- NANOG - lists.nanog.org

FW: TNT issues "workaround"
by John Lord 23 Aug '03

23 Aug '03

I seem to be having the same or similar problems with my Cisco boxes also , they either reboot or the pris hang , users get busy's but no one is logged in at all , when I do a show isdn status it shows b channels in use but no one on, the only way to fix is reboot the box , and it seems to be timed , everyday at 1400 and 2200 hours , since Monday anybody body heard of ciscos acting funny this week? John Lord(lord(a)allturbo.com) It Manager AllTurbo Internet Services Inc 410-213-9388 Office www.allturbo.com -----Original Message----- From: Brian Wallingford [mailto:brian@meganet.net] Sent: Saturday, August 23, 2003 1:41 AM To: nanog(a)merit.edu Subject: TNT issues "workaround" I haven't seen specific details posted here, so: Like many others, we've had a few TNTs online for years without hiccups or reboots until this week. Beginning late Sunday, we saw seemingly random blade reboots, and total system crashes. Errors ranged from memory leaks to infinite loops on the controller blade, but all blades were susceptible. HDLC2 blades seemed to be particularly vulnerable. We saw boxes that had been rock-solid for very long periods suddenly rebooting at periods ranging from 20 minutes to 4 hours, with no obvious cause (i.e., nothing more specific than the above). Border and core filtering of icmp echo * did little good. On the suggestion of some folks on another list, and against my better judgment, we disabled route caching in order to free up additional memory (though memory did not appear fragmented). This stabilized all involved boxes, and surprisingly, did not result in significant degradation of end user performance. Granted, it's not a true fix, but it may get you a few extra Z's at night. hth, brian

3 2

Moving quickly in network design
by Sean Donelan 23 Aug '03

23 Aug '03

http://www.washingtonpost.com/wp-dyn/articles/A34422-2003Aug22_2.html >Jonathan Zittrain, a Harvard Law assistant professor. "Now one person >really can change the world. But that's also what's terrifying." > >When hackers three decades ago found they could get free calls on pay >phones using a toy whistle that mimicked the phone's network signals, >they exploited the system's vulnerabilities in much the same manner as >today's viruses, Zittrain said. Phone firms, though, were able to >quickly change their network design. But the Internet is fundamentally a >different type of technology. Actually it took the telephone system over 30 years to convert from multi-frequency (per-trunk) singaling to common channel interoffice signaling. The signaling standard has gone through a few versions and is now known as SS7. SS7 security isn't all its cracked up to be. The Bell System lucked out because they had started development in the 1960's of new signaling methods not because of security, but because of money. Busy signals were tying up half the long distance lines in the US, and in the old days Ma Bell didn't get paid for busy signals. The business case for developing CCIS was primarly driven by more efficient (ie. more "paid" calls) use of the network, not security. By the time Capt'n Crunch found his 2600Hz whistle in the early 1970's, Ma Bell could "move quickly" (i.e. it still took several more years) because it had spent a decade already working on CCIS.

1 0

RTT/delay presentation from Defcon
by Anton L. Kapela 23 Aug '03

23 Aug '03

All, I put a small talk on at this years Defcon, discussing some of the rtt work I've been doing. For those interested in the topic, I've placed an mp3 of the presentation and my slides here: http://144.92.40.150/~xam/misc/dc-11/dc11-talk.htm http://144.92.40.150/~xam/misc/dc-11/020.MP3 Enjoy, --Tk

