May 2002 - Test - lists.nanog.org

Re: anybody else been spammed by "no-ip.com" yet?
by Paul Vixie 04 May '02

04 May '02

> ... not only does it cost usually very little to receive these messages ... even if i granted to a third party the right to determine the value of my time, which i don't, the fact is that an hour or more of my time per day is too high a price to pay "to receive these messages", by _any_ standard. to understand the scale, here's what came in during my trip home tonight. 456 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 457 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 458 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 459 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 460 05/04 FreeSampleCenter Win $20,000! Win $20,000 to RENOVATE your Home!< 463 05/04 my_own_business20 If a 15 year old boy can earn $71,000 in just a 464 05/03 "mike" YOUR HEALTH zNAUiqxgEx<<This is a multi-part mes 465 05/03 National Financia InvestorFacts: NasdaqNM: DSSI -Data Systems and 466 05/02 "Pamila Binkley" don't Pay another monthly Bill until you read th 469 05/04 Tax.Relief(a)isc.or Large Annual Tax Savings!<<<html> <head> <title> remember, it would be ~4X higher without filtering, according to my syslogs.

2 1

Re: anybody else been spammed by "no-ip.com" yet?
by rs＠seastrom.com 04 May '02

04 May '02

<measl(a)mfn.org> writes: > > It does not cost "very little" to recieve spam. > > It costs the end-user very little to recieve spam. I'll echo Paul's comments about the cost of my time. In my case, a half hour a day seems about right (compared to Paul's hour a day). I suspect you may have a very different perception about the value of your time than Paul and I have about the value of ours. I am sure that we have customers whose time is worth a lot and whose time is worth very little. Over half of our customers, however, are in countries where there is a per-minute cost to being off-hook on a dialup. They see a very direct cost to download spam, aside from the human costs. > Whether we like it or not however, this is a cost of doing business now, and > is a normal part of determining your cost of goods sold (at least it *should* > be). Counting inventory shrinkage costs as part of the cost of doing business at a retail establishment does not change the fact that shoplifting is a crime. > > Spam is theft, plain and simple. > > Spam is a reality that none of us, either alone or in concert, will ever be > able to eradicate. That makes the general gnashing of teeth == tilting at > windmills. Your position is noted. > Our time is probably the most expensive part of an ISPs "spam > cleanups" budget - automating a filter system (for those who specifically ask > for it, of course) via the purchase of services from Vixie or your favorite > equivalent is likely to be a reasonably inexpensive alternative to having us > spinning our wheels. <asbestos underwear in place ;-> You have incomplete information. That's all I'm going to say about it. ---Rob

1 0

Re: anybody else been spammed by "no-ip.com" yet?
by blitz 04 May '02

04 May '02

When I re-read my post, I'd like to clarify the "clean" part a bit. I mean technically clean, as in all of the parts working properly as best as the fine people represented on this list can make it happen that is...so lets say "properly operating"...to be a little more specific. The Internet certainly isn't "clean" by moral standards, and as I see it, those are individual choices individuals make, and I certainly don't want anyone, especially the "gooberment" mandating those choices for me. Gooberment does have a place in this, though I'd rather those bastards stay the hell away from anything thats working well. I wouldn't mind if a few more states made spam illegal, like Calif and Oregon have made it. I don't give a rat's rectum about advertisers, in fact I place them in the same category as shysters, the world could live life just fine (and cheaper) without their ilk around. At 18:44 5/3/02 -0700, you wrote: >uWell I tend to always error on the side of free expression verses >making something illegal and I definitely disagree with the statement >that its a clean internet otherwise but just like non electronic space >there are many differing standards and shades of things something I >actually think brings a lot to the quality and adventure of the thing.

