- NANOG - lists.nanog.org

Blocking port 135?
by Adi Linden 04 Aug '03

04 Aug '03

http://www.cert.org/advisories/CA-2003-19.html Would blocking port 135 at the network edge be a prudent preventative measure?

17 24

Complaint of the week: Ebay abuse mail (slightly OT)
by David G. Andersen 03 Aug '03

03 Aug '03

To add to the eternally annoying list of companies that ignore abuse@ mail... ebay now requires that you fill in their lovely little web form to send them a note. Even if, say, you're trying to let them know about another scam going around that tries to use the machine www.hnstech.co.kr to extract people's credit card information. Has anyone had success in convincing companies that this is just A Bad Idea (ignoring abuse mail), and if so, how did you manage to do it? Sorry for the slightly non-operational content, but I've had it with ebay on this one. -Dave ----- Forwarded message from eBay Safe Harbor <SafeHarbor(a)eBay.com> ----- Date: Sat, 02 Aug 2003 22:58:01 -0700 From: eBay Safe Harbor <SafeHarbor(a)eBay.com> Subject: Your message to safeharbor(a)ebay.com was not received (KMM86277800V90276L0KM) To: "David G. Andersen" <dga(a)lcs.mit.edu> Auto-Submitted: auto-replied Reply-To: eBay Safe Harbor <SafeHarbor(a)eBay.com> X-MIME-Autoconverted: from quoted-printable to 8bit by eep.lcs.mit.edu id h735w5sU087612 Thank you for writing to the eBay SafeHarbor Team. The address you wrote to (safeharbor(a)ebay.com) is no longer in service. Please resend your email to us through one of the online webforms listed below. Using these forms will help us direct your email to the right department where we can quickly answer your question correctly and get it right back to you. For Trust and Safety issues (reports of policy violations, problems with transactions, suspensions, etc.) please use the following webform: http://pages.ebay.com/help/basics/select-RS.html For General Support questions (billing, bidding, or selling concerns and technical issues, etc.) please use the following webform: http://pages.ebay.com/help/basics/select-support.html Once on the webform, what will really help us assist you further is if you choose the best topic for your question. This will allow you to view our Instant Help pages, where you may find your answer immediately. Should you not find your answer there, choosing the best topics will still help us answer your question faster, correctly, and completely. We truly appreciate your assistance in this matter and apologize for any inconvenience this may have caused. Sincerely, eBay SafeHarbor Team ----- End forwarded message ----- -- work: dga(a)lcs.mit.edu me: dga(a)pobox.com MIT Laboratory for Computer Science http://www.angio.net/ I do not accept unsolicited commercial email. Do not spam me.

7 7

RE: "The internet is slow"
by Jack.W.Parks＠alltel.com 03 Aug '03

03 Aug '03

Rebooting the Internet once a month might prevent future problems. Power off, count to ten, then restart...Proactive Management!? Jack -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Thursday, July 31, 2003 2:57 PM To: Richard A Steenbergen; Rick Ernst Cc: NANOG Subject: RE: "The internet is slow" But isn't that the purpose of NANOG? To fix the major problems before the world knows about them. I would much rather discuss a problem here and solve it and tell a reported, Yes (sir,or mam) the Internet commnity worked togather to solve the problem...... Than say, I don't it just cleared up it's all a mystery....... :) J -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Thursday, July 31, 2003 3:53 PM To: Rick Ernst Cc: NANOG Subject: Re: "The internet is slow" On Thu, Jul 31, 2003 at 12:02:32PM -0700, Rick Ernst wrote: > > Packet loss within UUNET, apparently localized to the Portland (OR) > area. I've turned down our peer with them and things are looking much > better. > > Thanks for all the help/responses. Shhhhhhh, next thing you know some reporter is going to be writing a story about how the NANOG mailing list fixed that darn "the internet is slow" problem everyone has been complaining about. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

