August 2003 - Test - lists.nanog.org

Re: WANTED: ISPs with DDoS defense solutions
by Vadim Antonov 02 Aug '03

02 Aug '03

On Sat, 2 Aug 2003, Doug Hughes wrote: > > Besides, firewalls only protect against outsiders, whereas most damaging > > attacks are from insiders. ^^^^^^^^^^^^^ > ^^^^^^^^^^^^^^^^^^^^^^^^^ > Do you have current data to support this? I believe this may have been > true 5 years ago but is no longer true. No, just my experience from working for the last 4 years in the security field (banking, insurance, government & US Army :) > Is this a case of distinguishing damaging vs non-damaging? Yes. External attacks are mostly show-offs by kids. Insiders intend to do damage - that's the whole point of those attacks. > At my company, > all recent attacks that I'm aware of have been from outside. Even if > I allow for the fact that I'm not aware of all attacks Internal attacks are rarely ever discovered because attackers have benefit of knowledge of the actual systems and can plan the execution, not just improvise (and trip detectors). Besides, intrusion detectors are mostly designed to detect footprints of the external attackers. > ... the mere volume of ones that I'm aware of would stand as > counterpoint to the assertion that most damaging attacks are from > insiders. Certainly, insiders have the 'potential' to generate the > most damaging attacks with greatest ease, but I'm not sure that > establishes a causal relationship with occurrence. You are right that it does not; I'm afraid nobody has real figures because these kinds of attacks are rarely reported even if discovered. BTW, taking an unauthorized copy of company's sources when leaving company IS an attack... how common is that? > Certainly the volume of attacks is strongly disproportional towards > the outsider. Yep. Automated scanning lets attackers to pick easy targets; thouse attacks are rarely targeted. --vadim

2 1

RE: New or existing virus/vulnerability in Windows software?
by Dan Lockwood 02 Aug '03

02 Aug '03

Rob was kind enough to look into my problem and found it to be a bot which is spread via TCP 139. No big alarm. Thanks to all! Dan -----Original Message----- From: Dan Lockwood Sent: Saturday, August 02, 2003 12:59 To: NANOG Subject: New or existing virus/vulnerability in Windows software? Everyone, We are having fits with a new? virus or vulnerability. The simptoms are as follows: an executable saatg.exe "appears" in the startup folder of the All Users group and after a reboot launches itself. It adds a registry entry under HKEY_LOCAL_MACHINE/Software/Microsoft/CurrentVersion/Run. The executable shows under processes and seems to also launch additional processes, e.g. ~1.exe, ~2.exe, ~3.exe, etc. I can not link any malicious activity to this behavior, but it seems to be spreading like wildfire on our network, apparantely with absolutely no user activity. In testing I have do thus far it finds its was on to a _virgin_ system that has been installed disconnected from the network with CD media including all relevent security patches. Panda anti-virus does not seem to detect it either. It shows up on systems where there is no interactive login, e.g. servers, regular users, and users with elevated privelages. Additionally once the executable is active is systematically searches for other systems to share the good news with on port TCP 135. I am aware of the recent vulnerabilities from Microsoft regarding RPC and netbios, but again, the recommended security fixes do not seem to provide any relief. Does anyone have any insight into what this thing is? TIA Dan Lockwood

1 0

RE: New or existing virus/vulnerability in Windows software?
by Dan Lockwood 02 Aug '03

02 Aug '03

-----Original Message----- From: Dan Lockwood Sent: Saturday, August 02, 2003 12:59 To: NANOG Subject: New or existing virus/vulnerability in Windows software? Everyone, We are having fits with a new? virus or vulnerability. The simptoms are as follows: an executable saatg.exe "appears" in the startup folder of the All Users group and after a reboot launches itself. It adds a registry entry under HKEY_LOCAL_MACHINE/Software/Microsoft/CurrentVersion/Run. The executable shows under processes and seems to also launch additional processes, e.g. ~1.exe, ~2.exe, ~3.exe, etc. I can not link any malicious activity to this behavior, but it seems to be spreading like wildfire on our network, apparantely with absolutely no user activity. In testing I have do thus far it finds its was on to a _virgin_ system that has been installed disconnected from the network with CD media including all relevent security patches. Panda anti-virus does not seem to detect it either. It shows up on systems where there is no interactive login, e.g. servers, regular users, and users with elevated privelages. Additionally once the executable is active is systematically searches for other systems to share the good news with on port TCP 135. I am aware of the recent vulnerabilities from Microsoft regarding RPC and netbios, but again, the recommended security fixes do not seem to provide any relief. Does anyone have any insight into what this thing is? TIA Dan Lockwood

