August 2003 - Test - lists.nanog.org

RE: How much longer..
by Fred Baker 14 Aug '03

14 Aug '03

At 12:53 PM 8/13/2003 -0500, Ejay Hire wrote: >I don't care what defective operating system a worm uses. Yes. Lets recall that the first worm on the net was a sendmail worm, and attacked UNIX systems. I'm no friend of Windows either, but a little humility is in order. Windows is attacked because it is ubiquitous, not because it is vulnerable. If the whole world ran Linux, the attacks would be on Linux machines.

7 6

dcom worm - curious
by Stephen J. Wilcox 14 Aug '03

14 Aug '03

Got a few emails in with the Mimail worm attached, the thing is who is sending them as these are not email addresses/domain names that I use altho they do exist in some old websites that are still live. Is someone spidering and spamming out this worm or something?? Steve ------------------------- BEGIN HEADERS ----------------------------- Received: from mail-0.telecomplete.net ([193.0.249.4] helo=mail.telecomplete.net) by mx-0.telecomplete.net with esmtp (Exim 4.10) id 19nGAW-0003Gn-00 for rjnr(a)thedogsbollocks.co.uk; Thu, 14 Aug 2003 11:21:24 +0000 Received: from [203.122.2.209] (helo=localhost) by mail.telecomplete.net with smtp (Exim 4.20) id 19nGAH-0005Hi-Tj for rjnr(a)thedogsbollocks.co.uk; Thu, 14 Aug 2003 12:21:14 +0100 From: admin(a)thedogsbollocks.co.uk To: Rjnr <rjnr(a)thedogsbollocks.co.uk> Reply-To: admin(a)thedogsbollocks.co.uk X-Mailer: The Bat! (v1.61) X-Priority: 2 (High) Subject: your account rspdhjri MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------FC242CEF000E8E3" Message-Id: <E19nGAH-0005Hi-Tj(a)mail.telecomplete.net> Date: Thu, 14 Aug 2003 12:21:14 +0100 -------------------------- END HEADERS ------------------------------

1 0

Road runner contact?
by McBurnett, Jim 14 Aug '03

14 Aug '03

Does anyone have a good contact over at Road Runner? I used to have one, but lost it.. Thanks, Jim

1 0

Blaster packet rates
by Pendergrass, Greg 14 Aug '03

14 Aug '03

Hello All, I am trying to get real figures on how much blaster scanning is going on to my network, but I don't have enough information. I am seeing 2200 packets per minute average (for TCP 135, 137-139) on my ingress points. As I'm advertising a /19 that's around .27 RCP and netbios packets per IP address per second being sent to my IP range. I haven't done a long-term look at RCP and netbios traffic on the web so I have no way to determine how much is blaster generated, does anyone have baseline information on the amount of RCP and netbios packets were on the web before blaster was propagated? Alternatively, has anyone worked out the % of blaster scan as opposed to "normal" background RCP and netbios traffic? Thanks, Greg Pendergrass -------------------------------------------------- Network Security Manager Vodafone Global Content Services Vodafone Global Content Services Limited Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN Registered in England No. 4064873 This e-mail is for the addressee(s) only. If you are not an addressee, you must not distribute, disclose, copy, use or rely on this e-mail or its contents, and you must immediately notify the sender and delete this e-mail and all copies from your system. Any unauthorised use may be unlawful. The information contained in this e-mail is confidential and may also be legally privileged.

