August 2003 - Test - lists.nanog.org

RE: To send or not to send 'virus in email' notifications?
by Wesley Vaux 20 Aug '03

20 Aug '03

Has anyone else gotten hit by this and know how to stop it? the new dats from McAffee have not effect....of course...and I can't find a tool anywhere. Does anyone have any ideas? Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Daniel Senie [mailto:dts@senie.com] Sent: Wednesday, August 20, 2003 12:37 PM To: nanog(a)merit.edu Subject: Re: To send or not to send 'virus in email' notifications? Notifications from virus scanners is backscatter, just the same as the backscatter generated by Smurf attacks. The virus scanners are contributory technology in the conduct of a denial of service attack in exactly the same way as having directed broadcasts enabled on your routers was (read RFC 2644 for the details). Please let's stop building technology that aids in the conduct of DoS attacks.

1 0

Re: virus or hacked?
by Paul A. Bradford 20 Aug '03

20 Aug '03

That was my thought after my initial knee jerk how to fix response. I'm sorry for replying to the list.... Thanks, Paul -- Paul A Bradford Senior Network Engineer Adelphia Cable Communications 814-274-6663

1 0

RE: virus or hacked?
by Chris Todd 20 Aug '03

20 Aug '03

Ok, let me kill this now, To everyone that helped thank you very much.. to others I am sorry for posting off topic. I just now found out the server admin left the server outside the firewall with many open ports. again, thanks for all the help and sorry for the off topic spam. Chris Todd Computer Technician Western Newspapers, Inc. (928)775-2499 Resistance is Futile > ---------- > From: McBurnett, Jim > Sent: Wednesday, August 20, 2003 11:48 AM > To: Todd Mitchell - lists; Chris Todd > Cc: nanog(a)nanog.org > Subject: RE: virus or hacked? > > ->| -----Original Message----- > ->| From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > ->Of > ->| Chris Todd > ->| Sent: Wednesday, August 20, 2003 12:33 PM > ->| To: 'nanog(a)merit.edu' > ->| Subject: virus or hacked? > ->| > ->| > ->| Good morning: > ->| I was wondering if anyone has seen this message on a win2k server > ->before > ->| and > ->| might be able to help me > ->| > ->| Message from destroyer to you on 8/19/2003 11:24:53pm > ->| Make this your last pop-up ever Destroy all these pop-up for a > ->fraction of > ->| the price of our competitors!!! > ->| go to www. messagdestroyer.net > ->| > ->| This is all in a plain windows box(gray box with an ok button at the > ->| bottom > ->| and the X is the upper right corner) > ->| > -> > ->This is a standard Windows messenger (not MSN messenger) spam. If you > ->don't use the Windows messenger service, disable the "messenger" > ->service. SPAM will stop. > -> > ->Todd > > If you have this showing up on a server that is behind a firewall, you > may have a MUCH bigger problem. The access to the messenger service > requires access to a specific port, and this problem normally only > manifests > itslef when the server/workstation is plugged directly into an internet > pipe > with a real world IP on one of it's network cards!!!!! > > If you are not behind a firewall/router of even the linksys family, shame > on you. > If you are behind a firewall... Oh boy, better look for some security > problems!!!! > > later, > J > >

1 0

Re: Hey netscalibur! (was: Re: Hijacked email)
by Christopher Chin 20 Aug '03

20 Aug '03

Today at 18:38 (+0100), Dan Houghton wrote: > Date: Wed, 20 Aug 2003 18:38:43 +0100 > From: Dan Houghton <dan(a)houghton.org.uk> > To: Christopher Chin <cchin(a)ack.Berkeley.EDU> > Cc: nanog(a)merit.edu > Subject: Re: Hey netscalibur! (was: Re: Hijacked email) > > [. . .] > > IP in question is in use by a Netscalibur UK customer. The RIPE whois > record for the IP provides the abuse@ contact details (which is staffed and > dealt with correctly) but also noticed you emailed onto > noc(a)netscalibur.co.uk as well. > > I'll make sure that the NOC staff deal with it and get these stopped. Thanks for the quick response, Dan. It's great to hear that you have alert folks on the other end of both abuse@ and noc@ roles. As with most organizations, we have a fair amount of overlap between queries that arrive at abuse@, security@, and noc@, but we tend to handle operational issues via noc, and abuse@ is mostly for questionable behavior (intentional or otherwise) by our local users. With that in mind, I figured noc@netscalibur would be the more appropriate address. Please do let me know (offline is OK too) if that is not your preference. Thanks, - Christopher

1 0

IDT-Winstar
by Tony Varriale 20 Aug '03

20 Aug '03

Any of you know off the top of your head Winstar's config/policy for a customer wanting to accept customer routes only from a BGP feed? Or, a contact that can respond within a couple of hours would be useful too. I've called their NOC. They have no clue what I am talking about. They said email noc(a)winstar.net. Emailed them. No response...going on 2 days. Checked their website...about as useful as above. Thanks! Tony

