- NANOG - lists.nanog.org

RE: FW: Worms versus Bots
by Daniel Senie 04 May '04

04 May '04

At 12:35 PM 5/4/2004, Smith, Donald wrote: >Daniel I agree a nat/firewall/router with acl's ... will all help >prevent windows compromises. >I believe security in depth is an essential element of any good security >system. > >The goal of this document is help new XP users survive long enough to do >their updates. >Many of them cant/wont put up acls/nat/firewalls Note that I said "have this NAT box in your bag." My suggestion is that this be used during installation. Is $50 too high an extra expense to suggest people just buy one with the machine, and use it as a tool for doing installations? That's what I was suggesting. For the money, this is FAR better protection than that provided by the document. >... but if they follow >the steps listed they have a better chance of >successfully downloading and updating their new machine then they will >have with OUT these steps. >It is not meant as a complete XP hardening document. There are lots of >documents that discuss in detail how to harden >windows (xp,nt,2k...). > >Donald.Smith(a)qwest.com GCIA >http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC >pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC >kill -13 111.2 > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > Behalf Of Daniel Senie > > Sent: Tuesday, May 04, 2004 9:39 AM > > To: Sean Donelan > > Cc: nanog(a)merit.edu > > Subject: RE: FW: Worms versus Bots > > > > > > > > At 10:54 AM 5/4/2004, Sean Donelan wrote: > > > > >On Tue, 4 May 2004, Smith, Donald wrote: > > > > If you follow these steps outlined by SANS you should be able to > > > > successfully update and NOT get infected. This is short, > > easy, fully > > > > documented (with pictures :) > > > > http://www.sans.org/rr/papers/index.php?id=1298 > > > > > >The risk is smaller, but still exists if you follow these directions > > >for XP pre-SP2. See the Microsoft release notes for XP SP2 > > for details > > >about the fix. > > > > > >If you do not have XP SP2, you need to disconnect your computer from > > >the network prior to every boot cycle until it is fully patched. > > > > A much simpler mechanism than that described by SANS is to > > have a small, > > cheap NAT box in your bag (e.g. D-Link DI-604 or similar). > > Worth the $50 > > cost to have one available. Put the little router between the > > new machine > > to be brought up and whatever network you have access to. Now > > you can bring > > up the new machine and update it without having it get > > instantly infected. > > (Use some common sense... don't set up email until the > > machine is patched, > > or use any other sort of mechanism to pull in potential > > viruses before > > patching is done). > > > > (To deflect the inevitable "NAT is not a firewall" > > complaints, the box is a > > stateful inspection firewall -- as all NAT boxes actually are). > > > >

1 0

L2TPv3 encaps performance (again)
by Joe Abley 04 May '04

04 May '04

I had quite a large number of people reply privately to me on this (see below), but a singular lack of vendors (just one) who had anything to say on the subject. So, before I conclude that there is only one vendor in the world that supports L2TPv3 at anything close to gigabit speeds, I thought I'd ask again, more explicitly: If there are any vendors interested in selling L2TPv3 boxes, and they'd like the list of potential customers who have sent me mail about this to find out about them, then they should feel free to send me a sentence or two about what their boxes can do so I can pass the information on. Suggestions and recommendations from operators would be also wildly good to hear. Thanks! Begin forwarded message: > From: Joe Abley [mailto:jabley@isc.org] > Sent: Wednesday, April 28, 2004 11:05 AM > To: nanog(a)nanog.org > Subject: L2TPv3 encaps performance > > Someone asked me the other day if I could recommend some L2TPv3 tunnel > termination devices which might be capable of encaps/de-encaps of > traffic which bursts near to 1Gbit/s (e.g. with GE uplinks to a > core/transport network, and GE interfaces for hand-off towards the > subscriber). Application is providing transparent/pseudowire wide-area > ethernet transport service over a routed-IP but non-LDP-capable core. > > This didn't sound like a particularly hard question, but I couldn't > find any performance numbers on L2TPv3 edge boxes anywhere. What boxes > exist that can do this stuff at gig speeds? > > Replies off-list would be fine, I can summarise if there's interest. >

