- NANOG - lists.nanog.org

wrt BofA ATM: is it ATM 'automated' or ATM 'async' ?
by Jeff.Hodges＠KingsMountain.com 28 Jan '03

28 Jan '03

good question. anyone know the answer? JeffH ------- Forwarded Message Date: Tue, 28 Jan 2003 02:29:17 -0500 Subject: [IP] is it ATM or ATM Internet Attack's Disruptions More Serious Than Many Thought Possible From: Dave Farber <dave(a)farber.net> To: ip <ip(a)v2.listbox.com> - ------ Forwarded Message From: David Devereaux-Weber <dave(a)cable.doit.wisc.edu> Date: Mon, 27 Jan 2003 23:52:19 -0600 To: dave(a)farber.net Subject: Re: [IP] Internet Attack's Disruptions More Serious Than Many Thought Possible One interesting aspect of the reporting for this event is related to the acronym ATM. The University of Wisconsin-Madison uses Asynchronous Transfer Mode (ATM) for backbone transport. We further use LAN Emulation (LANE) on the Asynchronous Transfer Mode backbone (LANE maps IP addresses to ATM Virtual Circuits and back to IP at the far end). The LANE BUS (Broadcast and Unknown Server) on the network was swamped due to the high volume of SQLSlammer hits on broadcast and unknown addresses, effectively denying legitimate traffic. This BUS saturation did not happen with the Code Red worm several months back. We spent several hours thinking our ATM problems were distinct from the SQLSlammer problems. My question is, has anyone seen source information about the Bank of America and Automated Teller Machines? Is it possible that Bank of America was reporting Asynchronous Transfer Mode (ATM) problems and not Automated Teller Machine (ATM) problems? Dave - -- David Devereaux-Weber, P.E. Network Services Division of Information Technology The University of Wisconsin - Madison dave(a)cable.doit.wisc.edu http://cable.doit.wisc.edu - ------ End of Forwarded Message - ------------------------------------- You are subscribed as Jeff.Hodges(a)stanford.edu To unsubscribe or update your address, click http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ------- End of Forwarded Message

2 1

Re: Level3 routing issues?
by Michael Lamoureux 28 Jan '03

28 Jan '03

"dave" == Dave Stewart <dbs(a)dbscom.com> writes: dave> I've seen various references to this worm firing off and dave> saturating networks worldwide within 1 minute... if *that* isn't dave> scary, I don't know what is. It shows that someone, with the dave> right tools and enough vulnerable servers can take out a good dave> portion of the Internet in seconds. And how can we predict dave> *every* possible issue and block it? Exactly!! This is why the Right Answer (TM) is to get end-users to secure their systems and networks so that an attacker can't get a critical mass of hosts in 1 minute (or even 1 month). You can only do so much on the ISP networks. At some point, everyone needs to admit that it's impossible for us to win this battle as long as people are allowed to not care about the security of their systems. I still remember the despair I felt at how successful the sadmind worm was with Solaris and Windows vulnerabilies that were over 2 years old. Hell, that was a long time ago, and I bet there are still systems on the Internet that have those vulnerabilies. I mean, that's negligence if anything is. dave> I think there's only so much one can do in advance. Sure, we dave> all know we shouldn't have these servers exposed, but again, dave> many are in the position of having to leave them open to some dave> extent - case in point, I have a developer who uses dialup dave> (because he's in the sticks in northern Georgia, and nothing dave> else is available, and he's a skinflint who uses the free or dave> nearly-free dialup providers)... he's also not going to use a dave> VPN... he'll just bitch because he can't get to the server. Note that in the case of a worm, a VPN could work against you. If you have all the right filters in place at your "perimeter" and yet let your employees in through a VPN solution of some sort, you could still be screwed if one of their home systems gets infected somehow. IMHO, Michael

