- NANOG - lists.nanog.org

RE: Qwest bgp communities
by Williams, Ken 10 Oct '03

10 Oct '03

http://stat.qwest.net/looking_glass.html -----Original Message----- From: Haesu [mailto:haesu@towardex.com] Sent: Thursday, October 09, 2003 5:39 PM To: nanog(a)merit.edu Subject: Qwest bgp communities Hi, Anyone here know if Qwest operates a route server like GBLX, HE, ATT, that also shows AS209's communities? It would be useful for some bgp troubleshooting.. There is one peer in route-views.oregon-ix.net that shows 209 routes, but unfortunately, that particular peer strips off all 209's communities. I am trying to troubleshoot a problem where 209:70 set on a prefix doesn't seem to work/propagate, etc et al. Or does anyone know of any route-servers run by a Qwest customer/peer that receives communities? I know that http://stat.qwest.net has looking glass but it doesn't let you run any bgp commands; just ping and traceroute :-( If you can assist, please reply to me off-list. Thank you very much for your time, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

1 0

Qwest bgp communities
by Haesu 10 Oct '03

10 Oct '03

Hi, Anyone here know if Qwest operates a route server like GBLX, HE, ATT, that also shows AS209's communities? It would be useful for some bgp troubleshooting.. There is one peer in route-views.oregon-ix.net that shows 209 routes, but unfortunately, that particular peer strips off all 209's communities. I am trying to troubleshoot a problem where 209:70 set on a prefix doesn't seem to work/propagate, etc et al. Or does anyone know of any route-servers run by a Qwest customer/peer that receives communities? I know that http://stat.qwest.net has looking glass but it doesn't let you run any bgp commands; just ping and traceroute :-( If you can assist, please reply to me off-list. Thank you very much for your time, -hc -- Haesu C. TowardEX Technologies, Inc. Consulting, colocation, web hosting, network design and implementation http://www.towardex.com | haesu(a)towardex.com Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 Fax: (978)263-0033 | POC: HAESU-ARIN

1 0

RE: Wired mag article on spammers playing traceroute games with trojaned boxes
by Mike Damm 09 Oct '03

09 Oct '03

Actually, running a web server on 8290 isn't as easy as 80. SpamAssassin tests (WEIRD_PORT) for this, as do many other filtering packages. Forcing spammers to use non-standard ports will greatly increase their rate of detection, and in turn help to solve the spam problem. -Mike -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Thursday, October 09, 2003 9:56 AM To: Joe Boyce Cc: nanog(a)merit.edu Subject: Re: Wired mag article on spammers playing traceroute games with trojaned boxes On Thu, 9 Oct 2003, Joe Boyce wrote: > VA> Personally, I think preventing residential broadband customers from hosting > VA> servers would limit a lot of that. I'm not saying that IS the solution. > > It's not like those customers are aware they are hosting servers, they > most likely were exploited and are now unaware they are hosting > websites. That's obviously the case. No spammer has "thousands" of legitimately purchased DSL/Cable connections. The article pretty clearly says they're exploiting insecure windows (isn't that redundant?) boxes. Trouble is, how do you stop this? Just blocking common ports like 80 by default (unless the customer plans to actually run a web server and asks for the filter to be removed) won't work. The spammers can just as easily spam with urls containing ports (http://blah.biz:8290/) if they find 80 is filtered or find that filtering has become common. So other than waiting some infinitely long time for a secure out of the box version of windows (and for everyone to upgrade), how do you stop this? Widespread deployment of reflexive access lists? Force all broadband customers to use NAT and let them forward ports or entire IPs to their private IP servers if they have any? Wait for the legal system to catch and prosecute a few people who do this and deter others from trying it? Convince registrars to kill domains that are clearly being used by thieves? ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

3 2

RE: Wired mag article on spammers playing traceroute games with trojaned boxes
by McBurnett, Jim 09 Oct '03

09 Oct '03

-> ->I found one of these today, as a matter of fact. The spam was ->advertising an anti-spam package, of course. -> ->The domain name is vano-soft.biz, and looking up the address, I get -> ->Name: vano-soft.biz ->Addresses: 12.252.185.129, 131.220.108.232, 165.166.182.168, ->193.165.6.97 -> 12.229.122.9 -> ->A few minutes later, or from a different nameserver, I get -> ->Name: vano-soft.biz ->Addresses: 131.220.108.232, 165.166.182.168, 193.165.6.97, ->12.229.122.9 -> 12.252.185.129 -> ->This is a real Hydra. If everyone on the list looked up ->vano-soft.biz ->and removed the trojaned boxes, would we be able to kill it? -> ->--Chris I got : Canonical name: vano-soft.biz Addresses: 165.166.182.168 193.92.62.42 200.80.137.157 12.229.122.9 12.252.185.129 I think even if we get all the ones for this domain name today, assuming we can muster even man hours to get it today, another 5000 will be added tomarrow. And looking at my list We have US(a very small ISP and a large ISP) RIPE, and LACNIC. I wonder if the better question should be: Can Broadband ISP's require a Linksys, dlink or other broadband router without too many problems? That is what it will take to slow this down, and then only if ALL of ISP's do it. This not only affects this instance but global security as a whole. Just a few days ago, Cisco was taken offline by a large # of Zombies, I am willing to say that those are potentially some of the same compromised systems. Thoughts? Jim

