- NANOG - lists.nanog.org

Embargos and proscriptions
by Roeland Meyer 18 Sep '01

18 Sep '01

The following link details various embargos in effect. http://pmdtc.org/country.htm Almost all of these entail defense and munitions. ITAR has long considered cryptographic material a munition, under ITAR category XVII (see: http://pmdtc.org/usml.htm) Personal opinion: we may see this definition expanded, as it has in the past. The problem is, expansion is easy, contraction is somewhat more difficult. [disclaimer] MHSC has been involved in ITAR issues since 1997. Our initial business plan was to provide secured services and individual privacy through encryption techniques and services, for both individuals and organizations. We couldn't get that past ITAR initially and when we could, the market wasn't there yet (couldn't get any traction. Most folks frankly, don't give a rat's tush about security, especially if they have to do anything extra for it). MHSC goes out of its way to avoid even the appearance of legal violations and to limit its risk of legal liability. MHSC is no longer in this business (see: http://www.mhsc.net/services.htm) -- IANAL = I Am Not A Lawyer. Before taking legal action based on anything I say or write, you are strongly encouraged to seek the advice of an attorney. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company tel: +1 925 373 3954 cel: +1 925 352 3615 fax: +1 925 373 9781 http://www.mhsc.com |> -----Original Message----- |> From: Tim Devries [mailto:tim.devries@inquent.com] |> Sent: Tuesday, September 18, 2001 12:56 PM |> To: Smith, Rick; nanog(a)merit.edu |> Subject: Re: Afghanistan |> |> |> |> Does anyone even have a list of IP blocks allocated on a national or |> regional level? |> |> ----- Original Message ----- |> From: "Smith, Rick" <rsmith(a)atsworld.com> |> To: <nanog(a)merit.edu> |> Sent: Tuesday, September 18, 2001 9:23 AM |> Subject: Afghanistan |> |> |> > |> > |> > Has anyone started to deny all traffic to/from Afghanistan ? |> > |> > Wouldn't that be worth it ? |> > |> > Or did I miss that post? |> > |> > R |> > |>

2 1

Re: Worm Probes
by Roeland Meyer 18 Sep '01

18 Sep '01

The damned thing continues to burn bandwidth here. My IIS systems were patched long ago and my Apache servers are inherently immune. But, that does not prevent vulnerability scans and it's those scans that are burning the pipe. Firewalling the scans sort of blocks those services too. So, that isn't the answer. Fortunately, I have long been a fan of having really huge boxen sip their internet through straws (any single box can saturate the uplink (100baseTX), at <50% CPU utilization and the WAN:LAN link never exceeds 1:10. So, my servers are just loafing. Still, this comes real close to being a DDOS attack because the WAN port is showing almost 40% usage from scans right now. I'm real glad that I have another set of zone servers, piggy-backed in AboveNet. Has anyone made any progress towards locating origination of these worms? They seem to be steadily mutating. This means that a/some programmer(s) is/are behind this somewhere. I'm sure that I'm not the only one that wants to know. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company tel: +1 925 373 3954 cel: +1 925 352 3615 fax: +1 925 373 9781 http://www.mhsc.com

4 3

RE: Worm probes
by Smith, Rick 18 Sep '01

18 Sep '01

I've seen 2,614 unique addresses. I'd be willing to do the same. Or contribute to the effort. -----Original Message----- From: Ulf Zimmermann [mailto:ulf@Alameda.net] Sent: Tuesday, September 18, 2001 2:32 PM To: sigma(a)pair.com Cc: nanog(a)merit.edu Subject: Re: Worm probes On Tue, Sep 18, 2001 at 01:36:48PM -0400, sigma(a)pair.com wrote: > > > Along those lines, weren't there some projects last time around to find and > clean up the affected machines? Clearly there are LOTS of vulnerable NT > servers still out there. Presumably these are being responded to just like > Smurf amplifiers, and the problem is just that the admins are clueless or > unreachable? > > So far the most prolific network probing us has belonged to 9NetAve, which > was bought by Concentric shortly before they became XO. I got so far about 205 unique IPs from the scans. If anyone is interested I can put them on a webpage. Or even put quickly a script with db in the back for other people to provide their list of IPs. > > Kevin > > > Hopefully the notification does some good. > > > > -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