5 5

RE: anybody else been spammed by "no-ip.com" yet?
by Ron Snyder 04 May '02

04 May '02

They're not paying the recipient, but it does increase their costs. http://harvee.billerica.ma.us/~esj/camram.html -ron > -----Original Message----- > From: Forrest W. Christian [mailto:forrestc@imach.com] > Sent: Saturday, May 04, 2002 1:15 AM > To: nanog(a)trapdoor.merit.edu > Subject: Re: anybody else been spammed by "no-ip.com" yet? > > > > On Sat, 4 May 2002, Forrest W. Christian wrote: > > > What I envision is some sort of micropayment protocol > extension to SNMP. > -------------------------------------------------------------- > -------^^^^ > > Make that SMTP :) I guess I've been working on network monitoring too > much recently..... > > - Forrest W. Christian (forrestc(a)imach.com) AC7DE > ---------------------------------------------------------------------- > The Innovation Machine Ltd. P.O. Box 5749 > http://www.imach.com/ Helena, MT 59604 > Home of PacketFlux Technogies and BackupDNS.com (406)-442-6648 > ---------------------------------------------------------------------- > Protect your personal freedoms - visit http://www.lp.org/ >

1 0

anybody else been spammed by "no-ip.com" yet?
by Paul Vixie 04 May '02

04 May '02

as a coauthor of rfc2136, my curiousity is always piqued when spammers use the technology. can i get private forwards of other similar messages? (see below.) (and yes, i'll also be in touch with level3, who serves 166.90.15.236, from whence this message came.) (time was, anyone who could use postfix and php would also know better than to spam, or at least, to spam *me*. <grump> <grumble>.) re: ------- Forwarded Message Return-Path: nobody(a)www.no-ip.com Delivery-Date: Fri May 3 07:44:25 2002 Return-Path: <nobody(a)www.no-ip.com> Delivered-To: vixie(a)as.vix.com Received: from isrv3.isc.org (isrv3.isc.org [204.152.184.30]) by as.vix.com (Postfix) with ESMTP id 2360D28B6B for <vixie(a)as.vix.com>; Fri, 3 May 2002 07:44:25 -0700 (PDT) (envelope-from nobody(a)www.no-ip.com) Received: from www.no-ip.com (yoka.vitalwerks.com [166.90.15.236]) by isrv3.isc.org (8.11.2/8.9.1) via ESMTP id g43EiOT08718 for <vix(a)vix.com>; Fri, 3 May 2002 14:44:25 GMT env-from (nobody(a)www.no-ip.com) Received: by www.no-ip.com (Postfix, from userid 99) id 4A10F833A4; Fri, 3 May 2002 07:54:40 -0700 (PDT) To: vix(a)vix.com Subject: Your password for no-ip.com From: No-IP Registration <webmaster(a)no-ip.com> Reply-To: webmaster(a)no-ip.com X-Mailer: PHP/4.1.2 Message-Id: <20020503145440.4A10F833A4(a)www.no-ip.com> Date: Fri, 3 May 2002 07:54:40 -0700 (PDT) Hello, Welcome to No-IP.com. Your number one stop for dynamic dns services. Your password is: jnMgta To logon to no-ip.com go to http://www.no-ip.com/ and enter your email address and the password above. Once you logon you may change your password by clicking the "Change Password" link. Remember that you can use our dynamic update client to keep our system is sync with your IP address. These clients are available at http://www.no-ip.com/downloads.php Also, keep in mind that No-IP offers services for use with personal domain names. This service, No-IP Plus, allows you to use YOUR domain name with our dynamic dns, and other facilities. More information on this and other services is at http://www.no-ip.com/services.php. If you have any further questions about this service, please refer to our FAQ at http://www.no-ip.com/faq.php. If the FAQ doesn't answer your question(s) contact us at support(a)no-ip.com. Enjoy! The No-IP Team webmaster(a)no-ip.com http://www.no-ip.com/ ------- End of Forwarded Message

