- NANOG - lists.nanog.org

RE: Blocking port 135?
by Drew Weaver 02 Aug '03

02 Aug '03

Im pretty sure the Shavlik products require the RPC ports for people to use HFNETCHK LE and stuff like that, and a lot of our co-lo customers use that to keep their win boxes up to date, which I think is great because that's one less abuse email I have to reply to ;-) -Drew -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Friday, August 01, 2003 9:32 PM To: Sean Donelan Cc: nanog(a)merit.edu Subject: Re: Blocking port 135? Sean Donelan wrote: > free/cheap software firewalls that > are easy and effective to use. And breaks all kinds of nifty things which ISP has to pay for via helpdesk support. -Jack

1 0

RE: Microsoft.com attack?
by Jason Frisvold 02 Aug '03

02 Aug '03

On Fri, 2003-08-01 at 22:16, Matt Ploessel wrote: > http://www.microsoft.com/homepage/features/2003/denialofservice.htm Cool... thanks for the info... Hopefully I'll be able to gather any information I can from our infected machine here and forward it on to the proper authorities... Anyone got a contact for the "good guys" ?? :) Thanks! -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Certified - RHCE # 807302349405893 MySQL Core Certified - ID# 205982910 --------------------------- "Something mysterious is formed, born in the silent void. Waiting alone and unmoving, it is at once still and yet in constant motion. It is the source of all programs. I do not know its name, so I will call it the Tao of Programming."

1 0

The irony.. (Re: Blocking port 135?)
by Len Rose 01 Aug '03

01 Aug '03

Who would have thought ten years ago that Microsoft and it's poorly written software would have been responsible for the advent of protocol filtering throughout the net. To those who want to filter everything, please make sure you state those policies all over your company web site so people desiring a "real" conneciton can avoid you. If you even filter only at the very edge you should make it optional as a "value-added" service.

1 0

RE: Microsoft.com attack?
by Dennis Wong 01 Aug '03

01 Aug '03

defcon? -----Original Message----- From: Adam Maloney [mailto:adamm@sihope.com] Sent: Friday, August 01, 2003 2:05 PM To: Jason Frisvold Cc: nanog(a)merit.edu Subject: Re: Microsoft.com attack? Yeah, seeing the same here - it's been flaky for us for the last 30 minutes while we've been trying it. I wonder if it's related to this messages.zip / admin@ thing that's all over the place today. I was just thinking the other day, wouldn't it be funny if there was a worm that had infected machines attack windowsupdate.microsoft.com so you couldn't patch? :) I haven't confirmed that this is the problem, but it seems likely. Adam Maloney Systems Administrator Sihope Communications On Fri, 1 Aug 2003, Jason Frisvold wrote: > Anyone aware of an attack on www.microsoft.com? I had a customer > machine that was attacking it, looks like either a bug in Microsoft's > SP4 (coincidentally this started the day after this was installed) or > there's some new(?) worm of some sort causing this ?? > > Thanks! > > -- > --------------------------- > Jason H. Frisvold > Backbone Engineering Supervisor > Penteledata Engineering > friz(a)corp.ptd.net > RedHat Engineer - RHCE # 807302349405893 > Cisco Certified - CCNA # CSCO10151622 > MySQL Core Certified - ID# 205982910 > --------------------------- > "Imagination is more important than knowledge. > Knowledge is limited. Imagination encircles > the world." > -- Albert Einstein [1879-1955] >

1 0

Microsoft.com attack?
by Jason Frisvold 01 Aug '03

01 Aug '03

Anyone aware of an attack on www.microsoft.com? I had a customer machine that was attacking it, looks like either a bug in Microsoft's SP4 (coincidentally this started the day after this was installed) or there's some new(?) worm of some sort causing this ?? Thanks! -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Engineer - RHCE # 807302349405893 Cisco Certified - CCNA # CSCO10151622 MySQL Core Certified - ID# 205982910 --------------------------- "Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -- Albert Einstein [1879-1955]

