July 2001 - Test - lists.nanog.org

Re: Update: CSX train derailment
by Sean Donelan 20 Jul '01

20 Jul '01

On Fri, 20 July 2001, Leo Bicknell wrote: > On Fri, Jul 20, 2001 at 08:28:37AM -0400, David Lesher wrote: > > I'm not sure where they could run temporary fiber... > > Next to the fire hoses snaking down the street? > > You'd be surprised what they can come up with on short notice. > For temporary fixes fiber can be quickly rolled out next to railroad > tracks (yes, just laying on the ground) or down other right of way > (sometimes even public roads). They generally put it in an innerduct The Baltimore Sun has a graphic showing the re-routed fiber optic line. http://www.sunspot.net/news/local/bal-traingridlockmap.graphic I understand all the carriers have people working very hard to fix the cut, but the question which is rarely asked and even more rarely answered is where was the physical diversity in those carriers networks? Did these carriers know about this vulnerability in their network? When customers asked, were the customers told? What are MFN or Worldcom sales people telling customers who ask what happened to their network diversity?

6 5

RE: Code Red : Any whitehouse.gov people around?
by Mike Najarian 20 Jul '01

20 Jul '01

Has anyone gutted an infected box to determine whether it's going to go for whitehouse.gov www.whitehouse.gov or a hardcoded IP? mnaj Best regards, Mike Najarian - FASTNET Corporation miken(a)fast.net (610)266-6700 http://www.fast.net FASTNET(r) - Business and Personal Internet Solutions > > Knowing that some of the colocated boxes in our network *might* be > infected; I have placed a nullroute for 198.137.240.92 (the IP > www.whitehouse.gov resolves to). >

7 6

Code Red host list
by John Kristoff 20 Jul '01

20 Jul '01

The following is a list of about 11,000 host IPs that are thought to be or were infected by the recent Code Red worm. I hope this is helpful. If I was watching more closely at the time I'm sure the list would be significantly larger. http://condor.depaul.edu/~jkristof/codered-hosts.txt This has been blind carbon copied to multiple recipients in order to ensure that it reaches all interested parties. Apologies to those that may receive this note more than once. John

1 0

Re: Update: CSX train derailment
by Sean Donelan 20 Jul '01

20 Jul '01

The curse seems to still work, my brand new "backup" server was installed in a location between Baltimore and Washington DC this week. A short time later, a nearby train derails. I think Murphy following me. Remember, its not parnoia if people really are out to get you :-) It appears most providers have found ways to re-route around the fiber break/fire in Baltimore. Physical diversity? Why bother, it only takes a day to have techs patch around the cut. Some individual customers still say they have problems, but generally things seem much better along the easter seaboard. Alternet/UUNET/Worldcom Abovenet/MFN Mindspring PSI Verio Other providers may have also been affected, but I have no information about the status of their network. The CSX and Amtrack routes are the primary fiber routes through Baltimore, so it was a crap shoot which provider got hit. Were they in the Amtrack right-of-way or the CSX right-of-way. The Baltimore Fire Department started removing train cars from the tunnel this morning, but stopped when the fire flared up again.

6 5

Re: Code Red
by Jeff Ogden 20 Jul '01

20 Jul '01

Here at Merit we are seeing large numbers of Code Red infected hosts. These hosts may be on our regional network MichNet or they may be elsewhere out on the greater Internet. It is the port scanning of random IP address that causes problems, because the scanning in turn is causing network problems due to heavy ARP loads when the local site routers ARP for what turn out to be unused IP addresses. This is an issue when there are large blocks of IP addresses behind a router. It is less of a problem when there is a relatively small number of IP addresses behind a router (say one class C worth). Are others seeing these sorts of problems? What strategies are there for dealing with this? What we've come up with so far is blocking inbound (inbound to the site) port 80 traffic on the LAN interface of the local site router (so outbound over the LAN interface). This prevents the ARP problems. It also gives us some indication of which systems are infected. It has serious undesirable side effects (preventing legitimate Web access) and so we also have to reenable inbound port 80 access for specific IP addresses that we know are Web servers or otherwise not vulnerable to Code Red. None of this solves the problem in any real sense. It just keeps performance reasonable and buys us time to work on or get others folks to work on real solutions. To solve the Code Red problem seems to require patching the vulnerable hosts or taking the vulnerable or infected hosts offline. How long is it going to take to get every Windows NT, Windows 2000, and Windows XP system patched? We may be at this for a long time. I am not looking forward to this. Any ideas for other approaches to the problem? -Jeff Ogden Merit

11 13

RE: Code Red : Any whitehouse.gov people around?
by Dave Stewart 20 Jul '01

20 Jul '01

At 10:04 AM 7/20/2001, Mike Najarian wrote: >Has anyone gutted an infected box to determine whether it's going to go for > whitehouse.gov > www.whitehouse.gov >or a hardcoded IP? While there's incomplete information available in the standard places, it appears to be a hardcoded IP. I, along with many others, have null routed it.... Symantec's site claims the IP address is no longer active at any rate. It *appears* that from xx-20-xxxx through xx-28-xxxx, this thing will attack that IP address... meaning that measures already in place will minimize damage from the portion of the code that attempts to flood 198.137.240.91. Networks where 198.137.240.91 isn't blocked could see network congestion, I suppose, if they host a large number of infected machines. I've seen a claim that if the date is greater than 28, the threads just go into an infinite sleep. From what I can see, I would expect another round of probes to take place starting on 01-August-2001...

