- NANOG - lists.nanog.org

RE: OpenSSL
by Matt Ryan 19 Mar '03

19 Mar '03

lol - I promise in future to read to the bottom of messages. In fact if I didn't top post I would have noticed, but that's a different can of worms 8-) Matt. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: 18 March 2003 17:52 To: Matt Ryan; alex(a)yuriev.com; nanog(a)merit.edu Subject: Re: OpenSSL Note the smiley 10 lines down. You have been had. Pete ----- Original Message ----- From: "Matt Ryan" <Matt.Ryan(a)telewest.co.uk> To: "'Petri Helenius'" <pete(a)he.iki.fi>; <alex(a)yuriev.com>; <nanog(a)merit.edu> Sent: Tuesday, March 18, 2003 5:58 PM Subject: RE: OpenSSL MPLS (on its own) gives you jack-squat in terms of delay and jitter. All the clever queuing can do it for you - but then it can for IP (because its the same thing!). Matt. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: 18 March 2003 15:10 To: alex(a)yuriev.com; nanog(a)merit.edu Subject: Re: OpenSSL > > While the timing attack is the attack against the SSL server, it is my > reading of the paper that the attacks' success largely depends on ability to > tightly control the time it takes to communicate with a service using SSL. > Currently, such control is rather difficult to achive on links other than > ethernet. > Doesn´t MPLS provide consistent delay and minimal jitter and thus SSL servers connected to MPLS networks are more suspectible to attack? :-) Pete ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

1 0

RE: Co-lo best practices on IP allocations
by McBurnett, Jim 19 Mar '03

19 Mar '03

One more thought: If the company is a SPAM or other less than popular type, I would keep a watch on SPAM-L and spamhaus.org Look for you IP block.. Some networks flat out put IP Access lists to block ranges for SPAM/XXXX.. J >-----Original Message----- >From: Daniel Abbey [mailto:dabbey@edeltacom.net] >Sent: Tuesday, March 18, 2003 11:57 AM >To: nanog(a)merit.edu >Subject: Co-lo best practices on IP allocations > > > >Are there any suggestions/ideas on best practices when it >comes to co-lo >allocation of addresses to its customers? Is there any site >that may have >some pointers? The dilemma is whether to charge or no to >charge separate for >the IPs. Should it be a cause built into their overall >contract? Any ideas? > >

1 0

RE: Code red- Returning?
by mohammed_al_sukkar＠maktoob.com 19 Mar '03

19 Mar '03

McBurnett, Jim Write >Marty, >this would be great news, IF I wasn't the victim.. >I did read the article when I got my NW Fusion this month.. >This needs to go to the folks who are infected... > >Is this the correct place for an Advertisement HTML cause error for software! Please write future in the US-ASCII or ISO-8859-6 Arabic ONLY Thank You. _________________________________________________________ Enjoy your secure on-line shopping experience with Shop@maktoob Mall. http://www.maktoob.com/

1 0

RE: Co-lo best practices on IP allocations
by mohammed_al_sukkar＠maktoob.com 19 Mar '03

19 Mar '03

marc van hoof Write >I know of cases where adult-websites/spammers (who have more money than >they know what to do with) will buy 8 class-C's and when one gets >blacklisted, they move onto the next... by the time they're on the 8th, >the 1st is available again... 8 /24 is small pool. Look for stole /16 use to Spam- 157.156.0.0 netmask 255.255.0.0 _________________________________________________________ Go see what people are talking about! Express your opinion with everyone on many topics in Maktoob Forum. http://www.maktoob.com/