1 0

RE: FW: Worms versus Bots
by Smith, Donald 04 May '04

04 May '04

Daniel I agree a nat/firewall/router with acl's ... will all help prevent windows compromises. I believe security in depth is an essential element of any good security system. The goal of this document is help new XP users survive long enough to do their updates. Many of them cant/wont put up acls/nat/firewalls ... but if they follow the steps listed they have a better chance of successfully downloading and updating their new machine then they will have with OUT these steps. It is not meant as a complete XP hardening document. There are lots of documents that discuss in detail how to harden windows (xp,nt,2k...). Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Daniel Senie > Sent: Tuesday, May 04, 2004 9:39 AM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: RE: FW: Worms versus Bots > > > > At 10:54 AM 5/4/2004, Sean Donelan wrote: > > >On Tue, 4 May 2004, Smith, Donald wrote: > > > If you follow these steps outlined by SANS you should be able to > > > successfully update and NOT get infected. This is short, > easy, fully > > > documented (with pictures :) > > > http://www.sans.org/rr/papers/index.php?id=1298 > > > >The risk is smaller, but still exists if you follow these directions > >for XP pre-SP2. See the Microsoft release notes for XP SP2 > for details > >about the fix. > > > >If you do not have XP SP2, you need to disconnect your computer from > >the network prior to every boot cycle until it is fully patched. > > A much simpler mechanism than that described by SANS is to > have a small, > cheap NAT box in your bag (e.g. D-Link DI-604 or similar). > Worth the $50 > cost to have one available. Put the little router between the > new machine > to be brought up and whatever network you have access to. Now > you can bring > up the new machine and update it without having it get > instantly infected. > (Use some common sense... don't set up email until the > machine is patched, > or use any other sort of mechanism to pull in potential > viruses before > patching is done). > > (To deflect the inevitable "NAT is not a firewall" > complaints, the box is a > stateful inspection firewall -- as all NAT boxes actually are). > >

1 0

RE: FW: Worms versus Bots
by Smith, Donald 04 May '04

04 May '04

Sean thanks I just reread XP sp2 details and your right sp2 starts the firewall SOONER during boot (like before it starts most network services :-) http://msdn.microsoft.com/security/default.aspx?pull=/library/en-us/dnwx p/html/securityinxpsp2.asp Boot time security. In earlier versions of Windows there is a window of time between when the network stack started and when ICF provided protection. Consequently, a packet could have been received and delivered to a service without ICF filtering it, potentially exposing the computer to vulnerabilities. In SP2, the firewall driver has a static rule called a boot-time policy to perform stateful filtering. This will allow the computer to perform basic networking tasks such as DNS and DHCP and communicate with a Domain Controller to obtain policy. Once the firewall service is running, it will load and apply the run-time ICF policy and remove the boot-time filters. This change should increase system security without affecting applications. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Tuesday, May 04, 2004 8:55 AM > To: Smith, Donald > Cc: nanog(a)merit.edu > Subject: RE: FW: Worms versus Bots > > > On Tue, 4 May 2004, Smith, Donald wrote: > > If you follow these steps outlined by SANS you should be able to > > successfully update and NOT get infected. This is short, > easy, fully > > documented (with pictures :) > > http://www.sans.org/rr/papers/index.php?id=1298 > > The risk is smaller, but still exists if you follow these > directions for XP pre-SP2. See the Microsoft release notes > for XP SP2 for details about the fix. > > If you do not have XP SP2, you need to disconnect your > computer from the network prior to every boot cycle until it > is fully patched. > >

1 0

Worms versus Bots
by Sean Donelan 04 May '04

04 May '04

The antivirus vendors are bemoaning the fact the Sasser worm has been slow to spread. On the other hand, most of the vulnerable computers seem to have already been taken over by one or more Bots days or weeks before the worms arrived. Other than the obvious, don't let a bot on get on your computer in the first place, are there any opinions about the best anti-bot tools for naive computer users? The major virus vendors seem to be having a bit of trouble dealing with bots, frequently recommending manual editing of files and use of regedit. There is also a much longer delay between the apperance of a new bot and updates to antivirus packages.

