September 2001 - Test - lists.nanog.org

worm blocker
by Joseph McDonald 18 Sep '01

18 Sep '01

Here is a little worm blocker I came up with. It runs like: tail -f $server_root/logs/error_log | blockworm.rb #!/usr/local/bin/ruby x = 0 badips = Hash.new(0) while line = gets if line =~ /root.ext|winnt|msadc|unrecognized FrontPage/i line =~ /client ([^\]].*)]/ bad = $1 bad.gsub!(/[^0-9\.]/, "") if not badips.has_key?(bad) system("/sbin/ipfw add 3000 unreach host tcp from #{bad} to any 80") $stderr.puts "killed #{bad}" end badips[$1] += 1 x += 1 end end I'm not positive that it's the best ipfw rule... I didn't know if "unreach" or "deny" was better. My ipfw guru is gone for the day. If anyone has any thoughts on that, please let me know. Also, the above assumes that IP "spoofing" isn't going on... BTW, if you want to run the above and don't have ruby, you can get it at: http://www.ruby-lang.org/en/index.html It is a way cool language, the snippet above does not show off any of its unique features, a summary of which you can find here: http://www.pragmaticprogrammer.com/talks/introruby/img1.htm regards, -joe

1 0

Issues at AADS
by Mitchell Rose 18 Sep '01

18 Sep '01

is anyone else experiencing packet loss and extremely variable ping times when pinging between peers? - Mitchell Rose

1 0

What Worked - What Didn't
by Sean Donelan 18 Sep '01

18 Sep '01

As the New York Stock market re-opens, and some things are returning to normal, I'd like to look at how well the Internet performed last week. At the Oakland NANOG I'd like to give a presentation about what worked, and what didn't work during the last week in regards to the Internet. I would like to gather what details I can from both small and large providers in New York, the rest of the USA, and even overseas about what they saw, what problems they experienced, and what things worked. You can send me private mail if you wish, with or without attribution. This is a personal effort, not assocated with my employer. Oakland NANOG is several weeks away, so I don't expect an immediate response. I expect many ISPs will be conducting their own internal reviews. But if you could, please consider responding. I'm looking for input from small, medium and large providers. Thank you. A few questions, all related to the time between Sept 11 and 17: 1. Briefly tell me who you are, and generally where your operations were located? 2. What worked? 3. What didn't work? 4. Did you activate your emergency response plan? 5. Were you required to do anything different operationally? Did you make preventive operational changes? 6. Were any infrastructure administration functions impaired, such as DNS registration, routing registry, address delegation? 7. Were you able to communicate NOC-to-NOC when needed? 8. Were any means of communications nonfunctional or impaired (direct dial telephone, toll-free telephone, pager, e-mail, fax) when you attempted to communicate with other NOC's? 9. Did you ask for or receive a request for mutual aid from any other providers? Was it provided? 10. Within the limits of safety and rescue efforts, where you able to gain access to your physical facilities? 11. Did hoaxes or rumors impact your operations? 12. Do you have any recommendations how Internet providers could have responded differently?

20 34

RE: What Worked - What Didn't
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Randy Bush [mailto:randy@psg.com] |> Sent: Monday, September 17, 2001 1:45 PM |> inter-isp peering and intra-isp ibgp to be covered fairly quickly. i |> would suggest having one's provisioning folk working with |> bgp customers |> to close that avenue as well, starting with the more |> critical customers. |> |> also, think about your igp. Why, IGP shouldn't even be visible from outside the border, neh? Internal issues are, internal issues. If it leaks, plug the leak.

4 3

Nimda Worm
by Mike Jackson 18 Sep '01

18 Sep '01

One of the spread methods has to do with retrieving a file called "readme.eml" from the infected web servers. Adding this to my Cisco HBAR code red config seems to at least keep my customers from becoming infected using that method. class-map match-any http-hacks .. code red stuff.. match protocol http url "*readme.eml" Can anyone confirm exactly what filenames the email spread version uses? -- Mike Jackson <mhjack(a)tscnet.com> Vice-President TSCNet, Inc. Phone: 360-308-0205 Fax: 360-698-7789 http://www.tscnet.com

