October 2004 - Test - lists.nanog.org

Re: BCP38 making it work, solving problems
by J. Oquendo 10 Oct '04

10 Oct '04

> I have received complaints from people about NOT being able to spoof > packets. <moronicy> Technical Support: "This is CompanyX, how can I help you?" 31337kiddi0t: "wHy c0m3 3ye c4nt sp0of?!$!*@" </moronicy> With all of the different standards which tend to add confusion, too much time seems to be going to waste drafting them while networks and businesses suffer from what's currently in place. From my perspective if someone mentioned this to me via complaints their account would be cancelled immediately since there is no benefit to sending out spoofed packets. "But it's a pen test audit!" Even in situations where a security admin needed to test certain elements an aware admin would find a way to get around doing what they had to do. Blocking elements such as SMTP do have its place and I'm sure most know this is not the "definitive" solution nothing more than patch work but it still has its advantages. The same way spammers can adapt, so should an engineer be able to for those who would like to contest the notion that one would be making "smarter idiots" who send spam and create malice. I've been digging more into RFC's in hopes of learning more from a technical perspective for my own sake and to date, all I've seen is more of less patchwork. Instead of reinventing the wheel as the old saying goes, sometimes a patch can get you moving on a flat tire. Sure it is a temporary solution, but it is a solution. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "There is no greater mistake than the hasty conclusion that opinions are worthless because they are badly argued." -- T.H. Huxley

1 0

looking for an urgent contact at ucsd.edu (138.23.0.0/16)
by Gadi Evron 10 Oct '04

10 Oct '04

Thanks for your help, sorry for the OT post. Gadi Evron.

1 1

Re: short Botnet list and Cashing in on DoS
by Paul Vixie 09 Oct '04

09 Oct '04

someone who wished to remain publically unnamed answered me by saying: > I got chastized a little while ago, too, for a single post, and told that > it was my THIRD warning (having not received any at all before). Feh. i can't think of anyone among all nanog posters since the beginning of time who has not deserved to be smacked around at least once by our erstwhile moderator for saying something on a dead thread or speaking offtopically. i'm up to two warnings, and i think it's a lifetime quota not subject to annual resets (in other words it's three, ever, not three in the last year). it's really improved my thought processes. if i weren't about to say something operationally relevant, i'd already have deleted this without sending it. quality control for crowds is hard; for engineers, also hard; for crowds of engineers, i can't imagine a way it can be accomplished, yet here we all are. so, i'd written: > > 2. Filter aggressively. Run a dark-net, and if one of your customers... > ^^^^^^^^ my nameless friend then asked me: > this sounds intrigueing, but I'm not sure what it is. Is is sort of an > internal honeypot NETWORK? it goes by several names. network telescope, darknet, etc. i called it a darknet above only because rob thomas calls it that, and he'd recently given a talk at the dns-oarc members meeting on this precise topic. yes, it's like a honeypot in some ways (but robt probably winced just now, as he read me saying that.) most of rob's talk is echoed by his web site <http://www.cymru.com/Darknet/index.html>, which is a good read. my own "darknet"-like project is wired up to a database that can answer questions like "what are the worst 25 sources of undesireable smtp since the last time i reset the database?" today's answer is: smtpk=> select * from top25_bysrc; src | howmany | earliest | latest -----------------+---------+----------------------+---------------------- 61.73.48.141 | 47650 | 03-AUG-2004 08:44:23 | 09-AUG-2004 22:03:55 61.73.49.56 | 39435 | 01-AUG-2004 18:53:03 | 02-AUG-2004 21:10:34 61.73.48.63 | 26938 | 21-JUL-2004 11:52:11 | 21-JUL-2004 12:12:39 210.244.26.120 | 17057 | 27-MAY-2004 04:42:33 | 27-MAY-2004 07:59:56 211.74.62.25 | 12674 | 26-MAY-2004 14:43:47 | 26-MAY-2004 15:31:58 61.73.20.220 | 12092 | 30-JUL-2004 13:43:55 | 31-JUL-2004 07:19:54 220.116.198.64 | 9576 | 05-AUG-2004 15:49:08 | 07-AUG-2004 00:01:31 61.73.49.21 | 9206 | 03-AUG-2004 19:57:01 | 04-AUG-2004 19:32:54 210.68.127.235 | 8367 | 26-MAY-2004 15:32:27 | 26-MAY-2004 16:47:56 222.101.168.37 | 8098 | 05-JUL-2004 03:55:37 | 31-JUL-2004 07:13:08 211.218.2.20 | 6410 | 06-AUG-2004 18:25:05 | 06-AUG-2004 18:51:45 222.117.215.23 | 5698 | 14-JUL-2004 03:56:23 | 18-JUL-2004 05:46:06 61.73.96.158 | 5516 | 06-AUG-2004 20:10:57 | 06-AUG-2004 20:27:48 220.116.197.49 | 5314 | 02-AUG-2004 15:10:37 | 02-AUG-2004 15:19:10 222.101.168.33 | 5066 | 22-JUN-2004 02:00:29 | 16-JUL-2004 13:11:30 211.218.3.167 | 4318 | 30-JUL-2004 12:36:05 | 30-JUL-2004 12:39:07 220.116.196.199 | 4301 | 04-AUG-2004 12:53:26 | 04-AUG-2004 16:23:08 222.117.216.15 | 4072 | 19-JUN-2004 14:16:52 | 22-JUN-2004 13:54:15 61.38.47.221 | 3777 | 04-JUL-2004 14:52:32 | 04-JUL-2004 21:49:40 211.218.5.224 | 3706 | 23-JUL-2004 12:22:55 | 23-JUL-2004 12:25:30 222.117.215.192 | 3624 | 15-JUN-2004 09:55:21 | 15-JUN-2004 14:33:42 222.117.216.112 | 3454 | 20-JUN-2004 19:24:13 | 21-JUN-2004 04:51:15 222.117.215.186 | 3418 | 18-JUN-2004 00:53:58 | 18-JUN-2004 20:46:21 211.218.2.125 | 3387 | 05-AUG-2004 09:28:24 | 05-AUG-2004 20:06:48 218.8.231.25 | 2996 | 16-AUG-2003 03:13:05 | 16-AUG-2003 21:28:31 (25 rows) caida's "network telescope" is also quite interesting. i see some 2001 work located at <http://www.caida.org/outreach/papers/2001/BackScatter/>. see also <http://www.nanog.org/mtg-0110/greene.html>. running an smtp listener in "darkspace" and wiring it to dynamic dns has resulted in a private-only dynamic blackhole list that now stops more spam than any other single public list i subscribe to... and some days more than all of them combined. (so you see, the venture capitalists and politicians were right after all -- there's all kinds of useful information out there, and great advantages available to anyone who can aggregate it in paranormal ways. but i digress.)

