- NANOG - lists.nanog.org

Code Red on dial-in ppp
by Mitch Halmu 21 Jul '01

21 Jul '01

You may have received the following from codered(a)securityfocus.com This mail is from the ARIS Analyzer Service (Attack Registry and Intelligence Service) from SecurityFocus. It has come to our attention that your system(s), listed below have been identified as being compromised by the Code Red Worm. The Code Red Worm is rapidly spreading across the Internet, compromising vulnerable Windows NT IIS servers. The addresses identified as belonging to you are as follows: [ dynamic dial-in ip ] [ dynamic dial-in ip ] [snip] This makes me think that the worm is capable to infect not only dedicated web servers, but also dial-in customers running ppp that happen to be online when the attack occurs. NetSide is an all Sun sparc shop and we don't have any Windows based machines, but I can see this worm being alive and spreading for a long time if dial-in users are affected. Unfortunately, they don't provide a date and time stamp, so identifying the actual user is not possible. I can provide web server log extracts to whomever collects/analyzes such information (John O., sorry but you're bouncing my email - get rid of MAPS). --Mitch NetSide

8 8

RE: Update: CSX train derailment
by Dave Stewart 21 Jul '01

21 Jul '01

At 12:50 PM 7/21/2001, up(a)3.am wrote: >Yes, I can see that; but I imagine you could handle this much the way >fiber is handled near the shoreline. Bury it a few feet under the mud or >sand. Keep in mind, too, that every crossing isn't going to be a nice, deep river... I can think of hundreds of cases (and so can you) where the crossing is over a shallow creek or fairly deep ravine (no water at all!) - yet difficult at best to trench it in... so cables, pipelines, etc, ride the bridge... Then your friendly local tropical storm comes along, drops plenty of water, and the bridge washes out. Now what? Reroute everything, of course. Or a tank truck catches fire and destroys the bridge (as happened in Atlanta not long ago - sure, it was I-285, and I don't think any cables rode that bridge), Obviously when routing cables, you have to deal with the cost/benefit ratio. What are the chances of any single point suffering catastrophic failure? How much will it cost to trench it in instead of riding a bridge/tunnel? You make a decision, then you deal with the consequences if you're wrong. More than worry about exactly what method is used for routing cables, I agree with building redundancy. Because no matter how you armor/protect your cables, something CAN occur that'll break through that protection... but if you have a backup in place, routed another way, with automatic failover, you barely notice. More importantly, your customers DON'T notice.

1 0

Cogent Retraction/Correction
by Vincent J. Bono 21 Jul '01

21 Jul '01

Dear All, Two weeks after I posted my Cogent comments one of their staff contacted me and pointed out that my post on their using Williams ATM was incorrect. They apparently use Williams purchased fiber IRUs and their own DWDM to IP equipment. They also seem to be encountering delays with our orders due to the delays of their metro-fiber venders.. Okay. Be that as it may. The two week lag between my post to NANOG and their response was still a hell of a lot shorter than the time it takes for their tech staff to get back to us when we ask for order updates. IMHO: Be wary when using them and read the fine print re: order delivery. -vb

1 0

Re: Update: CSX train derailment
by Sean Donelan 21 Jul '01

21 Jul '01

According to the Baltimore Sun, companies have laid 30,000 feet of emergency fiber to patch around the damage in the Howard Tunnel. "There was a ripple effect around the country with corporate networks due to this Baltimore disaster," said Frank Stanton, an executive with Lexent Inc., a New York-based company that repaired fiber-optic cable after the World Trade Center bombing in 1993. "Everybody thinks they have redundancy, but these type incidents show people there are huge issues. When you cross rivers and bridges, these choke points are the Achilles' heel." On the Washington DC to New York City fiber route, there seems to be at least one train derailment leading to significant network traffic re-routes every year.

3 2

The Cidr Report
by CIDR Report 21 Jul '01

21 Jul '01

This is an auto-generated mail on Fri Jul 20 23:00:00 PDT 2001 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amont of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. ------------------------------------------------------------------------------ CIDR REPORT for 20Jul01 0) General Status Table History ------------- Date Prefixes 130701 100848 140701 100609 150701 101337 160701 100485 170701 100311 180701 100565 190701 100739 200701 100950 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 11241 Number of ASes announcing only one prefix: 6694 (3840 cidr, 2854 classful) Largest number of cidr routes: 865 announced by AS701 Largest number of classful routes: 1414 announced by AS701 1) Gains by aggregating at the origin AS level --- 20Jul01 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1347 1001 346 25.7% Telstra Pty Ltd AS701 1414 1199 215 15.2% UUNET Technologies, Inc. AS4293 391 280 111 28.4% Cable & Wireless USA AS6595 169 59 110 65.1% DoD Education Activity Networ AS6429 199 102 97 48.7% RdC Internet AS13999 104 8 96 92.3% Mega Cable S.A. de C.V. AS705 232 137 95 40.9% UUNET Technologies, Inc. AS7018 726 634 92 12.7% AT&T AS4755 211 121 90 42.7% VSNL India AS4151 161 79 82 50.9% USDA AS8013 298 217 81 27.2% PSINet Ltd. Canada AS577 246 173 73 29.7% Bell Canada AS724 230 158 72 31.3% DLA Systems Automation Center AS7046 313 249 64 20.4% UUNET Technologies, Inc. AS6471 122 58 64 52.5% ENTEL CHILE S.A. AS16473 121 58 63 52.1% Bell South AS4200 131 70 61 46.6% Apex Global Information Servi AS3464 148 91 57 38.5% Alabama SuperComputer Network AS16758 63 6 57 90.5% IKON Office Solutions AS1 569 513 56 9.8% BBN Planet AS1239 447 392 55 12.3% Sprint ICM-Inria AS6413 65 13 52 80.0% Southern Online Systems, Inc. AS3908 203 152 51 25.1% Supernet, Inc. AS17561 112 61 51 45.5% Internet Service West Austral AS852 213 163 50 23.5% Telus Advanced Communications AS4323 235 185 50 21.3% Time Warner Communications, I AS2149 320 270 50 15.6% Performance Systems, Inc. AS12302 83 33 50 60.2% MobiFon S.A. AS703 268 220 48 17.9% UUNET Technologies, Inc. AS5106 81 33 48 59.3% Ameritech Advanced Data Servi For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

