- NANOG - lists.nanog.org

Re: My DB of Nimda infected Hosts
by Ulf Zimmermann 20 Sep '01

20 Sep '01

On Thu, Sep 20, 2001 at 03:23:10PM -0500, bonk(a)webchat.chatsystems.com wrote: > On Thu, 20 Sep 2001, Ulf Zimmermann wrote: > > Hello, > > > > I am doing a major rewrite of the scrips and going to do a reorg > > of the DB between 3pm and 5pm PDT. This reorg will allow easier > > searching and viewing. Also with that I should be able to get > > easier statistics. With the new scripts the password for submitter > > will be used to modify or delete entries. > > > I applaud what you've done with this as it's extremely useful. However, I > see many duplicates of IP's submitted. Is there a way you can code the > script so that doesn't happen ? The current layout this was intent to show multiple entries for IPs which could be dynamic (dialup user, etc.). I am working right now on a complete rewrite, which still allows multiple entries but it can set to only display it once. > > > Regards, Ulf. > > ================================================ > Travis > Email: Bonk(a)Undernet.Org | Bonk(a)cyberabuse.org > ================================================ > > -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

Nimda Online DB, addition
by Ulf Zimmermann 20 Sep '01

20 Sep '01

The online DB has been switched to Postgres and the field holding the IP is of type "inet" now. I also added another script to allow single automatic submission: http://seven.alameda.net/~ulf/nimda/addsingle.php?ip=<someIP>&email=<someemail> In addition to the above parameters there are the following possible: logdate=<somelogdate> Usual a string like: 2001/09/19:15:08:10 passwd=<somepassword> If not set this will be empty and you won't be able to edit or delete entries when I bring that function up comment=<Some comment> Like for example: "Added by log2DB script v0.1" -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

3 4

was Virus fix---Network Associates' fixes/filters, etc
by Murphy, Brennan 20 Sep '01

20 Sep '01

Network Associates' Mcafee business unit has released a stand alone tool to remove the nimda virus/worm. See this web page for more information: http://vil.nai.com/vil/virusSummary.asp?virus_k=99209 <http://vil.nai.com/vil/virusSummary.asp?virus_k=99209> Obviously, existing anti-virus software DATs have also been released. Network Associates' Sniffer business unit has released Sniffer filters to assist with identifying infected machines. There is even a way to set up an alert to send an email once the worm's signature traffic is detected on a network. See this web page for the filter and more information: http://www.sniffer.com/other/jump/nimda-filter.asp <http://www.sniffer.com/other/jump/nimda-filter.asp> I am not authorized/~/able to answer software specific support questions--so please do not contact me with those. :-) However, if I see a generic question posted to this list about the worm that I can answer, I will do so...time permitting. Thanks, -BM -----Original Message----- From: Eric Germann [mailto:ekgermann@cctec.com] Sent: Thursday, September 20, 2001 7:53 AM To: Indra PRAMANA; Andras Bellak Cc: Steve Smith; nanog(a)nanog.org Subject: RE: Trend Micro FIX_NIMDA.EXE - was Re: Virus fix -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Indra PRAMANA Sent: Wednesday, September 19, 2001 11:56 PM To: Andras Bellak Cc: Steve Smith; nanog(a)nanog.org Subject: RE: Trend Micro FIX_NIMDA.EXE - was Re: Virus fix Andras, At 07:46 PM 9/19/01 -0700, Andras Bellak wrote: Norton released a definition file yesterday that cleaned everything but the .eml files and made the systems resistant to re-infection. They released an update today that got the .eml files as well. Yes, but this requires us to install the antivirus software as well. Do you know any tools like FIX_NIMDA.EXE that can fix the problem automatically without having to use the antivirus software? I still haven't seen anything that cleans up the htm, html, asp, etc files, but there are a few utilities that work fine for doing that one. What are the utilities? Where can I get them? Norton Antivirus will clean most of the htm, html, asp, etc files. http://www.symantec.com Thank you for your help. Cheers.

1 0

Cable cut in Singapore
by Lloyd Taylor 20 Sep '01

20 Sep '01

ZDNet reports cable cuts in Singapore: SINGAPORE--Internet traffic from Asia to the United States has slowed to a snail's pace due to two impaired undersea cables. "There appears to be a damage to some circuits on the China-US and SEA-ME-WE3 cables, about 30 km off Shantou in China," said telecommunications service provider Reach Communications spokesperson Martin Ratia. http://dailynews.yahoo.com/h/zd/20010920/tc/cable_snag_slows_asian_access_t…