2 1

RE: Afghanistan
by Hallgren, Michael 18 Sep '01

18 Sep '01

> > >> Has anyone started to deny all traffic to/from Afghanistan ? > > It is my understanding that the free flow of ideas and > discussion of same > > is detrimental to an extremist or dictatorial government. > Such governments > > rarely (ever?) survive open discussions and flow of ideas. > > so i guess we should not advocate cutting off that flow, eh? > Yes (any channel for potentially constructive discussions, keep open). > resist the cycle of violence and hate. . mh > > randy >

1 0

Worm leveling off RE: Worm impact - September 18 2001
by Sean Donelan 18 Sep '01

18 Sep '01

The worm's impact appears to be leveling off. Any word if the infection rate has slowed like the CodeRed I/II worms?

1 0

Apache::Nimba released
by David Ulevitch 18 Sep '01

18 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 Hello Nanog'ers, I just released a dirty apache module to detect and if wanted, block Nimba via iptables. It's small, it's 0.1 but it works. I posted it here: http://www.everydns.net/~davidu/Apache-Nimba-0.1.tar.gz Any questions or comments can be directed here. I'll have a better version in a few hours but I'm late for my CS102 class. Thanks, David Ulevitch mailto:davidu@everydns.net Founder, EveryDNS.net http://www.everydns.net p.s: note that if you use the iptables part it's totally insecure for obvious reasons. I'll try to think of a fix while in class. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQIVAwUAO6efVUhMBortpHrDAQEMaRAAgb8um4ES8sbn21IOLOy/3aXnsTBAij0J Vdi9ak5CJ+UbdBYCU7pqpUzXT7M8jYHfelsi34pwhC+bHjeg6vY8YkI593GecVhG O9J+co/2NK5Wwqm2Xq0fO3OA30Ow/++N7TV6N0OI2wLlt8tGJN75fCYJ6RVAEZ9a DUFNUMWRFRm9hEQMuO1ToKwZF4QA1x7P3sFt2FwGH47qebRKUU0we6TCORoCNqC/ R3QIPf06ARW/J4Z4LFyG/vNj9T413i7FtbZz9sB1zE9VxcJDa6XF85Z+wvo68qB7 6y0CSpMTYsF1riHB1KgKAdpaCnqpN4S4rhvd4+sDV59xaTS77AXwlLBlOuSMkxq2 axPG+O5LRR89YLjBYvkIKeYV49u1vg8h/iv/Jjazy29Aeu9tBRaDEBP7cGV6LvTb 9LqKCfTQd/uZVD16QH6FEjGNvOL597XdPI5U/59Ux8ZCP1wxcBP2pjjDoURngEdu QjLADWEabn/l9iCX6aGn9bzg9n9af6F0Ub7/bWlf7wNh0ALPtkAz4Aoz31esxK6/ K7iksieSxlbKOqVS0Mp3lSlA4LmgPcaVzMcO7q4vhlWLaMwogL2n835qIeD71Pwe daA3lFL3qRrJEdXbmWEgq0T2H+0aaCH04/Xv41jTFdlm/Wfj7QU4hulU0cdZxx+B RGm2B0N2l6k= =IlZy -----END PGP SIGNATURE-----

1 0

Re: [isp-linux] RE: Massive port 80 hits
by Bill Larson 18 Sep '01

18 Sep '01

#!/usr/bin/perl # IISBLOCK - Infected IIS server blocking utility. # by Bill Larson <blarson(a)compu.net> of Compu-Net Enterprises. # http://www.compu.net. This header must be kept intact if you # wish to redistribute the script. my $check = 0; my $line = ""; my $weblog = "/etc/www/logs/access_log"; my $infection = "/root/infected"; my $removelist = "/root/fwclean"; # create the removelist file so that you can chmod it later and # automatically clear the firewall.. chmod 700 iisblock open (HTFILE3, ">$removelist"); print HTFILE3 "#!/bin/sh\n"; close(HTFILE3); #open the web server log file specified above and start processing open (HTFILE, "$weblog"); until (eof (HTFILE)) { $line =<HTFILE>; chop ($line); #Pattern match on IIS Attempts then strip down to the hostname/ip addresss if ($line =~ /.*\/winnt\/system32\/.*/) { $line =~ s/\ -.*//gi; # This host is infected so lets do something about it. &infected; } } close(HTFILE); sub infected { $check = 0; # begin a check to ensure that we only take action once. open (HTFILE2, "$infection"); until (eof (HTFILE2)){ $dupe =<HTFILE2>; chop ($dupe); if ($line =~ /$dupe/){ $check = 1; } else { } } close(HTFILE2); # If this is a unique host continue if ($check eq "0") { # time to add to the list of infected hosts open (HTFILE2, ">>$infection"); print HTFILE2 "$line\n"; close(HTFILE2); # add using the specified add command # firewall software will print an error on invalid hostnames. # Zap them one at a time maunally system ("/sbin/ipchains -I input -s $line -j DENY -l"); # write firewall removal line to the remove list file # modify this line for your specific firewall software open (HTFILE3, ">>$removelist"); print HTFILE3 "/sbin/ipchains -D input -s $line -j DENY -l\n"; close(HTFILE3); } # That's all folks! }

