October 2003 - Test - lists.nanog.org

Re: Wired mag article on spammers playing traceroute gameswith trojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>>>> Michael Airhart <mairhart(a)cisco.com> 10/9/03 1:57:06 PM >>> > >How many times have you received SPAM selling a product from a U.S. based >company? I have received plenty.... follow the money.... Hank has it right. > >M >(speaking only for myself) Well, Cisco has a sales office in the same building as CyberGate/Affinity/Skywebnet. Can you send a few of your people over to suite 200 and see if you can take care of that problem for us? :-) John --

1 0

Re: Sitefinder and DDoS
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

> > Let's also assume someone sets up a popular webpage with malware >> HTML causing it, perhaps with a time delay, to issue rapid GETs to >> deliberately nonexistent domains. > >You don't even have to imagine that. > >Imagine a long-term port 80 Denial of Service (DoS) attack against a >given website (using the website url rather than IP, which is not >uncommon). > >Imagine the attacked domain administrator removes their DNS records >from the registry to alleviate the attack. > >The attack is now directed at the Verisign Sitefinder service. > > Adam OUCH. Yet worse.

2 1

Re: Wired mag article on spammers playing traceroute gameswithtrojaned boxes
by John Neiberger 09 Oct '03

09 Oct '03

>>OrgName: CyberGate, Inc. >>OrgID: CYBG >>Address: 3250 W. Commercial Blvd. Suite 200 >>City: Ft. Lauderdale >>StateProv: FL >>PostalCode: 33309 >>Country: US > >This appears to be a rather prolific spammer. At first I thought they >were affiliated with www.skynetweb.com because they have the same >address, including suite number, but it now appears that they are really >affiliated with these guys: > >http://www.affinity.com/about/our_team/our_team.htm > >John I decided to revise the way I phrased this. I should have said that this is a rather prolific home for spammers. I doubt Affinity or its associates are doing much spamming of their own. It does appear that Affinity, et. al., are hosting the page that is accepting information from that javascript. Affinity ought to know who is paying for that site and it seems like law enforcement might be rather interested in that information. John --

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 09 Oct '03

09 Oct '03

On Thu, 09 Oct 2003 14:36:53 -0400, Mike Tancsa wrote: >OrgName: CyberGate, Inc. This is a notorious spam-enabler about which I had a quarrel with AT&T management several years back to get them thrown off the AT&T network. I had to take it to their lawyers since the abuse staff would do nothing. Jeffrey Race

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Dr. Jeffrey Race 09 Oct '03

09 Oct '03

On Thu, 9 Oct 2003 10:28:30 -0700 (PDT), Andy Ellifson wrote: >And as soon as you call law enforcement what happends? The spammer is >located offshore. Then what? This is an easy one. Again, see <http://www.camblab.oom/misc/univ_std.txt>

1 0

RE: Finding ASN from IP address
by Austad, Jay 09 Oct '03

09 Oct '03

There's a tool out there called "tracesroute" (note the "s") that will also provide the AS number of every ip it lists. > -----Original Message----- > From: Suresh Ramasubramanian [mailto:suresh@outblaze.com] > Sent: Thursday, October 09, 2003 12:46 PM > To: Avleen Vig > Cc: nanog(a)merit.edu > Subject: Re: Finding ASN from IP address > > > > Avleen Vig writes on 10/9/2003 10:19 PM: > > > I want to create a mapping of IP addresses to ASN, for a > specific like > > of IP addresses. Eg: > > 1.2.3.4 > > 12.34.56.78 > > > > etc, gathered from my system logs. > > > > What is the best way of doing this? > > Rob Thomas (cymru.com) has something like this - see below. > > -- > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > manager, outblaze.com security and antispam operations > > > > * To: apops(a)apops.net > > * Subject: [apops] New Team Cymru IP2ASN whois server > > * From: Rob Thomas <robt(a)cymru.com> > > * Date: Fri, 26 Sep 2003 01:56:11 -0500 (CDT) > > * List-archive: <http://www.apnic.net/mailing-lists/apops/> > > * List-help: <mailto:apops-request@apops.net?subject=help> > > * List-id: Asia Pacific Operators Forum <apops.apops.net> > > * List-post: <mailto:apops@apops.net> > > * List-subscribe: > <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apop > s-request(a)apops.net?subject=subscribe> > > * List-unsubscribe: > <http://mailman.apnic.net/mailman/listinfo/apops>,<mailto:apop > s-request(a)apops.net?subject=unsubscribe> > > * Sender: apops-admin(a)apops.net > > > > Fellow networkers, > > > > Team Cymru is happy to announce the availability of a public whois > > server dedicated to mapping IP numbers to ASNs, located at > > whois.cymru.com. You can find the link to this tool at: > > > > http://www.cymru.com/BGP/whois.html > > > > This link has been added to our main BGP data page available at: > > > > http://www.cymru.com/BGP/index.html > > > > We have also extended the functionality of this daemon to > support BULK > > IP submissions for those who wish to further optimize their > queries with > > netcat. > > > > Following is a quick overview of how to use it: > > > > $ whois -h whois.cymru.com <IP> > > > > Where <IP> is replaced by the IP you'd like to map, like so: > > > > $ whois -h whois.cymru.com 4.2.2.1 > > ASN | IP | Name > > 3356 | 4.2.2.1 | LEVEL3 Level 3 Communications > > > > You can also include port information, and/or timestamps in your > > queries. Be sure to include quotes around your queries, or > the daemon > > will interpret your request as multiple lines: > > > > $ whois -h whois.cymru.com "4.2.2.1 -0600 GMT" > > ASN | IP | Info | Name > > 3356 | 4.2.2.1 | -0600 GMT | LEVEL3 Level 3 > > Communications > > > > For instructions on how to submit BULK queries via netcat, > simply issue > > the following command: > > > > $ whois -h whois.cymru.com help > > > > We hope you find this tool useful. Stay tuned for more features! > > > > If you have any comments or suggestions as to how we might > improve this > > service, feel free to let us know! > > > > Thanks, > > Rob, for Team Cymru. > > -- > > Rob Thomas > > http://www.cymru.com > > ASSERT(coffee != empty); > > > > > >

