- NANOG - lists.nanog.org

RE: Speaking of DDoS attacks
by Rowland, Alan D 12 Jul '01

12 Jul '01

In my humble opinion it looks like something at your mail server. 198.108.1.26 is trapdoor.merit.edu , their mail server, which appears to be re-sending the original 10 Jul mail. The original hit their mail server 10 Jul. This copy was forwarded to your XXX (is this the actual header or are you protecting the innocent?) on 12 Jul. Your work mail server may not be properly acknowledging receipt of the list mail so Merit's server continues to re-send (for the default 4 days?) until the resend TTL. A trace to 165.135.0.253 dies at 500.Serial2-2.GW1.HNL2.ALTER.NET so I'm not sure what's hanging there but I'd look at your mail agent configuration. A second possibility is some non-standard character in your work mail address. You don't say what it is but if there is a character in it that is benign on your system but meaningful to Merit's mail system, there may be a problem. I've been the victim of a similar "attack" in the past as a result of the _ in my address. Just my 2¢ -Al -----Original Message----- From: Robert Cannon [mailto:rcannon101@yahoo.com] Sent: Thursday, July 12, 2001 1:46 PM To: nanog(a)merit.edu Subject: Speaking of DDoS attacks Speaking of DDOS attacks, there seems to be one going on associated with the NANOG list. I was wondering if anyone could offer insite. At my work address, I have received the same email from NANOG about every 10 - 15 minutes. I have received hundreds of copies of this email. Yet at this address I do not receive the repeated copies (and no one else on the list appears to have complained). If I look at the header of the email, the last hop, if I am reading it correctly, is named "zombie.la.interpacket.net" by mrbig.la.interpacket.net. I have since unsubscribed from NANOG from my work address yet still receive the emails. Also, this has been going on for over a week (since a rule filters all my nanog email into a folder, it has not bothered me too much) - every few days, the email that I am repeatedly hit with changes. Currently, the email I am being hit with is "OT: The End of Empire." Below I have pasted the header of the email I would be curious to hear people's thoughts about this. Is this a type of a DDOS? Anyone familiar with it? -B Received: from XXXX ([165.135.0.253]) by XXXX; Thu, 12 Jul 2001 16:01:40 -0400 Received: by XXXX; id QAA14070; Thu, 12 Jul 2001 16:01:38 -0400 (EDT) Received: from unknown(198.108.1.26) by XXXX via smap (V5.5) id xmaa13982; Thu, 12 Jul 01 16:00:42 -0400 Received: by trapdoor.merit.edu (Postfix) id BB70F91231; Tue, 10 Jul 2001 14:35:31 -0400 (EDT) Delivered-To: nanog-outgoing(a)trapdoor.merit.edu Received: by trapdoor.merit.edu (Postfix, from userid 56) id 896EB91251; Tue, 10 Jul 2001 14:35:31 -0400 (EDT) Delivered-To: nanog(a)trapdoor.merit.edu Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) by trapdoor.merit.edu (Postfix) with ESMTP id 83A3791231 for <nanog(a)trapdoor.merit.edu>; Tue, 10 Jul 2001 14:35:29 -0400 (EDT) Received: by segue.merit.edu (Postfix) id 79E335DE1A; Tue, 10 Jul 2001 14:36:58 -0400 (EDT) Delivered-To: nanog(a)merit.edu Received: from bond.interpacket.net (us-la-gate.interpacket.net [209.198.223.250]) by segue.merit.edu (Postfix) with SMTP id ECF9A5DDD8 for <nanog(a)merit.edu>; Tue, 10 Jul 2001 14:36:57 -0400 (EDT) Received: (qmail 31855 invoked from network); 10 Jul 2001 18:35:43 -0000 Received: from mrbig.la.interpacket.net (192.168.6.5) by bond.la.interpacket.net with SMTP; 10 Jul 2001 18:35:42 -0000 Received: from [192.168.4.53] (zombie.la.interpacket.net [192.168.4.53]) by mrbig.la.interpacket.net with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13) id N6TNP8LB; Tue, 10 Jul 2001 11:39:32 -0700 Mime-Version: 1.0 X-Sender: mikey(a)popmail.la.interpacket.net Message-Id: <a05010406b770fb74762d(a)[192.168.4.53]> Date: Tue, 10 Jul 2001 11:35:52 -0700 To: nanog(a)merit.edu From: Mikey Wilsker <mikey(a)interpacket.net> Subject: OT: The End of Empire Content-Type: text/plain; charset="us-ascii" ; format="flowed" Sender: owner-nanog(a)merit.edu Precedence: bulk Errors-To: owner-nanog-outgoing(a)merit.edu X-Loop: nanog __________________________________________________ Do You Yahoo!? Get personalized email addresses from Yahoo! Mail http://personal.mail.yahoo.com/

