- NANOG - lists.nanog.org

Re: new nasty email virus trick to bypass scanners
by Damian Gerow 04 Dec '03

04 Dec '03

On Wed, 3 Dec 2003, Steven M. Bellovin wrote: > Is this in the wild yet? Any other details worth looking for? > Symantec's AV site apparently has nothing on it. I would say so - I got it in my inbox earlier this afternoon, and I traditionally get about three viruses a month. The virus itself is *exactly* like Mmimail.M, as reported by Symantec. Except that wendy.zip was definitely password protected. - Damian

2 1

new nasty email virus trick to bypass scanners
by Mike Tancsa 04 Dec '03

04 Dec '03

OK, here is a nasty virus trick. The message gets sent in a password protected zip file. The text of the messages says here are my pics and enter in the passwd xxxx to view the archive. The big problem is that normal avscanners cannot open the zip file to scan the contents since it is password protected. However, the user can be easily socially engineered to open the file and blam. The text of the message is nice and enticing making it look like private email with dirty pictures accidentally sent to the user... ---Mike -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

2 1

Re: new nasty email virus trick to bypass scanners
by J. Oquendoy 04 Dec '03

04 Dec '03

> However, the user can be easily socially engineered to open the file and > blam. The text of the message is nice and enticing making it look like > private email with dirty pictures accidentally sent to the user... <opinion> Someone should create some form of standard 'README' document for the layperson using the internet in regards to viruses, maybe template it and send it to ISP's, so when new users sign up, they'll have a `slight' clue as to why they're now getting those "RPC WARNING YOUR COMPUTER WILL SHUT DOWN IN 60 SECOND" messages. Then again many people wouldn't read it, unless of course an ISP stated something silly to the extent that 'You will be held responsible* * *", of which would be a horrible policy. It would be a nice thing for both the user, and the network engineers/admins to have something in place to minizmize the reach of viruses and trojans. Hell it would have been nice for MS to invest in creating safer products as opposed to paying `bounty hunters'. </opinion> =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "I watch gangster flicks and root for the bad guy and turn it off before it ends because the bad guy dies" 50 Cents - 'Assassins' This is a farce confidential disclaimer intended to make you aware that even though this may be priveledged information, being it will become Google cache in the future, my original intentions of keeping this message restricted and/or private are thrown out the door. If you have received this e-mail in error, please enjoy this signature and destroy this message by dousing it in gasoline.

2 1

Re: Does any know where the link is for
by Richard Irving 04 Dec '03

04 Dec '03

John Starta wrote: > If you locate this, please forward the link along. I haven't found the original, it was dated about 97-99... NLANR, perhaps ???? But, there are more recent write ups... Here are two I encountered: <http://www.inetdaemon.com/tools/ping_is_not.html> This one explains why PING -may- be bad, but regular performance, OK... (Call it the end user explanation of ACL-CAR intervention) :) And this one,( more what I was looking for..) a detailed explanation of the caveats of clever tracerouting providing Bogus Data. <http://homepage.ntlworld.com/robin.d.h.walker/cmtips/traceroute.html> I needed something for a rookie tech who was "whining" about a site tracerouting with an intervening router - appearing - slow (An exchange BGP router, go figure), but an end to end of -38 ms-, -consistent- and with -no- loss. He didn't believe the explanation of the BGP rumble... and I was growing frustrated with the need for detail, when it just wasn't registering ! :( "When the Judge is a blind man, it can be -exasperating- trying defend your choice of the Winner of the Art fair." :P

1 1

Does any know where the link is for
by Richard Irving 04 Dec '03

04 Dec '03

I seem to recall someone doing a paper on ICMP and traceroute -at times-, as not always being indicative of actual network performance... Does anyone remember who, or where, that link is ? Thanks in Advance. :)

1 0

MTU path discovery and IPSec
by jgraun＠comcast.net 03 Dec '03

03 Dec '03

Two questions: 1) I assume MTU path discovery has to been in enabled on each router in the path in order for it work correctly?! 2) Anybody use this to solve application issues over an IPSec tunnel to due to large of a frame? any help would be great Thanks

4 4

Re: AOL rejecting mail from IP's w/o reverse DNS?
by Dave Temkin 03 Dec '03

03 Dec '03

You mean like Level3? -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Steven M. Bellovin Sent: Wednesday, December 03, 2003 2:27 PM To: Matthew Crocker Cc: Christopher X. Candreva; nanog(a)nanog.org Subject: Re: AOL rejecting mail from IP's w/o reverse DNS ? In message <01D22399-25C5-11D8-940C-000A956885D4(a)crocker.com>, Matthew Crocker >> > >AOL says the PTR record needs to be assigned. It doesn't specify it >has to match the @domain.com in the MAIL FROM: header. Wouldn't it be >enough to make sure every IP address you announce has a PTR and >matching A record? Hasn't this been a requirement for MANY services >for MANY years? Right -- and then folks will start creating wildcard PTR records... --Steve Bellovin, http://www.research.att.com/~smb -- David Temkin

2 1

Re: AOL rejecting mail from IP's w/o reverse DNS ?
by Michael.Dillon＠radianz.com 03 Dec '03

03 Dec '03

>What about speaking plain old smtp, but with transport / mailertable >rules routing all mail for domain X (say AOL or MSN) to "special >access" servers that have firewall ACLs allowing only connections from a >restricted set of IPs? If it's behind a firewall, then it's not on the Internet. Since NIMTP is a proposal for improving Internet email, then I think a new port number is in order. However, anyone is free to implement NIMTP peering by using a firewall to redirect new-port-number traffic to port 25 on some existing mail servers if that suits their purposes. NIMTP is lightweight technically, i.e. no new code needed, just reconfigure things a bit. The real solution resides in the agreements and the AUP that they will enforce and that has to be hashed out by the people who run mail services at the large ISPs. Not by the BGP peering folks and not by the IETF and not by the anti-spammer brigade. --Michael Dillon

1 0

RE: AOL rejecting mail from IP's w/o reverse DNS ?
by Jeffrey Paul 03 Dec '03

03 Dec '03

Perhaps I'm being naïve, but this seems like a very good way to cause spammers to suddenly start having valid PTR RRs. Thoughts? -j -- Jeffrey Paul - jeffreypaul(a)diamondcard.com - (877) 748-3467 Senior Network Administrator, Diamond Financial Products

3 2

Re: AOL rejecting mail from IP's w/o reverse DNS ?
by Greg Maxwell 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 Michael.Dillon(a)radianz.com wrote: [snip] > Peering relationships work for BGP (lots of rules) and they worked > for USENET (not many rules). Why can't the same principles be applied > to email or IM services? Where is NickC when you need him... this sounds like something out of his layer4 nap idea... Seriously, do we really need SMTP peering agreements? I don't know of too many places that are UUCPing their email... SMTP traffic already crosses (BGP) peering agreement controlled links. If putting contractional obligations there fails to work why should we believe some new and less understood system would be any more effective?

2 1