9 11

World-wide distributed DoS and "warez" bot networks (fwd)
by blitz 04 May '02

04 May '02

From a forward to me on the DDos stuff...this might shed some light on the DDos problem, if not sorry for the bandwidth. --------begin forward >[Note: I just noticed last night, after giving a talk on this incident, that >several threads on the SANS Unisog list going back as far as February 18, >2002 have discussed this same botnet in generality and in some detail, so I >can't claim to be the first to analyze this botnet. That credit goes to >Christopher E. Cramer of Duke University. (That's what I get for letting >myself get so far behind on email, and for not studying all sources of >information I had available to me when we first started seeing problems. >Hopefully someone on the unisog list will cross-post to >incidents(a)securityfocus.com when a widespread incident like this pops up >next time. ;) > >The Unisog threads can be found here: > > http://staff.washington.edu/dittrich/misc/ddos/unisog-xdcc.txt > >Since all this work was already done, I'll still post what I have assembled >with the assistance of Mike Hornung and Alexander Howard at the UW, in hopes >I'm adding something new in the way of tools and techniques (see my >CanSecWest talk slides referenced at bottom) that will help speed up >response the next time one of these massive botnets is assembled using >compromised computers.] > > >Summary >======= > >Over the months of March through late April of 2002, the University of >Washington has seen multiple incidents of distributed "warez" (pirated >software) and denial of service (DDoS) attacks, coming from Windows 2000 and >NT systems. These systems all have several things in >common: > > o They appeared to be found with no password on the > Administrator account, and control taken over. > > o They had various IRC bots installed on them, including > knight.exe, GTbot, and X-DCC (a distributed "warez" > serving bot.) > > o They had the ServUFTP daemon running on them for incoming > file transfer (to load the "warez".) > > o They had Firedaemon (a program that registers programs for > execution to serve incoming connections, similar to the Unix > "inetd" daemon.) > >Details >======= > >Forensic analysis of hard drive contents and IRC traffic has revealed the >methods and signatures of the malware installed on the compromised systems. >To date we are not 100% sure of exactly how the initial backdoor >installation occurs, but it appears to involve remote shell access (via >telnetd). Whatever it is, the next step is to transfer a script onto the >system and run it to bootstrap the rest of the installation of backdoors, >bots, FTP server, and other support programs, the modification of >directory/file permissions and attributes to hide files, and changes to >registry settings to make programs run at each boot. On some system, FTP is >also used to later transfer files onto the compromised system. > >The script does the following: > >o Creates a directory under the C:\RECYCLER directory, and marks > it hidden and system directory. > >o Kills any previously running instances of itself. > >o Installs Firedeamon, and changes it (and other support programs) > to be system/hidden. > >o Uses tftp to download IRC bot configuration files from a temporary > cache (on another compromised system) > >o Does a "net user administrator changem" and deletes the > ipc$ file share. > >o Starts the Firedaemon and registers services named "Ms32dll", > "SVHOST" and "MSVC5" > >o Creates a file to set the following Registry settings, then > runs "regedit" on this file: > > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\] > restrictanonymous"="1" > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\] > "NTLM"="2" > >o Cleans up some files, and stops and deletes the following > services: "tlntsvr" and "PSEXESVC" > >o (Re)Starts the following services: "lmhosts" and "NtLmSsp" > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >user_nick [XDCC]XXXX-649 >slotsmax 20 >loginname XXXXX >filedir C:\RECYCLER\S-1-5-21-2686636377-1107193052-384560437-1000 >uploaddir C:\RECYCLER\S-1-5-21-2686636377-1107193052-384560437-1000 >xdccfile c:\winnt\system32\vmn32\asp\mybot.xdcc >pidfile c:\winnt\system32\vmn32\asp\mybot.pid >server irc.XXXXXX.net 6667 >server irc.XXXXXX.net 7000 >server XXXX.XXXXX.net 6667 >server XXXX.XXXXX.net 7000 >server XXX.XXX.XX.XXX 6667 >logrotate weekly >messagefile c:\winnt\system32\vmn32\asp\mybot.msg >ignorefile c:\winnt\system32\vmn32\asp\mybot.ignl >channel #XDCC -plist 15 >user_realname XDCC >user_modes +i >virthost no >vhost_ip virtip.domain.com >firewall no >dccrangestart 4000 >queuesize 20 >slotsmaxpack 0 >slotsmaxslots 5 >slotsmaxqueue 10 >maxtransfersperperson 1 >maxqueueditemsperperson 1 >restrictlist yes >restrictsend yes >overallminspeed 5.0 >transfermaxspeed 0 >overallmaxspeed 2000 >overallmaxspeeddayspeed 0 >overallmaxspeeddaytime 9 17 >overallmaxspeeddaydays MTWRF >debug no >autosend no >autoword bleh >automsg bleh >autopack 1 >xdccautosavetime 15 >creditline ^2Brought to you by #XDCC^2 >adminpass Xv8h8aXknm8J5z >adminhost *!