- NANOG - lists.nanog.org

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

These are the three e-mail addresses they have contacted me on so far. armada.collective(a)bk.ru melvin.webster2(a)gmail.com luciennemcglynn30(a)gmail.com -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

2 1

Traffic Eng - VM's routing
by WA 10 Dec '15

10 Dec '15

All, I'm working on trying to move VM's from site A to site B, simple enough motion to complete. The issue is the VM's on site A have to stay the same so once the VM's are moved across they still have site A address but are location now on site B, so what happens is return path for the VM traffic will go to site A (typical routing) My questions is for any fellow engineers is have you tried to do this before , I know we can could do some policy routing to control the traffic but has anyone tried this using MPLS TE or by using separate VRF;s Any hints or tips would be awesome! Thanks!

1 0

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

We received a similar ransom e-mail yesterday followed by a UDP flood attack. Here is a sample of the attack traffic we received as well as a copy of the ransom e-mail. Thought this might be useful to others who have been targeted as well. I will have to talk with our upstream providers to get a definitive on the size of the attacks. At the point in time we blackholed our ip we were seeing 20+Gbps. *Dec/07/2015 5:40:22PM *Here is a summary of the flows to our web server IP during the ddos event: ================================================ Top 10 flows by packets per pecond for dst IP: 96.43.134.147 Duration Proto Src IP Addr Src Pt Dst Pt Packets pps bps 0.001 UDP 175.43.224.99 1900 22456 2048 2.0 M 5.8 G 0.002 UDP 120.199.113.49 1900 54177 2048 1.0 M 2.8 G 0.002 UDP 27.208.164.227 1900 54177 2048 1.0 M 2.7 G 0.002 UDP 60.209.31.218 1900 16632 2048 1.0 M 3.0 G 0.002 UDP 27.220.71.238 1900 22456 2048 1.0 M 3.0 G 0.002 UDP 120.236.121.9 1900 62005 2048 1.0 M 2.5 G 0.002 UDP 104.137.222.90 1900 14944 2048 1.0 M 3.7 G 0.002 UDP 121.27.133.72 1900 44417 2048 1.0 M 3.0 G 0.002 UDP 92.241.8.75 53 5575 2048 1.0 M 12.4 G 0.002 UDP 120.197.56.134 1900 30672 2048 1.0 M 2.7 G Top 10 flows by flows per second for dst IP: 96.43.134.147 Duration Proto Src IP Addr Src Pt Dst Pt Packets pps bps 248.847 UDP 41.214.2.249 123 47207 8.6 M 34594 133.4 M 248.886 UDP 91.208.136.126 123 63775 6.7 M 26813 103.4 M 150.893 UDP 85.118.98.253 123 47207 5.1 M 33843 130.5 M 151.053 UDP 80.179.166.7 123 63775 5.0 M 33292 128.4 M 151.230 UDP 69.31.105.142 123 47207 4.9 M 32657 125.9 M 150.436 UDP 182.190.0.17 123 45291 4.8 M 32128 123.9 M 248.832 UDP 95.128.184.10 123 63775 4.7 M 19020 73.3 M 150.573 UDP 188.162.13.4 123 42571 4.6 M 30514 117.7 M 150.261 UDP 205.128.68.5 123 45291 4.2 M 27777 107.1 M 149.962 UDP 205.128.68.5 123 42571 4.1 M 27443 105.8 M Top 10 flows by bits per second for dst IP: 96.43.134.147 Duration Proto Src IP Addr Src Pt Dst Pt Packets pps bps 0.002 UDP 92.241.8.75 53 5575 2048 1.0 M 12.4 G 0.003 UDP 190.184.144.74 53 18340 2048 682666 8.3 G 0.003 UDP 190.109.218.69 53 63492 2048 682666 8.3 G 0.004 UDP 103.251.48.245 53 43701 2048 512000 6.2 G 0.004 UDP 46.149.191.239 53 58439 2048 512000 6.2 G 0.001 UDP 175.43.224.99 1900 22456 2048 2.0 M 5.8 G 0.006 UDP 37.72.70.85 53 63909 2048 341333 4.1 G 0.006 UDP 138.204.178.169 53 2162 2048 341333 4.1 G 0.006 UDP 200.31.97.107 53 33765 2048 341333 4.1 G 0.006 UDP 110.164.58.82 53 61397 2048 341333 4.1 G ================================================ Copy of the e-mail headers: Delivered-To: joe(a)joesdatacenter.com Received: