- NANOG - lists.nanog.org

RE: Packeteer stuff?
by Austad, Jay 12 Aug '03

12 Aug '03

If you're looking at the Packeteer to put some limits in place based on protocol, you can take a look at Cisco's NBAR, which is supported in IOS. What kind of metrics are you looking for? Netflow type info? How fat is the pipe you want to monitor/manipulate? -jay -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Tuesday, August 12, 2003 9:47 AM To: 'nanog(a)merit.edu' Subject: Packeteer stuff? Specifically talking about the PacketSeeker 6500 Is it worth the money? Or are there better ways to get centralized views of network metrics? -Drew

1 0

FW: What the heck is this msblast.exe
by Drew Weaver 12 Aug '03

12 Aug '03

The real injustice is the 15k program someone sent to sec-focus that you type in an IP address and it returns a command prompt on the target machine (eek). -Drew -----Original Message----- From: Rod Trent [mailto:rodtrent@yahoo.com] Sent: Monday, August 11, 2003 6:45 PM To: Lee_Fisher(a)NAI.com; morris_minchu(a)iwon.com; focus-ms(a)securityfocus.com Subject: RE: What the heck is this msblast.exe Medium???? That's an irresponsible rating, considering that both MS and the Department of Homeland Security have listed the vulnerability as critical. -----Original Message----- From: Lee_Fisher(a)NAI.com [mailto:Lee_Fisher@NAI.com] Sent: Monday, August 11, 2003 6:27 PM To: morris_minchu(a)iwon.com; focus-ms(a)securityfocus.com Subject: RE: What the heck is this msblast.exe >From your description I would imagine it to be the Blaster ( We called it W32/Lovsan.worm ) Many posts on forums - We list it as a Medium On Watch alert - other AV orgs have a similar classification. http://vil.nai.com/vil/content/v_100547.htm Lee Fisher Solutions Architect McAfee Product Management -----Original Message----- From: Minchu Mo To: focus-ms(a)securityfocus.com Sent: 11/08/03 15:00 Subject: What the heck is this msblast.exe The code resides in c:\winnt\system32. It somehow change my registry and pretend to be Window autoupdate in \Localsystem\software\microsoft\window\run, so it can run when I boot the machine. Now it sending out packet to random(?)IP 's endpoint port ------------------------------------------------------------------------ --- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms ------------------------------------------------------------------------ --- --------------------------------------------------------------------------- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms --------------------------------------------------------------------------- --------------------------------------------------------------------------- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms ---------------------------------------------------------------------------

1 0

Gigabit Media Converter
by Vincent J. Bono 12 Aug '03

12 Aug '03

Anyone out ther ever see or hear tell of a device that will let you run two GBICs back to back wthout an associated switch and all the trimmings? Application is to convert a CWDM GBIC signal to a Multimode one. TIA, Vin

6 9

RE: RPC errors
by Sean Crandall 12 Aug '03

12 Aug '03

This worm is amazing. I have only had filters in place for about 4.5 hours and I am already approaching 100 million matches for the deny tcp/135 across my network. Of that, only one customer has said that they needed 135 open for legimate use (probably more, but I have only heard from the one). Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA (925) 201-2530 > -----Original Message----- > From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] > Sent: Monday, August 11, 2003 7:45 PM > To: John Palmer; nanog(a)merit.edu > Subject: RE: RPC errors > > > > over 24 hours.. started block suday afternoon... > deny tcp any any eq 445 log (256936 matches) > deny udp any any eq 445 log (1 match) > deny tcp any any eq 135 (6984433 matches) > deny udp any any eq 135 (147654 matches) > deny udp any any eq netbios-ss > deny tcp any any eq 139 log (378289 matches) > > -----Original Message----- > From: John Palmer [mailto:nanog@adns.net] > Sent: Monday, August 11, 2003 8:28 PM > To: nanog(a)merit.edu > Subject: Re: RPC errors > > > > > 45 seconds: > > deny tcp any any eq 135 (5445 matches) > deny tcp any any eq 137 > deny tcp any any eq 138 > deny tcp any any eq 139 > deny tcp any any eq 445 (207 matches) > > ----- Original Message ----- > From: "Randy Bush" <randy(a)psg.com> > To: <nanog(a)merit.edu> > Sent: Monday, August 11, 2003 18:52 > Subject: Re: RPC errors > > > > > > must be fun out there on the net today. one minute of counter > > accumulation > > > > deny tcp any any eq 135 (5721 matches) > > deny tcp any any eq 137 > > deny tcp any any eq 138 > > deny tcp any any eq 139 (17 matches) > > deny tcp any any eq 445 (1137 matches) > > > > randy > > > > > > >