1 0

Re: short Botnet list and Cashing in on DoS
by Gadi Evron 09 Oct '04

09 Oct '04

From a recent email I gather this is very off-topic, so I will try to be brief in my reply. > (Geneva.CH.EU.*) since 3+ years. I can say from my experiences I couldn't > make any kind of communication between botnets and spam. Most Trojan codes I > have looked into doesn't have any command/action to make users send spam > emails and such however they try infecting others by different ways that > port 25 can't avoid. Short answer: Many of the infected systems have more Trojan horses installed than the original infecting agent. Many Trojan horses have spam-sending or relaying capabilities.. or even just anonymity capabilities or ID theft/DDoS options. Thing is, there are always more options that can be later installed. As to you not seeing them.. I suppose it's as simple as you not seeing enough of them.. count your blessings. Gadi.

1 0

Re: short Botnet list and Cashing in on DoS
by Paul Vixie 09 Oct '04

09 Oct '04

i was recently chastised for posting non-operational content to nanog, and so, while i am willing to beat the drum for source address validation, i'm very concerned about commenting further in what has to be the 40th or 50th version of this thread in the last ten years. with trepidation, then: > > there are many ways of sending spam that dont use port 25.. > > True, but reducing spam from millions to thousands seems like something > good, no? no. (thanks for asking.) that's not good. network abuse is a very strong economic force -- whether it's spam, ddos-for-hire, or whatever. blocking port 25 will make legitimate smtp permanently hard to use, while making non- legitimate smtp temporarily hard to use. if i learned anything at MAPS, it was that taking actions which merely harden, toughen, and educate spammers is counter-productive. good counteractivity must be recombinant, not just reactive. short term effectiveness is completely irrelevant, and not "good." > > individual rules are costly to implement and users wont use a service > > where you have to pay more for basic services > > Several big ISP's are blocking port 25 now. I believe this will catch. had this been done in 1998 when the anti-spam community first warned about it, then a lot of good could have been done. but network abuse takes many more forms than smtp delivery now. stopping outbound tcp/25 won't make any notable difference to a network's support costs, by the end of the year. on the other hand, source address validation would make a notable difference in support costs, by the end of the first quarter after it was deployed. > It limits the amount of junk coming out from their users, and the usage of > their tubes. no. blocking outbound tcp/25 would not have that effect. doing BCP38 would. > I doubt even 0.001% of dynamic range Cable/DSL users will ever call to ask > for port 25 to be opened. > > This is something ISP's can implement, and it works. if you define "works" very narrowly, perhaps as "causes the next wave of abuse coming from your network to not be in the form of outbound tcp/25", then i'd have to agree. but i don't define "works" that way since it will just shift costs toward the following months, after the attackers retune for their reduced capability (perhaps by inventing some new capabilities). -------- i have a suggestion. if you're going to propose some method of curbing network abuse, which operates at something other than the IP layer, then please find a different forum. also, read vjs's "you might be" article. and when you're educated as to what's been tried and what's been done, and you find a forum where your proposal will be found interesting, then please cast your proposal in the following terms: "we implemented source address validation toward our customers as described in BCP38, and it wasn't good enough, so we did $X as well, and it had benefit $Y and cost $Z". (cc me!)