8 9

RE: Worms versus Bots
by Eric Krichbaum 04 May '04

04 May '04

True, but this isn't just an XP issue. Look at how many ppl are still infected with Code Red/Nimda/Slammer/etc. A Windows 2000 box doesn't fair any better. Heck, I still see Happy99. Eric -----Original Message----- From: Buhrmaster, Gary [mailto:gtb@slac.stanford.edu] Sent: Monday, May 03, 2004 11:28 PM To: Eric Krichbaum; nanog(a)merit.edu Subject: RE: Worms versus Bots Microsoft has said Windows XP SP2 will have the firewall turned on by default, and that they have "considered" reissuing the installation CD's such that a new installation will have the firewall enabled to deal with just this problem. I do not know the current state of the consideration, but to me it seems reasonable that Microsoft should at least make the offer of a new CD (to anyone who has a valid XP license key?) No, many people will not request a new CD, but then many people never apply patches either. I think this is a horse and water problem. Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > Of Eric Krichbaum > Sent: Monday, May 03, 2004 8:13 PM > To: nanog(a)merit.edu > Subject: FW: Worms versus Bots > > > I see times more typically in the 5 - 10 second range to infection. > As a test, I unprotected a machine this morning on a single T1 to get > a sample. 8 seconds. If you can get in 20 minutes of downloads > you're luckier than most. > > Eric > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > Of william(at)elan.net > Sent: Monday, May 03, 2004 11:49 PM > To: Sean Donelan > Cc: Rob Thomas; NANOG > Subject: Re: Worms versus Bots > > > On Mon, 3 May 2004, Sean Donelan wrote: > > > On Mon, 3 May 2004, Rob Thomas wrote: > > > ] Just because a machine has a bot/worm/virus that didn't > come with > > > a ] rootkit, doesn't mean that someone else hasn't had their way > with it. > > > > > > Agreed. > > > > Won't help. What's the first thing people do after > re-installing the > > operating system (still have all the original CDs and keys > and product > > > activation codes and and and)? Connect to the Internet to > download the > > > patches. Time to download patches 60+ minutes. > > Time to infection 5 minutes. > > Its possible its a problem on dialup, but in our ISP office I setup > new win2000 servers and first thing I do is download all the patches. > I've yet to see the server get infected in the 20-30 minutes it takes > to finish it > (Note: I also disable IIS just in case until everything is patched..). > > Similarly when settting up computers for several of my relatives (all > have dsl) I've yet to see any infection before all updates are > installed. > > Additional to that many users have dsl router or similar device and > many such beasts will provide NATed ip block and act like a firewall > not allowing outside servers to actually connect to your home > computer. > On this point it would be really interested to see what percentage of > users actually have these routers and if decreasing speed of > infections by new virus (is there real numbers to show it decreased?) > have anything to do with this rather then people being more carefull > and using antivirus. > > Another option if you're really afraid of infection is to setup proxy > that only allows access to microsoft ip block that contains windows > update servers > > And of course, there is an even BETTER OPTION then all the above - > STOP USING WINDOWS and switch to Linux or Free(Mac)BSD ! :) > > > Patches are Microsoft's > > intellectual property and can not be distributed by anyone without > > Microsoft's permission. > I don't think this is quite true. Microsoft makes available all > patches as indidual .exe files. There are quite many of these updates > and its really a pain to actually get all of them and install updates > manually. > But I've never seen written anywhere that I can not download these > .exe files and distribute it inside your company or to your friends as > needed to fix the problems these patches are designed for. > > > The problem with Bots is they aren't always active. That > makes them > > difficult to find until they do something. > As opposed to what, viruses? > Not at all! Many viruses have period wjhen they are active and > afterwards they go into "sleep" mode and will not active until some > other date! > > Additionally bot that does not immediatly become active is good thing > because of you do weekly or monthly audits (any many do it like that) > you may well find it this way and deal with it at your own time, > rather then all over a sudden being awaken 3am and having to clean up > infected system. > > -- > William Leibzon > Elan Networks > william(a)elan.net > > >