2 1

RE: RPC errors
by McBurnett, Jim 12 Aug '03

12 Aug '03

over 24 hours.. started block suday afternoon... deny tcp any any eq 445 log (256936 matches) deny udp any any eq 445 log (1 match) deny tcp any any eq 135 (6984433 matches) deny udp any any eq 135 (147654 matches) deny udp any any eq netbios-ss deny tcp any any eq 139 log (378289 matches) -----Original Message----- From: John Palmer [mailto:nanog@adns.net] Sent: Monday, August 11, 2003 8:28 PM To: nanog(a)merit.edu Subject: Re: RPC errors 45 seconds: deny tcp any any eq 135 (5445 matches) deny tcp any any eq 137 deny tcp any any eq 138 deny tcp any any eq 139 deny tcp any any eq 445 (207 matches) ----- Original Message ----- From: "Randy Bush" <randy(a)psg.com> To: <nanog(a)merit.edu> Sent: Monday, August 11, 2003 18:52 Subject: Re: RPC errors > > must be fun out there on the net today. one minute of counter > accumulation > > deny tcp any any eq 135 (5721 matches) > deny tcp any any eq 137 > deny tcp any any eq 138 > deny tcp any any eq 139 (17 matches) > deny tcp any any eq 445 (1137 matches) > > randy > > >

1 0

Latest analysis of MSBLAST
by Huopio Kauto 12 Aug '03

12 Aug '03

from F-Secure is here: http://www.f-secure.com/v-descs/msblast.shtml --Kauto Kauto Huopio - kauto.huopio(a)ficora.fi Information Security Adviser / CERT-FI -coordinator Finnish Communications Regulatory Authority / CERT-FI tel. +358-9-6966772, fax. +358-9-6966515 CERT-FI duty desk +358-9-6966510 / http://www.cert.fi

3 2

Re: RPC errors and latest worm
by Kevin Loch 12 Aug '03

12 Aug '03

----- Original Message ----- From: Scott Fendley <scottf(a)uark.edu> Date: Monday, August 11, 2003 7:49 pm Subject: Re: RPC errors and latest worm > > " * Close port 135/tcp (and if possible 135-139, 445 and > 593) ". Is there a Windows service that uses port 136, or was it included because it's easier to type than "135, 137-139"? KL

1 0

Re: RPC errors and latest worm
by Stewart, William C (Bill), RTSLS 11 Aug '03

11 Aug '03

According to http://isc.sans.org/diary.html?date=2003-08-11 , the worm uses the latest popular MS exploit ports, so " * Close port 135/tcp (and if possible 135-139, 445 and 593) ". It also uses TCP port 4444 and TFTP = UDP 69 to download its attack code after getting the initial bootstrap infection. So you probably want to be blocking TCP 4444 and (if appropriate, which it usually is, TFTP), and tracing any 4444 activity and TFTPs to detect attacks.

2 1

RE: RPC errors
by Mike Damm 11 Aug '03

11 Aug '03

According to Symantec it doesn't know if the system has already been infected until it is running on the target machine, at which point the RPC crash is imminent. It shouldn't re-infect, but further attempts from other infected hosts will cause random reboots. On the plus side this one will be much easier to clean up than CodeRed, Nimda, etc. Random J. Clueless might actually look for patches if his box is rebooting on a regular basis. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 11, 2003 2:53 PM To: 'Mike Damm' Cc: 'nanog(a)merit.edu' Subject: RE: RPC errors Its bloody gorgeous too, my girlfriend's pc rebooted like 9 times, apparently the worm doesn't check to see if its already infected. -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: Monday, August 11, 2003 5:27 PM To: 'Jack Bates'; NANOG Subject: RE: RPC errors The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

1 0

RE: RPC errors
by Brennan_Murphy＠NAI.com 11 Aug '03

11 Aug '03

does anyone know if the scanning is sequential once a range is chosen or is it random within a range? e.g., 1.1.1.1 1.1.1.2 1.1.1.3 etc or 1.1.1.89 1.1.1.33 1.1.1.12 etc -----Original Message----- From: John Dvorak [mailto:john@dvorak.net] Sent: Monday, August 11, 2003 5:57 PM To: NANOG Subject: Re: RPC errors On Mon, 11 Aug 2003 17:33:33 -0400 Kevin Houle <kjh(a)cert.org> wrote: > > --On Monday, August 11, 2003 02:26:40 PM -0700 Mike Damm > <MikeD(a)irwinresearch.com> wrote: > > >The DCOM exploit that is floating around crashes the Windows RPC > >service when the attacker closes the connection to your system after > >a successful attack. Best bet is to assume any occurrence of crashing > >RPC services to be signs of a compromised system until proven > >otherwise. > > > >http://www.cert.org/advisories/CA-2003-19.html > > That's good advice. Many of the known exploits cause the RPC service > to crash after the exploit is successful. I'll point out that not all > exploits cause the service failure. So, the absence of an RPC service > failure is likewise not an indicator that a vulnerable machine has > escaped compromise. > > Kevin Interestingly, we have clear examples of boxes which were not infected but on which RPC services did crash. This may suggest that the worm also takes advantage of the unrelated RPC DOS vulnerability (2000 and XP) which I believe MS has still not patched. John

2 1