January 2003 - Test - lists.nanog.org

Re: Level3 routing issues?
by hc 28 Jan '03

28 Jan '03

I am on Verizon-GNI via Qwest and Genuity and seeing the same problem as well. -hc Joel Perez wrote: >I am also seeing increased traffic on my network. It has gotten so bad for one of my edge routers that i cant telnet into it. >But i am on Qwest and GBLX. > > -----Original Message----- > From: Alex Rubenstein [mailto:alex@nac.net] > Sent: Sat 1/25/2003 1:04 AM > To: hc > Cc: nanog(a)merit.edu > Subject: Re: Level3 routing issues? > > > > > > I dunno about that. But, I am seeing, in the last couple hours, all kinds > of new traffic. > > like, customers who never get attacked or anything, all of a sudden: > > http://mrtg.nac.net/switch9.oct.nac.net/3865/switch9.oct.nac.net-3865.html > > > We are seeing this on ports all across out network -- nearly 1/2 our ports > are in delta alarm right now. > > Anyone else? > > I will dig more to look at the traffic. > > > > > On Sat, 25 Jan 2003, hc wrote: > > > > > Anyone seeing routing problems with Level3 at this hour? I just > > witnessed tons of prefixes behind level3's network withdraw. Any > > information on what is happening (if you know) would be great. Thanks! > > > > -hc > > > > > > > > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- > -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net -- > > > > > >

36 76

RE: What could have been done differently?
by Ray Burkholder 28 Jan '03

28 Jan '03

The SANS Institute [sans(a)sans.org] www.sans.org is a well respected collection of individuals who have provided this 'pool' of knowledge and regularly disseminate it to inquiring minds. Ray Burkholder > -----Original Message----- > From: Andy Putnins [mailto:putnins@lett.com] > Sent: January 28, 2003 12:43 > To: Alex Bligh > Cc: Sean Donelan; nanog(a)merit.edu; putnins(a)lett.com > Subject: Re: What could have been done differently? > > This is therefore a request for all of those who possess this > "clue" to > write down their wisdom and share it with the rest of us, so we can > address what clearly is a need for discipline in the design > of networks > and network security, since computer networks are an > infrastructure upon > which people are becoming dependent, even to the point of > their personal > safety. > > - Andy > >

1 0

Re: Banc of America Article
by Roger Marquis 28 Jan '03

28 Jan '03

alex(a)yuriev.com wrote: > > It could be that BoA's network wasn't flooded / servers infected, but that > > the ATM's do not dial BoA directly, and dial somewhere else (ie, maybe some > > kind of ATM Dial Provider, nationwide wholesale, etc), and then tunnel back > > to BoA to get the data. Could be that the upstream of either the dial > > provider, or BoA was just flooded... > > Again, that design makes nearly no sense. The vast majority of the ATMs that > banks own and operate directly are located in the LATAs with bank branches. > Those branches do have good connectivity to the bank processing centers be > that via dedicated links, VPN or carrier pigeons. While the exact mechanism of BofA's exposure is important it is nowhere near as important as the fact that they were, and presumably are still, exposed. My money's on Frame Relay congestion. Some department at BofA, short on engineers and long on budget-oriented management, likely made a decision that saving a lot of money was worth a bit of exposure. I know that decision has been made at other banks. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

1 0

RE: What could have been done differently?
by Drew Weaver 28 Jan '03

28 Jan '03

Would it be that hard to have windows update check to see the version of SQL server? Its sad but I know a lot of MS admins only use windows update to check for updates because awhile ago Microsoft pushed it as the premier method of which to update your systems. Im just saying if they included all fixes in one spot instead of halfway automating it and halfway making it cryptically difficult it would benefit everyone. -Drew -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Tuesday, January 28, 2003 10:36 AM To: ekgermann(a)cctec.com; Leo Bicknell; nanog(a)merit.edu Cc: Eric Germann Subject: Re: What could have been done differently? From: "Eric Germann" > > Not to sound to pro-MS, but if they are going to sue, they should be > able to > sue ALL software makers. And what does that do to open source? > Apache, MySQL, OpenSSH, etc have all had their problems. Should we > sue the nail gun > vendor because some moron shoots himself in the head with it? With all the resources at their disposal, is MS doing enough to inform the customers of new fixes? Are the fixes and lates security patches in an easy to find location that any idiot admin can spot? Have they done due diligence in ensuring that proper notification is done? I ask because it appears they didn't tell part of their own company that a patch needed to be applied. If I want the latest info on Apache, I hit the main website and the first thing I see is a list of security issues and resolutions. Navigating MS's website isn't quite so simplistic. Liability isn't necessarily in the bug but in the education and notification. Jack Bates BrightNet Oklahoma

1 0

[barney@databus.com: NYTimes.com Article: Worm Hits Microsoft, Which Ignored Own Advice]
by Barney Wolff 28 Jan '03