10 24

Re: Level3 routing issues?
by hc 28 Jan '03

28 Jan '03

I am on Verizon-GNI via Qwest and Genuity and seeing the same problem as well. -hc Joel Perez wrote: >I am also seeing increased traffic on my network. It has gotten so bad for one of my edge routers that i cant telnet into it. >But i am on Qwest and GBLX. > > -----Original Message----- > From: Alex Rubenstein [mailto:alex@nac.net] > Sent: Sat 1/25/2003 1:04 AM > To: hc > Cc: nanog(a)merit.edu > Subject: Re: Level3 routing issues? > > > > > > I dunno about that. But, I am seeing, in the last couple hours, all kinds > of new traffic. > > like, customers who never get attacked or anything, all of a sudden: > > http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.html > > > We are seeing this on ports all across out network -- nearly 1/2 our ports > are in delta alarm right now. > > Anyone else? > > I will dig more to look at the traffic. > > > > > On Sat, 25 Jan 2003, hc wrote: > > > > > Anyone seeing routing problems with Level3 at this hour? I just > > witnessed tons of prefixes behind level3's network withdraw. Any > > information on what is happening (if you know) would be great. Thanks! > > > > -hc > > > > > > > > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- > -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net -- > > > > > >

36 76

RE: What could have been done differently?
by Ray Burkholder 28 Jan '03

28 Jan '03

The SANS Institute [sans(a)sans.org] www.sans.org is a well respected collection of individuals who have provided this 'pool' of knowledge and regularly disseminate it to inquiring minds. Ray Burkholder > -----Original Message----- > From: Andy Putnins [mailto:putnins@lett.com] > Sent: January 28, 2003 12:43 > To: Alex Bligh > Cc: Sean Donelan; nanog(a)merit.edu; putnins(a)lett.com > Subject: Re: What could have been done differently? > > This is therefore a request for all of those who possess this > "clue" to > write down their wisdom and share it with the rest of us, so we can > address what clearly is a need for discipline in the design > of networks > and network security, since computer networks are an > infrastructure upon > which people are becoming dependent, even to the point of > their personal > safety. > > - Andy > >

1 0

Re: Banc of America Article
by Roger Marquis 28 Jan '03

28 Jan '03

alex(a)yuriev.com wrote: > > It could be that BoA's network wasn't flooded / servers infected, but that > > the ATM's do not dial BoA directly, and dial somewhere else (ie, maybe some > > kind of ATM Dial Provider, nationwide wholesale, etc), and then tunnel back > > to BoA to get the data. Could be that the upstream of either the dial > > provider, or BoA was just flooded... > > Again, that design makes nearly no sense. The vast majority of the ATMs that > banks own and operate directly are located in the LATAs with bank branches. > Those branches do have good connectivity to the bank processing centers be > that via dedicated links, VPN or carrier pigeons. While the exact mechanism of BofA's exposure is important it is nowhere near as important as the fact that they were, and presumably are still, exposed. My money's on Frame Relay congestion. Some department at BofA, short on engineers and long on budget-oriented management, likely made a decision that saving a lot of money was worth a bit of exposure. I know that decision has been made at other banks. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

RE: What could have been done differently?
by Drew Weaver 28 Jan '03

28 Jan '03

Would it be that hard to have windows update check to see the version of SQL server? Its sad but I know a lot of MS admins only use windows update to check for updates because awhile ago Microsoft pushed it as the premier method of which to update your systems. Im just saying if they included all fixes in one spot instead of halfway automating it and halfway making it cryptically difficult it would benefit everyone. -Drew -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Tuesday, January 28, 2003 10:36 AM To: ekgermann(a)cctec.com; Leo Bicknell; nanog(a)merit.edu Cc: Eric Germann Subject: Re: What could have been done differently? From: "Eric Germann" > > Not to sound to pro-MS, but if they are going to sue, they should be > able to > sue ALL software makers. And what does that do to open source? > Apache, MySQL, OpenSSH, etc have all had their problems. Should we > sue the nail gun > vendor because some moron shoots himself in the head with it? With all the resources at their disposal, is MS doing enough to inform the customers of new fixes? Are the fixes and lates security patches in an easy to find location that any idiot admin can spot? Have they done due diligence in ensuring that proper notification is done? I ask because it appears they didn't tell part of their own company that a patch needed to be applied. If I want the latest info on Apache, I hit the main website and the first thing I see is a list of security issues and resolutions. Navigating MS's website isn't quite so simplistic. Liability isn't necessarily in the bug but in the education and notification. Jack Bates BrightNet Oklahoma

