August 2001 - Test - lists.nanog.org

Code Red growth stats (fwd)
by Larry Sheldon 01 Aug '01

01 Aug '01

> (david moore with help from a bunch of elves) > http://www.caida.org/analysis/security/code-red/aug1-live-hosts.gif Seems to be dead--what happened? I also can't seem to find the "internethealthreport" any more.

2 3

Code Red Scans
by Joe Blanchard 01 Aug '01

01 Aug '01

Still seeing tons of traffic scanning for port 80s. Already sent off 4 emails to various .edu s that appear to be infected (several nodes) and one to Microsoft as well. In a brief listing of nodes my count is greater than 64k of unique IP addys so far. Hmm, Pretty bad when MS themselves look to be infected. Or maybe there "testing" something, or someone is spoofing? > Aug 1 12:37:36: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/3383 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:37:40: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/3383 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:40:04: %PIX-3-106010: Deny inbound tcp src > outside:131.107.190.124/41854 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:40:08: %PIX-3-106010: Deny inbound tcp src > outside:131.107.190.124/41854 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:40:39: %PIX-3-106010: Deny inbound tcp src > outside:131.107.86.103/4167 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:41:52: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/4367 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:42:00: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/4367 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:43:02: %PIX-3-106010: Deny inbound tcp src > outside:131.107.90.67/3667 dst inside:xxx.xxx.xxx.xxx/80 > > > Microsoft Corporation (NET-MICROSOFT) One Redmond Way Redmond, WA 98052 US Netname: MICROSOFT Netblock: 131.107.0.0 - 131.107.255.255 Coordinator: Microsoft (ZM39-ARIN) noc(a)microsoft.com -Joe

1 0

What happens when a fiber carrier goes broke ?
by Joe McGuckin 01 Aug '01

01 Aug '01

I see that a number of companies that lease dark fiber are near bankruptcy. What is the legal position of someone who has purchased a multi-year IRU on the fiber? Can the bankruptcy trustee or creditors reposess your fiber strands? Joe

2 1

MicroSoft amplification?
by Brandon Ross 01 Aug '01

01 Aug '01

So with all the noise about Code Red, and in the process of trying to recover from various attacks, I happened to try to ping www.microsoft.com. It's probably par for the course that this happens: Wed Aug 1 14:05:29 bross@ogre:~ $ ping www.microsoft.com PING www.microsoft.akadns.net (207.46.197.100): 56 data bytes 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=37.5 ms 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=41.2 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=42.8 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=43.9 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=45.0 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=46.1 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=47.3 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=48.4 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=49.5 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=57.6 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=39.8 ms 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=41.4 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=42.7 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=43.3 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=44.4 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=45.5 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=46.8 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=47.9 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=49.0 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=51.6 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=3 ttl=45 time=39.6 ms I find it interesting and almost amusing that MicroSoft's own web server can be used for amplification attacks. -- Brandon Ross 404-522-5400 EVP Engineering, NetRail http://www.netrail.net AIM: BrandonNR ICQ: 2269442 Read RFC 2644!

1 0

Code Red growth stats
by k claffy 01 Aug '01

01 Aug '01

(david moore with help from a bunch of elves) http://www.caida.org/analysis/security/code-red/aug1-live-hosts.gif was exponential till about an hour ago, we're not sure if leveling off is due to our monitor load or an actual peak in the data. log-scale version http://www.caida.org/analysis/security/code-red/aug1-live-hosts-log.gif will put on main caida home page later today and update every minute (you'll have to hit reload, and you won't actually notice changes at a minute granularity so please no per-minute cron jobs to reload :) ) note the corresponding graph for 19-20 july: http://www.caida.org/analysis/security/code-red/gifs/cumulative-ts.log.gif no per AS stats for this outbreak yet, also under construction.

2 1

RE: telnet vs ssh on Core equipment , looking for reasons why ?
by Roeland Meyer 01 Aug '01

01 Aug '01

> From: Charles Sprickman [mailto:spork@inch.com] > Sent: Tuesday, July 31, 2001 9:41 AM > 6) Finding a unix ssh that supports 3DES and DES. > > I curse those OpenSSH folks for making me have to trudge > through the code > to find out how to get DES working... > > 6a) Finding a release on CCO that supports 3DES. You are probably aware, but EFF published the DES crack. I understand that it is now an issue of cracking DES in less than 12 hours. 3DES is better but it only amounts to DES with a 128-bit key. Definitely a limited shelf-live.

6 5

Re: A watched pot never boils: The Return of Code Red
by Vern Paxson 01 Aug '01

01 Aug '01

> I checked my apache logs this morning, and I do see some Code Red > activity: We've seen > 800 attacks so far. The growth rate is a clear exponential, no sign of any slowdown yet. Vern

3 2

Visio icons
by Grant A. Kirkwood 01 Aug '01

01 Aug '01

My apologies for the non-operational content. I'm trying to find the Cisco Visio icon set, would anyone have a copy they could shoot me? TIA, -- Grant A. Kirkwood - grant(a)virtical.net Chief Technology Officer - Virtical Solutions, Inc. http://www.virtical.net/

5 4

A watched pot never boils: The Return of Code Red
by Sean Donelan 01 Aug '01

01 Aug '01

After eight hours of Code Red II, I haven't seen any impact. So far the only website I can't reach is WWW.KEYNOTE.COM Everything else seems to be humming along just fine. Of course, exponential growth starts out small. Any updates from the field?

2 1

RE: telnet vs ssh on Core equipment , looking for reasons why ?
by Roeland Meyer 01 Aug '01

01 Aug '01

> From: Rafi Sadowsky [mailto:rafi-nanog@meron.openu.ac.il] > Sent: Tuesday, July 31, 2001 10:43 PM > > On Tue, 31 Jul 2001, Charles Sprickman wrote: > > > > > On Tue, 31 Jul 2001, Kevin Steves wrote: > > > > > On Tue, 31 Jul 2001, Charles Sprickman wrote: > > > :6) Finding a unix ssh that supports 3DES and DES. > > DES(not 3DES) is a compile time option for SSH1 > (default is not to support DES) > > Try to convince to person in charge of SSH that even > SSH1+DES while weak > is much better than cleartext tel-net .... SSH1, properly deployed, is not all that weak and scads better than (any version) telnet.

1 0