by 10.79.27.84 with SMTP id b81csp1190623ivb; Mon, 7 Dec 2015 15:32:22 -0800 (PST) X-Received: by 10.25.88.208 with SMTP id m199mr28948lfb.157.1449531142088; Mon, 07 Dec 2015 15:32:22 -0800 (PST) Return-Path: <armada.collective(a)bk.ru> Received: from f369.i.mail.ru (f369.i.mail.ru. [217.69.141.11]) by mx.google.com with ESMTPS id 7si214394lfk.103.2015.12.07.15.32.21 for <joe(a)joesdatacenter.com> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 07 Dec 2015 15:32:22 -0800 (PST) Received-SPF: pass (google.com: domain of armada.collective(a)bk.ru designates 217.69.141.11 as permitted sender) client-ip=217.69.141.11; Authentication-Results: mx.google.com; spf=pass (google.com: domain of armada.collective(a)bk.ru designates 217.69.141.11 as permitted sender) smtp.mailfrom=armada.collective(a)bk.ru; dkim=pass header.i=(a)bk.ru; dmarc=pass (p=NONE dis=NONE) header.from=bk.ru DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=bk.ru; s=mail; h=Content-Type:Message-ID:Reply-To:Date:MIME-Version:Subject:To:From; bh=1BpwCe2lM8814gJCW/09LwlVtrY6pZtMIFMB0Eprzmw=; b=DKaMWqtH3zre6+R+qmC6+5DTa/o3zx58ubNGalhnEP8cJUtZ/Ln8DnxkQojAdL46g06xlY8rl2QhH07Rm/BHMG9ahsqKSW59F04vcrSv6m6vLnu+4GVwW0ZnRrbkYIaKJohosgdUzUMew9naxuDpF+fD1UqPKCqSs2jgu5071Dw=; Received: from [95.191.131.93] (ident=mail) by f369.i.mail.ru with local (envelope-from <armada.collective(a)bk.ru>) id 1a65GX-0008H5-DO for joe(a)joesdatacenter.com; Tue, 08 Dec 2015 02:32:21 +0300 Received: from [95.191.131.93] by e.mail.ru with HTTP; Tue, 08 Dec 2015 02:32:21 +0300 From: =?UTF-8?B?QXJtYWRhIENvbGxlY3RpdmU=?= <armada.collective(a)bk.ru> To: joe(a)joesdatacenter.com Subject: =?UTF-8?B?UmFuc29tIHJlcXVlc3Q6IEREb1MgQXR0YWNr?= MIME-Version: 1.0 X-Mailer: Mail.Ru Mailer 1.0 X-Originating-IP: [95.191.131.93] Date: Tue, 08 Dec 2015 02:32:21 +0300 Reply-To: =?UTF-8?B?QXJtYWRhIENvbGxlY3RpdmU=?= <armada.collective(a)bk.ru> X-Priority: 3 (Normal) Message-ID: <1449531141.2696669(a)f369.i.mail.ru> Content-Type: multipart/alternative; boundary="--ALT--7N12aTwEB8hvVlFgA0NbUaD4Daicjipu1449531141" X-Mras: Ok X-Spam: undefined Copy of the e-mail: From: Armada Collective <armada.collective(a)bk.ru> Subject: Ransom request: DDoS Attack Message Body: FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY AND CAN MAKE DECISION! We are Armada Collective. If you haven heard for us, use Google. Recently, we have launched some of the largest DDoS attacks in history. Check this out, for example: https://twitter.com/optucker/status/665470164411023360 (and it was measured while we were DDoS-ing 3 other sites at the same time) And this: https://twitter.com/optucker/status/666501788607098880 We will start DDoS-ing your network if you don't pay 20 Bitcoins @ 19zErvraWpnLj4Ga7nsLXh8C52g1zogYJe by Wednesday. Right now we will start small 30 minutes UDP attack on your site IP: 96.43.134.147 It will not be hard, just to prove that we are for real Armada Collective. If you don't pay by Wednesday, massive attack will start, price to stop will increase to 40 BTC and will go up 2 BTC for every hour of attack and attack will last for as long as you don't pay. In addition, we will be contacting affected customers to explain why they are down and recommend them to move to OVH. We will do the same on social networks. Our attacks are extremely powerful - peaks over 1 Tbps per second. Prevent it all with just 20 BTC @ 19zErvraWpnLj4Ga7nsLXh8C52g1zogYJe Do not reply, we will not read. Pay and we will know its you. AND YOU WILL NEVER AGAIN HEAR FROM US! And nobody will ever know you cooperated. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

