August 2003 - Test - lists.nanog.org

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

What do you want your ISP to block today?
by Sean Donelan 04 Sep '03

04 Sep '03

Which Microsoft protocols should ISP's break today? Microsoft Exchange? Microsoft file sharing? Microsoft Plug & Play? Microsoft SQL/MSDE? Microsoft IIS? It would be so much easier if worm writers followed the RFC's and set the Evil Bit. China has firewalled the entire country, and they have more infected computers than the US. http://www.vnunet.com/Analysis/1143268 > Although companies may have the infrastructure to deal with the current > band of worms, Trojans and viruses, there is currently a line of defence > that is not in place. "The problem isn't Microsoft's products or the > knowledge of the consumer. The problem lies in the ISPs' unwillingness > to make this issue disappear or at least reduce it dramatically," said > Cooper. > He added that ISPs have the view and ability to prevent en-masse > attacks. "All these attacks traverse their networks before they reach > you and me. If they would simply stop attack traffic that has been > identified and accepted as such, we'd all sleep better," Cooper said.

31 73

AT&T NYC
by Bryan Heitman 04 Sep '03

04 Sep '03

Anyone seeing any problems with ATT in new york? Best regards, Bryan Heitman Interland, Inc.

10 11

On the back of other 'security' posts....
by Matthew Sullivan 03 Sep '03

03 Sep '03

Hi All, On the back of the latest round of security related posts, anyone notice the 50% packet loss (as reported to me) across the USA -> NZ links around lunchtime (GMT+10) today? Yet more spoofed traffic aimed at the SORBS nameservers - this time enough to crash a core router of my upstream... Hopefully the commercial damage now may insite people getting damaged by these DDoSes to start proceedings against those ISPs whom continue to show a lack of respobsibility and allow unfiltered spoofed DDoS traffic from their networks. Certainly I have been told to talk to various US authorities about the problem, and will be doing so as soon as I have the nessesary information. In the mean time a plea to people on this list in all countries - watch for the DDoS attacks (particually against 203.15.51.33, 203.15.51.35, 203.15.51.44 & 203.101.254.254) and stop the damn traffic before you are held responsible for your customers actions. There is still a 10k pps SYN flood occuring 8 hours later - this is being rate limited upstream. ..and if the perps are on this list, keep going if you want, the more you do the more likely you'll get caught. You will not force SORBS off the net like you have Osirusoft. I and SORBS will leave when we are good and ready, and not because of some infantile spotty faced 15 year old nerd without a clue on life. / Mat

14 22

Automatic shutdown of infected network connections
by Sean Donelan 03 Sep '03

03 Sep '03

Some universities such as Vanderbilt University are automatically shutting down network ports when they detected signature worm traffic. Almost 25% of the students' computers were detected as infected when they connected to the university network. http://www.vanderbilthustler.com/vnews/display.v/ART/2003/08/29/3f4eb4b3537… How many ISPs disconnect infected computers from the network? Do you leave them connected because they are paying customers, and how else could they download the patch from microsoft?

9 12

Re: Sprint NOC? Are you awake now?
by neal rauhauser 03 Sep '03

03 Sep '03

I didn't know their NOC number, puck.nether.net is down, normal phone channels lead to voicemail jail. Sorry to disturb your morning but its much easier to complete by 0600 than to have five counties worth of users dialing a phone right next to where you're working. Simon Lockhart wrote: > > On Fri Aug 29, 2003 at 04:10:27AM -0500, neal rauhauser wrote: > > I've just upgraded a Cisco 7206 for a customer with a DS3 and we're > > now ready to take full routes. No one is answering at support, email has > > gone unanswered for thirty minutes - if someone at the Sprint NOC is > > awake please call Neal or Mike at 402-426-6136 - we'd really like to get > > this done before customers start waking up ... > > Since when was nanog a way to get in touch with NOCs? > > Simon > -- > Simon Lockhart | Tel: +44 (0)1628 407720 (x37720) | Si fractum > Technology Manager | Fax: +44 (0)1628 407701 (x37701) | non sit, noli > BBC Internet Operations | Email: Simon.Lockhart(a)bbc.co.uk | id reficere > BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK -- mailto:neal@lists.rauhauser.net phone:402-301-9555 "After all that I've been through, you're the only one who matters, you never left me in the dark here on my own" - Widespread Panic

11 20

Hey, QWEST clean up your network
by John Brown 02 Sep '03

02 Sep '03

Seems like QWEST doesn't have any edge ACL's in place to deal with this lovely worm issue. Count Source Prexix, rounded up to a /16 144 208.46.0.0 199 65.114.0.0 347 208.45.0.0 462 65.118.0.0 486 65.119.0.0 702 208.44.0.0 ---- 2340 TOTAL Packets out of 2500 for 2 seconds This is ICMP and TCP MS bad traffic for a 2500 packet capture on a DS1 that is directly connected to Qwest. Ergo, Qwest is the transit provider. Capture period was about 2 seconds. ICK According to Qwest Tech/Noc people they can't leave filters up for more than 1 day. Given that this worm has lasted more than 1 day, I'd think its reasonable to leave filters up for say more than one day ???? The other thing I learned from QWEST IP-NOC was that it seems managment decided *NOT TO* filter packets related to this worm issue at the edge...... john brown AS 10480 and others

7 10

Blaster author identified, about to be arrested...
by JC Dill 02 Sep '03

02 Sep '03

(08-28) 20:31 PDT WASHINGTON (AP) -- The FBI has identified a teenager as the author of a damaging virus-like infection unleashed on the Internet and plans to arrest him early Friday, a U.S. official confirmed Thursday. The 18-year-old, whose name and hometown was not immediately available, was accused of writing one version of the damaging "Blaster" infection, which spread quickly across the Internet weeks ago, the official said, speaking on condition of anonymity. <http://sfgate.com/cgi-bin/article.cgi?file=/news/archive/2003/08/28/nationa…>

7 7

dry pair
by Austad, Jay 02 Sep '03

02 Sep '03

Does anyone know to go about getting Qwest or a CLEC to patch through a dry pair between two buildings connected to the same CO? When I called to order one, no one knew what I was talking about. -jay

8 8

RE: Tier-1 without their own backbone?
by Sean Crandall 01 Sep '03

01 Sep '03

> One of the providers we are looking at is Level-3. Any > comments good/bad on > reliability and clue? We already have UU, Sprint, and AT&T. > I also realize > that the "they suck less" list changes continuously... :) I have about 5 GB of IP transit connections from Level3 across 8 markets (plus using their facilities for our backbone). Level3 has been very solid on the IP transit side. MFN/AboveNet has also been very good to us. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. 6691 Owens Drive Pleasanton, CA 94588 (925) 201-2530 (office) (925) 201-2550 (fax)

23 26