August 2003 - Test - lists.nanog.org

RE: To send or not to send 'virus in email' notifications?
by Brandon Butterworth 20 Aug '03

20 Aug '03

> > Considering the amount of email traffic generated by responding to > > forged virus laden email from culprits like sobig should email virus > > scanning systems be configured to send notifications back to > > sender or not? If your scanner doesn't know if a virus forges addresses, and hence no point replying, then bin it and buy a proper one brandon

1 0

RE: To send or not to send 'virus in email' notifications?
by Tomas Daniska 20 Aug '03

20 Aug '03

maybe the AV vendors could suply a 'to mail or not to mail' flag within their databases, based on character of the virus... any of them lurking here? :) -- deejay > -----Original Message----- > From: Matthew Kaufman [mailto:matthew@eeph.com] > Sent: 20. augusta 2003 16:41 > To: 'Joe Maimon'; nanog(a)merit.edu > Subject: RE: To send or not to send 'virus in email' notifications? > > > > Absolutely not. > > SoBig.F, like many others, forges the sender address. That > means that your > notifications: > 1) Don't make it back to the person with the infection > 2) Simply add more clutter to the mailbox of the person > whose address was > used (in addition to all the bounce messages) > > In the enterprise, this is a great argument for scanning > outbound email with > positive identification of whose outbound mail you're scanning. > > Matthew Kaufman > matthew(a)eeph.com > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > Behalf Of Joe Maimon > > Sent: Wednesday, August 20, 2003 7:25 AM > > To: nanog(a)merit.edu > > Subject: To send or not to send 'virus in email' notifications? > > > > > > > > Considering the amount of email traffic generated by responding to > > forged virus laden email from culprits like sobig should > email virus > > scanning systems be configured to send notifications back to > > sender or not? > > > > > > > > > >

2 1

RE: To send or not to send 'virus in email' notifications?
by Mark Segal 20 Aug '03

20 Aug '03

All of "my" bounces are coming from emails that originated from 195.157.87.253... Maybe it's the same guy with others here? Mark Fyi.. netadmin@aaa-01:~> whois -h whois.ripe.net 195.157.87.253 % This is the RIPE Whois server. % The objects are in RPSL format. % % Rights restricted by copyright. % See http://www.ripe.net/ripencc/pub-services/db/copyright.html inetnum: 195.157.70.0 - 195.157.87.255 netname: NSUK-PARTITION-LL descr: Connectivity country: GB admin-c: NSUK2-RIPE tech-c: NSUK1-RIPE status: LIR-PARTITIONED PA remarks: ************************************************************** remarks: * Please do not send abuse reports to tech or admin contacts * remarks: * All abuse reports to abuse(a)netscalibur.co.uk * remarks: ************************************************************** remarks: * This is an partition object and does not represent a valid # remarks: # assignment. Valid assignments have status: ASSIGNED PA # remarks: ############################################################## notify: ripe(a)netscalibur.co.uk mnt-by: NETSCALIBURUK-MNT mnt-lower: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20011025 changed: ripe(a)netscalibur.co.uk 20020110 changed: ripe(a)netscalibur.co.uk 20020514 source: RIPE route: 195.157.0.0/16 descr: Netscalibur UK Ltd origin: AS8272 mnt-by: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20010706 source: RIPE role: Netscalibur UK Hostmaster address: Netscalibur UK Ltd address: 9 Selsdon Way address: Cityharbour address: London E14 9GL address: UK phone: +44 (0)870 887 8800 fax-no: +44 (0)870 887 8867 e-mail: hostmaster(a)netscalibur.co.uk admin-c: CSP3-RIPE admin-c: SY131-RIPE tech-c: NSUK1-RIPE tech-c: NSUK3-RIPE nic-hdl: NSUK2-RIPE remarks: Hostmaster remarks: **** remarks: * All abuse reports to abuse(a)netscalibur.co.uk remarks: **** notify: ripe(a)netscalibur.co.uk mnt-by: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20010712 changed: ripe(a)netscalibur.co.uk 20010731 changed: ripe(a)netscalibur.co.uk 20020109 changed: ripe(a)netscalibur.co.uk 20020116 source: RIPE role: Netscalibur UK NOC address: Netscalibur UK Ltd address: 9 Selsdon Way address: Cityharbour address: London E14 9GL address: UK phone: +44 (0)845 117 2200 fax-no: +44 (0)870 887 8867 e-mail: noc(a)netscalibur.co.uk admin-c: ZP64-RIPE admin-c: DJH8-RIPE tech-c: NSUK2-RIPE tech-c: NSUK3-RIPE nic-hdl: NSUK1-RIPE remarks: Network Operations Center remarks: **** remarks: * All abuse reports to abuse(a)netscalibur.co.uk remarks: **** notify: ripe(a)netscalibur.co.uk mnt-by: NETSCALIBURUK-MNT changed: ripe(a)netscalibur.co.uk 20010711 changed: ripe(a)netscalibur.co.uk 20020116 source: RIPE -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Jim Deleskie [mailto:jdeleski@rci.rogers.com] Sent: August 20, 2003 10:36 AM To: nanog(a)merit.edu Subject: RE: To send or not to send 'virus in email' notifications? Kind of like a statement made @ a security conference I was recently at, 'Hacking from the conference = Dismissal, if you have to ask No you shouldn't' -----Original Message----- From: Gregory Hicks [mailto:ghicks@cadence.com] Sent: Wednesday, August 20, 2003 10:30 AM To: nanog(a)merit.edu; jmaimon(a)ttec.com Subject: Re: To send or not to send 'virus in email' notifications? > Date: Wed, 20 Aug 2003 10:25:28 -0400 > From: Joe Maimon <jmaimon(a)ttec.com> > To: nanog(a)merit.edu > Subject: To send or not to send 'virus in email' notifications? > > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? Not.

