- NANOG - lists.nanog.org

Re: All your NIC handles are belong to us
by Ukyo Kuonji 27 Feb '01

27 Feb '01

Only if it is setup that way. Majordomo will trigger fitters off of erveral things. It's default it to trigger off on administration commands, but other can be configured. I have configured filters for HTML coded messages and other stuff in the lists I host. --- Opinions in this email are the personal opinions of the author and are not associated with author's employer. This email account is a not the regular email account of the author and is being used for the protection of the employer. -----Original Message----- From: Kai Schlichting To: nanog(a)merit.edu Subject: Re: All your NIC handles are belong to us *knock knock* ALL YOUR NIC HANDLES ARE BELONG TO US. The mystery with posts going to nowhere has re-appeared. No bounces due to NANOG-post. No moderation notice. Nothing. Does Majordomo mind Subjects starting with "OT:" ? _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

Re: All your NIC handles are belong to us
by Kai Schlichting 27 Feb '01

27 Feb '01

*knock knock* ALL YOUR NIC HANDLES ARE BELONG TO US. The mystery with posts going to nowhere has re-appeared. No bounces due to NANOG-post. No moderation notice. Nothing. Does Majordomo mind Subjects starting with "OT:" ? Feb 26 18:10:44 sonet sendmail[27445]: SAA27445: from=<kai(a)pac-rim.net>, size=2083, class=0, pri=32083, nrcpts=1, msgid=<6669287802.20010226180952(a)conti.nu>, bodytype=8BITMIME, proto=ESMTP, relay=localhost.conti.nu [127.0.0.1] Feb 26 18:10:45 sonet sendmail[27447]: SAA27445: to=<nanog(a)merit.edu>, ctladdr=<kai(a)pac-rim.net> (100/101), delay=00:00:01, xdelay=00:00:01, mailer=esmtp, relay=mail.merit.edu. [198.108.1.41], stat=Sent (Ok: queued as A13D45DDA4) Original post at: http://www.conti.nu/nanog/nanog-20010226.txt bye,Kai -- "Just say No" to Spam Kai Schlichting New York, Palo Alto, You name it Sophisticated Technical Peon Kai's SpamShield <tm> is FREE! http://www.SpamShield.org | | LeasedLines-FrameRelay-IPLs-ISDN-PPP-Cisco-Consulting-VoiceFax-Data-Muxes WorldWideWebAnything-Intranets-NetAdmin-UnixAdmin-Security-ReallyHardMath

1 0

Re: Warning: Cisco RW community backdoor.
by owen＠dixon.delong.sj.ca.us 27 Feb '01

27 Feb '01

It applies to 12.0 and later, so testing it on an 11.x router doesn't help. Owen > > > It appears that 2500 are not affected. > > The fix below doesn't work on 11.1 and 11.2 , you have to turn snmp off by > the looks. > > have fun. > > ----- Forwarded message from "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> ----- > > Date: Tue, 27 Feb 2001 00:39:38 +0000 (GMT) > From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> > X-Sender: <jamesr@inet15> > To: <members(a)lonap.net>, <ops(a)linx.net> > Subject: Warning: Cisco RW community backdoor. > Precedence: bulk > > If your router responds to `snmpwalk router.isp.net.uk ILMI`, you > probabally will want to do the following to disable it: > conf t > snmp-server community ILMI RO 99 > access-list 99 deny any log > (pick another spare access-list if 99 isn't available) > > If you dont, assuming your ios/hardware combination supports it, > (most of the bigger routers do) anyone can do things like: > `snmpset router.isp.net.uk ILMI system.sysName.0 s \ > "ALL YOUR ROUTER ARE BELONG TO US."` > Thats a harmless example. You can do almost anything with RW snmp. > > Warm Regards > James > > -- > James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk > Internet Operations Engineer | Phone: 01737 839 737 > BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. > > ----- End forwarded message ----- > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > > > > >

1 0

Re: Warning: Cisco RW community backdoor.
by Jim Duncan 27 Feb '01

27 Feb '01

Sean Donelan writes: > > Anyone with a Smartnet contract have a response from Cisco yet? I really > need to get my own Smartnet number. > No need. I'll post the advisory as soon as I can get it ready. It's probably going to be another hour or two. The only reason I've paused to post this response is to ask everyone to wait for the advisory and stop experimenting. This one is really strange in the interactions with various releases, features, and hardware. The real problem is that if you try enough different combinations of config commands to shut off the problem, you'll put your ATM connections in a very poor state (that's the best way I can put it). As a side note, this is a problem with the standards. In particular, how the standards _require_ a function to be implemented. Please wait for the advisory. Thanks! Jim -- Jim Duncan, Product Security Incident Manager, Cisco Systems, Inc. <http://www.cisco.com/warp/public/707/sec_incident_response.shtml> E-mail: <jnduncan(a)cisco.com> Phone(Direct/FAX): +1 919 392 6209