1 0

RE: North America not interested in IP V6
by Irwin Lazar 02 Aug '03

02 Aug '03

> -----Original Message----- > From: Michel Py [mailto:michel@arneill-py.sacramento.ca.us] > Sent: Thursday, July 31, 2003 12:16 PM > To: Jeroen Massar > Cc: nanog(a)merit.edu > Subject: RE: North America not interested in IP V6 > > > Jeroen Massar wrote: > > It has a timeline (slides 47-50) showing the US falling behind > > for at least 3 years... come on US show what you are good for :) > > Show me where there is money to make with IPv6 first :-) > There are some > exceptions, but here v6 is somehow like ISDN: I Still Don't Need. > > Michel. > Christian Huitema of Microsoft presented on IPv6 at our Catalyst conference last month. He noted that Microsoft had a very difficult time creating xBox live due to issues with IPv4/NAT, which is one of the reasons they are pushing for IPv6 as the basis for future collaborative/peer-to-peer applications (for example, 3degrees). I believe Sony is also IPv6 enabling their products for the same reason. For these services to truly scale you've got be able to have true peer-to-peer computing. Right now, I'm not able to directly connect to my neighbor's computer to play a game if we are both on home LANs. I'm not able to directly connect to my PC at home when I'm on the road. I can't accept incoming phone calls to my netmeeting client without static configuration of my NAT gateway (same for an IP softphone). It would be a configuration nightmare to get four Vonage phones each with their own phone number. Christian provided a wonderful demonstration of a future interactive video application that would be difficult to scale if proxy/NAT services got in the way. There are lots of things that just don't work, and lots of opportunities for making money with IPv6. My own personal opinion is that over the next 5-10 year everything will come out of the box with IPv6 capabilities, making it fairly straightforward to turn on. I doubt we'll see much acceptance in the enterprise space before then, but there are significant opportunities to bring additional services into the home and serve those on home networks if we can eliminate NAT. As one person noted in response to Christian's speech. If there is no addressing shortage, why do I have to pay $75 a month for a DSL connection with a static IP address when a floating IP address only costs me $40 per month? Just my .02c irwin

8 16

New or existing virus/vulnerability in Windows software?
by Dan Lockwood 02 Aug '03

02 Aug '03

Everyone, We are having fits with a new? virus or vulnerability. The simptoms are as follows: an executable saatg.exe "appears" in the startup folder of the All Users group and after a reboot launches itself. It adds a registry entry under HKEY_LOCAL_MACHINE/Software/Microsoft/CurrentVersion/Run. The executable shows under processes and seems to also launch additional processes, e.g. ~1.exe, ~2.exe, ~3.exe, etc. I can not link any malicious activity to this behavior, but it seems to be spreading like wildfire on our network, apparantely with absolutely no user activity. In testing I have do thus far it finds its was on to a _virgin_ system that has been installed disconnected from the network with CD media including all relevent security patches. Panda anti-virus does not seem to detect it either. It shows up on systems where there is no interactive login, e.g. servers, regular users, and users with elevated privelages. Additionally once the executable is active is systematically searches for other systems to share the good news with on port TCP 135. I am aware of the recent vulnerabilities from Microsoft regarding RPC and netbios, but again, the recommended security fixes do not seem to provide any relief. Does anyone have any insight into what this thing is? TIA Dan Lockwood

1 0

RE: Blocking port 135?
by Michel Py 02 Aug '03

02 Aug '03

> Sean Donelan wrote: > As someone else pointed out, if you want the ISP to provide you > with a completely "safe" network you will end up with something > like Minitel. Note that the Minitel itself had many backdoors (not all of them being blocked by servers) and has not been safe for years; the issue is somehow comparable: The {app|minitel} has built-in vulnerabilities {crummy code|hidden control codes}. Those of us that participated in the early days of it still remember that when you wanted to get rid of someone in a chat room all you had to do was to private a message containing <esc>:f<ctrl-c><esc>9g Michel.

