- NANOG - lists.nanog.org

RE: Another one bites the dust...
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: Andy Dills [mailto:andy@xecu.net] > Sent: Friday, August 10, 2001 9:15 AM > > http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/w > ww/story/08-10-2001/0001552511&EDATE= > > Rhythms is disbanding their network. ... and I just saw a Rythms truck, on the San Mateo bridge, Wednesday.

2 1

Re: Was: Code Red 2 cleanup -- SHOULD NSPs PULL THE PLUG? Solutions?
by z＠s0be.net 10 Aug '01

10 Aug '01

On Fri, 10 Aug 2001, Etaoin Shrdlu wrote ( sanitized by z(a)s0be.net ): > z(a)s0be.net wrote: > > > I think an interesting solution to this problem, no matter how > > unethical would be to write a program that leverages the vulnerability to > > patch the infected machine. In fact, it surprises me that this hasn't > > been done. > > It's illegal. Really. What's the difference between someone breaking into > my machine and destroying stuff, and someone breaking into, say, > x.x.x.x., and "fixing" it? None. It's illegal. And yes, I HATE the > machine that is on the other end of that IP. It is apparently installed > with either mandarin or cantonese, which means that it bothers me a LOT > when it bothers me. > > It's a poorly configured win2k machine, with no proper reverse entry > (although I know it belongs to OWNER_OF_x.x.x.x). Looking isn't > illegal. I've even connected to his smtp server (but not bothered to send > mail, since vrfy doesn't really guarantee that someone is there, and I have > no evidence that he'd read email sent to administrator in any case). Sad, > really. > > It's still illegal. Yes, it'd probably be a kindness. It's still illegal. > <--( SNIP )--> Helu, I'm in agreement that it is illegal as well, however it does raise an interesting issue: Under what terms, if any, should various parties whose infrastructure is under some form of attack be able to defend themselves and what is the extent of that defense for a given situation? I think that due dilligence should be carried out in any situation, to give someone the chance to stop ( in most situations ), but where do you draw the line? NOTE: I'm not exactly condoning counterattacks, but I think in certain situations I could definitely justify it in my mind if someone were to take that course of action after exhausting their options for resolving a situation in which they are under some form of attack. .z

1 0

RE: MPLS VPNs or not?
by Kavi, Prabhu 10 Aug '01

10 Aug '01

> -----Original Message----- > From: Vadim Antonov [mailto:avg@exigengroup.com] > Sent: Wednesday, August 08, 2001 3:45 AM > To: Christian Kuhtz > Cc: nanog(a)merit.edu > Subject: Re: MPLS VPNs or not? <snip> > I'm known for making strong statements, you are right. > However, so far > I've heard no convincing argument against these positions; > and I tried to > solicit opinions by offering the opinions in question for the public > review. Frankly, i was disappointed by the "let's wait and > see which one > works" attitude. As Randy was kind to point out, that > attitude already > gave us a slew of DOA networking technologies, to the tune of billions > wasted. I don't think UUNET considered it a waste. UUNET could not have grown as quickly as it did during the mid to late 90s without L2 (Frame and ATM) technologies. Fortunately for them, they did not have any pure IP only zealots that prevented the pragmatic use of other technologies in their networks. Otherwise they probably would not have been able to outrun the other ISPs. UUNET received two benefits from it: 1. Speed, since at the time L2 switches were faster than routers, and 2. Traffic engineering, which saved them money in transport costs. Point 1 is no longer valid. Point 2 is still valid. UUNET built bigger and better networks at the time because of this. The market decided that UUNET was right. UUNET's shareholders were well rewarded because of what you called this "waste". I guess the real question should be how much market cap did other companies lose because of certain people's zealotry? Any answers Vadim? Prabhu ---------------------------------------------------------------------- Prabhu Kavi Phone: 1-978-264-4900 x125 Director, Adv. Prod. Planning Fax: 1-978-264-0671 Tenor Networks Email: prabhu_kavi(a)tenornetworks.com 100 Nagog Park WWW: www.tenornetworks.com Acton, MA 01720