2 1

DDOS prevention offensive.
by Joseph T. Klein 12 Jul '01

12 Jul '01

To move toward a positive direction ... Discuss the effect that wide spread filtering against spoofed addresses would have on the current number of DDOS attacks. Why can't access router vendors be jawboned into providing anti spoofing filters as a default configuration; or at least automate the process to eliminate spoofed addresses in the wild? Have a logo like the good housekeeping seal for networks that filter on the egress. As Paul stated, demand it from peers. It is a pain. If the political will exist, it will be done. If the PR and marketing folks think it will increase sales, it will be done a lot faster. -- Joseph T. Klein +1 414 915 7489 Senior Network Engineer jtk(a)titania.net Adelphia Business Solutions joseph.klein(a)adelphiacom.com "... the true value of the Internet is its connectedness ..." -- John W. Stewart III

5 5

Re: DDOS prevention offensive.
by John McNeal 12 Jul '01

12 Jul '01

On Thu, Jul 12, 2001 at 02:57:29PM -0700, Roeland Meyer wrote: > >Aha! I knew there was a reason that I filter EDU <g>. Really? How do you configure a DSL modem to filter EDU? -John _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

RE: DDoS attacks
by Roeland Meyer 12 Jul '01

12 Jul '01

I happen to agree, if only because; when script kiddies don't have IRC to play with they'll start looking elsewhere. I'd rather them have an IRC net to play with while they're being hunted. Wouldn't you? > -----Original Message----- > From: Scott Francis [mailto:darkuncle@darkuncle.net] > Sent: Wednesday, July 11, 2001 7:24 PM > To: Richard A. Steenbergen > Cc: Ariel Biener; nanog(a)merit.edu > Subject: Re: DDoS attacks > > > On Wed, Jul 11, 2001 at 07:40:45PM -0400, Richard A. > Steenbergen exclaimed: > > Hrm you may have an idea there. Since so many attacks are related to > > EFNet, and there are so many possible reasons for it to be > impacting the > > rest of the internet, I propose we introduce a new ICMP > type, ICMP EFNet. > > This message type could be used to convey all kinds of important > > information about why things are broken, for example: > > > > ICMP EFNet code 1 - Smurfing > > ICMP EFNet code 2 - SYN Flooding > > ICMP EFNet code 3 - Channel takeover > > ICMP EFNet code 4 - Warring botnets > > ICMP EFNet code 5 - Dianora > > > > and many other useful messages. > > regardless of one's opinion on the usefulness/validity/point > of IRC, I think > some respect is due EFnet simply considering the antiquity of > the network, and > the sheer volume of communication, good bad and indifferent, > that has flowed > over it since its inception. I'm sure I'll be flamed for my > (mis)use of > 'antiquity', but I think IRC has been, and continues to be, a valuable > communication tool. Like any useful tool, it tends to be used for both > beneficial and nefarious purposes. > > And let's not forget that any network attack, regardless of > the target or > purpose, is a Bad Thing and responsible netizens should do > their part to help > eliminate such abuses. > > I'm done preaching now; I'm sure those who agree with me > didn't need a rehash, > and those that don't are unlikely to change their minds. Just > wanted to > provide a counterpoint to the "since $service has no business > function and > doesn't increase profits, there's no point in supporting it" crowd. > > (not that RAS is necessarily in that crowd; he just happened > to be the first > to respond.) > > Sometimes things are worth doing, even if doing them causes > you some grief. I'm > sure cynicism will eventually overwhelm me and I will realize > that there's no > point in sticking one's neck/network out to provide a useful > service to the > community. > > okay, I'm ready for the flames now. > > > -- > > Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras > PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6) -- Scott Francis darkuncle@ [home:] d a r k u n c l e . n e t Systems/Network Manager sfrancis@ [work:] t o n o s . c o m UNIX | IP networks | security | sysadmin | caffeine | BOFH | general geekery GPG public key 0xCB33CCA7 illum oportet crescere me autem minui

13 19

RE: DDOS prevention offensive.
by Roeland Meyer 12 Jul '01

12 Jul '01

> From: Jason Slagle [mailto:raistlin@tacorp.net] > Sent: Thursday, July 12, 2001 10:19 AM > > On Thu, 12 Jul 2001, Bill Larson wrote: > > > Well to sum it up in one sentence. If you eliminate the > bogus addresses, you > > can then target the actual zombie machines used to attack > the site and > > eventually eliminate the risk via patching or null route > them. So filtering > > bogus addresses, non-routable addresses, and the addresses, > which do not > > belong to your net blocks, would serve to combat the denial > of service > > attacks. > > > I believe the attacks in question are actually non-spoofed. > > It's getting the source networks to remove the boxes that is the > problem. Most of them are .edu. Aha! I knew there was a reason that I filter EDU <g>.

