERVER4YOU - Server4You Inc. 37 16 13237 LAMBDANET-AS European Backbone 15 12 9800 UNICOM CHINA UNICOM 14 11 27645 ASN-NA-MSG-01 - Managed Soluti 18 11 Historical Report ranked by past suspect C&Cs mapping into the AS: ASN Responsible Party Total Open Percent Resolved 14742 INTERNAP-BLOCK-4 - Internap Ne 142 2 99% 14744 30058 FDCSERVERS - FDCservers.net LL 123 43 65% 10913 INTERNAP-BLK - Internap Networ 84 0 100% 25761 STAMINUS-COMM - Staminus Commu 58 0 100% 21840 SAGONET-TPA - Sago Networks 53 26 51% 3356 LEVEL3 Level 3 Communications 43 5 88% 21844 THEPLANET-AS - THE PLANET 38 5 87% 30083 SERVER4YOU - Server4You Inc. 37 16 57% 15083 INFOLINK-MIA-US - Infolink Inf 37 21 43% 11739 DIGITAL-FOREST-NW - digital.fo 29 0 100% 16237 NXS Nxs Internet BV 29 0 100% The report summary includes a Percent Resolved Column in order to recognize the mitigation efforts of the AS Responsible Parties. The Opens Unresolved column represents the number of unique C&C which reported as open to the survey's connection attempts and which have neither been investigated nor cleared by the Responsible Party (to the extent of our knowledge). The Total mapping count may include multiple names mapping to a single IP within an AS. We count each mapping count as a unique C&C. Stats for the DA group compiled by: Randal Vaughn Professor Information Systems Baylor University Randy_Vaughn (at) Baylor.edu -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Peering Contact Database
by Deepak Jain 31 Aug '05

31 Aug '05

Hey. Hopefully this is operational. If someone could send me a copy of the current (or most recent) Peering Contact Database. I know Bill Norton used to distribute it, but I seem to have fallen off the distribution list or its getting eaten by my spam filters. (really operational: I want to make sure there are no prospective peers at Equinix/Ashburn that I may have missed on my last survey). Thanks, Deepak Jain AiNET

3 2