1 0

Re: short Botnet list and Cashing in on DoS
by Fergie (Paul Ferguson) 09 Oct '04

09 Oct '04

Which reminds me -- this is only one of the issues that appeared om the "SANS Top 20 Internet Vulnerabilities": http://www.sans.org/top20/ - ferg -- "J. Oquendo" <sil(a)politrix.org> wrote: Most ISP's wouldn't have to deal with this problem if corporations took the time to release better products. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

FW: House Toughens Spyware Penalties
by Nicole 08 Oct '04

08 Oct '04

It all reads ok until the latter part... shudder... Nicole -----FW: <200410081600530249.000E013B(a)mail.themezz.com>----- Date: Fri, 08 Oct 2004 16:00:53 -0400 Sender: cybercrime-alerts-bounce(a)freelists.org From: cybercrime-alerts <alerts(a)theMezz.com> To: cybercrime-alerts(a)freelists.org Subject: House Toughens Spyware Penalties October 8, 2004 House Toughens Spyware Penalties http://www.internetnews.com/bus-news/article.php/3419211 For the second time in three days, the U.S. House of Representatives has passed an anti-spyware bill, this time adding criminal penalties to tough civil provisions of legislation passed on Tuesday. The Internet Spyware Prevention Act of 2004 (H.R. 4661), which passed on a 415-0 vote Thursday, makes it a crime to intentionally access a computer without authorization or to intentionally exceed authorized access. If the unauthorized intrusion is to further another federal crime such as secretly accessing personal data, the penalty is up to five years in prison. Deliberately injuring or defrauding a person or damaging a computer through the unauthorized installation of spyware carry prison terms of up to two years. The legislation also authorizes $10 million for the Department of Justice to combat spyware and phishing (define) scams, although the bill does not specifically make phishing a crime. "By imposing criminal penalties on these bad actors, this legislation will help deter the use of spyware, and will thus help protect consumers from these aggressive attacks," Rep. Bob Goodlatte (R-VA), the bill's author, said in a statement. "At the same time, the legislation leaves the door open for innovative technology developments to continue to combat spyware programs." Tuesday night, the House passed legislation prohibiting unfair or deceptive practices related to spyware. The bill, known as the Spy Act (H.R. 2929), also requires an opt-in notice and consent form for legal software that collects personally identifiable information from consumers. The penalties in H.R. 2929 are limited to civil fines of up to $3 million. Both bills now go the Senate, which has pending legislation similar to the House bills. House Energy and Commerce Committee Chairman Joe Barton (R-Texas) said earlier this week he thought the two chambers could agree on a spyware bill before lawmakers adjourn on Friday or Saturday. "[We've] seen several egregious examples of spyware being used in ways that most Americans would think clearly ought to be criminal," Ari Schwartz, associate director of the Center for Democracy and Technology, said in another statement. "The bill will help make sure there are strong deterrents to using spyware to defraud or injure consumers." The two House bills are supported by a broad array of trade groups, including the U.S. Chamber of Commerce and the Business Software Alliance (BSA). "This anti-spyware legislation ensures that criminal penalties are imposed upon those persons who aim to harm innocent Internet users via spyware applications," said Robert Holleyman, president and CEO of the BSA. Dell (Quote, Chart), eBay (Quote, Chart)>, Microsoft (Quote, Chart), Time Warner (Quote, Chart), Yahoo (Quote, Chart) and Earthlink (Quote, Chart) endorsed the Tuesday legislation. They did so after exemptions were added to the bill for network monitoring for security purposes, technical support or repair, or the detection or prevention of fraudulent activities. The bill also permits computer software providers to interact with a user's computer without notice and consent in order to determine whether the computer user is authorized to use the software upon initialization of the software or an update of the software. "Every day thousands of unsuspecting Americans have their identities hijacked by a new breed of cyber criminals because of spyware. People whose identities have been stolen can spend months or years -- and much of their hard-earned money -- trying to restore their good name and credit record. This legislation will help prevent bad things from happening to good names," Rep. Lamar Smith (R-Texas) said. -- Articles distributed for the purposes of education, discussion and review. Archives and Subscription Updates: http://cybercrime.theMezz.com Guestbook: http://guestbook.theMezz.com PGP Key: http://pgp.theMezz.com --------------End of forwarded message------------------------- -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" - Politicaly Correct UNIX Page Opportunity is missed by most people because it is dressed in overalls and looks like work. - Thomas Edison "Microsoft isn't evil, they just make really crappy operating systems." - Linus Torvalds If you want to go backwards, you put it in 'R,' and if you want to go forward, you put it in 'D' -- Sen. Tom Harkin (D-IA)