1 0

Re: DDoS attacks
by Richard A. Steenbergen 12 Jul '01

12 Jul '01

> For the last few days, I have experienced a series of DDoS attacks > on various targets around the globe. The general target is the EFNet > irc network, and servers have been attacked all through Europe, USA, > Canada, Israel, and such. Wow, EFNet is being attacked? That's never happened before. Someone should alert the media. > Due to the various attacks, more than half of the servers on the > network were black holed (null routed). The others which hold 1/3 of > the client count, are attacked, or going to be attacked soon. Perhaps because there are only 5 servers which actually accept clients? > If this keeps on going, this irc network will cease to exist. Oh the humanity. > In this time of need, it would be a great help if the large > carriers would be helpful in tracing the traffic. Hrm you may have an idea there. Since so many attacks are related to EFNet, and there are so many possible reasons for it to be impacting the rest of the internet, I propose we introduce a new ICMP type, ICMP EFNet. This message type could be used to convey all kinds of important information about why things are broken, for example: ICMP EFNet code 1 - Smurfing ICMP EFNet code 2 - SYN Flooding ICMP EFNet code 3 - Channel takeover ICMP EFNet code 4 - Warring botnets ICMP EFNet code 5 - Dianora and many other useful messages. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

9 12

Re: DDoS attacks
by Adam Herscher 12 Jul '01

12 Jul '01

> > This is pathetic. Someone asks for help and you demean them with jokes. > > Who was joking? I wasn't. I suppose that we should all start posting > "HELP ME!" posts to NANOG instead of sending an email to/calling the NOC > of networks with which we are having issues with DIRECTLY. All the > original poster did was add to the impact of the attack in question. The > attackers can now say, "Look! We kicked SO MUCH BUTT THAT THEY HAD TO GO > WHINE ON NANOG! WE RULE!" I did not originally reply because I figured you were going for a troll. Now I realize you're just clueless. Just because IRC servers are the first to feel the effects of a new, intense denial of service attack does not mean it should be ignored. The "they brought it upon themselves" argument lost all merit (hehe - Merit), when we saw large corporations (yahoo, ebay, cnn, etc) being brought to their knees by the same types of attacks. For what its worth, what we've seen in these attacks is somewhat new (log included below courtesy of Steven Nash, Lightning Internet). We should deal with them (and the networks they are coming from) now, and stop this flame war. lose the caps, lose the attitude, get a life, etc.. "kthx" Adam Herscher Administrator, irc.umich.edu -- After dealing with all these attacks on lightning the past 48 hours, and especially the past 24 hours, I noticed a trend. Very small arbitrary packets, built up of garbage (protocol FF (255) with a s.port and d.port of 0. Here is what the last blast looked like: ---netflow snippit--- AT3/0.147 24.102.124.6 Se1/0 207.45.69.69 FF 0000 0000 48K AT3/0.147 24.101.120.14 Se1/0 207.45.69.69 FF 0000 0000 4103 AT3/0.147 24.9.118.233 Se1/0 207.45.69.69 FF 0000 0000 7578 AT3/0.147 24.248.115.52 Se1/0 207.45.69.69 FF 0000 0000 465 AT3/0.147 24.9.71.197 Se1/0 207.45.69.69 FF 0000 0000 36K AT3/0.147 24.18.81.210 Se1/0 207.45.69.69 FF 0000 0000 15K AT3/0.147 24.101.82.141 Se1/0 207.45.69.69 FF 0000 0000 74K AT3/0.147 24.102.41.106 Se1/0 207.45.69.69 FF 0000 0000 69K AT3/0.147 24.8.59.35 Se1/0 207.45.69.69 FF 0000 0000 35K AT3/0.147 24.7.1.224 Se1/0 207.45.69.69 FF 0000 0000 23K AT3/0.147 24.9.29.11 Se1/0 207.45.69.69 FF 0000 0000 33K [snip] For those of you who aren't familiar with a netflow output, the second IP is the destination IP followed by the Protocol (FF), the source port (0000), the destination port (0000) and the number of packets. --

1 0

DDOS attacks and AIS and so forth
by Sean Donelan 12 Jul '01

12 Jul '01

After the DDOS attacks on several high-profile websites, a number of companies met at the White House and formed the Alliance for Internet Security. According to the web site, the AIS has several thousand members. Is the Alliance for Internet Security providing a useful function? Could something like the ISP-ISAC discussed at the last NANOG provide more or less assistance to Internet operators handling DDOS and other issues? Would an out-of-band communication system help Internet operators when a DDOS attack hits their network? Do Internet operators care about the issues affecting other networks so they can make plans, or do they prefer to concentrating only on things affecting their own network right now.