2 1

Re: How much longer..
by Len Rose 14 Aug '03

14 Aug '03

Hi.. just think if the billions of dollars being spent on M$ products could have been funneled into open source projects. To reinforce the point in the most blunt manner possible: No one had ever better dare postulate that the inherent reason for all of the vulnerabilities in Micro$oft products are due to any special features of note. There is no particular network-enabled feature that Windows has that UNIX didn't implement years before and has done so securely following established internet design standards adopted by the ruling standards body (IETF) after intense study and open participation from all parties who were interested. Now knee-jerk reactions by various network operators is to filter, filter, filter and soon, by the grace of a piece of crap operating system you'll have a much more limited internet to work with because for Micro$oft's sake they've filtered everything. What makes it all ironic is that you can directly thank Micro$oft if the governments decide to pass more draconian laws, even further criminalizing activities which were considered marginally criminal to begin with. Instead of subsidizing the monopoly, keeping sub-standard operating systems alive, they should fine them billions of dollars for the cost of repairing damages, managing overloaded network and system infrastructures (due to the effects of the latest vulnerability). The governments should cease using all Micro$oft products and go back to UNIX which can easily be transformed into a "friendly" operating system for business users (it already has been of course) For the millions of dollars that are spent buying this fake operating system with it's fake applications the government could subsidize development of open software whose quality and security would far exceed that of the closed source garbage that has become "standard" in today's offices. Their operating systems were a joke 10 years ago, and they're still a joke today. The people administering these systems need to start learning UNIX and colleges need to go back to teaching computer science based around a real operating system. It's embarassing for a recent graduate to only know how to point and click while UNIX hackers are unemployed thanks to the disease that is called Micro$oft. Not to mention watching weeks of Micro$oft admins wondering publicly on Full Disclosure (soon to be renamed Microsoft Whining and Crying) what to do about their systems that they can't protect because those systems are rotten to the core with garbage code written by fake programmers who were trained by Universities who use Micro$oft operating systems to teach their curriculum and who are managed by ex-vms programmers (Uncle Bill hired them to write Windows Code) On Wed, Aug 13, 2003 at 11:42:59AM +0000, *Hobbit* wrote: > I often ask the larger question, "how long will it take for millions > of people to realize that having to deal with winbloze has completely > *derailed* their careers for the last ten years, when they could have > been doing so much more productive things on their jobs?" > > But evidently most of them can't think that deep, and get all defensive > about it. > > If all those people had been contributing to free and better replacements > in the linux/bsd/open-source arena, we'd be *so* much farther ahead, > and would have saved countless dollars that are now in Bill's pocket. > > _H*

4 3

RE: How much longer..
by Andrew Staples 13 Aug '03

13 Aug '03

> "McBurnett, Jim" <jmcburnett(a)msmgmt.com> wrote: > > >OK.. > >I have lurked enough on this one.. > >$60 Billion plus for microsoft.. > >and 600 millions lines of code. > >thousands of employee programmers... Brooks' Law (in its various forms) applies to software houses, not open source projects. Since open source (rarely|never) commits to a schedule/deadline, GNU projects accomplish what Microsoft et.al. will never be able to as their products bloat. (for case study consider RH Linux 4.0 in 1996) IMHO, Andrew

1 0

RE: The impending DDoS storm
by McBurnett, Jim 13 Aug '03

13 Aug '03

But doesn't that mean the hacker won? If you change the DNS and a user can not get to windowsupdate, you just helped him create a better DoS than he had... J -----Original Message----- From: Lloyd Taylor [mailto:ltaylor@keynote.com] Sent: Wednesday, August 13, 2003 12:26 PM To: Jack Bates Cc: nanog(a)merit.edu Subject: Re: The impending DDoS storm Does anyone have any notion of what the Blaster worm will do if the DNS lookup for "windowsupdate.com" returns NXDOMAIN? If it handles this case by not sending any micreant love, might that not be the best way to mitigate the potential damage? --Lloyd On Wed, 13 Aug 2003, Jack Bates wrote: > Date: Wed, 13 Aug 2003 11:10:13 -0500 > From: Jack Bates <jbates(a)brightok.net> > To: Jason Frisvold <friz(a)corp.ptd.net> > Cc: "Ingevaldson, Dan (ISS Atlanta)" <dsi(a)iss.net>, > Stephen J. Wilcox <steve(a)telecomplete.co.uk>, nanog(a)merit.edu > Subject: Re: The impending DDoS storm > > > On Wed, 2003-08-13 at 10:55, Ingevaldson, Dan (ISS Atlanta) wrote: > >-Does one DNS lookup on "windowsupdate.com" and then uses the IP > > No, I wouldn't dream of setting windowsupdate.com to 127.0.0.1. Who in > their right mind would do that? > > -Jack > --