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Mike Tancsa 09 Oct '03

09 Oct '03

Looks like attachments wont go through, so I will repost without the attachment. If anyone wants a copy, let me know ---Mike At 01:28 PM 09/10/2003, Andy Ellifson wrote: >Oops... Try this again... > >And as soon as you call law enforcement what happends? The spammer is >located offshore. Then what? Actually, in the case of the wired article (removeform.com) it seems to be connected to a site in Florida. I asked my programmer (gabor(a)sentex.net) to decode the obfuscated java script/page that is served up by one of the zombies (On FreeBSD fetch -B 18192 -o danger.html http://www.removeform.com/d - I got it from 207.5.215.72 at the time). I have attached it as a zip file with its contents. You will note that the form post goes back to form action="http://207.36.47.68/cgi-bin/addinfo.cgi" OrgName: CyberGate, Inc. OrgID: CYBG Address: 3250 W. Commercial Blvd. Suite 200 City: Ft. Lauderdale StateProv: FL PostalCode: 33309 Country: US ---Mike >--- Hank Nussbacher <hank(a)att.net.il> wrote: > > > > On Thu, 9 Oct 2003, Suresh Ramasubramanian wrote: > > > > > * "Follow the money" - find out the spammer / the guy who he spams > > for, > > > from payment information etc.Sic law enforcement on them. > > > > > > srs > > > > I think we can all safely assume that the people behind this are most > > probably on NANOG or reading the archives and are now aware of your > > idea > > :-) > > > > -Hank > >

1 0

Sitefinder and DDoS
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

Let's assume for a moment that Verisign's wildcards and Sitefinder go back into operation. Let's also assume someone sets up a popular webpage with malware HTML causing it, perhaps with a time delay, to issue rapid GETs to deliberately nonexistent domains. What would be the effect on overall Internet traffic patterns if there were one Sitefinder site? (flashback to ARPANET node announcing it had zero cost to any route) How many Sitefinder nodes would we need to avoid massive single-point congestion? AFAIK, the issues of distribution of Sitefinder, and even a formal content distribution network, were not discussed. I asked some general questions that touched on this at the ICANN ISSC committee meeting, but I think they were interpreted as directed toward the reliability of the Sitefinder service in operation, rather than potential vulnerabilities it might create. I am NOT suggesting this simply as an argument against Sitefinder, and I'd like to see engineering analysis of how this vulnerability could be prevented.

2 1

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Gregory Hicks 09 Oct '03

09 Oct '03

> Date: Thu, 9 Oct 2003 10:51:08 -0500 > Subject: Re: Wired mag article on spammers playing traceroute games with trojaned boxes > From: Chris Boyd <cboyd(a)gizmopartners.com> > To: nanog(a)merit.edu > > > > On Thursday, October 9, 2003, at 10:04 AM, Suresh Ramasubramanian > wrote: > > > > > http://www.wired.com/news/business/0,1367,60747,00.html > > > > -- > > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > > manager, outblaze.com security and antispam operations > > > > > > > > I found one of these today, as a matter of fact. The spam was > advertising an anti-spam package, of course. > > The domain name is vano-soft.biz, and looking up the address, I get > > Name: vano-soft.biz > Addresses: 12.252.185.129, 131.220.108.232, 165.166.182.168, > 193.165.6.97 > 12.229.122.9 > > A few minutes later, or from a different nameserver, I get > > Name: vano-soft.biz > Addresses: 131.220.108.232, 165.166.182.168, 193.165.6.97, 12.229.122.9 > 12.252.185.129 > > This is a real Hydra. If everyone on the list looked up vano-soft.biz > and removed the trojaned boxes, would we be able to kill it? This is NOT a hydra. The IP addresses are the same but presented differently. This happens because of THIS setup in DNS: vano-soft.biz. IN A 131.220.108.232 IN A 165.166.182.168 IN A 193.165.6.97 IN A 12.229.122.9 IN A 12.252.185.129 This setup is called "Round-robin" because the name server provides the first IP address FIRST to the first query; the second IP address first to the second query; the third IP address first to the third query; ... to the fifth query. Then it starts over with the first IP Address in response to the sixth query... In each case, ALL IP addresses are provided in response to each query. Yes, the TTL may be a bit low, but it is a workable setup... And no, I am NOT condoning what vano-soft.biz is doing, just trying to explain why, when you checked the first time, you got one answer, and when you checked sometime later, you got a different answer... (Donning flameproof underwear...) Regards, Gregory Hicks ------------------------------------------------------------------- "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Joe St Sauver 09 Oct '03

09 Oct '03

Hi, #I think even if we get all the ones for this domain name today,=20 #assuming we can muster even man hours to get it today, another #5000 will be added tomarrow. Actually, we wrote a little tool to systematically track the dotted quads associated with the vano-soft domain name. We have been seeing a steady stream of new dotted quads advertised for that host, but no where near thousands per day. There have also been some Usenet posts talking about this particular site and the methodology it uses; see: http://groups.google.com/groups?selm= pan.2003.10.03.19.40.44.564854%40frontiernet.net&output=gplain Regards, Joe

1 0