9 8

RE: Code Red 2 cleanup; reporting..
by Tim Devries 10 Aug '01

10 Aug '01

-----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] Sent: Friday, August 10, 2001 11:22 AM To: 'up(a)3.am'; nanog(a)merit.edu Subject: RE: Code Red 2 cleanup; reporting.. > From: up(a)3.am [mailto:up@3.am] > Sent: Friday, August 10, 2001 8:09 AM > > On Fri, 10 Aug 2001, Roeland Meyer wrote: > > > Win2K boxen are ALWAYS running IIS. It doesn't matter > whether you have Pro > > or Server. ALL Win2K systems need to run the patch. MSFT > chose to integrate > > much of the IIS stuff into DLLs with other system critical > stuff. As a > > result, IIS can't be completely removed without killing off > other critical > > functions. Yes, what they proved in court is even more true > with Win2K than > > with Win98 (Duh! MSFT didn't lie, but they didn't tell the > whole truth > > either). WinXP is even more in that direction, from all reports. > > I admit to knowing very little about Win2k, but on the only box I've > installed Win2k on, it doesn't *appear* to be running: > > Port State Protocol Service > 135 open tcp loc-srv > 139 filtered tcp netbios-ssn > 445 open tcp microsoft-ds > 1025 open tcp list > > ...unless it runs on one of those 3 other open ports? This was Win2k > Client, not server, BTW...perhaps you mean every Win2k Server? Win2k proffesional can run IIS. Goto add remove programs -->add/remove windows components ---> IIS. You probably did not select the component on the install. So I guess that means that not every w2k box is vulnerable. Tim

1 0

RE: Code Red 2 cleanup; reporting..
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: up(a)3.am [mailto:up@3.am] > Sent: Friday, August 10, 2001 8:09 AM > > On Fri, 10 Aug 2001, Roeland Meyer wrote: > > > Win2K boxen are ALWAYS running IIS. It doesn't matter > whether you have Pro > > or Server. ALL Win2K systems need to run the patch. MSFT > chose to integrate > > much of the IIS stuff into DLLs with other system critical > stuff. As a > > result, IIS can't be completely removed without killing off > other critical > > functions. Yes, what they proved in court is even more true > with Win2K than > > with Win98 (Duh! MSFT didn't lie, but they didn't tell the > whole truth > > either). WinXP is even more in that direction, from all reports. > > I admit to knowing very little about Win2k, but on the only box I've > installed Win2k on, it doesn't *appear* to be running: > > Port State Protocol Service > 135 open tcp loc-srv > 139 filtered tcp netbios-ssn > 445 open tcp microsoft-ds > 1025 open tcp list > > ...unless it runs on one of those 3 other open ports? This was Win2k > Client, not server, BTW...perhaps you mean every Win2k Server? Have you installed a Win2K Domain (Active Directory)?

2 1

RE: Code Red 2 cleanup; reporting..
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Friday, August 10, 2001 12:32 AM > > In message <3B7360B4.71755CA7(a)deaddrop.org>, Etaoin Shrdlu writes: > >Spent nearly two days convincing someone who was managing a > server that he > >thing that sucks is that he KNEW he couldn't be a problem, > since he wasn't > >running IIS. I had the packet captures and obvious grabs for > So -- if he wasn't running IIS, what was he running? Win2K boxen are ALWAYS running IIS. It doesn't matter whether you have Pro or Server. ALL Win2K systems need to run the patch. MSFT chose to integrate much of the IIS stuff into DLLs with other system critical stuff. As a result, IIS can't be completely removed without killing off other critical functions. Yes, what they proved in court is even more true with Win2K than with Win98 (Duh! MSFT didn't lie, but they didn't tell the whole truth either). WinXP is even more in that direction, from all reports. BTW, is any motion happening, in the direction of finding the author(s)? I'd like to personally thank them, with a new neck-tie. The other end is attached to a huge California oak tree.

