- NANOG - lists.nanog.org

Re: kornet.net abuse desk is mailing out W32.Nimda.E@mm worm
by Steven M. Bellovin 30 Oct '01

30 Oct '01

In message <195358945566.20011030133637(a)conti.nu>, Kai Schlichting writes: > >If you or your staff have dealt with kornet.net (a Korean ISP belonging >to Korean Telecom), and specifically abuse(a)kornet.net in the past, beware: >It seems that they've been overrun by the brand-spanking-new W32.Nimda.E@mm >worm (**) sometimes late last night. > >Specific case in hand: yesterday at 9:40pm EST, I received a mail >with a Subject: line of an UNRELATED abuse issue (hello MFNX/XO/ >Above.net :) that contains a MIME attachment with an auto-playing >"sound file" of sample.exe , openened in an <iframe> of your favorite >Microsoft email client. Source IP of the mailing : 210.222.17.36 (/24). Note, however, that the From: line on these Nimda variants is also forged; see http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html for details. (I received several messages saying that some mail I sent was infected with Nimda.E. This struck me as quite improbable, since I use NetBSD for all my email and other real work.) --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

1 0

Re: Re[2]: NOC Question
by Gregory Urban 30 Oct '01

30 Oct '01

At 12:36 AM 10/19/2001, you wrote: >I'd like to see how many folks have the top-end functional NOCs as opposed >to fishbowls for customers to gawk at like a zoo. Low, indirect lighting. >Sound and light absorbing materials everywhere. Quiet fans in the >ceiling. Enough space between NOC techs so that phone conversations don't >interfere with each other. etc. > >That's opposed to NOCs with white, hard, sound and light reflecting >materials, bright flourscent lighting, closely packed people and the clear >window to look in from the outside creating the fishbowl effect. > >It's hard to tell, but the AT&T NOC in the link given earlier seems to >have the characteristics of the first kind, but the picture's not too >detailed. Any good, detailed pictures of a top-end functional NOC with >said characteristics? > >scott Talk about a fishbowl, the AT&T NOC has an overlook area for customers complete with stadium seating! Greg U

1 0

kornet.net abuse desk is mailing out W32.Nimda.E@mm worm
by Kai Schlichting 30 Oct '01

30 Oct '01

If you or your staff have dealt with kornet.net (a Korean ISP belonging to Korean Telecom), and specifically abuse(a)kornet.net in the past, beware: It seems that they've been overrun by the brand-spanking-new W32.Nimda.E@mm worm (**) sometimes late last night. Specific case in hand: yesterday at 9:40pm EST, I received a mail with a Subject: line of an UNRELATED abuse issue (hello MFNX/XO/ Above.net :) that contains a MIME attachment with an auto-playing "sound file" of sample.exe , openened in an <iframe> of your favorite Microsoft email client. Source IP of the mailing : 210.222.17.36 (/24). Mental note to all abuse desk personnel and publicly visible contacts: do not use Microsoft, or any other widely used piece of software to read and process your mail. Auto-adding mail senders to your Outlook addressbook could be considered a deadly sin. Anti-Virus software with definitions older than 24 hrs seem to be a real hazard, too. bye,Kai (**) http://securityresponse.symantec.com/avcenter/venc/data/w32.nimda.e@mm.html

1 0

FBI is at it again
by Larry Diffey 30 Oct '01

30 Oct '01

Per the following article: http://www.foxnews.com/story/0,2933,37203,00.html it appears as if the FBI now wants to route ALL Internet traffic through it's central servers!!!! What gall!! What nerve!!!! Now, for all of you who said, "Hey, I'm not doing anything wrong, let the FBI monitor what it wants to." can go shove hot spikes up your nose. I don't think the FBI really wants to control the Internet, they want to destabilize it. As tyranny approaches the only thing more dangerous than an armed populace is an informed one. If they can monitor all the traffic, they can certainly control it. The ISP's (whatever those are) need to collectively tell the FBI to go jump off a bridge. Information campaigns need to be sent to the customers to alert them of the potential loss of civil liberties. I'm gonna stop before I say something that will get me arrested. Regards, Larry Diffey

12 11

RE: Fwd: Re: Digital Island sponsors DoS attempt?
by Scotty Allen 30 Oct '01

30 Oct '01

> I have no objection if someone who honestly saw a message I > wrote and > thought I'd be suitable for a particular job emails me asking if I'm > interested. However, the same email would be bulk if sent to everyone who > posts to NANOG, even if says, "I saw your post about "Re: Fwd: > Re: Digital > Island sponsors DoS attempt" and thought you might be interested > in buying > our premium fishing worms". A corallary to this is the dreaded "I saw your resume on <insert job board here> and so you must be interested in our offer of <insert job hunting service here>." The spammer would argue they are in the right, in that as part of posting a resume, one is expecting, and inviting responses. However, I would argue that just because I post my resume, doesn't mean I'm interested in anything other than serious job offers. I dealt with a similar situation from the abuse desk end, in which a client was doing searches of resumes on job boards for a given skill set, and then mass mailing them with a specific job offer that centered around that skill set. It was a tough issue to resolve, because on the one hand, from our client's perspective, he was contacting people he thought would be genuinely interested. And yet, from the recipients perspective, since it wasn't directed straight to them, it could be considered UBE. Moral of the story is, it came down to a very fine line of what does "solicited" mean? We ended up comprimising that he would fully disclose where he got his email addresses from, and why he was sending the email, which all but competely eliminated complaints. Scotty Allen

