September 2001 - Test - lists.nanog.org

Apache::Nimba released
by David Ulevitch 18 Sep '01

18 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 Hello Nanog'ers, I just released a dirty apache module to detect and if wanted, block Nimba via iptables. It's small, it's 0.1 but it works. I posted it here: http://www.everydns.net/~davidu/Apache-Nimba-0.1.tar.gz Any questions or comments can be directed here. I'll have a better version in a few hours but I'm late for my CS102 class. Thanks, David Ulevitch mailto:davidu@everydns.net Founder, EveryDNS.net http://www.everydns.net p.s: note that if you use the iptables part it's totally insecure for obvious reasons. I'll try to think of a fix while in class. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQIVAwUAO6efVUhMBortpHrDAQEMaRAAgb8um4ES8sbn21IOLOy/3aXnsTBAij0J Vdi9ak5CJ+UbdBYCU7pqpUzXT7M8jYHfelsi34pwhC+bHjeg6vY8YkI593GecVhG O9J+co/2NK5Wwqm2Xq0fO3OA30Ow/++N7TV6N0OI2wLlt8tGJN75fCYJ6RVAEZ9a DUFNUMWRFRm9hEQMuO1ToKwZF4QA1x7P3sFt2FwGH47qebRKUU0we6TCORoCNqC/ R3QIPf06ARW/J4Z4LFyG/vNj9T413i7FtbZz9sB1zE9VxcJDa6XF85Z+wvo68qB7 6y0CSpMTYsF1riHB1KgKAdpaCnqpN4S4rhvd4+sDV59xaTS77AXwlLBlOuSMkxq2 axPG+O5LRR89YLjBYvkIKeYV49u1vg8h/iv/Jjazy29Aeu9tBRaDEBP7cGV6LvTb 9LqKCfTQd/uZVD16QH6FEjGNvOL597XdPI5U/59Ux8ZCP1wxcBP2pjjDoURngEdu QjLADWEabn/l9iCX6aGn9bzg9n9af6F0Ub7/bWlf7wNh0ALPtkAz4Aoz31esxK6/ K7iksieSxlbKOqVS0Mp3lSlA4LmgPcaVzMcO7q4vhlWLaMwogL2n835qIeD71Pwe daA3lFL3qRrJEdXbmWEgq0T2H+0aaCH04/Xv41jTFdlm/Wfj7QU4hulU0cdZxx+B RGm2B0N2l6k= =IlZy -----END PGP SIGNATURE-----

1 0

Re: [isp-linux] RE: Massive port 80 hits
by Bill Larson 18 Sep '01

18 Sep '01

#!/usr/bin/perl # IISBLOCK - Infected IIS server blocking utility. # by Bill Larson <blarson(a)compu.net> of Compu-Net Enterprises. # http://www.compu.net. This header must be kept intact if you # wish to redistribute the script. my $check = 0; my $line = ""; my $weblog = "/etc/www/logs/access_log"; my $infection = "/root/infected"; my $removelist = "/root/fwclean"; # create the removelist file so that you can chmod it later and # automatically clear the firewall.. chmod 700 iisblock open (HTFILE3, ">$removelist"); print HTFILE3 "#!/bin/sh\n"; close(HTFILE3); #open the web server log file specified above and start processing open (HTFILE, "$weblog"); until (eof (HTFILE)) { $line =<HTFILE>; chop ($line); #Pattern match on IIS Attempts then strip down to the hostname/ip addresss if ($line =~ /.*\/winnt\/system32\/.*/) { $line =~ s/\ -.*//gi; # This host is infected so lets do something about it. &infected; } } close(HTFILE); sub infected { $check = 0; # begin a check to ensure that we only take action once. open (HTFILE2, "$infection"); until (eof (HTFILE2)){ $dupe =<HTFILE2>; chop ($dupe); if ($line =~ /$dupe/){ $check = 1; } else { } } close(HTFILE2); # If this is a unique host continue if ($check eq "0") { # time to add to the list of infected hosts open (HTFILE2, ">>$infection"); print HTFILE2 "$line\n"; close(HTFILE2); # add using the specified add command # firewall software will print an error on invalid hostnames. # Zap them one at a time maunally system ("/sbin/ipchains -I input -s $line -j DENY -l"); # write firewall removal line to the remove list file # modify this line for your specific firewall software open (HTFILE3, ">>$removelist"); print HTFILE3 "/sbin/ipchains -D input -s $line -j DENY -l\n"; close(HTFILE3); } # That's all folks! }

