- NANOG - lists.nanog.org

RE: How much longer..
by Dan Lockwood 13 Aug '03

13 Aug '03

I have to agree with Ejay. Microsoft is not the only software vendor. It seems silly to argue that one OS is better than the other. Linux needs to be patched to, as do all the various flavors or Unix, solaris, etc from time to time and with varying degrees of urgency. This is a fact of life. Dan -----Original Message----- From: Ejay Hire [mailto:ejay.hire@isdn.net] Sent: Wednesday, August 13, 2003 10:53 To: Len Rose; *Hobbit* Cc: nanog(a)merit.edu Subject: RE: How much longer.. >From my perspective, I don't care what defective operating system a worm uses. If a malevolent worm is spreading via a vulnerability in IIS and I can keep from answering support calls by blocking it at the edge I will. If one of the 31337 crowd ever catches a clue and launches a worm that spreads via the OpenSSH vulnerability, I'll block that too. My objective in blocking is not to bail Microsoft out, my objective is to make sure the people I work with can accomplish useful work and don't have to spend days repeatedly explaining how to download a patch and remove msblast.exe. For the record, I have two folders that catch Microsoft security bulletins and Red hat package update notifications. Right now the score is close at MS 12 vs RH 9. -e -----Original Message----- From: Len Rose [mailto:len@netsys.com] Sent: Wednesday, August 13, 2003 12:26 PM To: *Hobbit* Cc: nanog(a)merit.edu Subject: Re: How much longer.. Hi.. just think if the billions of dollars being spent on M$ products could have been funneled into open source projects. To reinforce the point in the most blunt manner possible: No one had ever better dare postulate that the inherent reason for all of the vulnerabilities in Micro$oft products are due to any special features of note. There is no particular network-enabled feature that Windows has that UNIX didn't implement years before and has done so securely following established internet design standards adopted by the ruling standards body (IETF) after intense study and open participation from all parties who were interested. Now knee-jerk reactions by various network operators is to filter, filter, filter and soon, by the grace of a piece of crap operating system you'll have a much more limited internet to work with because for Micro$oft's sake they've filtered everything. What makes it all ironic is that you can directly thank Micro$oft if the governments decide to pass more draconian laws, even further criminalizing activities which were considered marginally criminal to begin with. Instead of subsidizing the monopoly, keeping sub-standard operating systems alive, they should fine them billions of dollars for the cost of repairing damages, managing overloaded network and system infrastructures (due to the effects of the latest vulnerability). The governments should cease using all Micro$oft products and go back to UNIX which can easily be transformed into a "friendly" operating system for business users (it already has been of course) For the millions of dollars that are spent buying this fake operating system with it's fake applications the government could subsidize development of open software whose quality and security would far exceed that of the closed source garbage that has become "standard" in today's offices. Their operating systems were a joke 10 years ago, and they're still a joke today. The people administering these systems need to start learning UNIX and colleges need to go back to teaching computer science based around a real operating system. It's embarassing for a recent graduate to only know how to point and click while UNIX hackers are unemployed thanks to the disease that is called Micro$oft. Not to mention watching weeks of Micro$oft admins wondering publicly on Full Disclosure (soon to be renamed Microsoft Whining and Crying) what to do about their systems that they can't protect because those systems are rotten to the core with garbage code written by fake programmers who were trained by Universities who use Micro$oft operating systems to teach their curriculum and who are managed by ex-vms programmers (Uncle Bill hired them to write Windows Code) On Wed, Aug 13, 2003 at 11:42:59AM +0000, *Hobbit* wrote: > I often ask the larger question, "how long will it take for millions > of people to realize that having to deal with winbloze has completely > *derailed* their careers for the last ten years, when they could have > been doing so much more productive things on their jobs?" > > But evidently most of them can't think that deep, and get all defensive > about it. > > If all those people had been contributing to free and better replacements > in the linux/bsd/open-source arena, we'd be *so* much farther ahead, > and would have saved countless dollars that are now in Bill's pocket. > > _H*

1 0

Re: I can't reach MS sites
by Gerald 13 Aug '03

13 Aug '03

On Wed, 13 Aug 2003, Stephen Williams wrote: > in attempting to patch systems here (at U of Texas) I have noticed that > over the last two days the windowsupdate url for Microsoft has at times > not responded, or been very slow to respond. Between port scans from > the worm and the demand of people wanting to download patches they may > be getting a bit overwhelmed. On a few of the machines I patched that already had it running, IE would flip to Done with a blank screen. Checked the registry and removed everything except default from Run (with a reg backup of course) and removed everything from the startup menu. Reboot and it pulled up windows update. In one instance had 2 machines sitting side by side. Both had MSN as home page. Both would pull the MSN site up fine. Click on tools/WUPD and one would go every time. The other would open a blank web site. Removed all from Run in registry and cleared startup. Reboot and viola WindowsUpdate pulls up. (Patch, reboot, patch, reboot, driver update, reboot, and then add keys back to registry that were really needed) Note: On one windows XP machine unchecking all in msconfig for registry was not enough. G P.S. Patching my FreeBSD machines twice this last week was soo much easier.