5 4

DOS attack fills input queue?
by Scott Call 03 Aug '03

03 Aug '03

One of my FE interfaces was "stuttering" this morning, and when I checked it out, it had an input queue of 76/75 which of course made me think of the recent Cisco vulnerability, which we have upgraded IOS and added ACLs to counteract. I checked the ACLs and they hadn't caught any traffic from the "bad four" protocols, only TCP and UDP, so I started to investigate. The packets (as pulled from the buffer) have headers like: Buffer information for Small buffer at 0x42561A68 data_area 0x42561D18, refcount 1, next 0x41C4F394, flags 0xA00 linktype 7 (IP), enctype 1 (ARPA), encsize 14, rxtype 1 if_input 0x42E47824 (FastEthernet4/0/0.7), if_output 0x0 (None) inputtime 0x1433CC, outputtime 0x0, oqnumber 65535 datagramstart 0x42561D5E, datagramsize 60, maximum size 260 mac_start 0x42561D5E, addr_start 0x42561D5E, info_start 0x0 network_start 0x42561D6C, transport_start 0x42561D78, caller_pc 0x403F5BD4 source: 71.209.243.3, destination: 163.29.243.5, id: 0x0100, ttl: 128, TOS: 0 prot: 6, source port 0, destination port 40 Buffer information for Small buffer at 0x425868E4 data_area 0x42586B94, refcount 1, next 0x4253BC7C, flags 0xA00 linktype 7 (IP), enctype 1 (ARPA), encsize 14, rxtype 1 if_input 0x42E47824 (FastEthernet4/0/0.7), if_output 0x0 (None) inputtime 0x96724, outputtime 0x0, oqnumber 65535 datagramstart 0x42586BDA, datagramsize 60, maximum size 260 mac_start 0x42586BDA, addr_start 0x42586BDA, info_start 0x0 network_start 0x42586BE8, transport_start 0x42586BFC, caller_pc 0x403F5BD4 source: 224.209.80.156, destination: 163.29.243.5, id: 0x0100, ttl: 128, TOS: 0 prot: 6, source port 0, destination port 40 and so on.... Random sources, same destination, same source/destination port pairs (0/40 tcp) I added: access-list 111 deny tcp any host 163.29.243.5 access-list 111 deny tcp host 163.29.243.5 any to the interface and it did not catch any of them, and the input queue returned to 76/75 (when the customer is disconnected the queue empties back to 0/75, when I re-enable their switchport, it takes 30-60 seconds to fill back up). I'm sure the packets are problably just one of the latest windows worms, but what concerns me is that I can't seem to catch them in an ACL before they cause damage to the router. The router is a 7507 with 12.0.25S on it. Since 12.0.25S has given me (unreleated) problems on other boxes, and been pulled by Cisco, I've scheduled a reload to 12.0.21S7 tonight. I don't know if that will, however, fix this problem, so I wanted to both ask for the advice of, and maybe raise a red flag for, the nanog folks out there who might run into the same thing. Thanks -Scott

1 0

Re: WANTED: ISPs with DDoS defense solutions
by Vadim Antonov 03 Aug '03

03 Aug '03

On Sat, 2 Aug 2003, Doug Hughes wrote: > > Besides, firewalls only protect against outsiders, whereas most damaging > > attacks are from insiders. ^^^^^^^^^^^^^ > ^^^^^^^^^^^^^^^^^^^^^^^^^ > Do you have current data to support this? I believe this may have been > true 5 years ago but is no longer true. No, just my experience from working for the last 4 years in the security field (banking, insurance, government & US Army :) > Is this a case of distinguishing damaging vs non-damaging? Yes. External attacks are mostly show-offs by kids. Insiders intend to do damage - that's the whole point of those attacks. > At my company, > all recent attacks that I'm aware of have been from outside. Even if > I allow for the fact that I'm not aware of all attacks Internal attacks are rarely ever discovered because attackers have benefit of knowledge of the actual systems and can plan the execution, not just improvise (and trip detectors). Besides, intrusion detectors are mostly designed to detect footprints of the external attackers. > ... the mere volume of ones that I'm aware of would stand as > counterpoint to the assertion that most damaging attacks are from > insiders. Certainly, insiders have the 'potential' to generate the > most damaging attacks with greatest ease, but I'm not sure that > establishes a causal relationship with occurrence. You are right that it does not; I'm afraid nobody has real figures because these kinds of attacks are rarely reported even if discovered. BTW, taking an unauthorized copy of company's sources when leaving company IS an attack... how common is that? > Certainly the volume of attacks is strongly disproportional towards > the outsider. Yep. Automated scanning lets attackers to pick easy targets; thouse attacks are rarely targeted. --vadim

2 1

RE: New or existing virus/vulnerability in Windows software?
by Dan Lockwood 02 Aug '03

02 Aug '03

Rob was kind enough to look into my problem and found it to be a bot which is spread via TCP 139. No big alarm. Thanks to all! Dan -----Original Message----- From: Dan Lockwood Sent: Saturday, August 02, 2003 12:59 To: NANOG Subject: New or existing virus/vulnerability in Windows software? Everyone, We are having fits with a new? virus or vulnerability. The simptoms are as follows: an executable saatg.exe "appears" in the startup folder of the All Users group and after a reboot launches itself. It adds a registry entry under HKEY_LOCAL_MACHINE/Software/Microsoft/CurrentVersion/Run. The executable shows under processes and seems to also launch additional processes, e.g. ~1.exe, ~2.exe, ~3.exe, etc. I can not link any malicious activity to this behavior, but it seems to be spreading like wildfire on our network, apparantely with absolutely no user activity. In testing I have do thus far it finds its was on to a _virgin_ system that has been installed disconnected from the network with CD media including all relevent security patches. Panda anti-virus does not seem to detect it either. It shows up on systems where there is no interactive login, e.g. servers, regular users, and users with elevated privelages. Additionally once the executable is active is systematically searches for other systems to share the good news with on port TCP 135. I am aware of the recent vulnerabilities from Microsoft regarding RPC and netbios, but again, the recommended security fixes do not seem to provide any relief. Does anyone have any insight into what this thing is? TIA Dan Lockwood

1 0

RE: New or existing virus/vulnerability in Windows software?
by Dan Lockwood 02 Aug '03