2 1

Code Red : Any whitehouse.gov people around?
by Jasper Wallace 20 Jul '01

20 Jul '01

According to a recent post on bugtraq the worm is going to switch from infecting webservers to DDOS'ing whitehouse.gov in about 1/2 an hour or so. Now i'm not certain if the worm has a hardcoded ip to attack or will do a DNS lookup for whitehouse.gov, but if it is going to do a dns lookup then they've still got a chance to change the A records in their dns records to something else, like 127.0.0.1. Unfortunatly this will make it hard for people to track down and fix infected boxes, so if they could use an ip in a non-routable block, that's unlickley to be used for anything else, e.g. 192.0.2.1, which in on the 'TEST-NET', or possible on 192.0.0.1, which is on the range HP use for printer auto configuration (they only use 192.0.0.192). The TTL on the A RR for whitehouse.gov is 24 hours unfortunatly. :-( -- Internet Vision Internet Consultancy Tel: 020 7589 4500 60 Albert Court & Web development Fax: 020 7589 4522 Prince Consort Road vision(a)ivision.co.uk London SW7 2BE http://www.ivision.co.uk/

3 2

Re: Advanced Countermeasures to prevent a Ddos
by Hank Nussbacher 20 Jul '01

20 Jul '01

At 16:38 19/07/01 -0400, you wrote: It all hinges on your upstream ISPs. The things to ask for are: - SYN and ICMP rate limiting: If you buy a T3 from your upstream, you should ask that they place on *their* peering routers and on the router facing you, Cisco rate limits of about 512kb/sec of ICMP and about 128kb/sec of SYNs. Pay extra if need be. - anti-spoofing: require your upstream ISPs to implement full anti-spoofing for incoming packets. That includes RFC1918, unassigned IANA blocks and (as a minimum) IP anti-spoofing on all single-homed customer links (Cisco ip verify unicast reverse-path) - BGP community: Your upstream should allow you to announce a BGP community for any sub-prefix in your IP block (meaning he has to not be strict in the length of the prefix you announce to him since it can change dynamically) that will me ROUTENULL, which means they eat the packets for you. Find 2 upstreams who will agree to the above 3 items and you are 99% safe from dDoS. -Hank >I was wondering if anyone on this list has considered the idea of trying to >eliminate Ddos attacks while designing their Data Centre's network topology. >If so, did you include server isolation and or distribution? > >Secondly, is it even possible to eliminate (or as close to elimination as >one can have in the tech world) Ddos attacks with network design and server >implementation. Does anyone have an advanced understanding of these issues >and if so are you willing to exchange information off-line? > > >Scott E. MacKenzie >semackenzie(a)crop.attcanada.ca >

3 3

Code Red http log request
by Jon O . 20 Jul '01

20 Jul '01

Hey: I'm doing a post infection analysis of the Code Red worm. If you could send me any http logs showing hits on default.ida that would help get a larger sampling. cat /var/log/apache_access_log | grep default.ida This command outputs a great format. Thanks, Jon

1 0

Re: Cisco, Qwest, Cert, NIPC (was Re: Code Red -> Router Memory depletion? )
by Marshall Eubanks 20 Jul '01

20 Jul '01

> >The Code Red traffic is starting to have a measureable impact on >global Internet traffic. The Internet Health Report (Keynote) >and the Internet Weather Report (Matrix) are showing packet loss >increasing and reachability decreasing throughout the afternoon. >Latency didn't start increasing until this evening. > >Keynote is showing problems in QWEST's network, and Slashdot >is reporting that QWEST has widely deployed a version of the >Cisco 67x DSL router which is vulnerable to a HTTP data >corruption error caused byt the worm. > >http://www.cisco.com/warp/public/707/CBOS-multiple.shtml > >CERT/CC and the National Information Protection Center issued >advisories today. I don't know at what time, since it hasn't >appeared in my e-mail yet. But it is available on the NIPC >and CERT/CC web sites. > >http://www.nipc.gov/ >http://www.cert.org/ > > Sean; Is there any evidence that the worm attacks are quasi periodic ? I saw waves of packet loss on vBNS to Columbia U. this afternoon in multicast, with bad loss roughly every one minute out of 5 or so. This happened much of the afternoon, and is pretty unusual. Regards Marshall Eubanks

1 0