- NANOG - lists.nanog.org

All hazard Internet security
by Larry Sheldon 02 Aug '01

02 Aug '01

> One of the issues I've been discussing as part of various > critical infrastructure protection forums is the need > for "all hazard" outage information. Treating Internet > security as just a law-enforcement issue can warp your > perception. Unless you have a good view into all the > other things which can wreck Internet availability, it is > difficult to gauge the impact of a malicious activity > versus "normal" outages. BoyHowdy! Bingo! I'll say. Also difficult to "sell" to managment--the notion of "normal" outages (I like the terms "risk assessment" and "business continuation preparation" here). > I don't completely understand the data. The impact of the > Baltimore train wreck shows up very clearly. Traffic > returns to nearly normal by 6am the next morning. But then > degrades again the following the day (i.e. "Worm day"). I > don't have access to the raw data, so I can't tell if there > are differences between carriers with fiber in the Howard > tunnel and other carriers. Did congestion increase the following > day due to the reduced bandwith the following day, or was it > consumed by the worms propagation. I think you have left out the "rubberneck effect" (I may have just coined a new term). I often notice in our traffic graphs that certain events and certain rumored events, as well as (in the instant case) certain "predictions" Will cause dramatic increases in traffic in our network. I think a sociologist would be helpful in understanding that, but my very informal and anecdote-ridden "study" indicates to me that when we make a major upgrade in facilities, there is a jump in traffic as people ping stuff all over, try the MS web page (and its speedometer doodad), and so on. There was a jump last evening at about 1930 local and there was one the night before at about the same time--people checking to see if the 'net was dead? -- -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- . . - L. F. (Larry) Sheldon, Jr. - . Unix Systems and Network Administration . - Creighton University Computer Center-Old Gym - . 2500 California Plaza . - Omaha, Nebraska, U.S.A. 68178 Two identifying characteristics - . lsheldon(a)creighton.edu of System Administrators: . - 402 280-2254 (work) Infallibility, and the ability to - . 402 681-4726 (cellular) learn from their mistakes. . - 402 332-4622 (residence) - . http://www.creighton.edu/~lsheldon Adapted from Stephen Pinker . -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-

1 0

All hazard Internet security
by Sean Donelan 02 Aug '01

02 Aug '01

One of the issues I've been discussing as part of various critical infrastructure protection forums is the need for "all hazard" outage information. Treating Internet security as just a law-enforcement issue can warp your perception. Unless you have a good view into all the other things which can wreck Internet availability, it is difficult to gauge the impact of a malicious activity versus "normal" outages. I don't completely understand the data. The impact of the Baltimore train wreck shows up very clearly. Traffic returns to nearly normal by 6am the next morning. But then degrades again the following the day (i.e. "Worm day"). I don't have access to the raw data, so I can't tell if there are differences between carriers with fiber in the Howard tunnel and other carriers. Did congestion increase the following day due to the reduced bandwith the following day, or was it consumed by the worms propagation. http://www.keynote.com/press/html/special_worm_update.html One of the unique things IOPS/Kelly Cooper have been trying to include in the ISP-ISAC, which the other ISAC are lacking, is an outage reporting component. Currently the Internet does have a clear point of contact for dealing with these events. Even if your company is already joining other ISACs, if you are an Internet provider, I hope you look into and consider working with the ISP-ISAC. See the last NANOG conference web page for a copy of the proposal. The "all hazard" aspect makes things more complicated, but I think it significantly enhances the usefullness of the ISP-ISAC.

