- NANOG - lists.nanog.org

Re: NANOG meeting subject of attack? Hmmmm....
by Hank Nussbacher 10 Feb '00

10 Feb '00

At 20:21 09/02/00 -0500, Travis Pugh wrote: Interesting and may have nothing to do with it, but: http://moat.nlanr.net/TopThroughput/ Starting at 2/2/2000, I have seen the top 100 Internet-2 flows to be significantly higher than a month ago. I would also look at vBNS: http://www.vbns.net/stats/flows/data/results/hibw/ Feel free to do the analysis and see if anything of interest turns up. Regards, Hank > > >On the subject of cooperation, has anyone set out to catalog where these >attacks are coming from, at least in terms of compromised networks, and >share said information? I know similar catalogs sprang up in response to >smurfs ... is it time to start listing offending networks? Even better, >does anyone know if the attacks are using something like TFN2K and using >dummy addresses to obfuscate real attacking hosts? > >I see a lot of talk of attacked sites putting up router filters to >stop attacks. Can anyone who knows let the rest of us in on what was >filtered ... was Yahoo taken down with a flood of HTTP GETs, ICMP, UDP, >SYN floods, or what? If this is a DDoS, the attack could probably be >fingerprinted ... this would be very useful information if we are going >to see more tomorrow. Do we know if the source addys are spoofed, and if >an attacker could turn off spoofing, revealing the source of the traffic >but getting around some filtering? > >I am making the assumption that the last three days' attacks were caused >by the same person or persons. But the intent is the same regardless >... we can all go back and forth on NANOG about what might be happening, >and wait for the feds to chase down the attacker(s), or people who have >been attacked or might be attacked can compare notes and try to get an >idea of where the attacks are coming from and exactly what they are. > >Any relevant info would be appreciated. Nobody knows who is next. > >-travis > > >On Wed, 9 Feb 2000, Joe Shaw wrote: > >> >> >> Make it a law, and they will. But I don't think laws are the answer >> to cooperation. The Tier1's should take the time to work together on >> their own before they are forced to in a way they may not like. >> >> -- >> Joseph W. Shaw - jshaw(a)insync.net >> Computer Security Consultant and Programmer >> Free UNIX advocate - "I hack, therefore I am." >> >> On Wed, 9 Feb 2000, Henry R. Linneweh wrote: >> >> > they should be made to co-operate with the backbone provider and not have >> > much choice in the matter. >> >> >> > > >