1 0

RE: To send or not to send 'virus in email' notifications?
by Jim Deleskie 20 Aug '03

20 Aug '03

Kind of like a statement made @ a security conference I was recently at, 'Hacking from the conference = Dismissal, if you have to ask No you shouldn't' -----Original Message----- From: Gregory Hicks [mailto:ghicks@cadence.com] Sent: Wednesday, August 20, 2003 10:30 AM To: nanog(a)merit.edu; jmaimon(a)ttec.com Subject: Re: To send or not to send 'virus in email' notifications? > Date: Wed, 20 Aug 2003 10:25:28 -0400 > From: Joe Maimon <jmaimon(a)ttec.com> > To: nanog(a)merit.edu > Subject: To send or not to send 'virus in email' notifications? > > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? Not.

1 0

Re: To send or not to send 'virus in email' notifications?
by Gregory Hicks 20 Aug '03

20 Aug '03

> Date: Wed, 20 Aug 2003 10:25:28 -0400 > From: Joe Maimon <jmaimon(a)ttec.com> > To: nanog(a)merit.edu > Subject: To send or not to send 'virus in email' notifications? > > > Considering the amount of email traffic generated by responding to > forged virus laden email from culprits like sobig should email virus > scanning systems be configured to send notifications back to sender or not? Not.

1 0

RE: AT&T US Network Slowdown?
by Sean Crandall 20 Aug '03

20 Aug '03

> > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T > network since 8/18 at around 4pm which is causing a lot of > internet circuits (including DSL) to be inaccessible and/or > appear down from the outside world? AT&T says this has been > escalated to "Level 4" with no ETA and affecting the whole > country. I am seeing this problem in the San Francisco area. > Just wondering if anyone else is experiencing anything that > would confirm AT&T's claim, and fishing for more info about > the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

6 5

Navy Marine Corps Internet hit
by Sean Donelan 20 Aug '03

20 Aug '03

The new EDS managed Navy Marine Corps Intranet with 100,000 users has become so congested by worm traffic it can not be used for useful work today. http://www.nwfusion.com/news/2003/0819navy.html

3 2

Re: Don't beat me, but i've noticed a huge influx of these .pif virii today.
by Steven M. Bellovin 20 Aug '03

20 Aug '03

In message <75634F04BFCFD511BF69009027DC86495C63B5(a)mailman.thenap.com>, Drew We aver writes: > Don't kill me for posting this, it may be slightly off topic but >I have noticed a very odd spike in traffic with these virii that have .pifs >attached to them. > >The subject is random. > >The body always says: > >"See attached file for details" and they're always a pif file. > >Anyone else notice this? Please don't post in html. Anyway -- it's the sobig.f virus. According to http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html it scans a variety of file types on the infected machine to find email addresses to abuse. It's not always a .pif file; sometimes, it's a .scr file. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Why do you use Netflow
by james 20 Aug '03

20 Aug '03

: what sort of tools are you using to interpret netflow, other than cflowd : (which I've found overly complex and not graphical enough) CUGrapher.pl

1 0

Re: Virus emails from nanog mail list
by Steven M. Bellovin 20 Aug '03

20 Aug '03

In message <p05200f04bb680320c606(a)[64.202.132.204]>, David Diaz writes: > >Spam may be off topic but in this case relevant. Has anyone else >noticed bounced emails that appear to have origionated from their >nanog email boxes and contain viruses? > >Obviously some bot has gone threw the nanog list and is now forging >headers such that they appear to come from those addresses, and they >are attaching viruses. > >The IP address (which may or may not be accurate) appears to be >[195.157.87.253]. > >Has anyone else noticed this recently? I've gotten hundreds of such bounce messages today. Only a few have Received: lines, but those have differed. I don't know for sure if it's the nanog list, since I don't use a different email address for it. --Steve Bellovin, http://www.research.att.com/~smb

2 1