August 2003 - Test - lists.nanog.org

RE: RPC errors
by Austad, Jay 12 Aug '03

12 Aug '03

> We appear to have been infected on a network that is very heavily > firewalled from the outside, and are trying to track down > possibly entry > methods the worm might have had... VPN or dialup? Laptop user that got infected at home and brought his machine into the office? -jay

1 0

RE: Port blocking last resort in fight against virus
by Mark Segal 12 Aug '03

12 Aug '03

Well after my port blocking escapades of yesterday we have got one complaint.. Someone who was selling exchange based mailboxes. So his /26 is now a permit rule in the acl.. But the blocking, has cut down on our infection rate significantly. (I am seeing a lot of inbound, but not a lot of outbound traffic to 135). mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] Sent: August 12, 2003 12:40 PM To: Jack Bates; Mans Nilsson Cc: nanog(a)merit.edu Subject: RE: Port blocking last resort in fight against virus Jack, et al. As a larger than average end user and what could be called a small ISP, I really can not image legitimate traffic on 135.. who in there right mind would pass NB traffic in the wild? I dunno, may it is just that Old military security mindset creeping into my brain housing group. Can someone enlighten me? What is legitimate 136 traffic? J -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Tuesday, August 12, 2003 12:31 PM To: Mans Nilsson Cc: nanog(a)merit.edu Subject: Re: Port blocking last resort in fight against virus Mans Nilsson wrote: > > Your chosen path is a down-turning spiral of kludgey dependencies, > where a host is secure only on some nets, and some nets can't cope > with the load of all administrative filters (some routers tend to take > port-specific filters into slow-path). That way lies madness. > Secure? Who's talking about secure? I'm talking about trash. Not blocking the port with a large group of infected users means that your network sends trash to other people's networks. Those networks may or may not have capacity to mean your network's trash. Temporarily blocking 135 is not about security. A single infection within a local net will infect all vulnerable systems within that local net. A block upstream will not save local networks from cross infecting. However, it does stop your network from sending the trash out to other networks which may have smaller capacities than your network does. Of course, perhaps a good neighbor doesn't really care about other people's networks? Perhaps there is no such thing as a good neighbor. It's kill or be killed, and if those other networks can't take my user's scanning them, then tough! There is legitimate traffic on 135. All users I've talked to have been understanding in a short term block of that port. They used alternative methods. I have a lot of valid traffic still cranking out the other Microsoft ports. -Jack

1 0

MPLS Broadband Wholesale
by Jay Greenberg 12 Aug '03

12 Aug '03

Has anyone on the list had experience wholesaling Broadband Residential Internet access via an MPLS infrastructure? I'm mainly interested in how to address the vrf interfaces that face the residential customers. i.e., if this is a wholesale customer, should the end ISP supply the addressing, default gw, etc, and should DHCP or proxy arp be used? etc etc etc... you get the point (I hope).. Thanks! -- Jason Greenberg, CCIE #11021 <jg(a)execulink.com>

1 0

RE: Port blocking last resort in fight against virus
by Dave Israel 12 Aug '03

12 Aug '03

On 8/12/2003 at 12:40:19 -0400, McBurnett, Jim said: > who in there right mind would pass NB traffic in the wild? That's the problem; not all customers are in their right mind. All they know is that it was working yesterday, and not today, because you blocked a port. The question of port blocking for most sizable ISPs comes down to principle vs principle. One the one hand, you have the principle of network invisibility. You agreed to pass customer traffic, not pass judgement on it. If it's a valid IP packet, you'll deliver it. And you don't slow down or stop traffic because you're spending cycles examining packets.* That's what customers expect. On the other hand, you have the principle of being a good network citizen. You try to keep your tables clean and your peers from flapping. You accept valid routes and inform your peers when you get invalid ones, so they have a chance to fix them. You are properly embarrassed when you find a spammer on your network or your name on the CIDR report. And you don't spew other people's networks with worm traffic. That is what other providers expect. Port blocking is therefore a quandry: do you stick with your customer principle, or your provider principle? I think most of us weigh the damage of the attack vs the damage of losing the port, and make individual judgement calls. It would be nice if there were some central consensus on when to block ports; then individual providers wouldn't need to take abuse from customers or other networks when their judgement wasn't exactly the same as somebody else's. -Dave * Before the holy war starts, yeah, some hardware doesn't slow down when blocking ports, and this is only an issue if your hardware isn't that breed. My point is that this might be an issue for some hardware, and that "Buy vendor X" isn't really a solution for everyone.

2 1

RE: RPC errors
by Mark Segal 12 Aug '03

12 Aug '03

I just put an access list on one of our cores with some spare cpu cycles.. And 10% of the traffic looks like port 135 calls..... Anyone else see this? Did I break anything legitimate? Also I still some Slammer traffic.. Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: August 11, 2003 6:19 PM To: 'Drew Weaver' Cc: 'nanog(a)merit.edu' Subject: RE: RPC errors According to Symantec it doesn't know if the system has already been infected until it is running on the target machine, at which point the RPC crash is imminent. It shouldn't re-infect, but further attempts from other infected hosts will cause random reboots. On the plus side this one will be much easier to clean up than CodeRed, Nimda, etc. Random J. Clueless might actually look for patches if his box is rebooting on a regular basis. -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Monday, August 11, 2003 2:53 PM To: 'Mike Damm' Cc: 'nanog(a)merit.edu' Subject: RE: RPC errors Its bloody gorgeous too, my girlfriend's pc rebooted like 9 times, apparently the worm doesn't check to see if its already infected. -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: Monday, August 11, 2003 5:27 PM To: 'Jack Bates'; NANOG Subject: RE: RPC errors The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