*(a)*.XXXXXX.net >adminhost *!*(a)*.cia.gov >uploadallowed no >uploadmaxsize 900 >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >A search of Google for the terms "+X-DCC +XDCC +bot" comes up with several >hits, including the following list of the top IRC networks. The X-DCC/XDCC >related channels (including channels found on many of the compromised >systems at the UW) were the majority of the top channels on this site: > > http://62.27.120.133/networks/chanlist.shtml > >The signature of these particular bots can be identified by the string >":Total Offered:" (the amount of disc space used for "warez" on the system, >to be served by the bot): > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >T 2002/04/18 08:30:18.768002 10.1.1.1:6667 -> 192.168.2.2:3852 [AP] > :[f0]-XDCC230!~accute@foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXXX > :.**. .Brought to you by #XXXXXXXXXXXXX. .**...:[f0]-XDCC230!~accute@ > foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXX :.**. .Brought to you by #X > XXXXXXXXXXXX. .**... > >T 2002/04/18 08:30:20.452092 217.199.39.139:7000 -> 128.208.113.130:1031 >[AP] > :[f0]-XDCC230!~accute@foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXXX > :Total Offered: 1223.5 MB Total Transferred: 419.19 MB..:[f0]-XDCC230 > !~accute(a)foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXX :Total Offered: 1 > 223.5 MB Total Transferred: 419.19 MB..:[f0]-XDCC230!~accute@foo-000 > 0000.bar.asu.edu PRIVMSG #XXXXXXXXX :Total Offered: 1223.5 MB Tota > l Transferred: 419.19 MB.. >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Using this information, a capture of all IRC traffic across the border of >the network was performed and a script written ("findoffer") to parse and >summarize the totals. Sampling IRC traffic to/from a set of 9 compromised >systems (tcpdump filter "tcp port 6667 and tcp port 7000"), and using >"findoffer", as many as 419 bots in 22 IRC channels, serving a total of >556.18 GB (yes, over half a Terabyte!!! and that is just from bots in some >of the X-DCC channels, not all of them.) > >[Note that IRC can be run over any port besides just 6667/tcp and 7000/tcp, >so I expect that these bots will likely move off of public servers to rogue >servers on compromised systems, and to use ports other than the standard >6666/tcp - 7000/tcp.] > >In addition to file sharing, many (all?) of these systems were at least >capable, if not actually used for, distributed denial of service (DDoS) >attacks. Dozens of attacks have been attributed to the same group who >installed these warez bots. Here is one such use: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >T 2002/03/27 02:28:31.434846 192.168.0.220:6667 -> 10.0.0.1:3164 [AP] > :ns.example.net 404 KNIGHT77tdtR #doschan :Cannot send t > o channel..:badd_kittycatN0yb!~moonglow@dc00.foonet.gatech.edu PRIVM > SG #doschan :[login accepted].. > >T 2002/03/27 02:28:31.986647 192.168.0.220:6667 -> 10.0.0.1:3164 [AP] > :ns.example.net 404 KNIGHT77tdtR #doschan :Cannot send t > o channel..:badd_kittycatN0yb!~moonglow@d000.foonet.gatech.edu PRIVM > SG #doschan :[packeting 192.168.32.94 at 64000kb/s 10000000 times].. > :vodkidWT!~zoolander@grd0000.foo.uiuc.edu PRIVMSG #doschan :[packet > ing 192.168.32.94 at 64000kb/s 10000000 times].. > > . . . > >T 2002/03/27 05:25:31.491814 192.168.0.220:6667 -> 10.0.0.1:3164 [AP] > :foobar!foo@staff.botnet.net PRIVMSG #doschan :.run c:\w > innt\system32\temp.exe..:XXXXXXXXXXZ2vco!~XXXXXX@A000000.N0.Vanderbilt > .Edu PRIVMSG #doschan :[running c:\winnt\system32\temp.exe].. > >T 2002/03/27 05:25:31.493483 10.0.0.1:3164 -> 192.168.0.220:6667 [AP] > PRIVMSG #doschan :[running c:\winnt\system32\temp.exe].. >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Two DDoS bots have been seen in use in conjunction with this activity: >"knight.exe" and "GTbot". ("knight.exe" is the Unix "knight.c" program, >compiled with the Cygwin development libraries.) These programs are >described here: > > http://www.cert.org/archive/pdf/DoS_trends.pdf > http://bots.lockdowncorp.com/gtbot.html > >The UDP traffic (seen by "tcpdump") during a GTbot attack shows some unusual >packets: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >1017207252.687968 192.168.32.126.1646 > 10.203.32.94.37046: rad-#43 837 [id >32 ] Attr[ Acct_out_octets{length 30 != 4} ARAP_zone_acces{length 46 != 4} >NAS_id{ +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH} Acct_out_packets{length >41 != 4} ARAP _challenge_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154}| >radius} ARAP_challenge_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B20 2B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154}|radius} ARAP_challenge >_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154}|radius} AR >AP_challenge_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154 >}|radius} [|radius] >. . . >1017207256.282173 192.168.32.126.1645 > 10.203.32.94.24413: rad-#64 