1 0

RE: Code Red growth stats
by Roeland Meyer 02 Aug '01

02 Aug '01

> From: Petr Swedock [mailto:petr@ai.mit.edu] > Sent: Wednesday, August 01, 2001 9:38 PM > : From: "Steven M. Bellovin" <smb(a)research.att.com> > : Date: Wed, 01 Aug 2001 23:15:50 -0400 > : In message > <EA9368A5B1010140ADBF534E4D32C728025AB1(a)condor.mhsc.com>, Roeland Me > : yer writes: > : >> From: Steven M. Bellovin [mailto:smb@research.att.com] > : >> Sent: Wednesday, August 01, 2001 7:36 PM > : > > : >> If it has indeed turned up again, I'm at a loss to > explain it. While > : >> I'm sure there are some IIS servers on home machines, I doubt > : >> there are > : >> that many. But I don't have another explanation to offer. > : > > : >Are you taking into account that every copy of Win2K > comes with IIS? I had > : >to quickly run around and do upgrades yesterday. I clean > forgot about the > : >workstations. I bet that I'm not the only one either. > I think it is NOT on by default for IIS 4.0 but IS on by default > for IIS 5.0... In any event, we had a machine that was freshly > installed with the very latest W2k on July 18, in the evening. That > machine was worm ridden within 12 hours. The grad student who > installed didn't specifically add IIS and didn't have any reason > to do so. I've just been staring at www.caida.org/analysis/security/code-red/aug1-live-hosts.gif (yeah, I know ... not enough to do). We have a nice little camel here. It occurs to me that the time coincide with info workers leaving work, eating dinner, and firing up the workstation at home, in the US. Do we have any location data on these infected hosts? What would be interesting is, if we have another tail-off starting at about 0400 (we do) UTC and picking up again about 10-12 hours later. UTC midnight is about 2100 EDT and 1700 PDT. That's when it starts to pick up again. The second peak corresponds to 0000EDT/0800PDT. This supposes that the super-majority of Win2K machines are in the US. There are also a bunch of WinXP beta machines out there. Is XP vulnerable?

1 0

Re: Code Red growth stats
by Avi Freedman 02 Aug '01

02 Aug '01

In article <10171.223820.2348(a)avi.netaxs.com> smd wrote: : Fascinating; thanks. SANS hasn't updated their plots lately, so I : can't compare. Anyone else with any data to post? (On the other hand : -- any chance that the dip recorded at CAIDA is due to the measurement : problems?) : If it has indeed turned up again, I'm at a loss to explain it. While : I'm sure there are some IIS servers on home machines, I doubt there are : that many. But I don't have another explanation to offer. : --Steve Bellovin, http://www.research.att.com/~smb Data from Akamai (we are not gathering all data, so this shows size as a trend based on sampling, not absolute #): Time Hosts New Hosts/Hour 11:00 4,782 15:00 25,600 5204.5 15:33 30,921 9674.55 16:29 37,240 6770.36 17:25 43,120 6300.00 18:23 48,885 5963.79 This is ONLY for default.ida and some pieces of "classic code red" byte matching, off of hits to Akamai web servers - not just port 80 scans to unused IP space. We saw almost nothing last night/yesterday. Then today we saw it go exponential, then linear, then slow, then linear. I can't get in to get the last-few-hours data... We've noted 4-5 new worm signatures today, though. Luckily no super-duper-evil ones yet. The security and architecture elves at Akamai are owed the credit, but if I mentioned their names the security weenies would have to kill me... Avi

3 2

Re: A watched pot never boils: The Return of Code Red
by Simon Waters 02 Aug '01

02 Aug '01

>After eight hours of Code Red II, I haven't seen any impact. So far >the only website I can't reach is WWW.KEYNOTE.COM Everything else >seems to be humming along just fine. Funny I get KEYNOTE.COM fine, but www.internethealthreport.com has problems. The site is reachable via http://internetpulse.com/ but Keynote seem to use the other name in their link. It is a DNS delegation issue (and possibly web server configuration), I have flagged it to the contact listed in the SOA at Keynote. A quick glance suggests at the Internet Pulse suggests that things may be slightly below average, but not dramatically different from normal, certainly it doesn't look fatal yet. The CAIDA Code Red figures quoted elsewhere suggest it may level off at about half as many infections as last time. But we don't really know what living with this thing for another 19 days will be like. My /24 *8-) didn't see any probes till about 80,000 unique hosts had been detected at www.incidents.org, so I suspect the "pseudo random" approach to IP addresses may lead to a long tail in the infection.