5 5

Packeteer stuff?
by Drew Weaver 12 Aug '03

12 Aug '03

Specifically talking about the PacketSeeker 6500 Is it worth the money? Or are there better ways to get centralized views of network metrics? -Drew

1 0

RE: Packeteer stuff?
by Austad, Jay 12 Aug '03

12 Aug '03

If you're looking at the Packeteer to put some limits in place based on protocol, you can take a look at Cisco's NBAR, which is supported in IOS. What kind of metrics are you looking for? Netflow type info? How fat is the pipe you want to monitor/manipulate? -jay -----Original Message----- From: Drew Weaver [mailto:drew.weaver@thenap.com] Sent: Tuesday, August 12, 2003 9:47 AM To: 'nanog(a)merit.edu' Subject: Packeteer stuff? Specifically talking about the PacketSeeker 6500 Is it worth the money? Or are there better ways to get centralized views of network metrics? -Drew

1 0

FW: What the heck is this msblast.exe
by Drew Weaver 12 Aug '03

12 Aug '03

The real injustice is the 15k program someone sent to sec-focus that you type in an IP address and it returns a command prompt on the target machine (eek). -Drew -----Original Message----- From: Rod Trent [mailto:rodtrent@yahoo.com] Sent: Monday, August 11, 2003 6:45 PM To: Lee_Fisher(a)NAI.com; morris_minchu(a)iwon.com; focus-ms(a)securityfocus.com Subject: RE: What the heck is this msblast.exe Medium???? That's an irresponsible rating, considering that both MS and the Department of Homeland Security have listed the vulnerability as critical. -----Original Message----- From: Lee_Fisher(a)NAI.com [mailto:Lee_Fisher@NAI.com] Sent: Monday, August 11, 2003 6:27 PM To: morris_minchu(a)iwon.com; focus-ms(a)securityfocus.com Subject: RE: What the heck is this msblast.exe >From your description I would imagine it to be the Blaster ( We called it W32/Lovsan.worm ) Many posts on forums - We list it as a Medium On Watch alert - other AV orgs have a similar classification. http://vil.nai.com/vil/content/v_100547.htm Lee Fisher Solutions Architect McAfee Product Management -----Original Message----- From: Minchu Mo To: focus-ms(a)securityfocus.com Sent: 11/08/03 15:00 Subject: What the heck is this msblast.exe The code resides in c:\winnt\system32. It somehow change my registry and pretend to be Window autoupdate in \Localsystem\software\microsoft\window\run, so it can run when I boot the machine. Now it sending out packet to random(?)IP 's endpoint port ------------------------------------------------------------------------ --- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms ------------------------------------------------------------------------ --- --------------------------------------------------------------------------- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms --------------------------------------------------------------------------- --------------------------------------------------------------------------- Your network firewall and IDS products do not prevent Web application attacks - the most common form of online exploitation- resulting in Web defacement, data theft, sabotage and fraud. KaVaDo is the only company that provides a complete suite of Web application security products. Download a FREE whitepaper on "Security Policy Automation for Web Applications":http://www.securityfocus.com/Kavado-focus-ms ---------------------------------------------------------------------------

1 0

Gigabit Media Converter
by Vincent J. Bono 12 Aug '03

12 Aug '03

Anyone out ther ever see or hear tell of a device that will let you run two GBICs back to back wthout an associated switch and all the trimmings? Application is to convert a CWDM GBIC signal to a Multimode one. TIA, Vin

6 9

RE: RPC errors
by Sean Crandall 12 Aug '03

12 Aug '03

This worm is amazing. I have only had filters in place for about 4.5 hours and I am already approaching 100 million matches for the deny tcp/135 across my network. Of that, only one customer has said that they needed 135 open for legimate use (probably more, but I have only heard from the one). Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA (925) 201-2530 > -----Original Message----- > From: McBurnett, Jim [mailto:jmcburnett@msmgmt.com] > Sent: Monday, August 11, 2003 7:45 PM > To: John Palmer; nanog(a)merit.edu > Subject: RE: RPC errors > > > > over 24 hours.. started block suday afternoon... > deny tcp any any eq 445 log (256936 matches) > deny udp any any eq 445 log (1 match) > deny tcp any any eq 135 (6984433 matches) > deny udp any any eq 135 (147654 matches) > deny udp any any eq netbios-ss > deny tcp any any eq 139 log (378289 matches) > > -----Original Message----- > From: John Palmer [mailto:nanog@adns.net] > Sent: Monday, August 11, 2003 8:28 PM > To: nanog(a)merit.edu > Subject: Re: RPC errors > > > > > 45 seconds: > > deny tcp any any eq 135 (5445 matches) > deny tcp any any eq 137 > deny tcp any any eq 138 > deny tcp any any eq 139 > deny tcp any any eq 445 (207 matches) > > ----- Original Message ----- > From: "Randy Bush" <randy(a)psg.com> > To: <nanog(a)merit.edu> > Sent: Monday, August 11, 2003 18:52 > Subject: Re: RPC errors > > > > > > must be fun out there on the net today. one minute of counter > > accumulation > > > > deny tcp any any eq 135 (5721 matches) > > deny tcp any any eq 137 > > deny tcp any any eq 138 > > deny tcp any any eq 139 (17 matches) > > deny tcp any any eq 445 (1137 matches) > > > > randy > > > > > > >

2 1