1 0

Re: Pattern matching odd HTTP request
by Karsten W. Rohrbach 20 Sep '01

20 Sep '01

Noah(sitz@onastick.net)@2001.09.20 10:36:17 +0000: > On Thu, 20 Sep 2001, Bill McGonigle wrote: > > > > > Thanks for all your work on this one, Karsten, and I hope you had a good > > nap. :) > > > > mod_throttle looks like it will stop a DOS from one client effectively, > > though the configuration is a bit complex for just that use of it. I > > plan to implement it for that. It doesn't appear to be useful though > > for the type of DDOS that seems to be brewing (which I hope fizzles and > > dies). > > I haven't tried it myself (yet... it's on the plate), but mod_tsunami > (http://bert.tuxfamily.org/mod_tsunami/) may work better. It limits the > number of connections on a per-directory basis, using the apache > scoreboard. The primary issue I had with mod_throttle when I was looking > at it (a few months back) was that it was fairly CPU intensive. This may > or may not be an issue depending on how much traffic you push on a > "normal" day (whatever that is). ALL modules that use directory/location base config for resource limiting won't work, because they start processing the reuqets after the request is in. to be more verbose: 1 client connects to server 2 when socket is connected, client send http headers (accept/host/...) 3 client issues a request (see rfc2616 for that) like GET / HTTP/1.1 followed by two carriage returns 4 server starts processing the request (filtering headers and uri information through the stack of configured modules) richt after step 2, there is no per-directory/per-location handler trigger, since the request has not yest triggered the corresponding handler because it was not issued by the client. the malicious client would just open a lot of sockets and wait. mod_throttle is the only implementation that could process those connections because it has an additional 'fixup' handler that gets called _before_ request processing has begun. the ideal location for some logic limiting incoming dead connections is in the core itself, because the api is somewhat limited in what you can do before the request processing an a module. i hope this shed a little light on the issue. take care, /k -- > Q: What do you get when you cross Dracula with a used car dealer? > A: autoexec.bat KR433/KR11-RIPE -- WebMonster Community Founder -- nGENn GmbH Senior Techie http://www.webmonster.de/ -- ftp://ftp.webmonster.de/ -- http://www.ngenn.net/ karsten&rohrbach.de -- alpha&ngenn.net -- alpha&scene.org -- catch(a)spam.de GnuPG 0x2964BF46 2001-03-15 42F9 9FFF 50D4 2F38 DBEE DF22 3340 4F4E 2964 BF46 Please do not remove my address from To: and Cc: fields in mailing lists. 10x

2 1

Re: Worldcom recovery efforts
by Sean Donelan 20 Sep '01

20 Sep '01

All four locations I had inquiries about were located outside of New York City, but within 100 miles of Manhattan. Several folks sent me e-mail they started to see circuits come back up inside New York City on Friday, with several people saying their circuits in New York City came back yesterday and last night. So it looks like Worldcom is concentrating on circuits inside New York City first. I think everyone understands there is some prioritization of repairs happening. They were just getting a bit frustrated in not knowing where on the list they were.

1 0

route-map match clause for existance of a BGP session?
by Bulger, Tim 20 Sep '01

20 Sep '01

Sorry for the non-operational content, but looking for some Cisco advice. Does anyone happen to know a trick for a route map match clause that will only match if a BGP session is established with a given peer? The idea being to only redistribute a particular static route based on the availability of the peer through which the next hop of the static would be configured... Thanks in advance, Tim

2 1

RE: Trend Micro FIX_NIMDA.EXE - was Re: Virus fix
by Roeland Meyer 20 Sep '01

20 Sep '01

[quoting HTML isn't fun, The attributions are probably wrong.] -----Original Message----- From: Eric Germann Sent: Thursday, September 20, 2001 4:53 AM >-----Original Message----- >From: Indra PRAMANA >Sent: Wednesday, September 19, 2001 11:56 PM > >At 07:46 PM 9/19/01 -0700, Andras Bellak wrote: > >>I still haven't seen anything that cleans up >>the htm, html, asp, etc files, but there are a >>few utilities that work fine for doing that one.> > >>What are the utilities? Where can I get them? > >Norton Antivirus will clean most of the htm, >html, asp, etc files. http://www.symantec.com What's standard practice around here, is to always deploy production web-content via CVS version control. If the content gets munged, simply re-deploy from the CVS repository. CVS is little to no cost and documentation is readily available, even from OReilly. There are Win2K binaries available, from Borland.

1 0

Worldcom recovery efforts
by Sean Donelan 20 Sep '01

20 Sep '01

How are Worldcom's recovery efforts progressing? I've talked to several people with Worldcom circuits down since last week. While its understandable, I've heard about almost every other carrier restoring circuits except Worldcom. After Tuesday, everyone told me Worldcom has been doing an excellent job answering the phone. But no one seems to know if Worldcom is or isn't restoring customer (i.e non-emergency) circuits yet. One customer called AT&T and had a brand-new circuit installed this week. Their Worldcom circuit is still down. If Worldcom is still operating in emergency mode, I can understand why things are delayed. But a couple of people asked me should they continue to wait for Worldcom to fix the circuits, or did they sustain more damage than has been reported, and they should start making arrangements with other carriers.

2 1

Re: Pattern matching odd HTTP request
by Bill McGonigle 20 Sep '01

20 Sep '01

On Thursday, September 20, 2001, at 10:36 AM, Noah wrote: > I haven't tried it myself (yet... it's on the plate), but mod_tsunami > (http://bert.tuxfamily.org/mod_tsunami/) may work better. It limits the > number of connections on a per-directory basis, using the apache > scoreboard. The primary issue I had with mod_throttle when I was looking > at it (a few months back) was that it was fairly CPU intensive. This may > or may not be an issue depending on how much traffic you push on a > "normal" day (whatever that is). > Looks like a good module, but in this case the server hasn't received a GET yet (and won't), so I don't think it would have a chance to do any URI pattern matching... -Bill

1 0