1 0

I can't reach MS sites
by John Obi 13 Aug '03

13 Aug '03

Hello, I can't open www.microsoft.com , windowsupdate.microsoft.com and www.msn.com very slow. It took long time to sign in the msn IM too. Do you see any problems so far? Thanks, -J __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

3 2

RE: How much longer..
by Ejay Hire 13 Aug '03

13 Aug '03

>From my perspective, I don't care what defective operating system a worm uses. If a malevolent worm is spreading via a vulnerability in IIS and I can keep from answering support calls by blocking it at the edge I will. If one of the 31337 crowd ever catches a clue and launches a worm that spreads via the OpenSSH vulnerability, I'll block that too. My objective in blocking is not to bail Microsoft out, my objective is to make sure the people I work with can accomplish useful work and don't have to spend days repeatedly explaining how to download a patch and remove msblast.exe. For the record, I have two folders that catch Microsoft security bulletins and Red hat package update notifications. Right now the score is close at MS 12 vs RH 9. -e -----Original Message----- From: Len Rose [mailto:len@netsys.com] Sent: Wednesday, August 13, 2003 12:26 PM To: *Hobbit* Cc: nanog(a)merit.edu Subject: Re: How much longer.. Hi.. just think if the billions of dollars being spent on M$ products could have been funneled into open source projects. To reinforce the point in the most blunt manner possible: No one had ever better dare postulate that the inherent reason for all of the vulnerabilities in Micro$oft products are due to any special features of note. There is no particular network-enabled feature that Windows has that UNIX didn't implement years before and has done so securely following established internet design standards adopted by the ruling standards body (IETF) after intense study and open participation from all parties who were interested. Now knee-jerk reactions by various network operators is to filter, filter, filter and soon, by the grace of a piece of crap operating system you'll have a much more limited internet to work with because for Micro$oft's sake they've filtered everything. What makes it all ironic is that you can directly thank Micro$oft if the governments decide to pass more draconian laws, even further criminalizing activities which were considered marginally criminal to begin with. Instead of subsidizing the monopoly, keeping sub-standard operating systems alive, they should fine them billions of dollars for the cost of repairing damages, managing overloaded network and system infrastructures (due to the effects of the latest vulnerability). The governments should cease using all Micro$oft products and go back to UNIX which can easily be transformed into a "friendly" operating system for business users (it already has been of course) For the millions of dollars that are spent buying this fake operating system with it's fake applications the government could subsidize development of open software whose quality and security would far exceed that of the closed source garbage that has become "standard" in today's offices. Their operating systems were a joke 10 years ago, and they're still a joke today. The people administering these systems need to start learning UNIX and colleges need to go back to teaching computer science based around a real operating system. It's embarassing for a recent graduate to only know how to point and click while UNIX hackers are unemployed thanks to the disease that is called Micro$oft. Not to mention watching weeks of Micro$oft admins wondering publicly on Full Disclosure (soon to be renamed Microsoft Whining and Crying) what to do about their systems that they can't protect because those systems are rotten to the core with garbage code written by fake programmers who were trained by Universities who use Micro$oft operating systems to teach their curriculum and who are managed by ex-vms programmers (Uncle Bill hired them to write Windows Code) On Wed, Aug 13, 2003 at 11:42:59AM +0000, *Hobbit* wrote: > I often ask the larger question, "how long will it take for millions > of people to realize that having to deal with winbloze has completely > *derailed* their careers for the last ten years, when they could have > been doing so much more productive things on their jobs?" > > But evidently most of them can't think that deep, and get all defensive > about it. > > If all those people had been contributing to free and better replacements > in the linux/bsd/open-source arena, we'd be *so* much farther ahead, > and would have saved countless dollars that are now in Bill's pocket. > > _H*

1 0

RE: Port blocking last resort in fight against virus
by Temkin, David 13 Aug '03

13 Aug '03

True, but at that time you didn't have illegitimate traffic on port 80, either. Future engineering could be worked around this issue. -----Original Message----- From: Matthew Kaufman [mailto:matthew@eeph.com] Sent: Wednesday, August 13, 2003 12:09 PM To: 'McBurnett, Jim'; nanog(a)merit.edu Subject: RE: Port blocking last resort in fight against virus > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of McBurnett, Jim >... I really can not image > legitimate traffic on 135.. My problem with this approach is that, in 1985, you could have said "I really cannot imagine legitimate traffic on port 80". (On the other hand, you could probably say that today and be mostly right) Matthew Kaufman matthew(a)eeph.com

1 0

RE: Port blocking last resort in fight against virus
by McBurnett, Jim 13 Aug '03

