September 2001 - Test - lists.nanog.org

Trend Micro FIX_NIMDA.EXE - was Re: Virus fix
by Indra PRAMANA 19 Sep '01

19 Sep '01

Steve, Yes, I think they are the first one. One slight problem, the tool will delete all non-cleanable files without logging or tracking them. Is there any safer way to clean the virus automatically? Cheers. At 04:27 PM 9/19/01 -0500, Steve Smith wrote: >Looks like Trend has a cleaning tool now, www.anitivirus.com > >Steve Smith MCSE, CCNA, CCDA >Data Networks Technical Manager >Freeliant Inc. >(901)309-3919 > >The brave may not live forever, but the cautious never live.

1 0

Re: looping traceroutes
by Patrick W. Gilmore 19 Sep '01

19 Sep '01

At 09:31 PM 9/18/2001 -0700, Ratul Mahajan wrote: [SNIP] >28 193.251.133.117 (193.251.133.117) 586.776 ms 584.171 ms 586.944 ms >29 193.251.133.117 (193.251.133.117) 608.677 ms 610.789 ms 618.232 ms >30 193.251.133.117 (193.251.133.117) 641.141 ms 643.149 ms 639.050 ms This sometimes happens when there is a filter on that router. All packets going through get an ICMP administratively denied sent back, and the traceroute host interprets that as an ICMP TTL expired or perhaps does not even notice what type of ICMP it is, just looks at the source IP address. >27 208.63.128.3 (208.63.128.3) 111.475 ms 69.670 ms 69.267 ms >28 208.63.128.1 (208.63.128.1) 68.883 ms 67.147 ms 72.106 ms >29 208.63.128.3 (208.63.128.3) 69.842 ms 67.889 ms 66.944 ms >30 208.63.128.1 (208.63.128.1) 70.986 ms 73.124 ms 68.452 ms This looks exactly like a routing loop to me. Why do you think it is not a routing loop? -- TTFN, patrick

5 4

Question about Dynamic Graphs of the Nimda worm
by Jeff Ogden 19 Sep '01

19 Sep '01

The Dynamic Graphs of the Nimda worm at http://www.caida.org/dynamic/analysis/security/nimda/ are interesting. To what degree do the graphs really tell us how many hosts are infected? Or do they just tell us how many infected hosts are observed every 15 minutes? I guess what I am asking is, is the 15 minute sample period causing the graph to under report the total number of infected sites? How likely is it that the CAIDA monitor will be visited at least once every 15 minutes by an infected system? No matter what the answer to this question is, I do like the fact that the trend is down. -Jeff Ogden Merit

1 0

Virus fix
by Steve Smith 19 Sep '01

19 Sep '01

Looks like Trend has a cleaning tool now, www.anitivirus.com Steve Smith MCSE, CCNA, CCDA Data Networks Technical Manager Freeliant Inc. (901)309-3919 The brave may not live forever, but the cautious never live.

1 0

Blocking nimda probes with a content-layer switch
by Joe Abley 19 Sep '01

19 Sep '01

Has anybody tried to block nimda HTTP GET probes using URL pattern matches in a "layer-4-7"[1] switch? The ideal result is to prevent nimda GET probes from ever reaching the destination address, but causing the session to be reset towards the server after the open handshake but before the GET can be sent to the server would be acceptably useful. Particularly whether it's possible on a cisco/Arrowpoint switch, but it would be interesting to know about other vendors too. Please reply directly, will summarise if there are answers to share. Thanks! [1] substitute phrase-du-jour as appropriate

4 3

Photos from Verizon's West St. (NYC) CO
by Jeff Wasilko 19 Sep '01

19 Sep '01

A friend of mine passed this URL on to me: http://www.internetsvc.com/vznwestco.ppt It's got 5 photos from inside of Verizon's CO, showing their DACS and 5ESS and the surrounding damage... -jeff

2 2

Re: Online DB of Nimda infected hosts.
by Ulf Zimmermann 19 Sep '01

19 Sep '01

I just fixed a problem in my php code, which will make the search for "prefix" work right. Searching for "10.10%" will not return an IP like "172.16.10.10" anymore. Going to try and work on a search based on real CIDR, so that you can enter "172.16.0.0/16". -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

Summary: Blocking nimda probes with a content-layer switch
by Joe Abley 19 Sep '01

19 Sep '01

Summary of suggested comments on defeating nimda probes follows. Lincoln Dale's comments were cc'd to the list, but I've included fragments here anyway just to keep them together with the other bits. Thanks! Three people suggested using NBAR on cisco routers, along these lines: http://www.cisco.com/warp/public/63/nbar_acl_codered.shtml One person suggested the following config fragment for F5's Big/IP switches: rule block_nimda { if (http_uri starts_with "/scripts" or http_uri contains "root.exe") { discard } else { use ( server_pool) } } with the proviso that adjustments might be required of those url patterns are too general for your purposes. Users of Big/IP versions prior to 4.0 (which don't support "discards" can route the connections to a dummy pool. One person was using a Nortel/Alteon switch to redirect all traffic to a cacheflow client accelerator, then using pattern matching on the cacheflow box to prevent the traffic reaching the origin servers. Lincoln suggested the following for the cisco Content Engine and Content Services Switch: Cisco Content Engine: rule enable rule block url-regex http://.*/cmd\.exe rule block url-regex http://.*/root\.exe Cisco CSS11K (Content Services switch): service dummy ip address 10.1.1.1 keepalive type none active ! header-field-group cmd.exe header-field cmd.exe request-line contain "cmd.exe" header-field-group root.exe header-field root.exe request-line contain "root.exe" ! content block_cmd.exe protocol tcp port 80 url "/*" header-field-rule cmd.exe add service dummy active content block_root.exe protocol tcp port 80 url "/*" header-field-rule root.exe add service dummy active Lincoln also pointed out that the CSS and CE configs above will prevent the client's TCP SYN from reaching the server (the devices will accept the TCP sessions and receive the HTTP headers before deciding whether to pass them on to the servers). NBAR will only match the HTTP headers on TCP sessions that successfully establish a TCP session with the server ("delayed binding").

1 0

Nimda & Yahoo
by Bill Larson 19 Sep '01

19 Sep '01

Well It looks as if the Yahoo Corporate network is infected. hilla.corp.yahoo.com - [19/Sep/2001:11:22:10 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 280 "-" "-" If anyone from Yahoo is reading this list you might want to start scanning systems. --- Bill Larson Network Administrator Compu-Net Enterprises

2 1

Online DB of IPs for Nimda worm infected machines
by Ulf Zimmermann 19 Sep '01

19 Sep '01

Hello, at: http://seven.alameda.net/~ulf/nimda/ I put a page to search for infected IPs. This is the first version. Currently I put IPs into it which probed me before about 2pm PDT. I got email from 2 people who sent me their IPs, which I am going to add when they ok it. You can right now search by SQL for IPs like: 64.81.% This will display all IPs which probed me starting with 64.81. Things I am adding in the next minutes is so that people can submit them self single IPs or bulk list. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

5 7