- NANOG - lists.nanog.org

Re: Fun new policy at AOL
by Susan Zeigler 28 Aug '03

28 Aug '03

Bob Bradlee wrote: > > Road-Runner pulled the same stunt with a chain of radio stations > I have as clients. We went ON-AIR with a NEWS story, and > recomended that everyone effected should call Roadrunner > or AOL. AOL contacted me, verified the problem, and had my > IP's whitelisted in a matter of hours. Both SBC and WOW were happy > to sign up the few that switched before AOL woke up. > > Good luck, I hope for your sake that your national association > has a national name and is ready to black list AOL in their > news letter for this. > > We dont care, we dont have to, were AOL > > Back to lurking... > > Bob > > ps: I dont think I have posting rights, or I would have sent this to the list, > back when it happened. I am sure there are a lot of people out there > who dont know they are Blacklisted by AOL/Timewarner yet. > Thanks Bob!!! Someone else has sent me the right phone number and I'm working on that. I'm forwarding this to the list as well so others can see we're not alone:) -- -- -- -Susan -- Susan Zeigler | Technical Services szeigler(a)spindustry.com | Spindustry Systems 515.225.0920 | "You cannot strengthen the weak by weakening the strong." -- Abraham Lincoln **************************************************************** Spindustry Systems, Inc. DES MOINES / CHICAGO / INDIANAPOLIS / DENVER CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message including any attachments.

1 0

London Power outage
by David Diaz 28 Aug '03

28 Aug '03

Can anyone in London provide details on the outage... are any colos on generator? dave

3 2

Re: Sobig.f surprise attack today
by Owen DeLong 28 Aug '03

28 Aug '03

OK.. Seems to me that under the circumstances, since they're willing to disconnect that host from the internet (any rational ISP would be), that replacing it with a /32 route to a honeypot created by the ISP would not be that difficult. Sure, it's unlikely that 100% of the ISPs could do it in the time required, but, even if you gust got the top 3 or so on the worm's hit list, it would have a significant impact. If you got 10, then the surprise would be no more than 50% effective. Sure, it won't happen in 30 minutes, but, I don't understand why this wasn't started when F-Secure first noticed the situation. Owen --On Friday, August 22, 2003 1:39 PM -0500 "Beprojects.com" <info(a)beprojects.com> wrote: > So who's going to do that? There are 20 machines on 20 different networks > covering the US, Canada and parts of Asia (from what I've read). Each > network would have to contact the individual user and ask permission to > put a honeypot on their IP and that's not going to happen in the next 30 > minutes. > > ----- Original Message ----- > From: "Owen DeLong" <owen(a)delong.com> > To: <jdawson(a)flexpop.net>; <nanog(a)merit.edu>; <Jaana.Sirkia(a)f-secure.com> > Sent: Friday, August 22, 2003 1:27 PM > Subject: Re: Sobig.f surprise attack today > > >> >> OK... Maybe I'm smoking crack here, but, if they have the list of 20 >> machines, >> wouldn't it make more sense to replace them with honey-pots that download >> code to remove SOBIG instead of just disabling them? >> >> Let's use the virus against itself. At this point, I think that's a >> legitimate >> countermeasure. >> >> Owen >> >> >> --On Friday, August 22, 2003 11:01 AM -0700 Jim Dawson <jdawson(a)navi.net> >> wrote: >> >> > >> > F-Secure Corporation is warning about a new level of attack to be >> > unleashed by the Sobig.F worm today. Supposed to take place at 1900 >> > UTC. >> > >> > http://www.f-secure.com/news/items/news_2003082200.shtml >> > >> > Jim >> > -- >> > >> > See what ISP-Planet is saying about us! >> > http://isp-planet.com/services/wholesalers/flexpop.html >> > __________________________________________________________________ >> > Jim Dawson jdawson(a)flexpop.net >> > Flexpop/Navi.Net http://www.flexpop.net >> > 618 NW Glisan St. Ste. 101 v. +1.503.517.8866 >> > Portland, Or 97209 USA f. +1.503.517.8868 >> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> > >> >> >> >