3 2

RE: Warning: Cisco RW community backdoor.
by Martin, Christian 27 Feb '01

27 Feb '01

> And yes, the only tree I could touch was system. Nothing > else, read or > write. Folks, I expect most of the community to know this, but just in case. A walk of the enterprises.cisco tree returns null as well(fortunately). UCD snmpwalk (and others) do not traverse the enterprise tree by default. Regards, chris > > -j > > -- > -Jonathan Disher > -Sr. Systems and Network Engineer, Web Operations > -Internet Pictures Corporation, Palo Alto, CA > -[v] (650) 388-0497 | [p] (877) 446-9311 | [e] jdisher(a)eng.ipix.com > >

1 0

It was documented (Re: Warning: Cisco RW community backdoor. )
by Sean Donelan 27 Feb '01

27 Feb '01

On Mon, 26 February 2001, John Fraizer wrote: > While I agree that "public" and "private" are "wellknowns," in most > implementations, they at least show up in the code. Cisco chose to hide > this one where it would not show up in the code. That IMHO is a very bad > thing and does bad things to my confidence level in Cisco. What is the difference between a bug and a feature, the feature is documented. http://www.protocols.com/pbook/ilmi.htm Protocol Limitations The following are some known SNMP limitations. ATM messages must be formatted according to SNMP version 1, not SNMP version 2. ALL SNMP messages will use the community name ILMI. In all SNMP Traps, the agent address field always has an IP Address value of 0.0.0.0. The supported traps are coldStart and enterpriseSpecific. In all SNMP traps, the timestamp field contains the value of the agents sysUpTime MIB object at the time of trap generation. In all of the standard SNMP traps, the enterprise field in the Trap PDU contains the value of the agents sysObjectID MIB object. The size of messages can be up to 484 octets. Those darn ATM people again. Screwing up a perfectly good protocol for their ATM UNI ILMI stuff.

1 0

Re: Warning: Cisco RW community backdoor.
by Shawn McMahon 27 Feb '01

27 Feb '01

There are some folks who think this only lets you change the contact string. This is false; it lets you change several strings. However, they appear to all be informational in nature, not operational. I think the information leakage point is a bigger deal than the information change point, although you could confuse a sufficiently clueless administrator by changing the location information.

1 0

Re: Warning: Cisco RW community backdoor.
by Shawn McMahon 27 Feb '01

27 Feb '01

Would it be redundant to add that if IOS was open, we'd have known about this years ago and it would have been fixed years ago?

2 1

Fw: Re: Warning: Cisco RW community backdoor. (fwd)
by Simon Lyall 27 Feb '01

27 Feb '01

Further updates.. It's not TOO bad. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz ---------- Forwarded message ---------- Date: Mon, 26 Feb 2001 21:54:50 -0400 From: Joe Abley <jabley(a)automagic.org> To: nznog(a)list.waikato.ac.nz Subject: Fw: Re: Warning: Cisco RW community backdoor. More details below. -----Original Message----- From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> Date: Tue, 27 Feb 2001 01:46:37 +0000 (GMT) Subject: Re: Warning: Cisco RW community backdoor. To: <members(a)lonap.net>, , , <ops(a)linx.net> Just a couple of things to note, I've been asked what the backdoor is, if its the community "ILMI" or if that was just an example, the answer is yes - "ILMI" is the backdoor which gives read-write access to parts of the SNMP base. Its looks like parts of my earlier email are somewhat misleading, the ILMI community appears to only allow RW access to the system object and possibly some more objects. Its not a 'standard' open RW community. hence the damage caused by this backdoor is limited. There is still some write access however, so the fix mentioned below is still highly recommended. And of course - it allows people to read what IOS/model cisco you have, which could be used to find exploitable bugs in that particular release. Oh I wonder what the chances of having a router stolen due to discovery of system.sysLocation is! :-) Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. On Tue, 27 Feb 2001, it was written: > If your router responds to `snmpwalk router.isp.net.uk ILMI`, you > probabally will want to do the following to disable it: > conf t > snmp-server community ILMI RO 99 > access-list 99 deny any log > (pick another spare access-list if 99 isn't available) > > If you dont, assuming your ios/hardware combination supports it, > (most of the bigger routers do) anyone can do things like: > `snmpset router.isp.net.uk ILMI system.sysName.0 s \ > "ALL YOUR ROUTER ARE BELONG TO US."` > Thats a harmless example. You can do almost anything with RW snmp. > > Warm Regards > James > > -- > James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk > Internet Operations Engineer | Phone: 01737 839 737 > BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Update for noc .nl problem..
by Shawn McMahon 26 Feb '01

26 Feb '01

On Sun, Feb 25, 2001 at 09:02:46PM -0800, Ben Browning wrote: > > The only possible reason you could want names, or account names, or > addresses, or copies of my logs, etc would be to initiate civil or criminal > proceedings, in which case the subpoena should be a piece of cake. Wow; despite the lengthy discussion in which I've posted at least two messages talking about another possible reason, you've gotten this far in the thread without realizing there was more than one possible reason? This reminds me of the old joke about how you tell something to a blonde with two black eyes. I've already tried to tell you twice, a third time would just waste my time and annoy the pig.

1 0