1 0

--NON-Topic-- Advertising on NANOG instead of......
by McBurnett, Jim 18 Mar '03

18 Mar '03

Marty, Many people on NANOG get there here subscribing to NWF... If your email was just a link, and an article summary, sure no problem, but putting the entire article here.. well that is a different story.. Kinda like, here is my reply, but I want you to read the entire thing to see what I have to say, and then to discover my reply is 99% off topic.. Yes, Code Red is a bug that needs to be patched. But where in your response did you answer: Has anyone out there noticed an increase in a Code-Red patterned virus? That is my problem. most of us get hundreds of emails a week. and to spend time going through something that is off-topic is a waste. Several of the other users here have commented that they filter out emails from said individuals when they notice the consistent off-topic replies. And I have held out so far... But I am leaning..... J -----Original Message----- From: Marty Armstrong [mailto:MartyA@patchlink.com] Sent: Tuesday, March 18, 2003 1:46 PM To: McBurnett, Jim Cc: nanog(a)merit.edu Subject: RE: Code red- Returning? Jim, It is no my intent to advertise as much as inform. The Network World article tells the story and speaks about all the companies in this category not just PatchLink. Also, other members of this list have discussed application on this prior, would their discussions also be considered advertising? -Marty -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Tuesday, March 18, 2003 11:38 AM To: Marty Armstrong Cc: nanog(a)merit.edu Subject: RE: Code red- Returning? Marty, this would be great news, IF I wasn't the victim.. I did read the article when I got my NW Fusion this month.. This needs to go to the folks who are infected... Is this the correct place for an Advertisement? Jim -----Original Message----- From: Marty Armstrong [mailto:MartyA@patchlink.com] Sent: Tuesday, March 18, 2003 12:57 PM To: McBurnett, Jim Cc: nanog(a)merit.edu Subject: RE: Code red- Returning? Network World evaluated several Patch Management tools on March 3rd. PatchLink Update won the Blue Ribbon Award. Also, none of our customers were hit by Slammer. PatchLink Update's flexibility helped it best three other products tested. Please see the attached link to read about our Blue Ribbon Award from Network World Fusion for Patch Management . http://www.nwfusion.com/reviews/2003/0303patchrev.html Review: Windows patch management tools PatchLink Update's flexibility helped it best three other products tested. By Mandy Andress, Network World Global Test Alliance Network World, 03/03/03 With Microsoft releasing more than 230 security bulletins since the beginning of 2000 - most of those requiring some sort of corrective action to fix a hole in one of its Windows-based products - the numbers speak for themselves: Windows patch management in an enterprise environment is a nightmare. We tested four stand-alone Windows patch management products - BigFix's Enterprise Suite, Gravity Storm Software's Service Pack Manager 2000, PatchLink's Update and Shavlik Technologies' HfNetChk Pro to find out if they improve patch deployment. (See "Not in the game" for declining vendors.) Patch management tools should identify accurately which patches are missing on each system, provide an easy means to deploy patches and provide administrative reports tracking patch status across multiple machines. The products we tested (see How we did it) attack the problem in two ways - with or without agent software. Agent-based products - such as those from PatchLink and BigFix - can greatly reduce network traffic by offloading processing and analysis to the target system, saving data until it needs to report to the central server. But they also force an administrator to manage software on all systems the product analyzes. With agentless products - such as those from Shavlik and Gravity Storm - you don't have any distributed management issues, but whenever a scan is requested all tests and communications travel over the network. If scanning a domain with a large number of systems, the increase in network traffic can be quite significant. PatchLink's Update 4.0 earned the Network World Blue Ribbon award for its ease of use, flexibility, automation and letting you easily create deployment packages. PatchLink has two components - PatchLink Update Server and the agent. The Update Server is installed on a Windows 2000 Server with SP2 and Internet Information Server (IIS). The installation process sets up a Microsoft Data Engine (MSDE) database, which can be upgraded to a full SQL Server after installation. This upgrade is recommended for large organizations. You easily can push the agents to targeted machines using the Agent Install Wizard, or agents can be installed during the logon process. For management purposes, administrators connect to the PatchLink server through a Web interface, which lets you view reports, deploy packages, create packages and view system inventory. PatchLink, the company, monitors Microsoft and other vendors, such as Citrix Systems and Adobe, for newly released patches. PatchLink engineers test the patches, put them into PatchLink's proprietary package format and deploy them to customers' local PatchLink servers through a periodic subscription-checking process, which occurs over Secure Sockets Layer at a time the administrator configures. Administrators receive e-mail informing them of a new patch on the PatchLink server. If it is a critical patch, it also is downloaded to the Update Server on the customer's network. Noncritical patches will be downloaded at the administrator's request. PatchLink automatically caches critical patches on the Update Server, a marked difference from BigFix and the agentless products. Caching patches is useful and the recent Sapphire/Slammer SQL Server worm proves the point. If a worm or other malicious act is taking place that slows down the Internet, how will administrators download patches to their critical servers? With cached patches, you already have the files at your location. Best Regards, Marty Armstrong martya(a)patchlink.com PatchLink Corporation 3370 N. Hayden Road Suite 123-175 Scottsdale, AZ 85251 (P) 480-970-1025 Ext. 136 (F) 480-970-6323 <<http://www.patchlink.com/>> PatchLink Update Awarded Blue Ribbion from Network World Fusion For the article go to: http://www.nwfusion.com/reviews/2003/0303patchrev.html PatchLink Update Receives Network Computing Editor's Choice Award for Patch Management For the article go to: <<http://www.patchlink.com/media_room/nwc92002.pdf>> -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Tuesday, March 18, 2003 10:50 AM To: nanog(a)merit.edu Subject: Code red- Returning? Has anyone out there noticed an increase in a Code-Red patterned virus? I know about the Microsoft bug that came out yesterday/last night. But I am seeing the same symptoms as Code Red, 800+ hits in the last 12 hours, from the same Class A network I am on. The amount is increasing per hour.. It started with 50 the first hour and now it just about 150 an hour... Thoughts? thanks, Jim