3 2

RE: How much longer..
by McBurnett, Jim 13 Aug '03

13 Aug '03

OK.. I have lurked enough on this one.. $60 Billion plus for microsoft.. and 600 millions lines of code. thousands of employee programmers... $1 million for *NIX less than a million lines of code. rewritten on a whim, and source given to millions.. Bugs will be found and squashed easier. Less code, more eyes. and less complex. Less market, less users, less interest for hackers 5 less than statements for *NIX and how many more statements for Micro$oft? This is like trying to comparing the towing capacity of car to turbo diesal pickup. there is no comparison... I don't care if MicroSoft spends $600 Million a year, there will always be bugs. If a software package was perfect or a network was perfect how many of us would have jobs? Nothing in this world is perfect, and complaining about it does absolutely no good.... J -----Original Message----- From: Charles Sprickman [mailto:spork@inch.com] Sent: Wednesday, August 13, 2003 4:30 PM To: Crist Clark Cc: nanog(a)merit.edu Subject: Re: How much longer.. On Wed, 13 Aug 2003, Crist Clark wrote: > Attacks _are_ on Linux machines. There have been Linux worms, Lion attacked > BIND, Ramen attacked rpc.statd and wu-ftpd, Slapper attached Apache, to > name a few. Attacks are on Solaris, the sadmin/IIS worm (which also attacked > IIS, a cross-platform worm, remember that, cool, huh?). Attacks are on FreeBSD, > Scalper worm attacked Apache. > > How soon people seem to forget these things. No, I don't think people are forgetting, but what Len was originally pointing out is that Microsoft, *because* of their vast install base *needs* to take a more proactive role in producing a secure OS. And the reason you can call it a "toy" OS is that on one hand you have *BSD, Linux and friends all with an annual budget of what, maybe $1M? And on the other hand you have a multi-billion dollar *software* company. Which should churn out better software? :) Charles > To pound it home one more time, worms that attack Microsoft products are a > bigger deal only because Microsoft has at least an order of magnitude greater > installbase than the nearest competitor. > -- > Crist J. Clark crist.clark(a)globalstar.com > Globalstar Communications (408) 933-4387 > > The information contained in this e-mail message is confidential, > intended only for the use of the individual or entity named above. > If the reader of this e-mail is not the intended recipient, or the > employee or agent responsible to deliver it to the intended recipient, > you are hereby notified that any review, dissemination, distribution or > copying of this communication is strictly prohibited. If you have > received this e-mail in error, please contact postmaster(a)globalstar.com >

3 2

Genuity/Verizon Online filtering port 135?
by Stephen Milton 13 Aug '03

13 Aug '03

I have some customers using Verizon Online DSL in Washington state, and they are seeing TCP/135 port filtering on their connection. Calls to tech support stated that they were not blocking, but that is tech support. Anyone have a contact at Genuity/Verizon Online network operations? TIA. -- Stephen Milton - Founder/VP Internet (425) 881-8769 x102 ISOMEDIA.COM - Premium Internet Services (425) 869-9437 Fax milton(a)isomedia.com http://www.isomedia.com

1 0

Re: Port blocking last resort in fight against virus
by Steven M. Bellovin 13 Aug '03

13 Aug '03

In message <Pine.GSO.4.53.0308131452310.19594(a)rampart.argfrp.us.uu.net>, "Chris topher L. Morrow" writes: >This is the point, atleast I, have been trying to make for 2 years... end >systems, or as close to that as possible, need to police themselves, the >granularity and filtering capabilities (content filtering even) are >available at that level alone. > It's just not possible. Believe it or not, I don't much like firewalls. But see slide 5 of a talk I gave in May, 1994 (http://www.research.att.com/~smb/talks/firewalls.ps or http://www.research.att.com/~smb/talks/firewalls.pdf) for why we need them. We'll *always* have buggy code. Yes, Microsoft has shipped buggy code. So has everyone else. For fun, I tallied up the source of the responsible vendor for every CERT advisory issued last year or this. There have been 57 of them. 17 were miscellaneous -- other vendors, incidents (like the current worm), etc. 9 were about Sun. 13 were about Microsoft. And 18 were about open source software -- a couple of Apache bugs, some ssh issues, etc. Looking beyond CERT advisories, I recently tallied up how many times someone could have penetrated my machines, and I run them about as tightly as possible. Given problems in ssh, various PDF readers, gv, etc., I tallied about a dozen times I could have been had. Now, that tally is the tip of the iceberg. Microsoft itself had 72 bulletins last year and 31 this year -- there's no doubt that they've shipped awful code (and worse yet, they have an awful architecture from a security perspective). But they're not the only villain, and the open source software implicated runs on most of the open source Unix systems (Linux in its many incarnations, *BSD, etc) and even on some of the proprietary ones. **The purpose a firewall is to keep the hackers away from the buggy code.** Should ISPs filter? Sometimes there's no choice. Note that there are two distinct forms of "network security" problems. The classic type -- the kind firewalls were designed to deal with -- aren't really network security problems. They're host security problems where the network is the conduit. I suspect that ISPs should not filter most such traffic, except with the consent of (and often payment from) the site. (I'll also note that there are designs for doing such filtering on the end systems, though it's easier to block traffic there than to selectively permit it.) The other kind of problem is one that affects the infrastructure. DDoS is the classic example, but worms are another instances where some filtering is often necessary -- not to protect the end users, but to protect the network for everyone else. On this list, I don't have to repeat the full litany problems that worms can cause -- I'm sure many of you remember the clogged ARP caches from Code Red-triggered scans of cable modem routers, or the near-collapse of many networks from Slammer. We're living in an exceedingly imperfect software world. Firewalls and the like are just one form of defense -- but I'll take any defense I can get. --Steve Bellovin, http://www.research.att.com/~smb

2 1