02 Aug '03

-----Original Message----- From: Dan Lockwood Sent: Saturday, August 02, 2003 12:59 To: NANOG Subject: New or existing virus/vulnerability in Windows software? Everyone, We are having fits with a new? virus or vulnerability. The simptoms are as follows: an executable saatg.exe "appears" in the startup folder of the All Users group and after a reboot launches itself. It adds a registry entry under HKEY_LOCAL_MACHINE/Software/Microsoft/CurrentVersion/Run. The executable shows under processes and seems to also launch additional processes, e.g. ~1.exe, ~2.exe, ~3.exe, etc. I can not link any malicious activity to this behavior, but it seems to be spreading like wildfire on our network, apparantely with absolutely no user activity. In testing I have do thus far it finds its was on to a _virgin_ system that has been installed disconnected from the network with CD media including all relevent security patches. Panda anti-virus does not seem to detect it either. It shows up on systems where there is no interactive login, e.g. servers, regular users, and users with elevated privelages. Additionally once the executable is active is systematically searches for other systems to share the good news with on port TCP 135. I am aware of the recent vulnerabilities from Microsoft regarding RPC and netbios, but again, the recommended security fixes do not seem to provide any relief. Does anyone have any insight into what this thing is? TIA Dan Lockwood

1 0

RE: North America not interested in IP V6
by Irwin Lazar 02 Aug '03

02 Aug '03

> -----Original Message----- > From: Michel Py [mailto:michel@arneill-py.sacramento.ca.us] > Sent: Thursday, July 31, 2003 12:16 PM > To: Jeroen Massar > Cc: nanog(a)merit.edu > Subject: RE: North America not interested in IP V6 > > > Jeroen Massar wrote: > > It has a timeline (slides 47-50) showing the US falling behind > > for at least 3 years... come on US show what you are good for :) > > Show me where there is money to make with IPv6 first :-) > There are some > exceptions, but here v6 is somehow like ISDN: I Still Don't Need. > > Michel. > Christian Huitema of Microsoft presented on IPv6 at our Catalyst conference last month. He noted that Microsoft had a very difficult time creating xBox live due to issues with IPv4/NAT, which is one of the reasons they are pushing for IPv6 as the basis for future collaborative/peer-to-peer applications (for example, 3degrees). I believe Sony is also IPv6 enabling their products for the same reason. For these services to truly scale you've got be able to have true peer-to-peer computing. Right now, I'm not able to directly connect to my neighbor's computer to play a game if we are both on home LANs. I'm not able to directly connect to my PC at home when I'm on the road. I can't accept incoming phone calls to my netmeeting client without static configuration of my NAT gateway (same for an IP softphone). It would be a configuration nightmare to get four Vonage phones each with their own phone number. Christian provided a wonderful demonstration of a future interactive video application that would be difficult to scale if proxy/NAT services got in the way. There are lots of things that just don't work, and lots of opportunities for making money with IPv6. My own personal opinion is that over the next 5-10 year everything will come out of the box with IPv6 capabilities, making it fairly straightforward to turn on. I doubt we'll see much acceptance in the enterprise space before then, but there are significant opportunities to bring additional services into the home and serve those on home networks if we can eliminate NAT. As one person noted in response to Christian's speech. If there is no addressing shortage, why do I have to pay $75 a month for a DSL connection with a static IP address when a floating IP address only costs me $40 per month? Just my .02c irwin

8 16

New or existing virus/vulnerability in Windows software?
by Dan Lockwood 02 Aug '03

02 Aug '03

Everyone, We are having fits with a new? virus or vulnerability. The simptoms are as follows: an executable saatg.exe "appears" in the startup folder of the All Users group and after a reboot launches itself. It adds a registry entry under HKEY_LOCAL_MACHINE/Software/Microsoft/CurrentVersion/Run. The executable shows under processes and seems to also launch additional processes, e.g. ~1.exe, ~2.exe, ~3.exe, etc. I can not link any malicious activity to this behavior, but it seems to be spreading like wildfire on our network, apparantely with absolutely no user activity. In testing I have do thus far it finds its was on to a _virgin_ system that has been installed disconnected from the network with CD media including all relevent security patches. Panda anti-virus does not seem to detect it either. It shows up on systems where there is no interactive login, e.g. servers, regular users, and users with elevated privelages. Additionally once the executable is active is systematically searches for other systems to share the good news with on port TCP 135. I am aware of the recent vulnerabilities from Microsoft regarding RPC and netbios, but again, the recommended security fixes do not seem to provide any relief. Does anyone have any insight into what this thing is? TIA Dan Lockwood

1 0

RE: Blocking port 135?
by Michel Py 02 Aug '03

02 Aug '03

> Sean Donelan wrote: > As someone else pointed out, if you want the ISP to provide you > with a completely "safe" network you will end up with something > like Minitel. Note that the Minitel itself had many backdoors (not all of them being blocked by servers) and has not been safe for years; the issue is somehow comparable: The {app|minitel} has built-in vulnerabilities {crummy code|hidden control codes}. Those of us that participated in the early days of it still remember that when you wanted to get rid of someone in a chat room all you had to do was to private a message containing <esc>:f<ctrl-c><esc>9g Michel.

1 0