1 0

FW: Code red- Returning?
by McBurnett, Jim 18 Mar '03

18 Mar '03

I think this shouldgo here.. Mistype nanog.... Jim >-----Original Message----- >From: Johannes Ullrich [mailto:jullrich@euclidian.com] >Sent: Tuesday, March 18, 2003 1:10 PM >To: McBurnett, Jim >Cc: anog(a)merit.edu >Subject: Re: Code red- Returning? > > > > >Yes. This month, we are tracking about twice as many sources as usual >scanning port 80. The likely reason is the release of Code Red >F earlier >this month. > >graph of port 80 activity for the last 2+months: >ttp://www.dshield.org/port_report.php?port=80&days=70 > > >In addition, there are some spikes in the number of targets >scanned, which >could be target list acquisitions for the next big thing >(maybe the WebDav >exploit). > >AFAIK, the only difference for Code Red F is that it changed >the 'cut off year' >at which it will stop scanning. So it probably infected some >machines that due >to clock settings where not infected by the other versions. >But I haven't had >a chance to look at it in detail. > > > >On Tue, 18 Mar 2003 12:50:17 -0500 >"McBurnett, Jim" <jmcburnett(a)msmgmt.com> wrote: > >> Has anyone out there noticed an increase in a Code-Red >patterned virus? >> I know about the Microsoft bug that came out yesterday/last night. >> But I am seeing the same symptoms as Code Red, >> 800+ hits in the last 12 hours, from the same Class A >network I am on. >> The amount is increasing per hour.. >> It started with 50 the first hour and now it just about 150 >an hour... >> >> Thoughts? >> >> thanks, >> Jim >> >> >> > > >-- >-------------------------------------------------------------------- >jullrich(a)euclidian.com Collaborative Intrusion Detection > join http://www.dshield.org >