1 0

The SANS Institute: SANS NewsBites Vol. 2 Num. 6
by Brett D. Watson 10 Feb '00

10 Feb '00

in light of current events, the links below will probably be useful to many folks. (from SANS newsletter) -brett ------- Forwarded Message From: Rob for the SANS NewsBites service Re: February 9 SANS NewsBites Congratulations to the winners of this year's SANS Security Technology Leadership Awards: Dave Dittrich of the University of Washington and Marcus Ranum of Network Flight Recorder for developing and distributing a network scanner that finds trin00 and other distributed denial of service attack tools. http://www.staff.washington.edu/dittrich Eric Kayden of MITRE and Steve Schmidt of the National Infrastructure Protection Center and their teams for developing and distributing a system scanner that searches for trin00 and other distributed denial of service attack tools. http://www.fbi.gov/nipc/trinoo.htm John Green of the Naval Surface Warfare Center and Laurie Zirkle of Virginia Tech University for creation of the document, "Handling A Distributed Denial of Service Trojan Infection: Step-by-Step." http://www.sans.org/y2k/DDoS.htm Robert Stone and Mark Krause and their team at UUNET for developing CenterTrack, the tool that Internet Service Providers will use to find the source of forged IP packets employed in distributed denial of service attacks. http://www.nanog.org/mtg-9910/robert.html Steve Christey, Dave Mann, Mary Zuk, Pete Tasker, and the staff at MITRE for establishing, nurturing, and sustaining the industry-wide cooperative CVE (Common Vulnerabilities and Exposures) project that enables accurate comparisons of vulnerability analysis tools and summaries. http://cve.mitre.org/ The awards, including plaques and financial stipends will be presented on March 24 at SANS2000 in Orlando. RK ********************************************************************** SANS NEWSBITES The SANS Weekly Security News Overview Volume 2, Number 6 February 9, 2000 Editorial Team: Kathy Bradford, Crispin Cowan, Roland Grefer, Rob Kolstad, Bill Murray, Stephen Northcutt, Alan Paller, Howard Schmidt, Eugene Schultz <sansro(a)sans.org> ********************************************************************** 8 February 2000 Yahoo! Suffers Distributed Denial of Service Attack 8 February 2000 More Sites Attacked 5 February 2000 Training Cyber Defenders 4 February 2000 Piracy Ring Exposed 4 February 2000 Cross Site Scripting Threat 4 February 2000 IETF Excludes Wiretapping 4 February 2000 The Human Element in Information Security 3 February 2000 Security of Home PCs 3 February 2000 E-Commerce Security Study 3 February 2000 Some Web Shopping Applications Could Allow Price Tampering 3 February 2000 Phony Donation Sites 3 February 2000 Computer Export Controls Eased 3 February 2000 Government Security Standards Updated 3 February 2000 Activists Taking a New Tack in Patrolling the Web 3 February 2000 Cyber Threats 2 February 2000 Java Machine Hole 2 February 2000 Japan Lagging on Computer Security, Punishment for Intrusions 2 February 2000 DVD Code Cases 1 February 2000 FIDNet at Center of Privacy Debate ******************** This week's sponsor: VeriSign ******************* Sponsored by VeriSign - The Internet Trust Company: Protect your servers with 128-bit SSL encryption! Get VeriSign's FREE guide, "Securing Your Web Site for Business." You will learn everything you need to know about using SSL to encrypt your e-commerce transactions for serious online security. Click here! http://www.verisign.com/cgi-bin/go.cgi?a=n016005080008000 ********************************************************************** - -- 8 February 2000 Yahoo! Suffers Distributed Denial of Service Attack Yahoo! was down for nearly three hours on Monday, the apparent victim of a distributed denial of service attack. The site was inundated with up to a gigabyte of data a second - more than most e-commerce sites face in a year. No data was lost, and no one has stepped forward to claim responsibility. http://www.washingtonpost.com/wp-dyn/business/A23174-2000Feb7.html http://www.msnbc.com/news/367156.asp?0m=N18Q Editor's Note (Northcutt): One generally effective defense against these types of attacks is egress filtering. More information is available at the Global Incident Analysis Center: www.sans.org/giac.htm - -- 8 February 2000 More Sites Attacked At least two other sites have been the targets of distributed denial of service (DDOS) attacks similar to the one that plagued Yahoo on Monday. DDOS attacks flood sites with traffic from a variety of locations, often causing the sites to shut down. http://dailynews.yahoo.com/h/nm/20000208/ts/tech_hackers_1.html - -- 5 February 2000 Training Cyber Defenders At the Northern California branch of Sandia National Laboratory, computer security students are learning to defeat computer attacks, and sharing their work on the Internet. http://washingtonpost.com/wp-srv/WPlate/2000-02/05/078l-020500-idx.html - -- 4 February 2000 Piracy Ring Exposed A Massachusetts man, a suspected leader of an international software piracy group, has been arrested and charged with conspiracy to infringe the copyright of a large number of software programs. The members of the group used a barter system to compile a large library of software. http://www.msnbc.com/news/366376.asp?0m=N14P http://www.zdnet.com/zdnn/stories/news/0,4586,2433357,00.html?chkpt=zdnntop - -- 4 February 2000 Cross Site Scripting Threat The Computer Emergency Response Team (CERT) Coordination Center has issued a warning about a security threat, called cross-site scripting, in which malicious code is inserted into dynamically generated web pages. The scripts can be inserted without the knowledge of the operator, and can capture data users offer to a site, such as credit card information and passwords. The technique exploits CGI pages that parrot back input fields without stripping the fields of characters that make them into a script. http://www.currents.net/newstoday/00/02/04/news2.html http://www.computerworld.com/home/print.nsf/all/000202E63A http://www.apbnews.com/newscenter/internetcrime/2000/02/03/certalert0203_01… http://www.usatoday.com/life/cyber/tech/cth270.htm http://www.fcw.com/fcw/articles/2000/0131/web-hackers-02-04-00.asp The CERT Advisory may be found at http://www.cert.org/advisories/CA-2000-02.html - -- 4 February 2000 IETF Excludes Wiretapping The Internet Engineering Task Force (IETF) has voted against incorporating