1 0

RE: Blocking port 135?
by Drew Weaver 01 Aug '03

01 Aug '03

Im pretty sure the Shavlik products require the RPC ports for people to use HFNETCHK LE and stuff like that, and a lot of our co-lo customers use that to keep their win boxes up to date, which I think is great because that's one less abuse email I have to reply to ;-) -Drew -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Friday, August 01, 2003 9:32 PM To: Sean Donelan Cc: nanog(a)merit.edu Subject: Re: Blocking port 135? Sean Donelan wrote: > free/cheap software firewalls that > are easy and effective to use. And breaks all kinds of nifty things which ISP has to pay for via helpdesk support. -Jack

1 0

RE: Microsoft.com attack?
by Jason Frisvold 01 Aug '03

01 Aug '03

On Fri, 2003-08-01 at 22:16, Matt Ploessel wrote: > http://www.microsoft.com/homepage/features/2003/denialofservice.htm Cool... thanks for the info... Hopefully I'll be able to gather any information I can from our infected machine here and forward it on to the proper authorities... Anyone got a contact for the "good guys" ?? :) Thanks! -- --------------------------- Jason H. Frisvold Backbone Engineering Supervisor Penteledata Engineering friz(a)corp.ptd.net RedHat Certified - RHCE # 807302349405893 MySQL Core Certified - ID# 205982910 --------------------------- "Something mysterious is formed, born in the silent void. Waiting alone and unmoving, it is at once still and yet in constant motion. It is the source of all programs. I do not know its name, so I will call it the Tao of Programming."

1 0

The irony.. (Re: Blocking port 135?)
by Len Rose 01 Aug '03

01 Aug '03

Who would have thought ten years ago that Microsoft and it's poorly written software would have been responsible for the advent of protocol filtering throughout the net. To those who want to filter everything, please make sure you state those policies all over your company web site so people desiring a "real" conneciton can avoid you. If you even filter only at the very edge you should make it optional as a "value-added" service.

1 0

RE: Microsoft.com attack?
by Dennis Wong 01 Aug '03

01 Aug '03

defcon? -----Original Message----- From: Adam Maloney [mailto:adamm@sihope.com] Sent: Friday, August 01, 2003 2:05 PM To: Jason Frisvold Cc: nanog(a)merit.edu Subject: Re: Microsoft.com attack? Yeah, seeing the same here - it's been flaky for us for the last 30 minutes while we've been trying it. I wonder if it's related to this messages.zip / admin@ thing that's all over the place today. I was just thinking the other day, wouldn't it be funny if there was a worm that had infected machines attack windowsupdate.microsoft.com so you couldn't patch? :) I haven't confirmed that this is the problem, but it seems likely. Adam Maloney Systems Administrator Sihope Communications On Fri, 1 Aug 2003, Jason Frisvold wrote: > Anyone aware of an attack on www.microsoft.com? I had a customer > machine that was attacking it, looks like either a bug in Microsoft's > SP4 (coincidentally this started the day after this was installed) or > there's some new(?) worm of some sort causing this ?? > > Thanks! > > -- > --------------------------- > Jason H. Frisvold > Backbone Engineering Supervisor > Penteledata Engineering > friz(a)corp.ptd.net > RedHat Engineer - RHCE # 807302349405893 > Cisco Certified - CCNA # CSCO10151622 > MySQL Core Certified - ID# 205982910 > --------------------------- > "Imagination is more important than knowledge. > Knowledge is limited. Imagination encircles > the world." > -- Albert Einstein [1879-1955] >

1 0