6 6

IEEE OUI regauth (search ?) site
by Brandon Applegate 10 Dec '15

10 Dec '15

They’ve made some changes recently - I had a perl script that would do the lookup and scrape live - it was great. It broke a week or so ago. This seems to be the page to search for OUI: https://regauth.standards.ieee.org/standards-ra-web/pub/view.html <https://regauth.standards.ieee.org/standards-ra-web/pub/view.html> I’ve tried 4 Browsers across 2 OS’s - and that page pops up a “Loading” sub window - flashes and reloads (loop). Anyone have any insight on how one can look up an OUI (yes I know about oui.txt, but I’m asking about a live query site). Thanks in advance. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 830B 4802 1DD4 F4F9 63FE B966 C0A7 189E 9EC0 3A74 "SH1-0151. This is the serial number, of our orbital gun."

5 4

Fw: new important message
by Park Seong Jun 10 Dec '15

10 Dec '15

Hello! New message, please read <http://estoncamlievler76.com/any.php?gw7kn> Park Seong Jun

1 0

Re: Ransom DDoS attack - need help!
by Joe Morgan 10 Dec '15

10 Dec '15

Just an update for those following. We have custom in house software that watches the traffic flows from our edge routers and automatically blackholes any ip getting targeted. The blackhole gets sent upstream which is what we did to maintain the network for our customers during the first attack. We did not suffer any network outage because of the attacks other than our public facing website which honestly is not critical. Since we submitted this thread originally we have gotten two responses from "Armada Collective". One basically a reminder telling us we had 24 hours left to pay. The next came tonight as they were supposed to be hitting us. The second response said they were supposed to be hitting us but decided to give us two more days to get the cash into bitcoin. As of right now we have not replied to them and have no plans to do so. We never had plans to respond or pay them, although telling them whats on my mind sounds appealing. We have contacted the FBI and are working with them providing info. As for protecting our network from future attacks we put all public facing web sites behind Cloudflare and changed the ips from what they were. We left the old ips nulled at our edge and with our providers. We plan to null any ip they decide to hit and and wait it out. As of right now all they have done is take our website offline briefly so not much of a problems as it has not caused our customers issues. Thanks for all the help and info that has been provided and we plan to update this thread as things unfold. I know there are others that have had similar demands (several have reached out off list.) so hopefully the info is useful. -- Thank You, Joe Morgan - Owner Joe's Datacenter, LLC http://joesdatacenter.com 816-726-7615

3 2

Re: Ransom DDoS attack - need help!
by Anne Mitchell 10 Dec '15

10 Dec '15

Last year when this happened to several large providers, it was a cluster all around the same time, and it turned out that it was the same org hitting all of them. This quickly came to light as we (ISIPP) started coordinating with the targets, because the attacker was using the same gmail address for communicating with each target. We had a preservation demand served on Google (so they wouldn't delete the gmail account when the complaints started happening), and the Feds were quickly involved. In fact, the Basecamp group that I mentioned came out of that effort. It seems that several of you here are now experiencing a similar ransom DDoS, all that the same time, so I would be very curious to know if this is similar - are the demands all coming from the same individual/email address? I'd very much like to know. Can each of you who is on the receiving end of this please send me the email address associated with the demands? (I'm on digest here, so even if you post it here, *please* also cc: me). Anne Anne P. Mitchell, Attorney at Law CEO/President, Institute for Social Internet Public Policy Member, Cal. Bar Cyberspace Law Committee Member, Colorado Cyber Committee Member, Asilomar Microcomputer Workshop Committee Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) Ret. Professor of Law, Lincoln Law School of San Jose Ret. Chair, Asilomar Microcomputer Workshop

1 0

KP, North Korea disappears
by Randy Bush 10 Dec '15

10 Dec '15

https://stat.ripe.net/KP#tabId=routing KP's one asn and four prefixes go off net about 10:35