440 [id >64 ] Attr[ Tunnel_type{length 62 != 4} Tunnel_type{length 62 != 4} >Tunnel_type{len gth 62 != 4} Tunnel_type{length 62 != 4} Tunnel_type{length >62 != 4} Tunnel_type {length 62 != 4} [|radius] >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Seen by "ngrep", there is a strange kind of UDP flood: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >U 2002/03/26 21:34:16.284428 192.168.32.126:2892 -> 10.203.32.94:19192 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH > 0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +A > TH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 > >U 2002/03/26 21:34:16.284790 192.168.32.126:3099 -> 10.203.32.94:61749 > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@ > >U 2002/03/26 21:34:16.285599 192.168.32.126:2767 -> 10.203.32.94:44393 > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@) > >U 2002/03/26 21:34:16.286329 192.168.32.126:4403 -> 10.203.32.94:56289 > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@) > >U 2002/03/26 21:34:16.287070 192.168.32.126:4008 -> 10.203.32.94:39934 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH > 0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +A > TH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Apparent IRC traffic confirms there is a DDoS bot on this system: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >T 2002/03/26 21:36:43.468911 192.168.32.126:1135 -> 10.76.175.220:7666 [AP] > PRIVMSG #doschan :.S.ending [.64,000.kb] of Data to (10.203.32.94). >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Seen by "tcpdump", one of the attack methods of this tool uses IP protocol >255 (listed as "Reserved" by IANA). These attacks use both large packets >(requiring fragmentation) and small packets. [Note: Network monitoring >tools that only log TCP, UDP, and ICMP protocols will not see this attack >traffic at all.] > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >Fri Mar 22 20:54:59 2002 >1016859299.879744 192.168.0.1 > 10.209.12.152: ip-proto-255 1480 (frag >37686:1480@0+) 1016859299.879745 192.168.0.1 > 10.209.12.152: (frag >37686:20@1480) 1016859299.881140 192.168.0.1 > 10.209.12.152: ip-proto-255 >1480 (frag 37687:1480@0+) 1016859299.881141 192.168.0.1 > 10.209.12.152: >(frag 37687:20@1480) 1016859299.882465 192.168.0.1 > 10.209.12.152: >ip-proto-255 1480 (frag 37688:1480@0+) 1016859299.882465 192.168.0.1 > >10.209.12.152: (frag 37688:20@1480) 1016859299.883866 192.168.0.1 > >10.209.12.152: ip-proto-255 1480 (frag 37689:1480@0+) > > >Sat Mar 23 13:13:25 2002 >1016918005.627814 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.627905 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.627986 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628120 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628180 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628282 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628342 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628448 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Seen with Foundstone's "FPort" program, the program showed the following >open port: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >FPort v1.33 - TCP/IP Process to Port Mapper >Copyright 2000 by Foundstone, Inc. >http://www.foundstone.com > >Pid Process Port Proto Path >2 System -> 80 TCP >187 inetinfo -> 80 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >2 System -> 113 TCP >191 temp -> 113 TCP C:\WINNT\System32\temp.exe >94 RpcSs -> 135 TCP C:\WINNT\system32\RpcSs.exe >2 System -> 135 TCP >2 System -> 139 TCP >2 System -> 443 TCP >187 inetinfo -> 443 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >191 temp -> 1035 TCP C:\WINNT\System32\temp.exe >187 inetinfo -> 1036 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >187 inetinfo -> 1037 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >187 inetinfo -> 2962 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >191 temp -> 9000 TCP C:\WINNT\System32\temp.exe >2 System -> 135 UDP >2 System -> 137 UDP >2 System -> 138 UDP > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > >More information on this botnet, and references to the tools used to analyze >it, were presented at CanSecWest Core02 in Vancouver, BC on May 2. The >slides and references to the tools that were used can be found at the >following location: > > http://staff.washington.edu/dittrich/talks/core02/ > >An example report produced by "findoffer" can be found at: > > http://staff.washington.edu/dittrich/misc/ddos/xdcc-report.txt > >This report has been anonymized, since some of the host are voluntarily >serving files (these networks are NOT exclusively compromised hosts running >bots.) Use this script ONLY to identify hosts on your network, and make sure >you follow all applicable privacy laws and policies of your organization >regarding logging of IRC traffic. > >-- >Dave Dittrich Computing & Communications >dittrich(a)cac.washington.edu University Computing Services >http://staff.washington.edu/dittrich University of Washington