1 0

RE: virus or hacked?
by McBurnett, Jim 20 Aug '03

20 Aug '03

->| -----Original Message----- ->| From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf ->Of ->| Chris Todd ->| Sent: Wednesday, August 20, 2003 12:33 PM ->| To: 'nanog(a)merit.edu' ->| Subject: virus or hacked? ->| ->| ->| Good morning: ->| I was wondering if anyone has seen this message on a win2k server ->before ->| and ->| might be able to help me ->| ->| Message from destroyer to you on 8/19/2003 11:24:53pm ->| Make this your last pop-up ever Destroy all these pop-up for a ->fraction of ->| the price of our competitors!!! ->| go to www. messagdestroyer.net ->| ->| This is all in a plain windows box(gray box with an ok button at the ->| bottom ->| and the X is the upper right corner) ->| -> ->This is a standard Windows messenger (not MSN messenger) spam. If you ->don't use the Windows messenger service, disable the "messenger" ->service. SPAM will stop. -> ->Todd If you have this showing up on a server that is behind a firewall, you may have a MUCH bigger problem. The access to the messenger service requires access to a specific port, and this problem normally only manifests itslef when the server/workstation is plugged directly into an internet pipe with a real world IP on one of it's network cards!!!!! If you are not behind a firewall/router of even the linksys family, shame on you. If you are behind a firewall... Oh boy, better look for some security problems!!!! later, J

1 0

Re: virus or hacked?
by Gregory Hicks 20 Aug '03

20 Aug '03

> From: Chris Todd <ctodd(a)westernnews.com> > Date: Wed, 20 Aug 2003 09:32:30 -0700 > > > Good morning: > I was wondering if anyone has seen this message on a win2k server > before and might be able to help me Chris: This is the new spam technique using the windows "admin" pop-up vector. Supposed to be used by an Admin to send messages of some import to all their users on a particular server. That the popup showed up means you have some patching to do as well as some (3 - I think) ports to block on your firewall. See the NANOG archives for more details. Regards, Gregory Hicks > > Message from destroyer to you on 8/19/2003 11:24:53pm > Make this your last pop-up ever Destroy all these pop-up for a fraction of > the price of our competitors!!! > go to www. messagdestroyer.net > > This is all in a plain windows box(gray box with an ok button at the bottom > and the X is the upper right corner) > > Any help or insight would much appreciated!! > > Thanks > Chris Todd > Computer Technician > Western Newspapers, Inc. > (928)775-2499 > > Resistance is Futile --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com Never attribute to malice that which is adequately explained by ignorance or stupidity. Asking the wrong questions is the leading cause of wrong answers "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

Re: To send or not to send 'virus in email' notifications?
by Leo Bicknell 20 Aug '03

20 Aug '03

FWIW In a message written on Wed, Aug 20, 2003 at 10:04:05AM -0700, Steve Thomas wrote: > From: Steve Thomas <nanog(a)sthomas.net> > To: Leo Bicknell <bicknell(a)ufp.org> > Subject: Re: To send or not to send 'virus in email' notifications? [other headers editied] > NO! Some organizations (the company I work for, for instance) use MailScanner on incoming AND outgoing mail. I tried telling this to the person who sent the Postfix regex, but, of course, my mail was rejected. > > MailScanner is a very widely used product, and adding rules/filters like the one above only adds to the problems that the virus author is trying to create. Please forward this to NANOG - I tried subscribing to NANOG-POST, but my subscription request was bounced with "content rejected". Note, unlike the postfix rule his message still made it past spamassassin has he had enough "non-spam" qualities to offset the rule I suggested adding. Please keep in mind there may be legitimate e-mail with these headers if you're going to use rules such have been suggested here. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

1 0

RE: To send or not to send 'virus in email' notifications?
by Claire Kelly 20 Aug '03

20 Aug '03

http://support.microsoft.com/default.aspx?scid=kb;[LN];823980 Cheers, Cade Kelly System/Network Administrator ECONnergy Co. Inc Spring Valley, NY -----Original Message----- From: Wesley Vaux [mailto:Wesley.Vaux@globalknowledge.com] Sent: Wednesday, August 20, 2003 11:58 AM To: 'Stephen J. Wilcox'; Joe Maimon Cc: nanog(a)merit.edu Subject: RE: To send or not to send 'virus in email' notifications? At 10:30:43 my systems rebooted after installing hotfix "Windows 2000 Hotfix KB823980 was installed" and machines rebooted. Any ideas on how to remove this or what it may be? Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] Sent: Wednesday, August 20, 2003 10:33 AM To: Joe Maimon Cc: nanog(a)merit.edu Subject: Re: To send or not to send 'virus in email' notifications? On Wed, 20 Aug 2003, Joe Maimon wrote: > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? well if you dont tell them they wont know, altho with sobig the return address is false anyhow it would probably be best to cache the sender/virus combinations and send a single message per 7 days Steve

1 0

RE: To send or not to send 'virus in email' notifications?
by Wesley Vaux 20 Aug '03

20 Aug '03

At 10:30:43 my systems rebooted after installing hotfix "Windows 2000 Hotfix KB823980 was installed" and machines rebooted. Any ideas on how to remove this or what it may be? Wes Vaux, CCNA, CCDA Network Security Engineer, 9000 Regency Pkwy Ste 500 Cary, NC 27511 t 919.463.6782 f 919.463.1290 Global Knowledge Experts Teaching Experts http://www.globalknowledge.com -----Original Message----- From: Stephen J. Wilcox [mailto:steve@telecomplete.co.uk] Sent: Wednesday, August 20, 2003 10:33 AM To: Joe Maimon Cc: nanog(a)merit.edu Subject: Re: To send or not to send 'virus in email' notifications? On Wed, 20 Aug 2003, Joe Maimon wrote: > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? well if you dont tell them they wont know, altho with sobig the return address is false anyhow it would probably be best to cache the sender/virus combinations and send a single message per 7 days Steve

2 1