1 0

[barney@databus.com: NYTimes.com Article: Worm Hits Microsoft, Which Ignored Own Advice]
by Barney Wolff 28 Jan '03

28 Jan '03

----- Forwarded message from barney(a)databus.com ----- Date: Tue, 28 Jan 2003 00:43:09 -0500 (EST) Worm Hits Microsoft, Which Ignored Own Advice January 28, 2003 By JOHN SCHWARTZ ... A spokesman for Microsoft, Rick Miller, confirmed that a number of the company's machines had gone unpatched, and that Microsoft Network services, like many others on the Internet, experienced a significant slowdown. "We, like the rest of the industry, struggle to get 100 percent compliance with our patch management," he said. ... http://www.nytimes.com/2003/01/28/technology/28SOFT.html?ex=1044732589&ei=1… Copyright 2002 The New York Times Company ----- End forwarded message -----

1 0

Re: Is there a line of defense against Distributed Reflective attacks?
by Michael Lamoureux 28 Jan '03

28 Jan '03

"alex" == alex <alex(a)yuriev.com> writes: >> > > Sure, but this like all other attacks of this sort can be >> > > tracked... and so the pain is over /quickly/ provided you can >> > > track it quickly :) Also, sometimes null routes are ok. >> > >> > How quickly is quickly? Often times as has been my recent >> > experience (part of my motivation for posting this thread) the >> > flood is over before one can get a human being on the phone. >> >> Once the call arrives and the problem is deduced it can be tracked >> in a matter of minutes, like 6-10 at the fastest... alex> So if one wants to create a really nasty, largely untrackable alex> problem, one just needs to mount a set of attacks that last 3-4 alex> minutes at a time? Sure, that's one way to make it difficult. alex> This is a very bad band-aid. The solution is amazingly simple - Just to be clear, the solution to WHAT is amazingly simple? alex> make it uneconomical to have unprotected networks, For whom to have unprotected networks? What constitutes a protected network? How does one make it uneconomical enough? wondering, Michael

5 4

Re: [Re: Level3 routing issues?]
by Joshua Smith 27 Jan '03

27 Jan '03

Simon Lockhart <simonl(a)rd.bbc.co.uk> wrote: > > On Mon Jan 27, 2003 at 04:16:00PM -0500, alex(a)yuriev.com wrote: > > Again, but why does it talk to the outside world unsupervised? Your > > organization clearly has a border that separates its internal systems from > > external ones. Why not apply those restrictions on *those* borders? > > From inside the organisation to outside, yes, ish. Except all those SSL sites > on random port numbers. And other protocols which use random port numbers > (not just peer-to-peer, but also things like FTP, etc). > > But, we were talking about end-user connected into the inside network using > a VPN. That user needs to have pretty much unfettered access to the > business parts of your internal network. (Okay, mission critical stuff > should be seperately firewalled, but MS makes that hard enough, due to > things like Active Directory, where everything needs to talk to everything). > and don't forget the fact that nearly every M$ service pack/'critical' update changes what ports that program is using (exchange/outlook are really bad about this) joshua > Simon > -- > Simon Lockhart | Tel: +44 (0)1628 407720 (BBC ext 37720) > Technology Manager | Fax: +44 (0)1628 407701 (BBC ext 37701) > BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk > BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

OT: alex@yuriev.com email issues?
by Jeff S Wheeler 27 Jan '03

27 Jan '03

Dear nanog, I apologize in advance for my off-topic posting. I doubt I am alone, though, in saying that Alex Yuriev needs to "slow his roll". Alex, stop sending a follow-up to everything you read. If you really have something to say, please just write a pointed email with a sensible subject and send it. ONCE. I do not intend to flame, but I have mailed similar comments to Alex in private before and it has quite clearly not reduced this behavior. I am not trying to bash his views or his person, only ask him not to post 13 messages in the span of two hours. Again, my apologies for this off-topic posting. -- Jeff S Wheeler <jsw(a)five-elements.com>

2 1