7 10

Re: Re[2]: relays.osirusoft.com
by George William Herbert 28 Aug '03

28 Aug '03

Paul wrote: >this part, on the other hand... > >> he's put >> *.*.*.* in, he's asking people not to use it anymore. > >...mystifies me. anyone who has read rfc1034 or rfc1035, even >if they did not also read rfc2181 or rfc2136 or rfc2308, knows >that in a zone containing the following wildcardish data: > > $ORIGIN example.vix.com. > * 1H IN A 127.0.0.1 > *.* 1H IN A 127.0.0.2 > *.*.* 1H IN A 127.0.0.3 > *.*.*.* 1H IN A 127.0.0.4 > >the result will be that only the top one will match: I must hope and pray that nobody on NANOG would be foolish enough to load narrative prose mailed to the list into their BIND configurations ;-) BGP, now, feel free to do that all you want. -george william herbert gherbert(a)retro.com

1 0

Re: Fun new policy at AOL
by Johnny Eriksson 28 Aug '03

28 Aug '03

Matthew Crocker <matthew(a)crocker.com> wrote: > Technically no, There is no reason for a customer to have direct > access to the net so long as the ISP can provide appropriate proxies > for the services required. Good idea. I'll start working on the SSH proxy tomorrow. > -Matt --Johnny

1 0

RE: Fun new policy at AOL
by Michel Py 28 Aug '03

28 Aug '03

> Matthew Crocker wrote: > Shouldn't customers that purchase IP services from an ISP > use the ISPs mail server as a smart host for outbound mail? Trouble is with some ISPs you get more rejections when using their mail servers than when havong your own, not to mention theirs eating some email from no reason, having limits in attachment size, you can't have a mailing list that way, etc. Michel.

6 5

XO as a provider
by Bil Herd 28 Aug '03

28 Aug '03

Anyone have positive or negative experiences with XO as a 'tier1' provider? We are re-evaluating our backbone connections and looking for new where appropriate. Bil Herd - INS

2 1

Re: Fun new policy at AOL
by Simon Waters 28 Aug '03

28 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Demon announcement was interesting to me as a subscriber. Historically Demon allocated static IP addresses to (nearly) all dial up users. For many businesses this was a cheap and effective way to have their own email servers running. For those of us running businesses (from home) in areas without ADSL, it is still convenient, although suddenly looks a lot less good value for money. I understand AOL have asked Demon for a list of all legitimate sources of SMTP traffic. Seems AOL intend to maintain a whitelist of senders, where as historically I was led to believe they maintained their own blacklist. The policy is flawed, as maintaining a straight list of legitimate senders is a huge task. They have already failed at maintaining accurate blacklists, and accurate lists of dynamic IP address ranges, so I don't see why this one will work better. I can't believe the effort wouldn't be better spent on some easier task (like replacing SMTP! or agreeing reverse DNS entries to indicate legitimate mail senders (or entries to flag dynamic IP addresses - probably easier to implement) which stops virus and spam email (sent without the DNS maintainers knowledge) - obviously should be called an XM record). I understand the issues with dynamic IP addresses, but where an IP address is readily traceable, blacklisting, not whitelisting seems the obvious answer. End users do have a various legitimate reasons for wanting to send SMTP mail from their own static IP addresses. Not least for Demon it has been more reliable, their own servers often being overworked through mailing lists, viruses and spam. Also the SMTP relays often ended up in various blacklists because they were relaying spam from one of the many thousands of subscribers. Being forced to use the ISP SMTP relay merely means more multistage relays, and big ISP SMTP servers relay spam much more efficiently than their subscribers boxes on the end of narrow pipes, and worse you can't blacklist the big ISPs SMTP relays without losing bucket loads of genuine mail. In a similar fashion as someone who does work with DNS I run my own DNS caching server (sometimes even caching off the ICANN root servers ;-). I'd be somewhat upset if my ISP insisted I send all DNS queries via their caches. The various country code maintainers would probably get less reports, so I guess that is a plus for someone ;-) Not every end user is some naive computer user who needs lots of hand holding. -----BEGIN PGP SIGNATURE----- Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE/TjywGFXfHI9FVgYRApWxAKCuVNkifrrKkHhUm5Fvgxoge3OXfwCdFSoS Hrl4YkfjXYRrMeHDD0zke60= =r5d+ -----END PGP SIGNATURE-----

