March 2000 - Test - lists.nanog.org

Re: Network Probes
by Michael Shields 10 Mar '00

10 Mar '00

In article <38C80DF3.6194803E(a)bexair.com>, "Scott McGrath" <s_mcgrath(a)bexair.com> wrote: > Has anyone else noticed probes against their network with a spoofed Sure, all the time. http://www.nfr.net/forum/publications/id-myths.html -- Shields.

2 1

Trojan Alert was: Check this
by Kai Schlichting 09 Mar '00

09 Mar '00

Can someone with a lucky hand in Visual Basic actually tell us what the trojan attachment we saw (LINKS2.VBS) we saw (full mail headers included, in case Shawn hasn't seen them yet) actually does. Seems to cloak itself well, and my Norton AV is *not* detecting anything. On another operational note: I am seeing a vastly swelling number of customers falling victim to the NETWORK.VBS worm: a simple VB script that first scans surrounding network space for open, writable windows shares (and replicates by copying itself into a shared C:\ drive, if such drive is shared), then goes on to randomly scan /24's , where the 3 first octets of the IP number are random: this is generating boatloads of violations in my "no RFC1918 in or out" filters (and this is how this came to my attention). We found a user who had scanned a stunning 9980 /24's this way : there is a C:\network.log (or was it .txt) file showing the scan activity. bye,Kai >Received: from conti.nu (IDENT:root@sonet.conti.nu [208.241.100.25]) > by speedus.com (8.9.3/8.9.3) with ESMTP id PAA23318 > for <kai(a)mail.speedus.net>; Thu, 9 Mar 2000 15:12:02 -0500 (EST) >Received-Date: Thu, 9 Mar 2000 15:12:02 -0500 (EST) >Received: from segue.merit.edu (segue.merit.edu [198.108.1.41]) > by conti.nu (8.9.3/8.9.3) with ESMTP id PAA17489 > for <kai(a)pac-rim.net>; Thu, 9 Mar 2000 15:11:50 -0500 (EST) >Received: by segue.merit.edu (Postfix) > id 15D935DDA5; Thu, 9 Mar 2000 15:08:12 -0500 (EST) >Delivered-To: nanog-outgoing(a)merit.edu >Received: by segue.merit.edu (Postfix, from userid 56) > id EE69F5DDE2; Thu, 9 Mar 2000 15:08:11 -0500 (EST) >Received: from astro.smorris.com (astro.smorris.com [157.238.77.132]) > by segue.merit.edu (Postfix) with ESMTP id B9C0D5DDA5 > for <nanog(a)merit.edu>; Thu, 9 Mar 2000 15:08:08 -0500 (EST) >Received: from scooby (scooby.smorris.com [157.238.77.131]) > by astro.smorris.com (8.9.3/8.9.3) with SMTP id OAA04495; > Thu, 9 Mar 2000 14:01:25 -0600 >From: "Shawn Morris" <shawn(a)smorris.com> >To: <shawn(a)smorris.com> >Subject: Check this >Date: Thu, 9 Mar 2000 14:05:58 -0600 >Message-ID: <001f01bf8a02$e2d6d140$834dee9d@scooby> >MIME-Version: 1.0 >Content-Type: multipart/mixed; > boundary="----=_NextPart_000_001C_01BF89D0.98395400" >X-Priority: 3 (Normal) >X-MSMail-Priority: Normal >X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) >X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 >Importance: Normal >Sender: owner-nanog(a)merit.edu >Precedence: bulk >Errors-To: owner-nanog-outgoing(a)merit.edu >X-Loop: nanog >X-UIDL: a6afd5395e4e1808e17ac7358522b210 > >Have fun with these links. >Bye.

5 4

Re: Provider-local addresses?
by Brian Candler 09 Mar '00

09 Mar '00

On Thu, Mar 09, 2000 at 02:49:03PM -0500, Daniel L. Golding wrote: > I'm not sure I see the point. You can use the existing RFC1918 space for > this kind of application, such as having fixed, non-changing addresses > for DNS. Except that you want to avoid clashes with your customers' own networks, which may already be using RFC1918 behind NAT routers. You could hijack some of this space ("if you connect to me, you may not use this particular subnet of RFC1918") but that's not particularly friendly. > The whole kettle of worms are downstream allocated IP customers - be they > leased line, DSL, etc. This is the renumbering that can and does cost > small providers many customers Yeah, that's pretty inescapable :-) Cheers, Brian.