wiretapping capabilities into the next generation of Internet protocols. The IETF says that because it is an international standards organization, incorporating net wiretapping would subject the rest of the world to US law. The IETF also expressed concerns that built-in net tapping capabilities hold the potential for abuse. http://www.wired.com/news/print/0,1294,34055,00.html http://www.currents.net/newstoday/00/02/04/news4.html - -- 4 February 2000 The Human Element in Information Security Both ex-CIA director John Deutch and Energy Department scientist Wen Ho Lee placed classified information on unsecured computers. Government officials say this is a human problem, not a technological problem. http://www.wired.com/news/print/0,1294,34105,00.html http://www.fcw.com/fcw/articles/2000/0131/web-security-02-04-00.asp - -- 3 February 2000 Security of Home PCs The recent revelation that the former CIA director's home computer contained highly classified material and was used to access the internet, raises the question of the security of home computers. http://cnn.com/2000/TECH/computing/02/04/pc.security/index.html http://www.msnbc.com/news/366221.asp?0m=N15P - -- 3 February 2000 E-Commerce Security Study Many e-commerce businesses lack comprehensive security policies, and IT managers are less confident in the security of their systems than are company executives, according to a recent study by Deloitte Touche Tohmatsu and the Information Systems Audit and Control Association (ISACA) http://www.currents.net/newstoday/00/02/04/news17.html - -- 3 February 2000 Some Web Shopping Applications Could Allow Price Tampering Some web based shopping cart applications could allow malicious shoppers to alter fields in HTML forms and in URLs to change the price of items they are buying. Eight of the eleven identified vulnerable shopping applications have been altered to increase security. http://www.computerworld.com/home/print.nsf/all/000202E636 http://www.usatoday.com/life/cyber/nb/nb2.htm http://www.theregister.co.uk/000203-000006.html - -- 3 February 2000 Phony Donation Sites At least two fraudulent web sites purporting to be related to Alaska Airlines Flight 261 have popped up on the Internet. At least one is trying to solicit donations and it spreads a virus to site visitors; another was shut down. Alaska Airlines is trying to find out who set up the phony sites; their official site, which contains Flight 261 information, is www.alaskaair.com. http://www.usatoday.com/life/cyber/tech/cth273.htm http://www.currents.net/newstoday/00/02/04/news7.html - -- 3 February 2000 Computer Export Controls Eased The Clinton administration has eased export controls on high performance computers; the controls will be reviewed again in April. http://www.currents.net/newstoday/00/02/03/news6.html - -- 3 February 2000 Government Security Standards Updated Government systems security and encryption validation standards have been updated. Revisions include removal of redundant information and the addition of a section on surviving cyber attacks. http://www.gcn.com/vol1_no1/daily-updates/1236-1.html - -- 3 February 2000 Activists Taking a New Tack in Patrolling the Web Former cyber vigilantes bent on ridding the Internet of child pornography have changed their tactics. Rather than engaging in illegal and evidence-destroying activities, they are patrolling the Internet and turning information over to law enforcement authorities. One of the more thought-provoking elements of the story is that fewer than a dozen of the 250 members stuck with the group when it went "legal." http://www.wired.com/news/print/0,1294,33869,00.html - -- 3 February 2000 Cyber Threats The US's reliance on information technology is both an asset and a liability. The technology of information warfare can magnify the range and effect of a single attacker, according to the directors of the CIA and the DIA (Defense Intelligence Agency). Intelligence suggests that Middle East terrorist groups are using computers and encryption. Most adversaries, however, are not sophisticated enough to launch a comprehensive information systems attack. http://www.currents.net/newstoday/00/02/03/news19.html - -- 2 February 2000 Java Machine Hole A security hole in Microsoft's Java virtual machine could allow attackers to lift files from computers by inserting code into a Java applet and them embedding it in a web page. http://www.zdnet.com/zdnn/stories/news/0,4586,2431555,00.html - -- 2 February 2000 Japan Lagging on Computer Security, Punishment for Intrusions Japan has not maintained a high level of computer security, which may in part explain the rash of attacks the country's government web sites recently experienced. Additionally, the country has not penalized cyber intrusions. A new law will change that, providing for prison time and a hefty fine for entering computer networks without authorization. The Japanese government also plans to step up its efforts to improve computer security. http://washingtonpost.com/wp-srv/WPlate/2000-02/02/152l-020200-idx.html - -- 2 February 2000 DVD Code Cases The Electronic Frontier Foundation (EFF), arguing for the defense in two DVD code cases, says that DVD encryption does not meet the minimum standard for a trade secret. http://www.cnnfn.com/news/technology/newsbytes/143179.html - -- 1 February 2000 FIDNet at Center of Privacy Debate FIDNet, the proposed Federal Intrusion Detection Network, is the focus of debate about the Clinton administration's National Plan for Information Systems Protection. Privacy advocates say the plan focused heavily on system monitoring and surveillance rather than on enhancing computer security. They have also expressed concern that one agency, the General Services Administration (GSA) would monitor all federal network communication. http://www2.infoworld.com/articles/en/xml/00/02/01/000201enprivate.xml?Temp… http://www.thestandard.com/article/display/1,1151,9327,00.html http://www.computerworld.com/home/print.nsf/all/000201E5E2 http://www.wired.com/news/print/0,1294,34027,00.html == End == Please feel free to share this with interested parties via email (not on bulletin boards). For a free subscription, e-mail sans(a)sans.org with the subject: Subscribe NewsBites Email <sans(a)sans.org> with complete instructions and your SD number (from the headers) for subscribe, unsubscribe, change address, add other digests, or any other comments. ------- End of Forwarded Message