1 0

Sobigf + BGP
by J. Oquendo 23 Aug '03

23 Aug '03

I was reading some PDF files on BGP along with Routing TCP/IP v2, and I found myself pondering what a nasty damn worm it would be if someone were to do something using winpcap in conjucting with the worm/virus, and I was a bit confused, disturbed, lost. So I drew up a quick question complete with ascii which can be viewed at politrix.org/segment/brat.txt for those who get a distorted diagram... Apologies beforehand if this post seems a bit odd, but I did not see anything similar to a networking 'vuln'dev', and besides I wouldn't think that any one here would do something malicious with any idea that actually worked for the worse. ------------------------------------------------------------- brat.txt I was thinking about the recent polymorphic Sobigf worm/virus and wondered about the following hypothetical scenario... Sorry about this ASCIIgram, I didn't want to look for Visio nor any other graphic program to do this in, strictly terms to keep it gritty... So here goes. Attacker scripts Sobigf variant with a virii/worm generator, and uses pcap (packet capture) under Windows to have his worm send out predefined packets. Let's say he created what I call a 'BRAT' BGP Router Attack Tool. Now this tool isn't something major it simply sends out two types of packets aimed at routers running BGP. They're both Notification Messages: ========================================= Packet 1 = BGP NM ERROR CODE 2 SUBCODE 2 | Packer 2 = BGP NM ERROR CODE 6 | ========================================= Now we have the hosts' information: www.targetednap.net (4 if's) 192.168.1.1 192.168.4.1 10.10.1.1 10.10.5.1 VIC's nap.maefi.com Link 1 nsp.maefee.com Link 2 nap.maefo.com Link 3 nsp.maefum.com Link 4 Link 1 Link 2 \ / ----------------- | | | Targetednap.net | | | ----------------- / \ Link 3 Link 4 Script kiddiot sets up his worm/virii to send packets as Targetednap to all VIC's as Targetednap via spoofing using WinPCAP. Given the rate of connections that were mentioned for SoBigf, what could happen say if route dampening were used between the routers. Would penalties keep adding up making the connection intolerable because of latency, would it ignore it. Or what could happen say if worm was smart enough to send NLRI's of something like $targetvalue=0 Wouldn't this knock off connections between BR's/ABR's, etc. Are there any flags one can take to prevent this from occurring. Keep in mind that packet creation is not difficult. My guess would be, even if someone didn't get all fancy with the packets being sent, a couple of million packets sent with say a: ping -l 25000 $VIC as $TARGETEDNAP would be enough to cause some massive latency, maybe even disconnect a backbone perhaps? Anyone care to share links on security on this level if any are available ================================================= J. Oquendo rsvp: segment ... antioffline . com PGP Fingerprint 39A7 24C6 A9A0 6C67 96CA 0302 F1D3 2420 851E E3D0 http://www.politrix.org http://www.antioffline.com ================================================= -- __________________________________________________________ Sign-up for your own personalized E-mail at Mail.com http://www.mail.com/?sr=signup CareerBuilder.com has over 400,000 jobs. Be smarter about your job search http://corp.mail.com/careers

2 1

TNT issues "workaround"
by Brian Wallingford 23 Aug '03

23 Aug '03

I haven't seen specific details posted here, so: Like many others, we've had a few TNTs online for years without hiccups or reboots until this week. Beginning late Sunday, we saw seemingly random blade reboots, and total system crashes. Errors ranged from memory leaks to infinite loops on the controller blade, but all blades were susceptible. HDLC2 blades seemed to be particularly vulnerable. We saw boxes that had been rock-solid for very long periods suddenly rebooting at periods ranging from 20 minutes to 4 hours, with no obvious cause (i.e., nothing more specific than the above). Border and core filtering of icmp echo * did little good. On the suggestion of some folks on another list, and against my better judgment, we disabled route caching in order to free up additional memory (though memory did not appear fragmented). This stabilized all involved boxes, and surprisingly, did not result in significant degradation of end user performance. Granted, it's not a true fix, but it may get you a few extra Z's at night. hth, brian

1 0

Cisco OC-3c card question
by Stephen Milton 23 Aug '03

23 Aug '03

What is the most cost effective equipment to use to connect two locations with an OC-3c circuit? I currently have 7206VXR routers at both ends, so would prefer slot cards for those if feasible. Excuse my ignorance, but I can't get hold of any pre-sales support at Cisco because the worms are overloading their phone reps. -Steve -- Stephen Milton - Founder/VP Internet (425) 881-8769 x102 ISOMEDIA.COM - Premium Internet Services (425) 869-9437 Fax milton(a)isomedia.com http://www.isomedia.com

3 2

Sobig.f surprise attack today
by Jim Dawson 22 Aug '03

22 Aug '03

F-Secure Corporation is warning about a new level of attack to be unleashed by the Sobig.F worm today. Supposed to take place at 1900 UTC. http://www.f-secure.com/news/items/news_2003082200.shtml Jim -- See what ISP-Planet is saying about us! http://isp-planet.com/services/wholesalers/flexpop.html __________________________________________________________________ Jim Dawson jdawson(a)flexpop.net Flexpop/Navi.Net http://www.flexpop.net 618 NW Glisan St. Ste. 101 v. +1.503.517.8866 Portland, Or 97209 USA f. +1.503.517.8868 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