1 0

eBay and the DoS thread
by Richard A Steenbergen 04 May '02

04 May '02

I would like to take this opportunity to publicly shame eBay, who decided to fire one of their engineers for disclosing their "proprietary" methods for defending against DoS in the recent NANOG thread. The only appropriate punishment for a company with its head so far up its proverbial poop chute to prevent the sharing of simple recommendations on DoS prevention with the networking community is that all useful, intelligent, and responsable people consider their policies carefully before working there. </rant> -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

Re: anybody else been spammed by "no-ip.com" yet?
by blitz 04 May '02

04 May '02

Picture it as a fellow stopping by every night and filling your home mailbox with horse manure...I'm sure you'll get a feeling for how most of us regard it. A) it wastes bandwidth B) It wastes our time C) It's the "litter" of an otherwise clean Internet. D) It's a method of placing the costs for the actual emailing on someone else without their explicit permission...the ISP, the user, and the ISP's other paying customers all pay for the act, either directly or indirectly. We need to make it illegal as soon as possible everywhere..... At 15:27 5/3/02 -0700, you wrote: >I realize this statement I'm about to make is going to open a huge... >can o worms but ... and hoefully everyone knows I mean this in the most >friendly responsible way ever but I'm not sure entirely what the big >deal with spam is. Honestly sure I get it like everyone else, in some >of my accounts more than others but I also get a real truckload in my >snailmail box. Just as with all the pottery barn catalogs <no offense >to pottery barn I guess>:) I have a delete key just like my trash can. >I know at one time the argument was made, and quite correctly that >people were paying to receive this service and these messages cost them >money. Today with flat rate access and many people not paying on a per >packet basis it seems to me that the responsibility lies with the end >user to filter properly and or dress that delete key. I always shut >down customers who spam and disrupt service simply because I don't want >the backlash or want specific ips blocked but in a way I don't feel its >right that the carriers do the filtering it seems tome up to the end >user. > >On Fri, 3 May 2002, Mitch Halmu wrote: > > > > > > > On Fri, 3 May 2002, Paul Vixie wrote: > > > > > > I hate to sound like the big idiot here, but what exactly in the email > > > > you received indicates no-ip.com spammed? It looks to me like you just > > > > have some secret "admirer" who thought you wanted a no-ip.com account, > > > > and no-ip.com emailed you to confirm that you do want the account. > > > > > > spam is like pollution in that (a) whenever you're not sure if you're > > > doing it, you probably are, and (b) if everybody did whatever it is, > > > life would be universally worse for, well, everybody. > > > > > > > Random disclaimer: Yes, we're a competitor of no-ip.com's... And > yes, we > > > > used to send similar emails to people signing up for an account, > > > > although nowadays instead of sending them an initial password we send a > > > > confirm URL instead. > > > > > > that's the right approach. no-ip's problem was they presumed my > permission. > > > > > > > You don't even have to be in the "big idiot" league to figure out that in > > both the "wrong" and the "right" approach as sanctioned above by a higher > > authority, an email message (aka spam) is sent to the presumed subscriber. > > > > One sends a password, one asks for permission to issue a password on their > > site. What's the difference in the annoy factor, if indeed one were to be > > subscribed by a secret "admirer"? > > > > Mr. Halmu chose to think, rather than bindly obey... > > > > --Mitch > > NetSide > >