1 0

DDoS attacks
by Ariel Biener 12 Jul '01

12 Jul '01

Hi people, For the last few days, I have experienced a series of DDoS attacks on various targets around the globe. The general target is the EFNet irc network, and servers have been attacked all through Europe, USA, Canada, Israel, and such. Due to the various attacks, more than half of the servers on the network were black holed (null routed). The others which hold 1/3 of the client count, are attacked, or going to be attacked soon. If this keeps on going, this irc network will cease to exist. These attacks are all coordinated, and some people are trying to locate the source. Alot of traffic is coming via AboveNet from Korea. Alot of "zombies" are used to attack targets, PCs infected with trojans, that can be remote controlled. In this time of need, it would be a great help if the large carriers would be helpful in tracing the traffic. I am, trying to gather more data, and since alot of ISPs were attacked (C&W, Concentric, Global crossing, exodus, different academic institues in the US, Internet Gold in Israel via UUnet, the swedish telia backbone and academic institues in sweden, russian rosstelekom, gigabell.de in germany and the list goes on), I think this is a time when these people have to be stopped. At this time, it would be very helpful if AboveNet people could contact me in private. thanks, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

11 11

Improving Robustness of Distributed Services (Re: DDoS attacks)
by Aleksi Suhonen 12 Jul '01

12 Jul '01

Hello, I've been involved in running part of another IRC network and I've been trying to find reasonable ways to immunize networks to DoS attacks. The reasoning behind this quest is that if there is no way to deny the service, then the attacker shouldn't have a reason to even try. I think this is relevant content for this mailing list because: * Most of DoS attacks are against IRC networks. Hence, if we can get rid of those, the health of the Internet as a whole should improve. * Experience gathered with this approach should be useful to developers and administrators of other distributed services and protocols. (e.g. usenet news, web cache heirarchies, DNS, BGP, ... YMMV) Protecting the network can be divided into two parts: Protecting network links and protecting client servers. There are a lot of well known ways to protect client servers and someone else can write about that. But apart from myself, I haven't observed anyone trying to protect network links. This I find surprising since it is often the links that the abusers are specifically trying to attack. The way I feel major inter server links should be protected is that they should be moved "out of band." They could for example be moved into permanent virtual circuits with a few megabits of guaranteed bandwidth per second. Since this protocol does not use a fully meshed network, but only an acyclic subset of it, most of the reserved bandwidth would be available for use by other services. In essence, using this dedication wouldn't use up any more bandwidth in the backbones than the current way of running links over the public Internet. It would just make sure that these critical links couldn't be caused to flap by denying their bandwidth. If resources exist and are readily available, the inter server links could maybe even be assigned a real dedicated circuit. Wrt. the applicability of this approach to other distributed services and protocols: It was just yesterday that I was talking with a friend about BGP transit and peering practises (in general) and one of the things I mentioned was that I would like to see the practise of separating the BGP transit session on its own circuit apart from the transit circuit being deployed more widely. This would not be such a bad idea at exchanges either. In some cases it might have very apparent uses for purposes other than DoS resistance as well: With the emergence of exchanges for multiple different "Internet Commodities" (IPv4, IPv4 MBone, IPv6, ...) many of the exchanges have a separate shared medium (often just a VLAN) for each of the exchanged protocols. I don't find debating about the reasons of separating them or not at this stage of hardware, software and protocol maturity useful. I'm just stating that this is one of the current practises. Now, what operators - that are capable of carrying all the protocols over a single infrastructure - could do at these exchanges is that they could run peering their sessions for all the protocols in one and work similar magic with the next-hop addresses etc. as in the transit session case above. The exchange point could provide a separate out of band shared medium over which the operators could run these peering sessions. This would simultaneously increase network stability by making the BGP sessions themselves impervious to attacks. These approaches of course require more complex configuration, more thought, more clue when debugging, and generally more everything, but I find that nothing new. Kindest regards, -- Aleksi Suhonen / Axu TM Oy Internetworking Consulting http://www.axu.tm/ PS. Of the people that flamed the original poster, tell me which were ones that didn't have any kind of affiliation with the provider that the original poster had trouble with? There was a time when they weren't the ones to effectively say "We are the phone company. We don't care. We don't have to."

2 2