12 13

Re: Wired mag article on spammers playing traceroute gameswith trojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>Actually, in the case of the wired article (removeform.com) it seems to be >connected to a site in Florida. I asked my programmer (gabor(a)sentex.net) >to decode the obfuscated java script/page that is served up by one of the >zombies (On FreeBSD fetch -B 18192 -o danger.html >http://www.removeform.com/d - I got it from 207.5.215.72 at the time). I >have attached it as a zip file with its contents. You will note that the >form post goes back to > >form action="http://207.36.47.68/cgi-bin/addinfo.cgi" > > >OrgName: CyberGate, Inc. >OrgID: CYBG >Address: 3250 W. Commercial Blvd. Suite 200 >City: Ft. Lauderdale >StateProv: FL >PostalCode: 33309 >Country: US This appears to be a rather prolific spammer. At first I thought they were affiliated with www.skynetweb.com because they have the same address, including suite number, but it now appears that they are really affiliated with these guys: http://www.affinity.com/about/our_team/our_team.htm John --

4 3

RE: contact at yahoo mail? (they think we're an open relay :< )
by Mark Jeftovic 09 Oct '03

09 Oct '03

We are listed in no-more-funn.moensted.dk as 127.0.0.2 which is described as: + NERD-CA ip-space assigned to Canada: ca.countries.nerd.dk -> 127.0.0.2 216.220.40/24 is in ca, rejected based on geographical location about: Please see our webpage for more information about: This zone lists ONLY based on geographic information about: The zone does NOT contain known spammers, nor open relays We do cop to being Canadian, but that's about it. I hope yahoo isn't keying on this RBL. -mark ...and we've already filled out the retest form at Yahoo. On Thu, 9 Oct 2003, Thor Larholm wrote: > If you read through all of that page, you will notice that Yahoo itself > has a re-test script you can use to trigger a verification. > > http://add.yahoo.com/fast/help/us/mail/cgi_retest > > Yahoo is not your only problem, if you look at > http://moensted.dk/spam/?addr=216.220.40.247 you will notice that > several DNSBL lists that IP address. No-more-fun believes it to be a > "Direct spam source" and ArixDictStale says it has performed active > dictionary attacks within the last 3 months. > > If you want to positively check whether you are an open relay, I would > recommend testing through ORDB at http://ordb.org/submit/ > > > Regards > Thor Larholm > PivX Solutions, LLC - Senior Security Researcher > > -----Original Message----- > From: Mark Jeftovic [mailto:markjr@easydns.com] > Sent: Thursday, October 09, 2003 1:23 PM > To: nanog(a)merit.org > Subject: contact at yahoo mail? (they think we're an open relay :< ) > > > > > Today our email forwarders started getting this from yahoo.com mail > handlers: > > 553 Mail from 216.220.40.247 not allowed - VS99-IP1 deferred - see > help.yahoo.com/help/us/mail/defer/defer-02.html (#5.7.1) Connection > closed by foreign host. > > Which when you go look at that page basically tells you you're probably > an open relay (which we're not), etc. > > Can any mail admins at Yahoo contact me offlist, or post what the > restrictions are or at what levels this will kick in? > > -mark > > -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

2 1

Need contact at Everyone Internet
by Mike Batchelor 09 Oct '03

09 Oct '03

I am seeking a contact at Everyone Internet (EV1.NET) who can address a routing problem at EV1's borders that is causing our users to be unable to reach many popular sites hosted there, or that have DNS servers there. We've tried contacting them by telephone, only to be referred to noc(a)ev1.net. We have sent mail there from outside our network, but have received no response. If someone from Everyone Internet is reading this, I would very much appreciate a response. If you cannot get email to me, please call at 213-739-5173. Or if you know how to reach someone at the EV1 NOC for problems of this sort, I'd appreciate that as well. Thank you. --- "The avalanche has already begun. It is too late for the pebbles to vote." -- Kosh