Re: Update: CSX train derailment
by Sean Donelan 21 Jul '01

21 Jul '01

On Fri, 20 July 2001, Leo Bicknell wrote: > On Fri, Jul 20, 2001 at 08:28:37AM -0400, David Lesher wrote: > > I'm not sure where they could run temporary fiber... > > Next to the fire hoses snaking down the street? > > You'd be surprised what they can come up with on short notice. > For temporary fixes fiber can be quickly rolled out next to railroad > tracks (yes, just laying on the ground) or down other right of way > (sometimes even public roads). They generally put it in an innerduct The Baltimore Sun has a graphic showing the re-routed fiber optic line. http://www.sunspot.net/news/local/bal-traingridlockmap.graphic I understand all the carriers have people working very hard to fix the cut, but the question which is rarely asked and even more rarely answered is where was the physical diversity in those carriers networks? Did these carriers know about this vulnerability in their network? When customers asked, were the customers told? What are MFN or Worldcom sales people telling customers who ask what happened to their network diversity?

6 5

RE: Code Red : Any whitehouse.gov people around?
by Mike Najarian 21 Jul '01

21 Jul '01

Has anyone gutted an infected box to determine whether it's going to go for whitehouse.gov www.whitehouse.gov or a hardcoded IP? mnaj Best regards, Mike Najarian - FASTNET Corporation miken(a)fast.net (610)266-6700 http://www.fast.net FASTNET(r) - Business and Personal Internet Solutions > > Knowing that some of the colocated boxes in our network *might* be > infected; I have placed a nullroute for 198.137.240.92 (the IP > www.whitehouse.gov resolves to). >

7 6

Code Red host list
by John Kristoff 20 Jul '01

20 Jul '01

The following is a list of about 11,000 host IPs that are thought to be or were infected by the recent Code Red worm. I hope this is helpful. If I was watching more closely at the time I'm sure the list would be significantly larger. http://condor.depaul.edu/~jkristof/codered-hosts.txt This has been blind carbon copied to multiple recipients in order to ensure that it reaches all interested parties. Apologies to those that may receive this note more than once. John

1 0

Re: Update: CSX train derailment
by Sean Donelan 20 Jul '01

20 Jul '01

The curse seems to still work, my brand new "backup" server was installed in a location between Baltimore and Washington DC this week. A short time later, a nearby train derails. I think Murphy following me. Remember, its not parnoia if people really are out to get you :-) It appears most providers have found ways to re-route around the fiber break/fire in Baltimore. Physical diversity? Why bother, it only takes a day to have techs patch around the cut. Some individual customers still say they have problems, but generally things seem much better along the easter seaboard. Alternet/UUNET/Worldcom Abovenet/MFN Mindspring PSI Verio Other providers may have also been affected, but I have no information about the status of their network. The CSX and Amtrack routes are the primary fiber routes through Baltimore, so it was a crap shoot which provider got hit. Were they in the Amtrack right-of-way or the CSX right-of-way. The Baltimore Fire Department started removing train cars from the tunnel this morning, but stopped when the fire flared up again.

6 5

Re: Code Red
by Jeff Ogden 20 Jul '01

20 Jul '01

Here at Merit we are seeing large numbers of Code Red infected hosts. These hosts may be on our regional network MichNet or they may be elsewhere out on the greater Internet. It is the port scanning of random IP address that causes problems, because the scanning in turn is causing network problems due to heavy ARP loads when the local site routers ARP for what turn out to be unused IP addresses. This is an issue when there are large blocks of IP addresses behind a router. It is less of a problem when there is a relatively small number of IP addresses behind a router (say one class C worth). Are others seeing these sorts of problems? What strategies are there for dealing with this? What we've come up with so far is blocking inbound (inbound to the site) port 80 traffic on the LAN interface of the local site router (so outbound over the LAN interface). This prevents the ARP problems. It also gives us some indication of which systems are infected. It has serious undesirable side effects (preventing legitimate Web access) and so we also have to reenable inbound port 80 access for specific IP addresses that we know are Web servers or otherwise not vulnerable to Code Red. None of this solves the problem in any real sense. It just keeps performance reasonable and buys us time to work on or get others folks to work on real solutions. To solve the Code Red problem seems to require patching the vulnerable hosts or taking the vulnerable or infected hosts offline. How long is it going to take to get every Windows NT, Windows 2000, and Windows XP system patched? We may be at this for a long time. I am not looking forward to this. Any ideas for other approaches to the problem? -Jeff Ogden Merit

11 13