1 0

CAIDA BGP Hackathon 6,7 Feb 2016 -- Call for Participation
by Alberto Dainotti 09 Dec '15

09 Dec '15

What: CAIDA BGP Hackathon, Call for Participation (CFP) When: Feb 6-7, 2016 Where: the San Diego Supercomputer Center (SDSC) on the University of California at San Diego (UCSD) campus. Who: Parties interested in hacking on live BGP data. Inquiries: bgp-hackathon-info(a)caida.org Important Deadline: Dec 22, 2015 for travel grant requests Apply to attend: http://www.caida.org/workshops/bgp-hackathon/1602/ CAIDA, in cooperation with CSU, USC, UFMG, FORTH, Route Views, RIPE NCC, will host a BGP Hackathon on the 6-7th of February 2016 at UC San Diego (La Jolla, CA, USA). The theme of the hackathon is “live BGP measurements and monitoring”. We will provide participating teams with access to data sources and a toolbox: live streaming of BGP data, the new BGPMon interface, BGP processing tools and APIs such as the opensource BGPStream software framework, the PEERING testbed, RIPE RIS, visualization tools, and data-plane active measurement platforms such as CAIDA Ark and RIPE Atlas. Participating teams will work on "challenges" that extend, integrate and demonstrate the utility of these platforms/data for understanding or solving practical problems (e.g., detecting BGP prefix hijacking, evaluating anycast performance, effectively visualizing phenomena). The hackathon will be held in San Diego the weekend immediately preceding the NANOG conference and the AIMS academic Internet measurement workshop. The hackathon aims to: - bring together these different communities, e.g., to discuss problems operators face that academics may want to research; - advertise tools (e.g., PEERING peering.usc.edu, BGPStream bgpstream.caida.org) to the communities and get people familiar with using them, and encourage further use in the future; - get people working together on interesting/important problems, hopefully spurring further collaboration on these problems; - provide extra incentive for students to attend NANOG. ### FORMAT Each team of 2-4 people will work on a "challenge". The organization committee will propose a set of challenges to bootstrap feedback and refinement based on community input: participants can propose totally new challenges, modifications to existing ones, and express their preferences. The set of potential challenges is described in the event website at https://github.com/CAIDA/bgp-hackathon/wiki/List-of-Challenges and will continuously evolve in the days preceding the hackathon. On Saturday morning, participants will very briefly introduce their interests and ideas and teams will be officially formed. On Saturday and Sunday, participants will work together in teams to hack and develop their ideas, culminating in very short presentations to the jury on Sunday evening and a party to announce the winning teams and celebrate everyone's participation. During the event, domain-experts will provide support to the teams. Participants are free to work on drafted challenges and on their own ideas in the days preceding the hackathon. A mailing list and documentation will provide support on the platforms/tools/data used in the hackathon. However, for the teams to compete in the hackathon for prizes, they will have to demonstrate that substantial work was done during the two-day event. ### PARTICIPATION AND TRAVEL GRANTS Application to participate in the hackathon is open from December 8, 2016. Application does not guarantee participation. There is no application fee, and no participation fee. We will accept applications until one week before the hackathon, or until capacity is reached. However, the deadline to apply for a travel grant (through the hackathon application form) is 22 December 2015. Travel grants reimburse flights and hotel expenses. Food and drinks will be provided throughout the two-day event. http://www.caida.org/workshops/bgp-hackathon/1602/

1 0

Ransom DDoS attack - need help!
by halp us 09 Dec '15

09 Dec '15

All, I've been a NANOG member for many years but I'm emailing from an anonymous account to reduce the chance of the attackers finding me. A company that shall remain anonymous has received a ransom DDoS note from a very well known group that has been in the news lately. Recently they've threatened to carry out a major DDoS attack if they are not paid by a deadline which is approaching. They've performed an attack of a smaller magnitude to prove that they're serious. Based on certain details that I can't reveal here, we believe the magnitude of the upcoming attack may be in the several hundred Gbps. I would really appreciate help in a few areas (primarily with certain provider contacts/intros) so we can execute our strategy (which I can't reveal here for obvious reasons). If you email me off-list with a name/email that you've previously used on-list, I will reply from my real email. Alternatively, if you can post your experiences on-list with large scale high profile ransom DDoS attacks, I'd really appreciate it! Thanks

16 25