13 Aug '03

Jack, et al. As a larger than average end user and what could be called a small ISP, I really can not image legitimate traffic on 135.. who in there right mind would pass NB traffic in the wild? I dunno, may it is just that Old military security mindset creeping into my brain housing group. Can someone enlighten me? What is legitimate 136 traffic? J -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Tuesday, August 12, 2003 12:31 PM To: Mans Nilsson Cc: nanog(a)merit.edu Subject: Re: Port blocking last resort in fight against virus Mans Nilsson wrote: > > Your chosen path is a down-turning spiral of kludgey dependencies, > where a host is secure only on some nets, and some nets can't cope > with the load of all administrative filters (some routers tend to > take port-specific filters into slow-path). That way lies madness. > Secure? Who's talking about secure? I'm talking about trash. Not blocking the port with a large group of infected users means that your network sends trash to other people's networks. Those networks may or may not have capacity to mean your network's trash. Temporarily blocking 135 is not about security. A single infection within a local net will infect all vulnerable systems within that local net. A block upstream will not save local networks from cross infecting. However, it does stop your network from sending the trash out to other networks which may have smaller capacities than your network does. Of course, perhaps a good neighbor doesn't really care about other people's networks? Perhaps there is no such thing as a good neighbor. It's kill or be killed, and if those other networks can't take my user's scanning them, then tough! There is legitimate traffic on 135. All users I've talked to have been understanding in a short term block of that port. They used alternative methods. I have a lot of valid traffic still cranking out the other Microsoft ports. -Jack

5 4

Chicago routers and Genuity estates
by Hank Nussbacher 13 Aug '03

13 Aug '03

I really hate to do this but I have no choice. IUCC terminated its services at the Genuity colo site at 216 W. Jackson, Chicago in May 2002. We had a financial disagreement about the final bill and Genuity refused to let us remove our routers from the site until our bill was paid. We finally agreed on final payment and we sent that in April 2003. The check has been cashed, but no one now replies to any of our letters (http://www.genuityestate.com/) So until we have a letter allowing us to remove our 7500 routers from their colo site, they are held hostage. Has anyone else been stuck in this situation and what have you done to get a letter of release from Genuity Estates? Thanks, Hank

1 0

The impending DDoS storm
by Jason Frisvold 13 Aug '03

13 Aug '03

All, What is everyone doing, if anything, to prevent the apparent upcoming DDoS attack against Microsoft? From what I've been reading, and what I've been told, August 16th is the apparent start date... We're looking for some solution to prevent wasting our network resources transporting this traffic, but at the same time trying to allow legitimate through... So, is anyone planning on doing anything? Thanks, -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

3 2

RE: The impending DDoS storm
by Jason Frisvold 13 Aug '03

13 Aug '03

On Wed, 2003-08-13 at 10:14, Ingevaldson, Dan (ISS Atlanta) wrote: > It might be somewhat tricky to block TCP/80 going to windowsupdate.com. I agree... but then, who needs updates anyways.. *grin* > Regards, > =============================== > Daniel Ingevaldson > Engineering Manager, X-Force R&D > dsi(a)iss.net > 404-236-3160 > > Internet Security Systems, Inc. > The Power to Protect > http://www.iss.net > =============================== > > > -----Original Message----- > From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] > Sent: Wednesday, August 13, 2003 10:38 AM > To: Jason Frisvold > Cc: nanog(a)merit.edu > Subject: Re: The impending DDoS storm > > > > > On Wed, 13 Aug 2003, Jason Frisvold wrote: > > > All, > > > > What is everyone doing, if anything, to prevent the apparent > upcoming > > DDoS attack against Microsoft? From what I've been reading, and what > > I've been told, August 16th is the apparent start date... > > > > We're looking for some solution to prevent wasting our network > > resources transporting this traffic, but at the same time trying to > > allow legitimate through... > > > > So, is anyone planning on doing anything? > > See previous discussion on filtering... > > > Other than that experience says if these things turn out to be big > enough to > cause an issue then they quickly burn themselves out anyway > > Steve -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

1 0

RE: Port blocking last resort in fight against virus
by McBurnett, Jim 13 Aug '03

13 Aug '03

>So give up trying to control the actions of the end nodes by >destroying the edge. Make sure that complaints reach the correct >responsible person. Limit your involvement to careful excerpts from >your customer/IP-address database, or better yet, register them in >the RIR registry so that others having complaints can reach them >without wasting your time. Intersting concept... MY upstream disagrees.. They, who shall remain nameless at this point, are doing a horrible job at policing their other customers, refuse to SWIP the block to me claiming they are working on it (been a year now), and they feel they need to know about whatever complaints they get about me. HMM, if they have gotten complaints, then I haven't gotten any!! And I have complained about other customers and never seen a fix.. One system was code red infected and had no FW, after a few weeks, I tracked them down and called them myself, and got told that <ISP> never called them!!! (I reported it 5 times) This is a great idea, but I very much doubt that most ISP's will even do it. And if ISP's did this.. NOTE the spammers, they would always lie about WHOIS, RWHOIS, contact info... I dunno, there is no perfect solution here... Except, as a community we need to enforce RIR policies and actual enforce our own AUP's. (NO shots being fired here, but as we all know some ISPs AUPs are like a law-- only effect the good citizen and not the high $ customer) just my 2c worth.. J

3 2