3 2

RE: ddos attack in progress... help needed
by Hassan, Shehzad 04 May '02

04 May '02

Reporting Security Incidents (PSIRT Advisories) http://www.cisco.com/warp/public/707/sec_incident_response.shtml#Incidents If you are under active security attack or believe that you are about to be attacked, contact the Cisco Technical Assistance Center at +1 408 526 7209 or +1 800 553 2447 or by any of the means listed under "Contact Summary" in this document. SH -----Original Message----- From: Rodney Joffe [mailto:rjoffe@centergate.com] Sent: Friday, May 03, 2002 8:15 PM To: NANOG Subject: ddos attack in progress... help needed Hello folks, We're undergoing a ddos attack on one of our machines. Its quite manageable so far - 28 source IPs, many of them cable modems. But its the first we've ever suffered, and before we get too deep in, I'd appreciate pointers to the appropriate law enforcement parties to contact so we can get to the root eventually. Offline is fine. If there's any value, I'm happy to provide the list. Sustained rate from each machine is around 2mbits per 5 min snapshot. -- Rodney Joffe CenterGate Research Group, LLC. http://www.centergate.com "Technology so advanced, even we don't understand it!"(SM)

2 1

RE: Effective ways to deal with DDoS attacks?
by LeBlanc, Jason 03 May '02

03 May '02

uRPF and Radware DoShield, one DoShield per link btw edge router and core router. Use IDS (yes there is a way to capture all your traffic and anaylyze it, regardless of bandwidth, no it isn't one box) to identify a signature, build a filter, config filter on DoShield, up to ~200Mb/s per DoShield of filtering with zero impact to legit traffic. Scale horizontally (add more links each with a DoShield on it) based on your ingress traffic. I've seen many suggestions on this list, this is the only thing that works for huge (100Mb/s+) attacks. eBay is likely the biggest target on the net, this works for us 90% of the time. Is the HW expensive? Yes. (~$35k per DoShield I think) It works, it scales. There is no way a Cisco router can handle filtering attacks past a certain point, nor is it capable of even filtering on some patterns in attack packets. Juniper is better, but still lacks some filtering capabilities. Your router is a router, not a packet filter, give up trying to make it do this until someone builds this into an ASIC on the router. Email me off list for more info. -----Original Message----- From: Pete Kruckenberg [mailto:pete@kruckenberg.com] Sent: Wednesday, May 01, 2002 4:18 PM To: nanog(a)merit.edu Subject: Effective ways to deal with DDoS attacks? There's been plenty of discussion about DDoS attacks, and my IDS system is darn good at identifying them. But what are effective methods for large service-provider networks (ie ones where a firewall at the front would not be possible) to deal with DDoS attacks? Current method of updating ACLs with the source and/or destination are slow and error-prone and hard to maintain (especially when the target of the attack is a site that users would like to access). A rather extensive survey of DDoS papers has not resulted in much on this topic. What processes and/or tools are large networks using to identify and limit the impact of DDoS attacks? Thanks. Pete.

5 6