1 0

FW: Worms versus Bots
by Eric Krichbaum 04 May '04

04 May '04

I see times more typically in the 5 - 10 second range to infection. As a test, I unprotected a machine this morning on a single T1 to get a sample. 8 seconds. If you can get in 20 minutes of downloads you're luckier than most. Eric -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of william(at)elan.net Sent: Monday, May 03, 2004 11:49 PM To: Sean Donelan Cc: Rob Thomas; NANOG Subject: Re: Worms versus Bots On Mon, 3 May 2004, Sean Donelan wrote: > On Mon, 3 May 2004, Rob Thomas wrote: > > ] Just because a machine has a bot/worm/virus that didn't come with > > a ] rootkit, doesn't mean that someone else hasn't had their way with it. > > > > Agreed. > > Won't help. What's the first thing people do after re-installing the > operating system (still have all the original CDs and keys and product > activation codes and and and)? Connect to the Internet to download the > patches. Time to download patches 60+ minutes. > Time to infection 5 minutes. Its possible its a problem on dialup, but in our ISP office I setup new win2000 servers and first thing I do is download all the patches. I've yet to see the server get infected in the 20-30 minutes it takes to finish it (Note: I also disable IIS just in case until everything is patched..). Similarly when settting up computers for several of my relatives (all have dsl) I've yet to see any infection before all updates are installed. Additional to that many users have dsl router or similar device and many such beasts will provide NATed ip block and act like a firewall not allowing outside servers to actually connect to your home computer. On this point it would be really interested to see what percentage of users actually have these routers and if decreasing speed of infections by new virus (is there real numbers to show it decreased?) have anything to do with this rather then people being more carefull and using antivirus. Another option if you're really afraid of infection is to setup proxy that only allows access to microsoft ip block that contains windows update servers And of course, there is an even BETTER OPTION then all the above - STOP USING WINDOWS and switch to Linux or Free(Mac)BSD ! :) > Patches are Microsoft's > intellectual property and can not be distributed by anyone without > Microsoft's permission. I don't think this is quite true. Microsoft makes available all patches as indidual .exe files. There are quite many of these updates and its really a pain to actually get all of them and install updates manually. But I've never seen written anywhere that I can not download these .exe files and distribute it inside your company or to your friends as needed to fix the problems these patches are designed for. > The problem with Bots is they aren't always active. That makes them > difficult to find until they do something. As opposed to what, viruses? Not at all! Many viruses have period wjhen they are active and afterwards they go into "sleep" mode and will not active until some other date! Additionally bot that does not immediatly become active is good thing because of you do weekly or monthly audits (any many do it like that) you may well find it this way and deal with it at your own time, rather then all over a sudden being awaken 3am and having to clean up infected system. -- William Leibzon Elan Networks william(a)elan.net