1 0

Re: Yahoo offline because of attack (was: Yahoo network outage)
by George Herbert 10 Feb '00

10 Feb '00

Roeland writes: >George wrote: >> Roeland wrote: >> >I smell denial here. The compromised systems (only 52?) had to >> >have access to pipes at least 1 Gbps in size, in order to carry out this >> >attack (do the math yourself). Either there were many more systems >> >participating (in itself a scarey thought) or many of these large and >> >professionally run systems are owned and their operators don't know it. >> >The only other alternative is the conspiracy theory from hell. >> >> No, they don't. Assume there's 40k of data in the homepage. >> How many bytes of SYN-SYNACK-ACK-GET / HTTP/1.0\n does it take >> to do a TCP connect and request? I just tested, I show 160 bytes. >> That's a 250:1 leverage for the attacker. To fill 1 GBPS worth >> of outbound trunking you only need to generate 4 MBPS (32 Mbps) >> worth of input. 50ish systems with T-1 connectivity gets there >> with margins. > >Okay, but you've still missed the point. Even if I stipulate everything you >said here, that's still 50 largish systems that are compromised. I would >almost wager that the perpetrators didn't use all of their assets either. >That's a shit-load of large compromised systems on the Internet. Doesn't >that thought worry you in the slightest? 50 systems across the internet with enough CPU capacity to near-fill a T-1 on a sustained basis with identical HTTP requests. Which is to say any modern multi-hundred-mhz RISC or x86 box with a reasonable OS, not really "largish". The processing needed in the OS TCP and IP stacks on the attacking system is most of the effort, and we're only talking in rough numbers 1,000 connects/sec for the attacker. Do I believe that there exist 50 or more T-1 connected hosts with that capability level or higher which still have vendor default setups and thus are vulnerable to this sort of attack, penetration, and then use as a distributed DOS attack participant? Yes, without a doubt. 50 simultaneous sites compromised by one attacker would be on the ambitious side these days, but some of the remote exploit scripts (and corresponding known holes in vendor supplied system configs) are pretty damn easy to use and it wouldn't be out of the relm of the practical for someone to do it if they worked hard, or got a small cooperating team to work on it. Of course the significance of this is highly worrysome. But the numbers have been in this rough performance range for attacker capabilities for several years now. That the tools used by attackers took that long to catch up is actually somewhat suprising to me, I was expecting this sort of thing some time ago. -george william herbert gherbert(a)crl.com