1 0

W32/Sobig-F - Halflife correlation ???
by Matt Martini 28 Aug '03

28 Aug '03

I've scanned my Netflow logs for activity associated with the 20 machines that SoBig was targeting and I found some very curious activity. I routed traffic to these 20 ips to Null0. At 3:09 I started getting traffic from 10 of the 20 machines to a Halflife server on my network. This continued until 6:14pm. The conversations could not be productive because of my Null route, but what were these machines trying to do? Even more interesting is the fact that these machines were supposed to be shutdown before 3:00. How could they be sending data to this halflife server? I suspect that the addresses are spoofed, but to what end? Are there any halflife vunerabilies that the virus writers are using? It just seems like too much of a coincidence that 10 out of 20 machines were hitting this server. I have the original Netflow data and the complete logs. Below is a sample of what I was seeing. Port 27015 is the normal Halflife port. Anyone have any ideas? or seeing anything similar? Read: Date,Time,SrcIP,SrcPort,DstIP,DstPort,Protocol,Packets,Bytes 2003/08/22 15:09:54 67.73.21.6.50416 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:00 12.232.104.221.64550 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:03 61.38.187.59.43445 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:07 67.9.241.67.17414 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:09 63.250.82.87.2956 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:12 24.197.143.132.18637 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:23 61.38.187.59.64072 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:31 67.73.21.6.27900 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:39 65.177.240.194.1448 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:10:46 63.250.82.87.33876 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:11:16 65.177.240.194.40713 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:11:18 61.38.187.59.58060 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:11:25 24.197.143.132.4336 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 15:11:40 67.9.241.67.6812 -> XXX.XXX.XXX.XXX.27015 17 1 37 [...] 2003/08/22 18:13:27 65.95.193.138.11565 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:31 12.232.104.221.32662 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:35 61.38.187.59.28106 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:37 24.33.66.38.19736 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:38 67.9.241.67.51452 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:46 65.95.193.138.46930 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:53 61.38.187.59.16641 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:13:59 63.250.82.87.56358 -> XXX.XXX.XXX.XXX.27015 17 1 37 2003/08/22 18:14:09 12.232.104.221.19923 -> XXX.XXX.XXX.XXX.27015 17 1 37 Total = 1751 flows from 15:09:54 to 18:14:09 Servers hitting the Halflife machine ------------------------------------ 12.232.104.221 24.33.66.38 24.197.143.132 24.202.91.43 61.38.187.59 63.250.82.87 65.95.193.138 65.177.240.194 67.9.241.67 67.73.21.6 __________________________ http://www.invision.net/ _______________________ Matthew E. Martini, PE InVision.com, Inc. (631) 543-1000 x104 Chief Technology Officer matt(a)invision.net (631) 864-8896 Fax _______________________________________________________________________pgp_

6 9

Cross-country shipping of large network/computer gear?
by Matthew Zito 28 Aug '03

28 Aug '03

Hello, I was wondering if anyone could provide any advice or suggestions on shipping heavy/bulky equipment (~300 pounds, about a half-rack worth of gear) on short notice cross-country? We're obviously looking to minimize cost, but realistically it can't be in transit for more than two days. Are there any companies or methods people would recommend? Thanks in advance for the help. Thanks again, Matt -- Matthew Zito GridApp Systems Email: mzito(a)gridapp.com Cell: 646-220-3551 Phone: 212-358-8211 x 359 http://www.gridapp.com

17 24