3 2

Tis the season to be cracking ...
by Roeland Meyer 10 Aug '01

10 Aug '01

Not only do we have SirCam and CodeRed, but just tday I started getting a bunch of [what looks like spam] email virii. They're all hitting my filters, but I thought y'all might have noticed similar things. This is two weeks before many Universitys open for business. That's right about the time I drop my EDU filters in place [having kids keeps you aware of these things]. I haven't seen this reported yet. It looks like we have a whole flock of wannabe virus writers out there this year. I'd block EDU permanently, but too many ICANN folks are on EDU addresses. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company t:01 925 373 3954 c:01 925 352 3615 f:01 925 373 9781

3 3

NetSol takes over .us TLD and does this
by up＠3.am 10 Aug '01

10 Aug '01

I thought this might be of interest: The whois for .us had been working a few weeks ago, but hadn't been since then. I dropped an email to action(a)isi.edu (who had been hosting the whois server until a few weeks ago) and cc'd usdomreg(a)nic.us and got the following responses: Date: Wed, 08 Aug 2001 12:21:22 -0700 From: IPC Computing Services <action(a)ISI.EDU> To: James Smallacombe <james(a)pil.net> Cc: action(a)ISI.EDU, action-team(a)ISI.EDU Subject: Re: {2001.08.445} .us TLD whois not in DNS > http://www.nic.us/register/whois.html > > Instructs one to use whois.isi.edu > > for whois queries on the .us TLD. It's not in DNS: > > [richard namedb james]$ traceroute whois.isi.edu > traceroute: unknown host whois.isi.edu > > Could you please look into this and let me know if either the website > is wrong or this will be fixed? At the request of the US Department of Commerce, USC/ISI transitioned all support for the US Domain to Verisign at the end of 2000. We appologize that the Verisign supported web site still points to USC/ISI resources but we have no control over their publication of data. IPC Computing Services ------- 31 hours later from the new registrar (Verisign): Date: Thu, 09 Aug 2001 19:27:10 -0400 From: US domreg <usdomreg(a)nic.us> To: James Smallacombe <james(a)pil.net> Cc: usreply(a)nic.us Subject: Re: .us TLD whois not in DNS Dear James, Thank you for contacting the US Domain Registry. The whois database was run by ISI until recently. The whois server has now been taken offline and so there is no .us whois server currently. We are currently working on a replacement but there is no estimate on how long that will take. In the meantime, if there are specific domains you wish to have information on, please email them to us and we will manually find the information for you. Regards, US Domain Registry www.nic.us usdomreg(a)nic.us =============================================================================== ok, so .us isn't very widely used, but why then, did the DOC give it to Verisign? James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

4 3

Re: Code Red 2 cleanup; reporting..
by David Luyer 10 Aug '01

10 Aug '01

On 10 Aug 2001 03:47:38 -0400, ken harris. wrote: > i haven't given this a whirl myself, but i came across > it and thought i'd at least share. > > "Code Red Autoresponder" : > < http://www.klippan.seths.se/default.phps > Dodgy whois lookup (and that's a redhat-ism too on the whois). You'd end up sending a heap of junk to bitbucket(a)ripe.net. >From the script: /* Get a whois output from whois.ripe.net */ @exec("/usr/bin/whois $ip(a)whois.ripe.net",$whois,$status); You need to consult ARIN and recurse to APNIC, RIPE, etc. One of the APNIC guys was complaining on aussie-isp about all the "your host has CodeRed" messages received by APNIC rather than people doing proper recursive lookups. David.

1 0

too late for the Oakland mtg....
by bmanning＠vacation.karoshi.com 10 Aug '01

10 Aug '01

http://www.srl.org --bill

1 0