1 0

Embargos and proscriptions
by Roeland Meyer 18 Sep '01

18 Sep '01

The following link details various embargos in effect. http://pmdtc.org/country.htm Almost all of these entail defense and munitions. ITAR has long considered cryptographic material a munition, under ITAR category XVII (see: http://pmdtc.org/usml.htm) Personal opinion: we may see this definition expanded, as it has in the past. The problem is, expansion is easy, contraction is somewhat more difficult. [disclaimer] MHSC has been involved in ITAR issues since 1997. Our initial business plan was to provide secured services and individual privacy through encryption techniques and services, for both individuals and organizations. We couldn't get that past ITAR initially and when we could, the market wasn't there yet (couldn't get any traction. Most folks frankly, don't give a rat's tush about security, especially if they have to do anything extra for it). MHSC goes out of its way to avoid even the appearance of legal violations and to limit its risk of legal liability. MHSC is no longer in this business (see: http://www.mhsc.net/services.htm) -- IANAL = I Am Not A Lawyer. Before taking legal action based on anything I say or write, you are strongly encouraged to seek the advice of an attorney. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company tel: +1 925 373 3954 cel: +1 925 352 3615 fax: +1 925 373 9781 http://www.mhsc.com |> -----Original Message----- |> From: Tim Devries [mailto:tim.devries@inquent.com] |> Sent: Tuesday, September 18, 2001 12:56 PM |> To: Smith, Rick; nanog(a)merit.edu |> Subject: Re: Afghanistan |> |> |> |> Does anyone even have a list of IP blocks allocated on a national or |> regional level? |> |> ----- Original Message ----- |> From: "Smith, Rick" <rsmith(a)atsworld.com> |> To: <nanog(a)merit.edu> |> Sent: Tuesday, September 18, 2001 9:23 AM |> Subject: Afghanistan |> |> |> > |> > |> > Has anyone started to deny all traffic to/from Afghanistan ? |> > |> > Wouldn't that be worth it ? |> > |> > Or did I miss that post? |> > |> > R |> > |>

2 1

Re: Worm Probes
by Roeland Meyer 18 Sep '01

18 Sep '01

The damned thing continues to burn bandwidth here. My IIS systems were patched long ago and my Apache servers are inherently immune. But, that does not prevent vulnerability scans and it's those scans that are burning the pipe. Firewalling the scans sort of blocks those services too. So, that isn't the answer. Fortunately, I have long been a fan of having really huge boxen sip their internet through straws (any single box can saturate the uplink (100baseTX), at <50% CPU utilization and the WAN:LAN link never exceeds 1:10. So, my servers are just loafing. Still, this comes real close to being a DDOS attack because the WAN port is showing almost 40% usage from scans right now. I'm real glad that I have another set of zone servers, piggy-backed in AboveNet. Has anyone made any progress towards locating origination of these worms? They seem to be steadily mutating. This means that a/some programmer(s) is/are behind this somewhere. I'm sure that I'm not the only one that wants to know. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company tel: +1 925 373 3954 cel: +1 925 352 3615 fax: +1 925 373 9781 http://www.mhsc.com

4 3

RE: Worm probes
by Smith, Rick 18 Sep '01

18 Sep '01

I've seen 2,614 unique addresses. I'd be willing to do the same. Or contribute to the effort. -----Original Message----- From: Ulf Zimmermann [mailto:ulf@Alameda.net] Sent: Tuesday, September 18, 2001 2:32 PM To: sigma(a)pair.com Cc: nanog(a)merit.edu Subject: Re: Worm probes On Tue, Sep 18, 2001 at 01:36:48PM -0400, sigma(a)pair.com wrote: > > > Along those lines, weren't there some projects last time around to find and > clean up the affected machines? Clearly there are LOTS of vulnerable NT > servers still out there. Presumably these are being responded to just like > Smurf amplifiers, and the problem is just that the admins are clueless or > unreachable? > > So far the most prolific network probing us has belonged to 9NetAve, which > was bought by Concentric shortly before they became XO. I got so far about 205 unique IPs from the scans. If anyone is interested I can put them on a webpage. Or even put quickly a script with db in the back for other people to provide their list of IPs. > > Kevin > > > Hopefully the notification does some good. > > > > -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

2 1

RE: Afghanistan
by Hallgren, Michael 18 Sep '01

18 Sep '01

> > >> Has anyone started to deny all traffic to/from Afghanistan ? > > It is my understanding that the free flow of ideas and > discussion of same > > is detrimental to an extremist or dictatorial government. > Such governments > > rarely (ever?) survive open discussions and flow of ideas. > > so i guess we should not advocate cutting off that flow, eh? > Yes (any channel for potentially constructive discussions, keep open). > resist the cycle of violence and hate. . mh > > randy >

1 0

Worm leveling off RE: Worm impact - September 18 2001
by Sean Donelan 18 Sep '01

18 Sep '01

The worm's impact appears to be leveling off. Any word if the infection rate has slowed like the CodeRed I/II worms?

1 0