2 1

RE: Worms versus Bots
by Buhrmaster, Gary 04 May '04

04 May '04

Microsoft has said Windows XP SP2 will have the firewall turned on by default, and that they have "considered" reissuing the installation CD's such that a new installation will have the firewall enabled to deal with just this problem. I do not know the current state of the consideration, but to me it seems reasonable that Microsoft should at least make the offer of a new CD (to anyone who has a valid XP license key?) No, many people will not request a new CD, but then many people never apply patches either. I think this is a horse and water problem. Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Eric Krichbaum > Sent: Monday, May 03, 2004 8:13 PM > To: nanog(a)merit.edu > Subject: FW: Worms versus Bots > > > I see times more typically in the 5 - 10 second range to > infection. As > a test, I unprotected a machine this morning on a single T1 to get a > sample. 8 seconds. If you can get in 20 minutes of downloads you're > luckier than most. > > Eric > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of > william(at)elan.net > Sent: Monday, May 03, 2004 11:49 PM > To: Sean Donelan > Cc: Rob Thomas; NANOG > Subject: Re: Worms versus Bots > > > On Mon, 3 May 2004, Sean Donelan wrote: > > > On Mon, 3 May 2004, Rob Thomas wrote: > > > ] Just because a machine has a bot/worm/virus that didn't > come with > > > a ] rootkit, doesn't mean that someone else hasn't had their way > with it. > > > > > > Agreed. > > > > Won't help. What's the first thing people do after > re-installing the > > operating system (still have all the original CDs and keys > and product > > > activation codes and and and)? Connect to the Internet to > download the > > > patches. Time to download patches 60+ minutes. > > Time to infection 5 minutes. > > Its possible its a problem on dialup, but in our ISP office I > setup new > win2000 servers and first thing I do is download all the patches. I've > yet to see the server get infected in the 20-30 minutes it takes to > finish it > (Note: I also disable IIS just in case until everything is > patched..). > > Similarly when settting up computers for several of my relatives (all > have dsl) I've yet to see any infection before all updates are > installed. > > Additional to that many users have dsl router or similar > device and many > such beasts will provide NATed ip block and act like a firewall not > allowing outside servers to actually connect to your home computer. > On this point it would be really interested to see what percentage of > users actually have these routers and if decreasing speed of > infections > by new virus (is there real numbers to show it decreased?) > have anything > to do with this rather then people being more carefull and using > antivirus. > > Another option if you're really afraid of infection is to setup proxy > that only allows access to microsoft ip block that contains windows > update servers > > And of course, there is an even BETTER OPTION then all the > above - STOP > USING WINDOWS and switch to Linux or Free(Mac)BSD ! :) > > > Patches are Microsoft's > > intellectual property and can not be distributed by anyone without > > Microsoft's permission. > I don't think this is quite true. Microsoft makes available > all patches > as indidual .exe files. There are quite many of these updates and its > really a pain to actually get all of them and install updates > manually. > But I've never seen written anywhere that I can not download > these .exe > files and distribute it inside your company or to your > friends as needed > to fix the problems these patches are designed for. > > > The problem with Bots is they aren't always active. That > makes them > > difficult to find until they do something. > As opposed to what, viruses? > Not at all! Many viruses have period wjhen they are active and > afterwards they go into "sleep" mode and will not active until some > other date! > > Additionally bot that does not immediatly become active is good thing > because of you do weekly or monthly audits (any many do it like that) > you may well find it this way and deal with it at your own > time, rather > then all over a sudden being awaken 3am and having to clean > up infected > system. > > -- > William Leibzon > Elan Networks > william(a)elan.net > > >

1 0

Don't forget physical security: Network Card Theft Causes Internet Outage
by Sean Donelan 03 May '04

03 May '04

Network Card Theft Causes Internet Outage May 3, 2004 By Sean Gallagher A handful of corporate customers were left without e-mail and Internet access Monday after the theft of networking equipment from a New York City office late Sunday. Law enforcement officials said four DS-3 cards were reported missing from a Manhattan co-location facility owned by Verizon Communications Inc. The theft at 240 E. 38th St. occurred just after 10:30 p.m. on Sunday and is being investigated by New York City Police and members of the joint terrorism task force, according to NYPD spokesman Lt. Brian Burke. http://www.eweek.com/article2/0,1759,1583359,00.asp

1 0

Re: Infrastructure Mapping Project Website
by sgorman1＠gmu.edu 03 May '04

03 May '04

Yup - on April 20th I passed my defense and I'll be walking May 15th. The committee agreed the dissertation was worth while, that is just four people, but I ain't complaining. "Now Supposedly" Dr. Gorman ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Monday, May 3, 2004 1:55 pm Subject: Re: Infrastructure Mapping Project Website > On Mon, 3 May 2004 sgorman1(a)gmu.edu wrote: > > If the work looks helpful to > > anyone or if you have an feedback please pass it along. > > But what everyone wants to know: Did the school finally decide to > awardyou a degree for your work? > > >

1 0