3 2

RE: maybe this should be on sec focus but.
by Drew Weaver 01 Aug '03

01 Aug '03

I do apologize for my outdated clue. ;-) -Drew -----Original Message----- From: Mike Tancsa [mailto:mike@sentex.net] Sent: Friday, August 01, 2003 2:34 PM To: Drew Weaver; nanog(a)merit.edu Subject: Re: maybe this should be on sec focus but. Sounds like mimail. See http://vil.nai.com/vil/content/v_100523.htm ---Mike At 02:45 PM 01/08/2003 -0400, Drew Weaver wrote: > I have had like 4 users call and tell me that they're > receiving email from admin@ourdomainname with a unidentified attachment, > possibly a worm that exploits the new Microsoft vulnerability last week, > all 4 of these people reported that their updated this morning antivirus > software missed it. > > > >FYI. > > > >

1 0

Re: maybe this should be on sec focus but.
by Gregory Hicks 01 Aug '03

01 Aug '03

It seems to come with a message attachment of "message.zip". The body of the message goes something like this: ----------------------------------------- From: Admin Sent: Friday, August 01, 2003 11:25 AM To: <user-ID> Subject: your account <some-random-string> Importance: High Hello there, I would like to inform you about important information regarding your email address. This email address will be expiring. Please read attachment for details. --- Best regards, Administrator <same-random-string-as-in-subject-line> Attachment seems to be "message.zip" ----------------------------------------- I would have sent this to the security list, but I got dropped today. Regards, Gregory Hicks > Date: Fri, 1 Aug 2003 14:27:26 -0400 > From: Damian Gerow <damian(a)sentex.net> > To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> > Subject: Re: maybe this should be on sec focus but. > X-GPG-Key-Id: 0xB841F142 > X-GPG-Fingerprint: C7C1 E1D1 EC06 7C86 AF7C 57E6 173D 9CF6 B841 F142 > > > Thus spake Drew Weaver (drew.weaver(a)thenap.com) [01/08/03 14:25]: > > I have had like 4 users call and tell me that they're receiving > > email from admin@ourdomainname with a unidentified attachment, possibly a > > worm that exploits the new Microsoft vulnerability last week, all 4 of these > > people reported that their updated this morning antivirus software missed > > it. > > The latest NAI definitions catch it as Exploit-Codebase (which I *think* is > just a general catchall). We have an open ticket with F-Prot for this, and > are currently waiting on updated definitions from them. > > - Damian --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

maybe this should be on sec focus but.
by Drew Weaver 01 Aug '03

01 Aug '03

I have had like 4 users call and tell me that they're receiving email from admin@ourdomainname with a unidentified attachment, possibly a worm that exploits the new Microsoft vulnerability last week, all 4 of these people reported that their updated this morning antivirus software missed it. FYI.

8 7

Re: WANTED: ISPs with DDoS defense solutions
by Dave Israel 01 Aug '03

01 Aug '03

On 7/31/2003 at 18:30:12 +0000, Paul Vixie said: > > > However, since improvements are always welcome, please recommend tools > > which would allow us to progress "above and beyond" C and it's deficencies. > > I've never been able to program a buffer overrun vulnerability in > Modula 3, or Perl, or any version of Lisp or Scheme. It's possible > that the physics has advanced enough that "low level programming" > now costs more than it saves. On the other hand, compiled C is still significantly faster than, say, Perl or Java. That may not be important for some apps, but when you're pushing hardware to its very limits (you know, the most important stuff on the Net, like playing games and serving porn) you can really feel it. And if there's a security hole or exploitable bug in Perl or Java itself, it exists in every program written with it. There's nothing wrong with low level languages, and with the proper libraries, they gain some of the advantages of high level languages. Personally, it'll be a long time before I'm convinced that I want my routers running Java. (Like how I brought that almost back on topic in the end, there?)

3 2

Just a quick thought...
by Jerry Eyers 01 Aug '03

01 Aug '03

I haven't had time to look, but just for my clarification, why was IPv8 not pursued further. I remember there was a discussion on IPv6 vs IPv8 and the argument to go directly to IPv8 instead, but I had to drop out from following the discussions since. Anyone remember the outcome? It seems obvious IPv6 won, but I am curious as to why... Jerry jeyers(a)rebma.com

4 3