18 29

Re: Info on the DoS attacks.
by Sean Donelan 10 Feb '00

10 Feb '00

On Wed, 09 February 2000, Declan McCullagh wrote: > From my perspective, corporations are filtering information through > clueless PR flacks to a (relatively clueless) media. I can't buy that sites > hit by an attack 48 hours ago "have no idea what is going on." If that's > the case, some people need to be fired real quick. I'm not too concerned about clueless media and PR flacks. But at NANOG I spoke with several people I thought would know, who didn't. I didn't talk to any GlobalCenter folks because I couldn't find any. They disappeared on Monday. But I did speak with several security people with other providers, and they hadn't heard any confirmed technical details. Just speculation about what had happened. In particular, everyone was wondering what made the attack so hard to detect as a DoS. Ok, I know, I don't work at an ISP anymore, so I'm not a member of the club. I think several departments at WorldCom are under orders not to speak to me. But instead I found the security folks at other providers were happy to talk about it, but didn't know any more than me. This worries me.

3 2

Sample box (more info)
by lucifer＠lightbearer.com 10 Feb '00

10 Feb '00

To update folks who have asked (too many to reply to directly, with any ease; my apologies if anyone is annoyed by this method): The box has not *yet* been scorched, it turns out; I've asked them to keep it until the research can be finished. Given the past record, and the fact that this server is somewhat important, I seriously doubt that they're going to be willing to just hand it over to the Feds - any more than any of you want to hand over your laptops. Errata: the machine was not actually on a 2xT1, as it had been moved since I was last aware of it's location; it was, during the attack, behind a 512k ADSL line, I have been told. I have a copy of what has been dug out of the box so far, which is the actual packet-generating tool, a binary called "imp"; for those about to ask me for the code, don't bother - because it's fairly generic, and I *think* it has been circulating for a good while; either way, it's nothing to write home about. All it's doing is sending a flood of SYN, ACK, FIN, or RST packets (which, I'm still trying to determine, although it appears likely to have been SYN; we're trying to dig out the actual trigger code, still). A reminder: this is not *proven* to have partcipated in the attacks that have been going on, per se, since we don't have enough information to know just what the attacks look like. -- *************************************************************************** Joel Baker System Administrator - lightbearer.com lucifer(a)lightbearer.com http://www.lightbearer.com/~lucifer KF6WAY (Tech) - 146.475 MHz (FM/Phone)

1 0

Re: NANOG meeting subject of attack? Hmmmm....
by Shawn McMahon 10 Feb '00

10 Feb '00

Or cooperate with each other, find the son of a bitch who started it, and prosecute him in each and every state the packets passed through that has computer intrusion laws, so that even if he's found not guilty or given token sentences, he gets that way one trial at a time in 50 states. Lather, rinse, repeat. Should be good for 15 to 25 years of trials. :-) At 08:02 PM 2/8/2000 -0700, you wrote: >not only that, it seems that the DOS is so bad that even UUNet is having to >shut down peering points around the West Coast with most of their peers. I >guess the only way to 'protect' against something this big would be to follow >Pauls RFC and/or have big, fat pipes sitting idle.

7 9

DDos apparently not http related
by George Herbert 10 Feb '00

10 Feb '00

I would like to make clear a bit of info... The discussion I started about attacker bandwidth multiplication and HTTP GET attacks was based on theoretical concerns and other possibilities which, as information is coming out now, appear to be unrelated to the actual current attacks. I had been thinking that it might be that type based on some comments by a Yahoo staffer, but was told late today that he'd been slightly misquoted and that all the current attacks are variants of ping flood, syn flood, etc. (known TFN-2K code being used, apparently, or so sez Cnet). -george william herbert gherbert(a)crl.com

1 0

RE: Yahoo offline because of attack (was: Yahoo network outage)
by Shawn McMahon 10 Feb '00