1 0

RE: Afghanistan
by Hallgren, Michael 18 Sep '01

18 Sep '01

> > > At 11:43 AM 9/18/2001 -0500, Basil Kruglov wrote: > > > >On Tue, Sep 18, 2001 at 12:23:58PM -0400, Smith, Rick wrote: > >> Has anyone started to deny all traffic to/from Afghanistan ? > >> > >> Wouldn't that be worth it ? > >> > >> Or did I miss that post? > > > >Do they even have Internet? > > > >http://www.cia.gov/cia/publications/factbook/geos/af.html > >Internet Service Providers (ISPs): NA > > It is my understanding that the free flow of ideas and > discussion of same > is detrimental to an extremist or dictatorial government. > Such governments > rarely (ever?) survive open discussions and flow of ideas. > > Either that, or their beliefs are so strongly held, so pure, > so obvious > that other ideas / beliefs need not even be examined. > Apparently the "boys > and girls" are simply told what to believe, and the reasoning > behind or, or > counter arguments to it, are irrelevant. No discussion or > substantiation > is necessary, "people with clue" told them so. > > > I vote for #1. What does the rest of NANOG think? > #1, (provided the open minded people over there do enjoy access to such a free flow of information, something I can't tell from my horizon.) mh > > >-Basil > > -- > TTFN, > patrick >

2 1

Re: Cisco PIX 515-->520?
by Lisa Napier 18 Sep '01

18 Sep '01

Hi all, Answers below: >From: Todd Suiter >Date: Wed Sep 12 20:19:02 2001 > > > I'm hearing rumors of problems with the 515 series PIX: > > '...that in some cases Cisco has opted to replace customers' 515 Pixes > with 520's at no charge because the 515 in some cases accepts packets > with spoofed source addresses that it should be able to reject.' This is untrue. >has anyone heard of this? Far as I know the sw is the same, but hw is >different. The hardware is different - that's why there are different product numbers - however the difference is in processing power and speed. Currently on the PIX, the anti-spoofing checks are all done in SOFTWARE, so anti-spoofing will be consistent across all hardware platforms. Hope that helps, Lisa Napier Product Security Incident Response Team Cisco Systems http://www.cisco.com/warp/public/707/sec_incident_response.shtml PGP: A671 782D 2926 B489 F81A 3D5E B72F E407 B72C AF1F ID: 0xB72CAF1F, DH/DSS 2048/1024

1 0

RE: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

There has already been a massive application of the patches, according to www.netcraft.com at http://www.netcraft.com/survey/#August, Code Red vulnerability has dropped to less than 20%, since July. It continues to drop. Your general characterization of cluelessness is a bit unfair. It is puzzeling that root.exe vulnerability is the only indicator that continues to rise, albeit slowly. Netcraft shows it to be >10% at the moment. BTW, I'm still seeing massive scanning activity. |> From: sigma(a)pair.com [mailto:sigma@pair.com] |> Sent: Tuesday, September 18, 2001 10:37 AM |> |> Along those lines, weren't there some projects last time |> around to find and |> clean up the affected machines? Clearly there are LOTS of |> vulnerable NT |> servers still out there. Presumably these are being |> responded to just like |> Smurf amplifiers, and the problem is just that the admins |> are clueless or |> unreachable? |> |> So far the most prolific network probing us has belonged to |> 9NetAve, which |> was bought by Concentric shortly before they became XO. |> > Hopefully the notification does some good. |> > |>

1 0