11 12

RE: Sobig.f surprise attack today
by Austad, Jay 22 Aug '03

22 Aug '03

I don't think the purpose was to DoS them. It looks like some of them were hosts on Comcast's cable network, probably some user machines being used to host the second part of the payload. I just want to know what the second part of this thing does. It's better than watching TV. :) > -----Original Message----- > From: Mark Segal [mailto:MSegal@Corporate.FCIBroadband.com] > Sent: Friday, August 22, 2003 4:05 PM > To: 'netadm'; 'nanog(a)merit.edu' > Subject: RE: Sobig.f surprise attack today > > > > My questions is what were those servers.. Was the purpose to denial of > service attack them? If so we just assisted that.. :) > > mark > > > -- > Mark Segal > Director, Network Planning > FCI Broadband > Tel: 905-284-4070 > Fax: 416-987-4701 > http://www.fcibroadband.com > > Futureway Communications Inc. is now FCI Broadband > > > -----Original Message----- > From: netadm [mailto:netadm@infolink.com] > Sent: August 22, 2003 3:50 PM > To: nanog(a)merit.edu > Subject: RE: Sobig.f surprise attack today > > > > From http://www.f-secure.com/v-descs/sobig_f.shtml > ----------------------------------------------------------------- > Update on 19:00 UTC > > When deadline for the attack was passed, one machine was still > (somewhat) up. However, immediatly after the deadline, this > machine (located > in the USA) was totally swamped under network traffic. > > We've tried connecting to it, just like the virus does. We do > this from > three different sensors from three different machines in > three different > countries. We haven't been able to connect to it once. If we > can't connect, > neither can the viruses. > > So the attack failed. Whoa. > > We'll keep monitoring until 22:00 UTC. If we're not able to > connect once, we > can safely say that the attack was prevented. > > > -----Original Message----- > From: Andrew Kerr [mailto:andrew_kerr@iamnos.ca] > Sent: Friday, August 22, 2003 3:43 PM > To: Jay Hennigan > Cc: nanog(a)merit.edu > Subject: Re: Sobig.f surprise attack today > > > > Jay Hennigan wrote: > > On Fri, 22 Aug 2003, Andrew Kerr wrote: > > > > > >>Its been posted here, and f-secure has it, but I wrote a > quick script > >>to keep an eye on the 20 servers and dump the output to a > simple page: > >> > >>http://207.195.54.37/sobig.html > >> > >>(Updates about every 5 mins) > > > > > > You're probing the list of NTP servers the worm uses to get > the date, > > not the list of hosts to which it "phones home". > > > > > A few people pointed that out. By the time this message hits > the list, > it should be corrected. >

1 0

Re: Cisco filter question
by Jack Bates 22 Aug '03

22 Aug '03

matt(a)petach.org wrote: >> ip address (access-lists): 199 > > ^^^ > >>Extended IP access list 181 > > ^^^ > > > > Did you mean to have a mismatch between the numbers? > Or is there some magic configuration detail that links > the two together that I haven't learned about yet? > They are comparitive lists. 181 lists all traffic leaving the router towards my networks while 199 is the list for the routemap that filters inbound icmp traffic of 92 bytes. 181 would be legitimate icmp traffic which is why it's lower than route-map nachi-worm which uses acl 199. -Jack

1 0

RE: Sobig.f surprise attack today
by Mark Segal 22 Aug '03

22 Aug '03

My questions is what were those servers.. Was the purpose to denial of service attack them? If so we just assisted that.. :) mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: netadm [mailto:netadm@infolink.com] Sent: August 22, 2003 3:50 PM To: nanog(a)merit.edu Subject: RE: Sobig.f surprise attack today >From http://www.f-secure.com/v-descs/sobig_f.shtml ----------------------------------------------------------------- Update on 19:00 UTC When deadline for the attack was passed, one machine was still (somewhat) up. However, immediatly after the deadline, this machine (located in the USA) was totally swamped under network traffic. We've tried connecting to it, just like the virus does. We do this from three different sensors from three different machines in three different countries. We haven't been able to connect to it once. If we can't connect, neither can the viruses. So the attack failed. Whoa. We'll keep monitoring until 22:00 UTC. If we're not able to connect once, we can safely say that the attack was prevented. -----Original Message----- From: Andrew Kerr [mailto:andrew_kerr@iamnos.ca] Sent: Friday, August 22, 2003 3:43 PM To: Jay Hennigan Cc: nanog(a)merit.edu Subject: Re: Sobig.f surprise attack today Jay Hennigan wrote: > On Fri, 22 Aug 2003, Andrew Kerr wrote: > > >>Its been posted here, and f-secure has it, but I wrote a quick script >>to keep an eye on the 20 servers and dump the output to a simple page: >> >>http://207.195.54.37/sobig.html >> >>(Updates about every 5 mins) > > > You're probing the list of NTP servers the worm uses to get the date, > not the list of hosts to which it "phones home". > A few people pointed that out. By the time this message hits the list, it should be corrected.

1 0