1 0

Fw: Broadband World Forum Conference Proceedings
by Alan Spicer 09 Oct '03

09 Oct '03

IEC Broadband World Forum Proceedings CD-ROM --- Alan Spicer (a_spicerNOSPAM(a)bellsouth.net) http://aspicer.homelinux.net/ Systems and Network Administration, and Telecommunications (954) 977-5245 ----- Original Message ----- From: Julie Brandt To: a_spicer(a)bellsouth.net Sent: Thursday, October 09, 2003 11:04 AM Subject: Broadband World Forum Conference Proceedings The Broadband World Forum 2003 combined high-level educational programming with high-impact exhibits to explore the range of business strategies and technology alternatives available to today's decision-makers in building tomorrow's next-generation broadband networks. With more than 100 speakers, the World Forum 2003 provided its educational conference attendees with current and in-depth information on the status of the broadband industry. The educational sessions featured discussions of today's most critical issues, including broadband rollout, mobility applications, DSL advances, FTTx, emerging wireless technologies, the status of the global marketplace, and much more. If you were unable to attend the World Forum in London, you can still benefit from the insight and expertise of the industry leaders who presented within the educational program. See below for your IEC Web Registrant Discount on the CD-ROM proceedings of the Broadband World Forum 2003. This CD-ROM contains comprehensive information on the latest technology advancements and current market trends from the thought leaders who are guiding today's global broadband industry. Topics covered include: a.. xDSL b.. Optical access c.. Metro-area networks d.. Gigabit Ethernet topologies e.. 802.11x, 802.16, and 3G wireless f.. Satellite last-mile access solutions g.. High-speed mobile Internet h.. Emerging broadband architectures i.. Revenue-driving applications, services, and content delivery A few of the featured presentations featured in this Proceedings CD-ROM include: a.. Gilles Coullon, Chief Technical Officer, France Telecom b.. Bernard Delvaux, Executive Vice President, Belgacom c.. Yves Goblet, Deputy Chief Executive Officer, Bouygues Telecom d.. Leif Aarthun Ims, Vice President, Telenor e.. Roland Kittel, Member of the Board of Management, Deutsche Telekom AG f.. Stefano Pileri, President, Telecom Italia g.. Krish Prabhu, Vice Chairman of the Board of Directors, ECI Telecom h.. Mario Mella, Network Planning Director, Fastweb i.. Rupert Gavin, Chief Executive, BBC Worldwide j.. Jean-Claude Vandenbosch, President, Belgacom Wireline k.. Jong-Lok Yoon, Executive Vice President, KT l.. Manuel Echánove Pasquin, General Manager, Telefónica de España m.. Pinny Chaviv, President and CEO, Inovia Broadband Access Division, ECI Telecom n.. David Cleevely, Chairman, Analysys Group o.. Joe Crupi, Vice President-Broadband Communications, Texas Instruments p.. Rupert Gavin, Chief Executive, BBC Worldwide q.. Anders Gustafsson, President, Tellabs International r.. Martin Harriman, Chief Marketing Officer, Marconi s.. Markku Hynninen, Vice President-Broadband Systems Division, Nokia Networks t.. Adam Joffe, Vice President of Information Technology and Chief Technology Officer, Sony Online Entertainment u.. Hack Kim, Executive Vice President, R&D Center, Samsung v.. Krish Prabhu, Vice-Chairman of the Board of Directors, ECI Telecom w.. Michel Rahier, President, Fixed Networks Division, and Chief Operating Officer, Fixed Communications Group, Alcatel x.. Anton Schaaf, Member of the Group Executive Management, Siemens ICN y.. Mike Short, Vice President, O2, and Chairman - Mobile Data Association z.. Hiroaki (Harry) Takeichi, Corporate Vice President and Group President, Network Systems Group, Fujitsu aa.. Christian Wolff, Vice President & General Manager, Infineon Technologies Don't miss this limited opportunity to learn from this impressive lineup of business leaders and technology innovators who are driving the broadband industry. Order your Broadband World Forum 2003 proceedings CD-ROM today for $295.00 ($495.00 retail). To receive this exclusive IEC Web Registrant Discount for your organization, simply reply "yes" to this e-mail or call Julie Brandt, IEC Publications Manager, at +1-312-559-3730. For a complete table of contents of the Broadband World Forum Proceedings CD-ROM visit http://www.iec.org/pubs/proceedings/2003/bbwf_2003_toc.html, call +1-312-559-3730, or e-mail the IEC Publications Department at publications(a)iec.org. -------------------------------------------------------------------------- The International Engineering Consortium periodically sends e-mails to constituents and other professionals in the communications industry announcing new research reports, upcoming seminars, and or other IEC initiatives. If you would prefer not to receive further e-mail messages from the IEC, click here. Please email any comments to support(a)iec.org

1 0

Re: Wired mag article on spammers playing traceroute gameswith trojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>>>> Michael Airhart <mairhart(a)cisco.com> 10/9/03 1:57:06 PM >>> > >How many times have you received SPAM selling a product from a U.S. based >company? I have received plenty.... follow the money.... Hank has it right. > >M >(speaking only for myself) Well, Cisco has a sales office in the same building as CyberGate/Affinity/Skywebnet. Can you send a few of your people over to suite 200 and see if you can take care of that problem for us? :-) John --

1 0

Re: Sitefinder and DDoS
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

> > Let's also assume someone sets up a popular webpage with malware >> HTML causing it, perhaps with a time delay, to issue rapid GETs to >> deliberately nonexistent domains. > >You don't even have to imagine that. > >Imagine a long-term port 80 Denial of Service (DoS) attack against a >given website (using the website url rather than IP, which is not >uncommon). > >Imagine the attacked domain administrator removes their DNS records >from the registry to alleviate the attack. > >The attack is now directed at the Verisign Sitefinder service. > > Adam OUCH. Yet worse.

2 1