1 0

Re: Napster and others...
by Michael Shields 09 Mar '00

09 Mar '00

In article <v0422080ab4ed9bb6c397(a)[216.240.40.194]>, "Erik E. Fair" <fair(a)clock.org> wrote: > Precis: they (developers, users) can modify the application to use > spread-spectrum style port numbers that constantly change throughout > the life of a session, which makes it effectively impossible to > filter using existing technology. Filtering such traffic is within the state of the art -- proxy firewalls are not new. But agreed that your Cisco routers cannot stop it. -- Shields.

1 0

Re: Trojan Alert was: Check this
by Kai Schlichting 09 Mar '00

09 Mar '00

At Thursday 03:53 PM 3/9/00 , Hermann Wecke wrote: >At 15:28 09/03/2000 -0500, Kai Schlichting wrote: >>Can someone with a lucky hand in Visual Basic actually tell us what >>the trojan attachment we saw (LINKS2.VBS) we saw (full mail headers >>included, in case Shawn hasn't seen them yet) actually does. > >Check at NAI: > >http://vil.nai.com/vil/vbs10225.asp <http://vil.nai.com/vil/vbs10225.asp> > Note the warning on that page: ensure that scanning for .VBS files is on, unless you have it configured to scan for ALL files. The warning is very applicable to Norton AV as well: My Norton AV is up to date, and the default is NOT to scan for .VBS files (!) How could they miss that. I can't recall changing the scan settings from 'all' to 'some' files either. Looks like we have a real winning worm here that evades detection by lamely configured virus scanners - what the real default scan settings are is YTBD. Meanwhile, NETWORK.VBS is marching on. bye,Kai

1 0

Re: Trojan Alert was: Check this
by Hermann Wecke 09 Mar '00

09 Mar '00

At 15:28 09/03/2000 -0500, Kai Schlichting wrote: >Can someone with a lucky hand in Visual Basic actually tell us what >the trojan attachment we saw (LINKS2.VBS) we saw (full mail headers >included, in case Shawn hasn't seen them yet) actually does. Check at NAI: http://vil.nai.com/vil/vbs10225.asp <http://vil.nai.com/vil/vbs10225.asp>

1 0

Re: Trojan Alert was: Check this
by Steven M. Bellovin 09 Mar '00

09 Mar '00

In message <4.2.2.20000309152159.00d31ea0(a)mail.speedus.net>, Kai Schlichting wr ites: > > Can someone with a lucky hand in Visual Basic actually tell us what > the trojan attachment we saw (LINKS2.VBS) we saw (full mail headers > included, in case Shawn hasn't seen them yet) actually does. > Seems to cloak itself well, and my Norton AV is *not* detecting anything. > There was a report on Bugtraq the other day that some AV programs don't look at .VBS files. You may have to select 'check all files' or at least add .VBS to your list of extensions to scan. --Steve Bellovin

1 0

Check this
by Shawn Morris 09 Mar '00

09 Mar '00

Have fun with these links. Bye.

7 6

Re: Check this
by Bandy Rush 09 Mar '00

09 Mar '00

Please refrain from sending your windows-based virii to the list. -BR --- Shawn Morris <shawn(a)smorris.com> wrote: > Have fun with these links. > Bye. > ATTACHMENT part 2 application/octet-stream name=LINKS2.VBS _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

Re: Napster and others...
by smd＠clock.org 09 Mar '00

09 Mar '00

| What would be your suggestions on making Napster a more network | friendly app? 1. RFC 2001 compliance. Keep it TCP. 2. Although RFC 1349 is supposedly dead and the TOS octet in the RFC 791 scheme is dead too[*], it is at least good politics to set a low TOS value on the bulk transfer traffic. (If not on all traffic). Thus, routers configured to do TOS-based fancy queueing will DTRT and fewer people will accuse Napster of being a resource pig. 3. "If we aren't network friendly, please let us know what will make us more network friendly" is a great attitude to demonstrate. Hopefully this will be appreciated by actual operators (at least the ones who don't pay per-packet/per-byte charges). Sean. [*] RFC 2474/RFC 2475 but don't hold your breath -:) Who implements this could be a NANOG topic. -:) -:)

7 6