1 0

RE: Code red- Returning?
by McBurnett, Jim 18 Mar '03

18 Mar '03

Marty, this would be great news, IF I wasn't the victim.. I did read the article when I got my NW Fusion this month.. This needs to go to the folks who are infected... Is this the correct place for an Advertisement? Jim -----Original Message----- From: Marty Armstrong [mailto:MartyA@patchlink.com] Sent: Tuesday, March 18, 2003 12:57 PM To: McBurnett, Jim Cc: nanog(a)merit.edu Subject: RE: Code red- Returning? Network World evaluated several Patch Management tools on March 3rd. PatchLink Update won the Blue Ribbon Award. Also, none of our customers were hit by Slammer. PatchLink Update's flexibility helped it best three other products tested. Please see the attached link to read about our Blue Ribbon Award from Network World Fusion for Patch Management . http://www.nwfusion.com/reviews/2003/0303patchrev.html Review: Windows patch management tools PatchLink Update's flexibility helped it best three other products tested. By Mandy Andress, Network World Global Test Alliance Network World, 03/03/03 With Microsoft releasing more than 230 security bulletins since the beginning of 2000 - most of those requiring some sort of corrective action to fix a hole in one of its Windows-based products - the numbers speak for themselves: Windows patch management in an enterprise environment is a nightmare. We tested four stand-alone Windows patch management products - BigFix's Enterprise Suite, Gravity Storm Software's Service Pack Manager 2000, PatchLink's Update and Shavlik Technologies' HfNetChk Pro to find out if they improve patch deployment. (See "Not in the game" for declining vendors.) Patch management tools should identify accurately which patches are missing on each system, provide an easy means to deploy patches and provide administrative reports tracking patch status across multiple machines. The products we tested (see How we did it) attack the problem in two ways - with or without agent software. Agent-based products - such as those from PatchLink and BigFix - can greatly reduce network traffic by offloading processing and analysis to the target system, saving data until it needs to report to the central server. But they also force an administrator to manage software on all systems the product analyzes. With agentless products - such as those from Shavlik and Gravity Storm - you don't have any distributed management issues, but whenever a scan is requested all tests and communications travel over the network. If scanning a domain with a large number of systems, the increase in network traffic can be quite significant. PatchLink's Update 4.0 earned the Network World Blue Ribbon award for its ease of use, flexibility, automation and letting you easily create deployment packages. PatchLink has two components - PatchLink Update Server and the agent. The Update Server is installed on a Windows 2000 Server with SP2 and Internet Information Server (IIS). The installation process sets up a Microsoft Data Engine (MSDE) database, which can be upgraded to a full SQL Server after installation. This upgrade is recommended for large organizations. You easily can push the agents to targeted machines using the Agent Install Wizard, or agents can be installed during the logon process. For management purposes, administrators connect to the PatchLink server through a Web interface, which lets you view reports, deploy packages, create packages and view system inventory. PatchLink, the company, monitors Microsoft and other vendors, such as Citrix Systems and Adobe, for newly released patches. PatchLink engineers test the patches, put them into PatchLink's proprietary package format and deploy them to customers' local PatchLink servers through a periodic subscription-checking process, which occurs over Secure Sockets Layer at a time the administrator configures. Administrators receive e-mail informing them of a new patch on the PatchLink server. If it is a critical patch, it also is downloaded to the Update Server on the customer's network. Noncritical patches will be downloaded at the administrator's request. PatchLink automatically caches critical patches on the Update Server, a marked difference from BigFix and the agentless products. Caching patches is useful and the recent Sapphire/Slammer SQL Server worm proves the point. If a worm or other malicious act is taking place that slows down the Internet, how will administrators download patches to their critical servers? With cached patches, you already have the files at your location. Best Regards, Marty Armstrong martya(a)patchlink.com PatchLink Corporation 3370 N. Hayden Road Suite 123-175 Scottsdale, AZ 85251 (P) 480-970-1025 Ext. 136 (F) 480-970-6323 <<http://www.patchlink.com/>> PatchLink Update Awarded Blue Ribbion from Network World Fusion For the article go to: http://www.nwfusion.com/reviews/2003/0303patchrev.html PatchLink Update Receives Network Computing Editor's Choice Award for Patch Management For the article go to: <<http://www.patchlink.com/media_room/nwc92002.pdf>> -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: Tuesday, March 18, 2003 10:50 AM To: nanog(a)merit.edu Subject: Code red- Returning? Has anyone out there noticed an increase in a Code-Red patterned virus? I know about the Microsoft bug that came out yesterday/last night. But I am seeing the same symptoms as Code Red, 800+ hits in the last 12 hours, from the same Class A network I am on. The amount is increasing per hour.. It started with 50 the first hour and now it just about 150 an hour... Thoughts? thanks, Jim

1 0

whois.crsnic.net down?
by up＠3.am 18 Mar '03

18 Mar '03

It's been like this all day: The GeekTools Whois Proxy has encountered an error: Unable to connect to whois.crsnic.net. I've also had a couple of reports of weird DNS issues from other parts of the 'net, although it's fine here... James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 1

Code red- Returning?
by McBurnett, Jim 18 Mar '03

18 Mar '03

Has anyone out there noticed an increase in a Code-Red patterned virus? I know about the Microsoft bug that came out yesterday/last night. But I am seeing the same symptoms as Code Red, 800+ hits in the last 12 hours, from the same Class A network I am on. The amount is increasing per hour.. It started with 50 the first hour and now it just about 150 an hour... Thoughts? thanks, Jim

2 1

RE: OpenSSL
by Matt Ryan 18 Mar '03

18 Mar '03

MPLS (on its own) gives you jack-squat in terms of delay and jitter. All the clever queuing can do it for you - but then it can for IP (because its the same thing!). Matt. -----Original Message----- From: Petri Helenius [mailto:pete@he.iki.fi] Sent: 18 March 2003 15:10 To: alex(a)yuriev.com; nanog(a)merit.edu Subject: Re: OpenSSL > > While the timing attack is the attack against the SSL server, it is my > reading of the paper that the attacks' success largely depends on ability to > tightly control the time it takes to communicate with a service using SSL. > Currently, such control is rather difficult to achive on links other than > ethernet. > Doesn´t MPLS provide consistent delay and minimal jitter and thus SSL servers connected to MPLS networks are more suspectible to attack? :-) Pete ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

3 2