- NANOG - lists.nanog.org

RE: dealing with w32/bagle
by Mike Damm 03 Mar '04

03 Mar '04

> We created bogus DNS entries for the following entries, known to be targeted by the worm: > www.sportscheck.de > www.songtext.net > www.songtext.de > www.maiklibis.de > www.gfotxt.net > postertog.de > permail.uni-muenster.de For what its worth ns{1,2,3,4}.everydns.net will answer for the wormy domains with 127.0.0.1 to help mitigate phone-home traffic. I just registered gfotxt.net (some appear to be registered while others are not) with the proper name servers and it should be visible worldwide along the normal timeline. Parties with control over the other mentioned domains or end user resolution are more than welcome to point them our way. We'll be generating some statistical data on DNS traffic and summarizing for anyone interested. -Mike

1 0

UUNet Offer New Protection Against DDoS
by John Obi 03 Mar '04

03 Mar '04

Hello Nanogers! I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do the same! MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwart and defend against Internet viruses and threats. http://informationweek.securitypipeline.com/news/18201396 It's the right time before it's too late! Regards, -J --------------------------------- Do you Yahoo!? Yahoo! Search - Find what you�re looking for faster.

10 13

Re: dealing with w32/bagle
by Brent_OKeeffe＠asc.aon.com 03 Mar '04

03 Mar '04

We created bogus DNS entries for the following entries, known to be targeted by the worm: www.sportscheck.de www.songtext.net www.songtext.de www.maiklibis.de www.gfotxt.net postertog.de permail.uni-muenster.de The entries directed traffic to an interface on a router that can handle the traffic. Currently, we have a logging ACL that drops port 80 to the bogus IP. We might connect a sniffer with that IP address at some point with triggers loaded to notify when systems attempt to access the address. So far this has helped. Any other suggestions are welcome. Brent Dan Hollis <goemon(a)anime.net> Sent by: owner-nanog(a)merit.edu 03/03/2004 03:24 PM To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> cc: Subject: dealing with w32/bagle I am curious how network operators are dealing with the latest w32/bagle variants which seem particularly evil. Also, does anyone have tools for regexp and purging these mails from unix mailbox (not maildir) mailspool files? Eg purging these mails after the fact if they were delivered to user's mailboxes before your virus scanner got a database update. -Dan

1 0

Re: dealing with w32/bagle
by W.D.McKinney 03 Mar '04

03 Mar '04

>-----Original Message----- >From: Dan Hollis [mailto:goemon@anime.net] >Sent: Wednesday, March 3, 2004 08:24 PM >To: 'nanog(a)merit.edu' >Subject: dealing with w32/bagle > > >I am curious how network operators are dealing with the latest w32/bagle >variants which seem particularly evil. > >Also, does anyone have tools for regexp and purging these mails from unix >mailbox (not maildir) mailspool files? Eg purging these mails after the >fact if they were delivered to user's mailboxes before your virus scanner >got a database update. > >-Dan > > Simply put, I run a Barracuda Networks box so I don't worry. Dee

1 0

Contact from (what used to be) CAIS (AS 3491).
by John Palmer 03 Mar '04

03 Mar '04

Could someone from whoever owns CAIS Internet (AS3491) please contact me offlist? One of your customers has a machine that is making a lame attempt at a DDOS attack. Although ineffectual, it is causing a slight uptick in bandwidth usage and we need to get this stopped before I take it to your upstream. Thanks John P. American Webmasters, Inc.

1 0

How much do worms and virus cost ISPs?
by Sean Donelan 03 Mar '04

03 Mar '04

Of course, I'm certain Sandvine is selling something to solve the problem, but it is still a very nice article with some measurable numbers. http://www.globeandmail.com/servlet/story/RTGAM.20040303.gtsandmar2/BNStory… "On any given day," its white paper concluded, "between 2 and 12 per cent of all Internet traffic moving across service provider networks is malicious. Even on well-run networks with dedicated security departments, malicious traffic constitutes, on average, 5 per cent of all data throughput." Service provider with about 100,000 subscribers will lose almost $60,000 in avoidable fees. A provider with one million subscribers will pay an additional $350,000.