1 0

RE: Afghanistan
by Hallgren, Michael 18 Sep '01

18 Sep '01

> > > At 11:43 AM 9/18/2001 -0500, Basil Kruglov wrote: > > > >On Tue, Sep 18, 2001 at 12:23:58PM -0400, Smith, Rick wrote: > >> Has anyone started to deny all traffic to/from Afghanistan ? > >> > >> Wouldn't that be worth it ? > >> > >> Or did I miss that post? > > > >Do they even have Internet? > > > >http://www.cia.gov/cia/publications/factbook/geos/af.html > >Internet Service Providers (ISPs): NA > > It is my understanding that the free flow of ideas and > discussion of same > is detrimental to an extremist or dictatorial government. > Such governments > rarely (ever?) survive open discussions and flow of ideas. > > Either that, or their beliefs are so strongly held, so pure, > so obvious > that other ideas / beliefs need not even be examined. > Apparently the "boys > and girls" are simply told what to believe, and the reasoning > behind or, or > counter arguments to it, are irrelevant. No discussion or > substantiation > is necessary, "people with clue" told them so. > > > I vote for #1. What does the rest of NANOG think? > #1, (provided the open minded people over there do enjoy access to such a free flow of information, something I can't tell from my horizon.) mh > > >-Basil > > -- > TTFN, > patrick >

2 1

Re: Cisco PIX 515-->520?
by Lisa Napier 18 Sep '01

18 Sep '01

Hi all, Answers below: >From: Todd Suiter >Date: Wed Sep 12 20:19:02 2001 > > > I'm hearing rumors of problems with the 515 series PIX: > > '...that in some cases Cisco has opted to replace customers' 515 Pixes > with 520's at no charge because the 515 in some cases accepts packets > with spoofed source addresses that it should be able to reject.' This is untrue. >has anyone heard of this? Far as I know the sw is the same, but hw is >different. The hardware is different - that's why there are different product numbers - however the difference is in processing power and speed. Currently on the PIX, the anti-spoofing checks are all done in SOFTWARE, so anti-spoofing will be consistent across all hardware platforms. Hope that helps, Lisa Napier Product Security Incident Response Team Cisco Systems http://www.cisco.com/warp/public/707/sec_incident_response.shtml PGP: A671 782D 2926 B489 F81A 3D5E B72F E407 B72C AF1F ID: 0xB72CAF1F, DH/DSS 2048/1024

1 0

RE: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

There has already been a massive application of the patches, according to www.netcraft.com at http://www.netcraft.com/survey/#August, Code Red vulnerability has dropped to less than 20%, since July. It continues to drop. Your general characterization of cluelessness is a bit unfair. It is puzzeling that root.exe vulnerability is the only indicator that continues to rise, albeit slowly. Netcraft shows it to be >10% at the moment. BTW, I'm still seeing massive scanning activity. |> From: sigma(a)pair.com [mailto:sigma@pair.com] |> Sent: Tuesday, September 18, 2001 10:37 AM |> |> Along those lines, weren't there some projects last time |> around to find and |> clean up the affected machines? Clearly there are LOTS of |> vulnerable NT |> servers still out there. Presumably these are being |> responded to just like |> Smurf amplifiers, and the problem is just that the admins |> are clueless or |> unreachable? |> |> So far the most prolific network probing us has belonged to |> 9NetAve, which |> was bought by Concentric shortly before they became XO. |> > Hopefully the notification does some good. |> > |>

1 0

Re: Worm probes
by Ulf Zimmermann 18 Sep '01

18 Sep '01

On Tue, Sep 18, 2001 at 11:18:58AM -0700, Michael Martin wrote: > I was getting a huge number of probes on my Bay Area @home cablemodem until > about an hour and a half ago and it looked to be exclusively from @home > space. At that point the traffic I was seeing to my two IPs dropped from > about 200 kbit/sec to zero. It looks like @home put some filters in place. > I in the Bay Area too with @Home service (also got Speakeasy business DSL). As for 11:39am PDT I still see probes on @Home still. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