10 Feb '00

For purposes of this kind of attack, bandwidth is *FREE*. Remember what we're positing here: 1) The attacks come from compromised sites. 2) The trigger is a single ICMP packet sent to each of those sites. You could run this over a 14.4k modem, no problem. You could run this over a Palm Pilot, plugged into a pay phone. You could run this from a PC sitting in your local public library, for free. It just takes setup time, and that can be done by writing a program that does something else, and has this lying in wait. Or, an ActiveX control sitting on a site somewhere that fires up when it's hit and attacks. Put some information on the site (DeCSS info, maybe?), post a link on Slashdot so lots of folks hit it, and whammo, hundreds or even thousands of dupes running Internet Explorer suddenly use all their bandwidth launching bits of your attack. 200 dupes with 33.6k modems can flood a T1. 200 dupes with 512k ADSL can flood multiple T3s. 200 dupes with Road Runner can flood OC-[insert small integer here]. Multiply by your worst nightmares. Again, the fact that X amount of bandwidth was consumed tells us *NOTHING* about the nature of the attack. (Which is the only point I'm arguing, here, and is the fallacy the initial poster fell victim to.) At 12:54 PM 2/9/2000 -0500, you wrote: >On the other hand, I have a 768k DSL line at home for $89/mo. Bandwidth >isn't as cheap as you might think.

2 1

RE: Yahoo! Lessons Learned
by K. Graham 10 Feb '00

10 Feb '00

On 8 Feb 2000, Sean Donelan wrote: > Date: 8 Feb 2000 03:25:36 -0800 > From: Sean Donelan <sean(a)donelan.com> > To: nanog(a)merit.edu > Subject: Yahoo! Lessons Learned > > > As much as I enjoy finding out about Yahoo & GlobalCenter issues by > reading the newswires, I wonder if there are any lessons we can learn > from these events. Or was this not big enough to get attention of > upper management? Possibly. > > Was there something Yahoo!, GlobalCeneter or other providers could > have done, either individually or in cooperation, to prevent the problem? > Yes. One of the emails sent in, mentioned that a network they work with or for was being utilized as an amplifier. Each network that have gateway routers should ensure that they disallow IP broadcasts. It was mentioned that this was a co-ordinated attack. That meant a bit of planning and access to various machines. As to the number of attackers only Yahoo's internal people may know. Even then it may have only been one individual with a script that accessed many locations at one time and initiated the commands. There is the ability to do such an attack. The reality of "stay connected 24/7" at the household level with highspeed internet, makes the possibility of this attack more of a multi level victom attack. Home users do not know that they are leaving the door open to exploitation with simple Window's shares. Savy people gain access to the cable and dsl modem user's PCs and then launch their attacks. Small utilities are put in place to make it easier to find the exploited machines. Thus creating a network of available attack, harder to track connections. Education is a tool that can be used to inform customers. If each node on the Internet takes care of it's own doors then there will be less available launching pads. Thus making it a bit simpler to track an attack. Who or what will do the education is a question. Who are the responsible parties if no education is taken or given? To me, the responsiblity question is a nitemare at best. I just hope Yahoo's unfortunate incident opens some eyes, some lines of communication and education. K. Graham Network Analyst, CCNA kim(a)penguin-power.com

6 6

Re: Yahoo! Lessons Learned
by Vadim Antonov 10 Feb '00

10 Feb '00

Daniel Senie <dts(a)senie.com> wrote: > While implementing these measures may not directly benefit your network, > doing so may thwart an attack against someone else's net. Tomorrow, the > roles could be reversed. As with many areas of managing the Internet, > cooperation is key. Yep. Actually, tier-1 ISPs can write the requirement for reverse-path source IP address verification on customer access circuits into their peering agreements. An enforcement can take a form of penalties per verified incident of forged source address attack originating in peer's network. (The adversarial IP perfix filtering was needed to institute such prefix-reduction policies as aggregation and address allocation out of ISP blocks. I remember that purely voluntary efforts were pretty much derailed by negligience of some ISPs (why AS 174 comes to the mind? :) I do not expect reverse path filtering to be any different in terms of deployment problems.) --vadim

6 5