1 0

Re: New Alert :: Whens the 'Net the target?
by Jeffrey Meltzer 30 Oct '01

30 Oct '01

My bad, has been off of mx10 forever, guess I forgot to take off of mx20 Jeff On Mon, Oct 29, 2001 at 04:28:59PM -0800, Derek J. Balling typed: > Would be much useful if you would disable orbs.org checking since > it's returning random false-positives since it went out of business > two months ago: > > ----- Transcript of session follows ----- > ... while talking to mx10.exobit.org.: > >>> DATA > <<< 421 Error: timeout exceeded > ... while talking to mx20.exobit.org.: > >>> DATA > <<< 554 Service unavailable; [64.71.143.244] blocked using relays.orbs.org > 554 5.0.0 Service unavailable > <<< 554 Error: no valid recipients > > Hard to confirm the signup, if you won't accept the confirmations... > > D > > At 6:38 PM -0500 10/29/01, Jeffrey Meltzer wrote: > >(no offense to the poster, someone was bound to post..) > > > >I see this thread getting long and entirely off topic for nanog. I've > >setup a list for discussions such as this, and any type of physical attack > >(although I guess regular DOS could be on topic) at the > >internet infrastruture, as this could go on for a while... > > > >http://www.exobit.org/mailman/listinfo/net-attacks > >for info. > > > >Let's try and keep nanog more operational? > > > >Jeff > > > >On Mon, Oct 29, 2001 at 06:17:09PM -0500, Eric Germann typed: > >> Do you think there will be an Internet component to one of these, someday? > >> > >> http://www.msnbc.com/news/633205.asp > >> > >> > >> ========================================================================== > >> Eric Germann CCTec > >> ekgermann(a)cctec.com Van Wert OH 45801 > >> http://www.cctec.com Ph: 419 968 2640 > >> Fax: 603 825 5893 > >> > >> "It is so easy to miss pretty trivial solutions to problems deemed > >> complicated. The goal of a scientist is to find an interesting problem, > >> and live off it for a while. The goal of an engineer is to evade > >> interesting problems :)" -- Vadim Antonov <avg(a)kotovnik.com> on NANOG > >> > >> > >> > > > -- > +---------------------+-----------------------------------------+ > | dredd(a)megacity.org | "Thou art the ruins of the noblest man | > | Derek J. Balling | That ever lived in the tide of times. | > | | Woe to the hand that shed this costly | > | | blood" - Julius Caesar Act 3, Scene 1 | > +---------------------+-----------------------------------------+ >

1 0

Re: Fwd: Re: Digital Island sponsors DoS attempt
by Paul Vixie 29 Oct '01

29 Oct '01

> > I am sure, Digital Island gets the necessary permissions from network > > owners before hammering them with those requests, right? > The same "permissions" that allow seamless end-to-end connectivity across > the entire Internet. The same "permissions" you granted to others when > you signed the connectivity agreement. "everything not expressly forbidden is allowed" is a workable model for peering relationships and even transit relationships, but it only works within the context of a direct relationship of some kind. in the case where the sender and receiver are communicating between one or many third parties, there is no direct relationship and thus no apriori terms of service to which the traffic must conform. for this, we reverse the model: "everything not welcomed is forbidden" and thus create a prior restraint problem which goes by the name "what, then, is implicitly welcome or unwelcome?" generally any traffic which unequally benefits the sender isn't welcome. ping traffic, even ping traffic which helps one network figure out how to best route traffic to another, still unequally benefits the sender. one ought not, in my opinion, ever have to ask that such pings be stopped. another test for "welcome" is "if everybody did this, would the recipient be injured?" clearly this is the same profile as "unequal benefit to the sender" and the answer in the case of these pings is "yes, ouch." smurf, ddos in general, and spam also classify well by this criteria. it *is* possible to know before initiating communication whether it's implicitly "welcome" by this standard, even if you have no direct relationship to the recipient whose terms and conditions would explicitly tell you the answer.