1 0

Re: Warning - new trend of attempts to infect ISP users (possibly virus)
by Kevin Oberman 03 Mar '04

03 Mar '04

> Date: Wed, 3 Mar 2004 16:15:39 +0000 (GMT) > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > Sender: owner-nanog(a)merit.edu > > > > > Erm is it me or are the writers of Bagle and Netsky determined to keep morphing > > > their code to outwit the virus scanners.. is this a new trend in virus writing - > > > beat the systems by evolving your code quicker than the security firms can > > > release updates? > > > > new trend in that it started only a decade ago? > > Perhaps I'm only following this as its affecting us more, but I dont recall a > time previously when I've had so many viruses hitting us and getting thro our > scanners with nothing we can do about it. I dont recall seeing viruses with > variants as high as 'j' before, especially in the relatively short time since > the previous variants were out > > Seriously, drop some references if I'm off-track.. its just my perception and > I'm not an expert at all with viruses... They are getting batter at it, but the WANK worm (1989) used self-modifying code so that no two replicas were the same. (Note: This worm only infected VMS systems running on the global DECNET internet, mostly DOE, NASA, and DEC corporate systems.) -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0

Looking for bandwidth around Penn Station NYC
by Paul Wouters 03 Mar '04

03 Mar '04

Hi guys, Is there anyone with a fiber drop or something around Penn Station in NYC? Or some non T-Mobile wireless presence? We're trying to get some bandwidth in the Pennsylvania Hotel in july, and I had hoped to do this through T-Mobile's wireless, but that doesn't seem to be an option they're willing to offer. Paul

1 0

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 03 Mar '04

03 Mar '04

Hi John, While the formalities of the C&W acquisition have yet to kick in, I have no reason to believe that anything will change here: Savvis pioneered the 15 minute response time for DoS issues - whether or not it's our customer calling in. If it involves Savvis customers in any way, we will have the oncall security person on the phone and working the issue in less than 15 minutes - *always* (usual times are closer to 3 minutes because of the oncall cell phone). //Alif Alif Terranson OpSec Engineering Manager Operations Security Department Savvis Communications Corporation (314) 628-7602 Voice (314) 208-2306 Pager (618) 558-5854 Cell -----Original Message----- From: John Obi [mailto:dalnetuzer@yahoo.com] Sent: Wednesday, March 03, 2004 1:21 AM To: nanog(a)merit.edu Subject: UUNet Offer New Protection Against DDoS Hello Nanogers! I'm happy to see this, and I hope C&W, Verio, and Level3 ..etc will do the same! MCI/WorldCom Monday unveiled a new service level agreement (SLA) to help IP services customers thwart and defend against Internet viruses and threats. http://informationweek.securitypipeline.com/news/18201396 It's the right time before it's too late! Regards, -J Do you Yahoo!? Yahoo! Search - Find what youre looking for faster.

1 0

RE: UUNet Offer New Protection Against DDoS
by Douglas.Dever＠alltel.com 03 Mar '04

03 Mar '04

From: On Behalf Of John Obi Sent: Wednesday, March 03, 2004 2:21 AM > MCI/WorldCom Monday unveiled a new service level agreement (SLA) At the risk of sounding thoroughly underwhelmed... Uhm, where's the beef? All I see is the opportunity to get a service credit should one complain loud enough after a DoS attack. Maybe I'm missing something here, but I doubt it. I've never seen an SLA that guarantees 5 9's of reliability keep a T1 from going down - but the paper it was written on was nice... somewhat soft, and you didn't have to worry about your finger poking through it. -- Douglas A. Dever ACI/IT Network Services ALLTEL Communications Inc. 330.963.1720 ****************************************************************************************** The information contained in this message, including attachments, may contain privileged or confidential information that is intended to be delivered only to the person identified above. If you are not the intended recipient, or the person responsible for delivering this message to the intended recipient, ALLTEL requests that you immediately notify the sender and asks that you do not read the message or its attachments, and that you delete them without copying or sending them to anyone else.

1 0