28 Jan '03

----- Forwarded message from barney(a)databus.com ----- Date: Tue, 28 Jan 2003 00:43:09 -0500 (EST) Worm Hits Microsoft, Which Ignored Own Advice January 28, 2003 By JOHN SCHWARTZ ... A spokesman for Microsoft, Rick Miller, confirmed that a number of the company's machines had gone unpatched, and that Microsoft Network services, like many others on the Internet, experienced a significant slowdown. "We, like the rest of the industry, struggle to get 100 percent compliance with our patch management," he said. ... http://www.nytimes.com/2003/01/28/technology/28SOFT.html?ex=1044732589&ei=1… Copyright 2002 The New York Times Company ----- End forwarded message -----

1 0

Re: Is there a line of defense against Distributed Reflective attacks?
by Michael Lamoureux 27 Jan '03

27 Jan '03

"alex" == alex <alex(a)yuriev.com> writes: >> > > Sure, but this like all other attacks of this sort can be >> > > tracked... and so the pain is over /quickly/ provided you can >> > > track it quickly :) Also, sometimes null routes are ok. >> > >> > How quickly is quickly? Often times as has been my recent >> > experience (part of my motivation for posting this thread) the >> > flood is over before one can get a human being on the phone. >> >> Once the call arrives and the problem is deduced it can be tracked >> in a matter of minutes, like 6-10 at the fastest... alex> So if one wants to create a really nasty, largely untrackable alex> problem, one just needs to mount a set of attacks that last 3-4 alex> minutes at a time? Sure, that's one way to make it difficult. alex> This is a very bad band-aid. The solution is amazingly simple - Just to be clear, the solution to WHAT is amazingly simple? alex> make it uneconomical to have unprotected networks, For whom to have unprotected networks? What constitutes a protected network? How does one make it uneconomical enough? wondering, Michael

5 4

Re: [Re: Level3 routing issues?]
by Joshua Smith 27 Jan '03

27 Jan '03

Simon Lockhart <simonl(a)rd.bbc.co.uk> wrote: > > On Mon Jan 27, 2003 at 04:16:00PM -0500, alex(a)yuriev.com wrote: > > Again, but why does it talk to the outside world unsupervised? Your > > organization clearly has a border that separates its internal systems from > > external ones. Why not apply those restrictions on *those* borders? > > From inside the organisation to outside, yes, ish. Except all those SSL sites > on random port numbers. And other protocols which use random port numbers > (not just peer-to-peer, but also things like FTP, etc). > > But, we were talking about end-user connected into the inside network using > a VPN. That user needs to have pretty much unfettered access to the > business parts of your internal network. (Okay, mission critical stuff > should be seperately firewalled, but MS makes that hard enough, due to > things like Active Directory, where everything needs to talk to everything). > and don't forget the fact that nearly every M$ service pack/'critical' update changes what ports that program is using (exchange/outlook are really bad about this) joshua > Simon > -- > Simon Lockhart | Tel: +44 (0)1628 407720 (BBC ext 37720) > Technology Manager | Fax: +44 (0)1628 407701 (BBC ext 37701) > BBC Internet Services | Email: Simon.Lockhart(a)bbc.co.uk > BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

1 0

OT: alex@yuriev.com email issues?
by Jeff S Wheeler 27 Jan '03

27 Jan '03

Dear nanog, I apologize in advance for my off-topic posting. I doubt I am alone, though, in saying that Alex Yuriev needs to "slow his roll". Alex, stop sending a follow-up to everything you read. If you really have something to say, please just write a pointed email with a sensible subject and send it. ONCE. I do not intend to flame, but I have mailed similar comments to Alex in private before and it has quite clearly not reduced this behavior. I am not trying to bash his views or his person, only ask him not to post 13 messages in the span of two hours. Again, my apologies for this off-topic posting. -- Jeff S Wheeler <jsw(a)five-elements.com>

2 1

att.net email issues?
by Jim Popovitch 27 Jan '03

27 Jan '03

Is anyone seeing problems delivering email to att.net? I see about 50% rejected, 50% accepted. The 50% accepted never make it to the endusers. Been like this for the last 36 hours. Anyone else? -Jim P.

8 11

Banc of America Article
by Alex Rubenstein 27 Jan '03

27 Jan '03

http://biz.yahoo.com/rb/030125/tech_virus_boa_1.html Let's make the assumption that the outage of ATM's that BoA suffered was caused by last nights 'SQL Slammer' virus. The following things can then be assumed: a) BoA's network has Microsoft SQL Servers on them. b) BoA has not applied SP3 (available for a week) or the patch for this particular problem (SQL Slammer) (available for many months). c) somehow, this attack spawned on the public internet made it's way to BoA's SQL servers, bypassing firewalls (did they have firewalls?). Another article states, "Bank of America Corp., one of the nation's largest banks, said many customers could not withdraw money from its 13,000 ATM machines because of technical problems caused by the attack. A spokeswoman, Lisa Gagnon, said the bank restored service to nearly all ATMs by late Saturday afternoon and that customers' money and personal information had not been at risk." Does anyone else, based upon the assumptions above, believe this statement to be patently incorrect (specifically, the part about 'personal information had not been at risk.') ? I find these statement made by BoA, based upon assumptions which are probably correct, to be very scary. Comments? -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

10 11