RE: Worm probes
by Smith, Rick 18 Sep '01

18 Sep '01

For the past 2 weeks or so, we were averaging 1,200 probes per hour. As of 8 or so this morning, we started averaging > 25,000 per hour! I've noticed that at the same time, we started getting probes from our provider's space (uniquely 23 addresses there), but not our own. Until this morning, we had *0* probes from inside our provider's space. Maybe this is the next round kicking off, looking for things to infect locally before searching the world again. Rick P.S. - Right now: (looks like it will be a bit over 25k this hour :) [root /usr/local/bin]# checkcodered.bash Code Red Log Checker Beginning Time: 10:00:00 Ending Time: 10:32:42 Number of attacks... 31730 Number of unique addresses... 3344 -----Original Message----- From: Daniel Senie [mailto:dts@senie.com] Sent: Tuesday, September 18, 2001 10:26 AM To: sigma(a)pair.com; nanog(a)merit.edu Subject: Re: Worm probes At 09:54 AM 9/18/01, sigma(a)pair.com wrote: >Has anyone else been seeing a dramatic increase in /scripts/.. NT worm >probes this morning? We're seeing about 8000/second, starting around 9:15 >Eastern time, to and from a wide variety of addresses. > >Is CodeRed or one of its relatives scheduled to start sweeping again today? >We've never seen this level of traffic related to the NT worms. Even >though we don't run any NT at all, we still have to suffer :( First ones appeared today, and so far I see 17650 attempts on just one of my servers. We don't run any Microsoft stuff either, but that doesn't keep our servers from getting hammered... ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

4 3

Re: Re: FW: Worm probes
by Frank Coluccio 18 Sep '01

18 Sep '01

re < readme.exe > : http://www.cert.org/current/current_activity.html#port80 > > > There is also an email vector where README.EXE is sent via email to > > numerous accounts. > > It also seems to set the from address in both the envelope and > header to an address, possibly from the address book(?). I've seen > a number of bounces come back to one of our NOC addresses, and a > couple of reports from humans. :( > > Rob >