2 1

RE: Code Red growth stats
by Roeland Meyer 02 Aug '01

02 Aug '01

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Wednesday, August 01, 2001 8:16 PM > >Are you taking into account that every copy of Win2K comes > with IIS? I had > >to quickly run around and do upgrades yesterday. I clean > forgot about the > >workstations. I bet that I'm not the only one either. > > > Are you sure about that? Or rather, are you sure it's on by > default? No, it's not on by default. But, no one that I know (including my duaghter's warez friends) whom is running Win2K at home, isn't running a web server. Even when they're not supposed to (behind cable modems). In the shop, we all run IIS, on the workstations, for local testing and development. But, what do you expect from a shop full of development geeks? > I just checked my toy desktop machine and rebooted to the other > partition of my laptop, and didn't see it running on either.l To be > sure, I'd have turned it off if I knew it was on, but I have no idea > how to do things like that on Windows... It is altogether too easy. Goto: Control Panel >> Administrative Tools >> Internet services manager.

2 1

RE: MicroSoft amplification?
by Rishi Singh 02 Aug '01

02 Aug '01

The DUP packets resemble WLBS (Windows Load Balancing Service) in action. What platform did you ping it from? A unix host? Windows ping command does not show the extra icmp responses. Just a thought. -----Original Message----- From: Steven M. Bellovin [mailto:smb@research.att.com] Sent: Wednesday, August 01, 2001 8:18 PM To: Tony Rall Cc: nanog(a)merit.edu Subject: Re: MicroSoft amplification? In message <OF3DD9155A.FA5F9232-ON88256A9B.00804F54(a)almaden.ibm.com>, "Tony Ral l" writes: > >I see it too, on that address and on the second of the 3 addresses mapped >to www.microsoft.com (the third address doesn't respond at all). > >Most likely this is due to a not very smart load distribution system. I'm told that that is indeed the case. Well, strike the "not very smart" part -- I wasn't told that -- but I was told that it is indeed because of the load distribution system. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Internet Pulse report was Re: A watched...
by Avi Freedman 02 Aug '01

02 Aug '01

In article <10171.175034.25348(a)avi.netaxs.com> you wrote: : Ironically after I sent the last NANOG message I checked the : http://internetpulse.com site again, and QWEST have improved : their performance, so the Internet is apparently "healthier" now : than it was when Code Red started this morning. I'm not sure I'd put a lot of faith in internetpulse.com measurements... Better than matrix.net (who exists to make keynote look good), but not by very much. For example, "sprint to sprint" is now showing red, and digging in, it's "phoenix" to "phoenix" is 195ms. From one keynote machine in a rack to another? Riiiiiight. Avi

1 0

Re: A watched pot never boils: The Return of Code Red
by Andy Bradford 02 Aug '01