8 7

Re: FBI is at it again
by Steven M. Bellovin 29 Oct '01

29 Oct '01

In message <GKEFKKIKGCMICPKBAEIMKENECDAA.dgolding(a)sockeye.com>, "Daniel Golding " writes: > > >Are you kidding? The problems with this are numerous. First, the source is >Fox News, which is about a half step up from the Drudge Report. I tried posting this before, but I don't think my note got out. Basically, from what I've heard this report is indeed inaccurate. The FBI is holding a meeting on Thursday of this week where they will explain their new desires, and the legal justification for them; let's see what they say. (Btw -- this is apparently work that's been going on for two years; it's not in reaction to September 11.) --Steve Bellovin, http://www.research.att.com/~smb Full text of "Firewalls" book now at http://www.wilyhacker.com

3 2

Hello, route filters?
by Adam Rothschild 29 Oct '01

29 Oct '01

I guess I see the rationale behind passing this cruft along to EXDS transit customers who haven't yet read the filtering section of Halabi (remember: more specifics == more outbound traffic from customer == more revenue). But exchange points? -a ----- Forwarded message from stats(a)merit.edu ----- Date: Sun, 28 Oct 2001 10:00:08 -0500 (EST) From: stats(a)merit.edu Subject: 10/27/01 Internet Routing Problems To: routing-problems(a)merit.edu See http://www.merit.edu/ipma for a more detailed report on routing problems and recommendations on ways service providers can limit the spread of invalid routing information. Send comments and questions to ipma(a)merit.edu [...] Reserved Network and Host Announcements (includes prefixes longer than /27 bits) ---------------------------------------- 202.0.73.32/27 at Paix from AS2516 ASPATH=2516 2500 IGP 202.139.168.232/29 at Paix from Exodus (AS3967) ASPATH=3967 9328 10097 17738 IGP 202.139.172.64/27 at Paix from Exodus (AS3967) ASPATH=3967 9328 10097 17738 IGP 203.236.98.224/27 at Paix from Exodus (AS3967) ASPATH=3967 4766 9522 IGP 203.239.51.128/28 at Paix from Exodus (AS3967) ASPATH=3967 4766 IGP 203.89.225.64/27 at Paix from Exodus (AS3967) ASPATH=3967 9328 6992 IGP 204.71.176.0/27 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 204.71.184.128/27 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 205.216.146.128/27 at Paix from Exodus (AS3967) ASPATH=3967 15870 IGP 206.132.131.160/27 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.142.224/27 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.160.0/27 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.160.32/27 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.187.64/28 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.187.80/30 at Paix from Exodus (AS3967) ASPATH=3967 15870 IGP 206.132.187.84/30 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.187.88/29 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.188.112/28 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.188.32/28 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.194.192/27 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.254.248/29 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.254.36/30 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.29.128/27 at Paix from Exodus (AS3967) ASPATH=3967 IGP 206.132.34.104/30 at Paix from Exodus (AS3967) ASPATH=3967 18997 IGP 206.132.34.112/28 at Paix from Exodus (AS3967) ASPATH=3967 18997 IGP 206.132.34.192/27 at Paix from Exodus (AS3967) ASPATH=3967 18997 IGP 206.132.34.224/27 at Paix from Exodus (AS3967) ASPATH=3967 IGP 206.132.34.64/27 at Paix from Exodus (AS3967) ASPATH=3967 18997 IGP 206.132.34.96/29 at Paix from Exodus (AS3967) ASPATH=3967 18997 IGP 206.132.42.0/27 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.42.48/29 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.42.56/30 at Paix from Exodus (AS3967) ASPATH=3967 15870 IGP 206.132.42.60/30 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.44.128/28 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.44.144/28 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.44.160/27 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.56.0/29 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.56.12/30 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.56.16/28 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.56.32/27 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP 206.132.56.8/30 at Paix from Exodus (AS3967) ASPATH=3967 15878 IGP 206.132.58.136/30 at Paix from Exodus (AS3967) ASPATH=3967 18993 IGP ***** Too many entries. List Truncated! ***** [...] ----- End forwarded message -----

5 6

Re: RBL & Broadband (WAS: Digital Island sponsors DoS attempt?)
by Paul Vixie 29 Oct '01

29 Oct '01

> ... If you do not filter spamers, how do you stop them? If you do > filter spamers, how to do stop from occasionally hurting people in > Christopher's situation? I dunno. Suggestions? That depends. If you want to filter abusive senders you have a different problem than if you want to filter abusive traffic. Abusive senders have ways of avoiding your filters; abusive traffic has other ways. Generally a high volume receiver (such as a busy e-commerce web site) has no way to differentiate an attack from a bump in traffic load. Whereas the number of possible sources of abuse ("launch points") is finite. These sources are not necessarily evil but from the reciever's point of view there's not a lot of difference between evil and laziness on the part of a source-owner. In the specific case of e-mail abuse ("spam"), has everybody checked out http://www.rhyolite.com/dcc/ yet? There ARE ways to raise the bar on the sender's pattern selections, at least for e-mail.

1 0