1 0

FW: Worm probes
by Braun, Mike 18 Sep '01

18 Sep '01

I received this warning from TruSecure regarding the latest worm attack. Mike Braun First American CREDCO -----Original Message----- TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm Date: September 18, 2001 Time: 1000 EDT RISK INDICES: Initial Assessment: RED HOT Threat: VERY HIGH, (rapidly increasing) Vulnerability Prevalence: VERY HIGH, effects IIS servers version 4.0, 5.0, and internal networks. Cost: High, command execution is possible Vulnerable Systems: IIS 4.0 and 5.0 SUMMARY: A new IIS worm is spreading rapidly. Its working name is Nimda: W32.nimda.a.mm It started about 9am eastern time today, Tuesday,September 18, 2001, Mulitple sensors world-wide run by TruSecure corporation are getting multiple hundred hits per hour. And began at 9:08am am. The worm seems to be targeting IIS 4 and 5 boxes and tests boxes for multiple vulnerabilities including: Almost all are get scripts, and a get msadc (cmd.exe) get_mem_bin vti_bin owssvr.dll Root.exe CMD.EXE ../ (Unicode) Getadmin.dll Default.IDA /Msoffice/ cltreq.asp This is not code red or a code red variant. The worm, like code red attempts to infect its local sub net first, then spreads beyond the local address space. It is spreading very rapidly. TruSecure believes that this worm will infect any IIS 4 and IIS 5 box with well known vulnerabilities. We believe that there are nearly 1Million such machines currently exposed to the Internet. Risks Indices: Vulnerability VULNERABILITY PREVALANCE is very high - Milllions of Internet Web server hosts: TruSecure process and essential configurations should generally be protective. The vulnerability prevalence world-wide is very high Threat - VERY HIGH and Growing The rate of growth and spread is exceedingly rapid - significantly faster than any worm to date and significantly faster than any variant of Code red. Cost -- Unknown, probably moderate per infected system. The worm itself is a file called README.EXE, or ADMIN.DLL a 56K file which is advertised as an audio xwave mime type file. Other RISKS: There is risk of DOS of network segments by traffic volume alone There is large risk of successful attack to both Internet exposed IIS boxes and to developer and Intranet boxes inside of corporations. Judging by the Code Red II experience, we expect many subtle routes of infection leading to inside corporate infections. We cannot discount the coincidence of the date and time of release, exactly one week to (probably to the minute) as the World Trade Center attack . REPLICATION: There are at least three mechanisms of spread: The worm seems to spread both by a direct IIS across Internet (IP spread) It probably also spreads by local shares. (this is not known for sure at this time) There is also an email vector where README.EXE is sent via email to numerous accounts. Mitigations TruSecure essential practices should work. Block all email with EXE attachments Filter for README.EXE Make sure IIS boxes are well patched and hardened, or removed from both the Internet and Intranets. Make sure any developer computing platforms are not running IIS of any version (many do so by default if either. Disconnect mail from the Internet Advise users not to double click on any unexpected attachments. Update anti-virus when your vendor has the signature. -----Original Message----- From: Bryan Heitman [mailto:bryanh@communitech.net] Sent: Tuesday, September 18, 2001 8:22 AM To: nanog(a)merit.edu Subject: Re: Worm probes We're also seeing a large increase in this activity. This seems to be more severe than the first time. Have an additional 30 to 40 meg inbound from this. Best regards, Bryan Heitman CommuniTech.Net, Inc. ----- Original Message ----- From: <up(a)3.am> To: <nanog(a)merit.edu> Sent: Tuesday, September 18, 2001 10:05 AM Subject: Re: Worm probes > > > ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k > box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this > time of day, although still well short of capacity...apache server > processor load is WAY up just from the requests, and the logs are growing > like mad. > > On Tue, 18 Sep 2001, deeann mikula wrote: > > > > > On Tue, 18 Sep 2001, ravi pina wrote: > > > > > > > > On Tue, Sep 18, 2001 at 09:54:31AM -0400, sigma(a)pair.com said at one point in time: > > > > > > > > > > > > Has anyone else been seeing a dramatic increase in /scripts/.. NT worm > > > > probes this morning? We're seeing about 8000/second, starting around 9:15 > > > > Eastern time, to and from a wide variety of addresses. > > > > > > affirmative. i just looked at my logs, and it looks like > > > each probe tries a bunch of things. i haven't seen much > > > on the lists, but i'm looking right now. > > > > i'm pretty sure that the worm's attack phase starts on the 20th (which > > of course, depends upon a correctly set system clock) and also that > > attempting to execute something like /scripts/root.ext/c++ something > > is involved. > > > > i think that cert's website would be a good place to look. i'm *not* > > a security/virus chick, but i did host a talk by marty linder of cert > > where he discected code red's activity and presented a summary. > > > > cert is of course, http://www.cert.org. > > > > > > deeann m.m. mikula > > > > director of operations > > telerama public access internet > > http://www.telerama.com > > 1.877.688.3200 > > > > > > > > > > James Smallacombe PlantageNet, Inc. CEO and Janitor > up(a)3.am http://3.am > ========================================================================= > "MMS <firstam.com>" made the following annotations on 09/18/01 08:34:15 ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

3 2

Re: Our Qwest Testimonial: qwestoutage.com
by Paul Vixie 18 Sep '01

18 Sep '01

> This really is way outside most people's "disaster recovery" scenarios. I > can see the thinking now: "If both WTC towers fall over, we have much > bigger things to worry about than fiber cuts." And they were right. Right as far as that goes, yes. But since fiber paths of that kind are used to feed cell towers and other parts of the communications infrastructure including emergency services infrastructure, it IS worth thinking about communications robustness even in the face of destruction on this scale. Not so that folks can surf the web but so that folks in air pockets can call out to their rescuers. -- Paul Vixie <vixie(a)eng.paix.net> President, PAIX.Net Inc. (NASD:MFNX)

1 0