02 Aug '01

Thus said Sean Donelan on 01 Aug 2001 01:21:18 PDT: > Any updates from the field? Today I saw an extremely high number of scans of port 80 being blocked at the firewall for seemingly random IPs within our /21 at work. I wasn't really certain whether it was a distributed attack using spoofed IPs or whether it was related to Code Red... I'm still seeing them even now (I hope this isn't inappropriate for this list): Aug 1 21:29:44 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 211.72.54.109:2162 216.250.133.18:80 L=48 S=0x00 I=16335 F=0x4000 T=111 SYN (#601) Aug 1 21:29:45 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 148.245.219.161:2328 216.250.132.139:80 L=48 S=0x00 I=21203 F=0x4000 T=116 SYN (#601) Aug 1 21:29:47 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 203.126.253.242:50221 216.250.135.40:80 L=48 S=0x00 I=24959 F=0x4000 T=106 SYN (#601) Aug 1 21:29:49 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 63.214.199.137:4107 216.250.134.32:80 L=48 S=0x00 I=2393 F=0x4000 T=114 SYN (#601) Aug 1 21:29:49 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 193.251.1.38:52206 216.250.130.33:80 L=48 S=0x00 I=20648 F=0x4000 T=101 SYN (#601) Aug 1 21:29:49 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 217.83.8.106:3030 216.250.130.163:80 L=48 S=0x00 I=64392 F=0x4000 T=109 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 211.72.54.109:2162 216.250.133.18:80 L=48 S=0x00 I=18317 F=0x4000 T=111 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 66.57.43.29:4461 216.250.130.89:80 L=64 S=0x00 I=4773 F=0x0000 T=112 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.34.25.110:21213 216.250.128.7:80 L=48 S=0x00 I=39855 F=0x4000 T=112 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 203.126.253.242:50221 216.250.135.40:80 L=48 S=0x00 I=25095 F=0x4000 T=106 SYN (#601) Aug 1 21:29:51 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 148.245.219.161:2328 216.250.132.139:80 L=48 S=0x00 I=21441 F=0x4000 T=116 SYN (#601) Aug 1 21:29:52 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 63.168.101.197:1147 216.250.133.251:80 L=48 S=0x00 I=63886 F=0x4000 T=114 SYN (#601) Aug 1 21:29:52 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 193.251.1.38:52206 216.250.130.33:80 L=48 S=0x00 I=20892 F=0x4000 T=101 SYN (#601) Aug 1 21:29:53 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 66.57.43.29:4461 216.250.130.89:80 L=64 S=0x00 I=4840 F=0x0000 T=112 SYN (#601) Aug 1 21:29:53 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.34.25.110:21213 216.250.128.7:80 L=48 S=0x00 I=40036 F=0x4000 T=112 SYN (#601) Aug 1 21:29:55 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 63.168.101.197:1147 216.250.133.251:80 L=48 S=0x00 I=63983 F=0x4000 T=114 SYN (#601) Aug 1 21:29:56 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.16.50.219:1363 216.250.134.218:80 L=48 S=0x00 I=23989 F=0x4000 T=114 SYN (#601) Aug 1 21:29:56 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 208.62.155.69:40665 216.250.134.69:80 L=48 S=0x00 I=43342 F=0x4000 T=116 SYN (#601) Aug 1 21:29:57 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 203.126.253.242:50221 216.250.135.40:80 L=48 S=0x00 I=25408 F=0x4000 T=106 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.16.50.219:1363 216.250.134.218:80 L=48 S=0x00 I=24244 F=0x4000 T=114 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 66.57.43.29:4461 216.250.130.89:80 L=64 S=0x00 I=4990 F=0x0000 T=112 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 193.251.1.38:52206 216.250.130.33:80 L=48 S=0x00 I=21512 F=0x4000 T=101 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 208.62.155.69:40665 216.250.134.69:80 L=48 S=0x00 I=45235 F=0x4000 T=116 SYN (#601) Andy -- GnuPG ID 0xA63888C9 (D2DA 68C9 BB2B 26B4 8204 2219 A43E F450 A638 88C9) [-----------[system uptime]--------------------------------------------] 9:30pm up 22 days, 20:09, 6 users, load average: 1.22, 1.16, 1.18

1 0

Re: Code Red growth stats
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <EA9368A5B1010140ADBF534E4D32C728025AB1(a)condor.mhsc.com>, Roeland Me yer writes: >> From: Steven M. Bellovin [mailto:smb@research.att.com] >> Sent: Wednesday, August 01, 2001 7:36 PM > >> If it has indeed turned up again, I'm at a loss to explain it. While >> I'm sure there are some IIS servers on home machines, I doubt >> there are >> that many. But I don't have another explanation to offer. > >Are you taking into account that every copy of Win2K comes with IIS? I had >to quickly run around and do upgrades yesterday. I clean forgot about the >workstations. I bet that I'm not the only one either. > Are you sure about that? Or rather, are you sure it's on by default? I just checked my toy desktop machine and rebooted to the other partition of my laptop, and didn't see it running on either.l To be sure, I'd have turned it off if I knew it was on, but I have no idea how to do things like that on Windows... --Steve Bellovin, http://www.research.att.com/~smb

2 1