April 2004 - Test - lists.nanog.org

Cr/Hackers Strike Advanced Computing Networks
by Sean Donelan 13 Apr '04

13 Apr '04

This was covered in the Washington Post, but the real information is on Stanford's web site. http://securecomputing.stanford.edu/alerts/multiple-unix-6apr2004.html

1 0

RE: Lazy network operators
by Eric Krichbaum 13 Apr '04

13 Apr '04

We do that here, and I agree it should be a standard practice from the dialup/broadband/etc. provider standpoint. Aren't some of the newer malware/viri using the SMTP setting out of the email client to send through now to get around that anyway? It really shouldn't matter though. I'd rather be: a.) blocking the port 25 traffic and b.) virus scanning the outbound mail, than dealing with the thousands of "Your user tried to hack my system. I'm calling the FBI on you." messages. Eric -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of John Curran Sent: Tuesday, April 13, 2004 3:53 PM To: Stephen J. Wilcox Cc: nanog(a)merit.edu Subject: Re: Lazy network operators At 8:39 PM +0100 4/13/04, Stephen J. Wilcox wrote: >Most of the spam I'm seeing comes directly from end user hosts that >have either an open proxy on them or some kind of malware with its own >SMTP engine designed to send out junk.. in this model the only port 25 >traffic is that from the end host coming outwards, I believe you're >suggestion is to filter port 25 towards hosts. > >Even blocking the outbound 25 traffic (eg pushing it via the ISP SMTP >relay) will not stop the emails. It is possible to extend this and >implement some sort of statistical sanity checking on the mail being >relayed (eg alarm/deny mail once it exceeds X/minute/host) which is potentially a workable solution. Steve, I'm very much suggesting blocking outward to the Internet port 25 traffic, except from configured mail relays for that end-user site. Those hosts which have MSTP malware are stopped cold as a result. /John

1 0

Dialin access in USA, off list
by frank＠try-us.de 13 Apr '04

13 Apr '04

Hello nanog, our company is looking for dialin web-access on a call by call basis in North-America (USA, Mexico, Canada)via ISDN or analog modem. Please contact me off list and thank you for your assistence -- Best regards, Frank Kuempel mailto:frank@try-us.de If it's there and you can see it - it's REAL If it's there and you can't see it - it's TRANSPARENT If it's not there and you can see it - it's VIRTUAL If it's not there and you can't see it - it's GONE

1 0

Computer room A/C
by Christopher J. Wolff 13 Apr '04

13 Apr '04

Hello, If anyone can recommend a dealer of surplus computer room/industrial AC equipment please have them mail me offlist. Thank you very much for your assistance. Regards, Christopher J. Wolff, VP CIO Broadband Laboratories, Inc. http://www.bblabs.com

1 0

Postmaster, hostmaster etc....
by McBurnett, Jim 12 Apr '04

12 Apr '04

All, My company has a large # of "divisions", each with their own domain. Currently we are maintaining hostmaster, webmaster, postmaster, security, and abuse accounts for nearly all domains. After our recent testing of some new spam filtering software, I am really wondering about the operational necessity of all these addresses. (total of about 200 or so) What is truly required? Our IP whois lists where we truly answer problems. But we still review all the others. Our spam software shows 98% of all email to the RFC accounts is spam. So what will we have to deal with if we did discontinue those addresses for all but 1 of our domains. how do some ISP's handle it? You host hundreds or thousands of domains. most with no webmaster etc... does it matter for the "small company" domain? Comments appreciated on or off list... Summary will be posted back to list..... thanks, Jim

7 6

curious
by Scott Stursa 12 Apr '04

12 Apr '04

Two (possibly related?) phenomena: 1. Nothing from NANOG since yesterday. 2. .org TLD names not resolving Maybe a local (to here) problem, but I thought I'd inquire before I start looking into it. ------------------------------------------------------------------------ Scott L. Stursa 850/644-2591 Network Security Officer stursa(a)acns.fsu.edu Academic Computing and Network Services Florida State University Modern cyberspace is a deadly, festering swamp, teeming with dangerous programs such as "viruses," "worms," "Trojan horses" and "licensed Microsoft software" that can take over your computer and render it useless. - Dave Barry

3 2

Cox Communications Network/NOC
by Chris Neitzert 12 Apr '04

12 Apr '04

Anyone from Cox Communications Network or NOC on the list? Please contact me directly. Thanks Chris

1 0

The spyware that loved me
by Sean Donelan 12 Apr '04

12 Apr '04

John Borland, a reporter for CNET News.com, made the mistake of loading some software on a Windows machine and hoping it was possible to restore the trustworthiness of a compromised Windows machine. In the end the CNET IT department took his computer away and re-installed a fresh image. http://news.com.com/2010-1032-5187106.html If even well-informed people do this, and can't fix their systems, what hope is there for the typical Internet user?

2 1

looking for cisco person in regards to completewhois
by william(at)elan.net 12 Apr '04

12 Apr '04

If there is somebody from Cisco on this list who has been accessing completewhois port 43 whois service with thousands of consequitive queries for last few days (or possibly somebody else from cisco who can lookup in your gateway/firewall logs to see it was) then please contact me for private arrangements if you don't want your 171.70.81.70 (nachinat.cisco.com) ip permanently banned. -- William Leibzon Elan Networks william(a)elan.net

2 1

RE: Postmaster, hostmaster etc....
by McBurnett, Jim 12 Apr '04

12 Apr '04

Summary (in no particular order, well almost ;) 1. Sure do it, We will list you on RFC Ignorant, will you give me your domain list and save me some time? 2. Forward to the holder of the domain, bouncing webmaster and listing contacts on website in reply. 3. All Abuse to go to one account, disable none. 4. Consolidate, consolidate consolidate 5. Webmaster to client, postmaster to support, abuse to abuse with CC to client 6. Drop them, the smart user will do a lookup to the IP owner via whois. 7. RFC 2142 says you should have them. 8. Single accounts and SPAM filter the dickens out of it.. Ok, So this is the result we will work from: ALL Postmaster will go to a single mailbox called postmaster Webmaster will go to IT and remote office staff. Hostmaster like postmaster. Security like postmaster Abuse like postmaster. IP whois update to say other addresses. SPAM filter set to Stun plus 5, With spam summaries sent to staff once daily containing subject line, and from address, and option to view / unspam. Thanks to all that responded..... Later, Jim

1 0