5 5

Is there an email admin from RR.COM out there?
by Jeff Wheeler 08 Oct '04

08 Oct '04

Not sure how applicable to NANOG this is, but the below thread has started on another list that I am on, and I thought someone listening here from RR.COM might be able to help. If you think you can assist or at least want to find out more about these issues, please contact me off list and I'll get you in touch with those effected. -- Jeff Wheeler Postmaster, Network Admin US Institute of Peace Begin forwarded message: > From: Mitchell Kahn > Date: October 8, 2004 3:06:22 PM EDT > To: "CommuniGate Pro Discussions" > Subject: Re: blocked for too many messages? > > It sounds as if your difficulties are actually worse than mine. Thanks > for letting me know that I am in good company. > > Mitch > > On Oct 8, 2004, at 11:44 AM, eLists wrote: > >> Hello, >> >> I too have had my emails to any rr.com server rejected as well. I >> also checked my IP address at this senderbase page and funny how a >> ranking of 10 equates to all internet email, and with my server >> sending out about 2000 emails a day, I have a rating of 2.3? >> >> Seems something is rather messed up with both senderbase and rr (not >> surprising that rr is messed up). >> >> In the past few days, my server has only attempted to send about 20 >> emails to rr.com servers. Yet all of mine are also blocked. Like you, >> my IP is not in any lists. >> >> Mitchell Kahn wrote: >>> One of our clients received the following messaged when her e-mail >>> was bounced: >>> Failed to deliver to 'islandfamily(a)hawaii.rr.com' >>> SMTP module(domain hawaii.rr.com) reports: >>> host orngca-01.mgw.rr.com says: >>> 452 Too many recipients received this hour. Please see our rate >>> limit >>> policy at http://security.rr.com/spam.htm#ratelimit >>> I went to the page listed to try to understand why her e-mail was >>> rejected but this is incongruent with the facts as I understand >>> them. I checked our logs and there was only one attempt in the last >>> two days to send mail to this domain. My server does not appear on >>> any of the spam lists that they show (see below), we have a static >>> IP address on the server, and we don't have any open relays. This >>> Road Runner process appears to render e-mail useless as a >>> communication tool if this is the future of spam filtering. I >>> contacted the ISP that bounced the mail but I have not had a >>> response. (I wonder if my contact mail was bounced.) >>> Is anyone else familiar with this experience? Does anyone know of a >>> way around it? >>> Thanks, >>> Mitch_ > > Mitchell Kahn

2 1

Anyone from Hotmail listening?
by Drew Linsalata 08 Oct '04

08 Oct '04

If anyone responsible at Hotmail is listening, please email me off list. We have an issue that needs some work, and the usual channels are getting us nowhere. Thanks. -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

1 0

MED and community fluctuation
by Zhen Wu 08 Oct '04

08 Oct '04

I understand the usage and application of MED and community attributes. But we watch some interesting policy/attribute fluctuation of MED and community. We analyze BGP updates sent out by RouteViews peers. We observed a lot of AADupType2 instabilities. We define AADupType2 event as: A route is implicitly withdrawn and replaced with a duplicate of the original route. The two messages have the same NEXTHOP and ASPATH attribute, but differ between at least one other attribute (like MED). Note that we only pair two updates from the same RouteViews' peer / neighboring AS. A fine-grained analysis revealed that most AADupType2 instabilities just change the MED or community attribute (or both), which means that MED and community values associated with prefixes are changing dynamically and frequently. We are not claiming it is a common practice of the Internet, this is just the cases observed from RouteViews peers. We are thinking of the motivation of doing this? Why the ISPs configured their network so that the MED values oscillate? Did ISPs configure MED values dynamically calculated from IGP metrics? The most strange thing to us is why the community attribute associated with prefixes also oscillate frequently. We know that community are used to simply operational complexity: group a set of prefixes to apply the same policy. It didn't make sense to me to change it dynamically. Misconfigurations? Any comments or discussions? Thanks! Zhen Wu

2 2