May 2004 - Test - lists.nanog.org

Worms versus Bots
by Sean Donelan 04 May '04

04 May '04

The antivirus vendors are bemoaning the fact the Sasser worm has been slow to spread. On the other hand, most of the vulnerable computers seem to have already been taken over by one or more Bots days or weeks before the worms arrived. Other than the obvious, don't let a bot on get on your computer in the first place, are there any opinions about the best anti-bot tools for naive computer users? The major virus vendors seem to be having a bit of trouble dealing with bots, frequently recommending manual editing of files and use of regedit. There is also a much longer delay between the apperance of a new bot and updates to antivirus packages.

8 9

RE: Worms versus Bots
by Eric Krichbaum 04 May '04

04 May '04

True, but this isn't just an XP issue. Look at how many ppl are still infected with Code Red/Nimda/Slammer/etc. A Windows 2000 box doesn't fair any better. Heck, I still see Happy99. Eric -----Original Message----- From: Buhrmaster, Gary [mailto:gtb@slac.stanford.edu] Sent: Monday, May 03, 2004 11:28 PM To: Eric Krichbaum; nanog(a)merit.edu Subject: RE: Worms versus Bots Microsoft has said Windows XP SP2 will have the firewall turned on by default, and that they have "considered" reissuing the installation CD's such that a new installation will have the firewall enabled to deal with just this problem. I do not know the current state of the consideration, but to me it seems reasonable that Microsoft should at least make the offer of a new CD (to anyone who has a valid XP license key?) No, many people will not request a new CD, but then many people never apply patches either. I think this is a horse and water problem. Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > Of Eric Krichbaum > Sent: Monday, May 03, 2004 8:13 PM > To: nanog(a)merit.edu > Subject: FW: Worms versus Bots > > > I see times more typically in the 5 - 10 second range to infection. > As a test, I unprotected a machine this morning on a single T1 to get > a sample. 8 seconds. If you can get in 20 minutes of downloads > you're luckier than most. > > Eric > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf > Of william(at)elan.net > Sent: Monday, May 03, 2004 11:49 PM > To: Sean Donelan > Cc: Rob Thomas; NANOG > Subject: Re: Worms versus Bots > > > On Mon, 3 May 2004, Sean Donelan wrote: > > > On Mon, 3 May 2004, Rob Thomas wrote: > > > ] Just because a machine has a bot/worm/virus that didn't > come with > > > a ] rootkit, doesn't mean that someone else hasn't had their way > with it. > > > > > > Agreed. > > > > Won't help. What's the first thing people do after > re-installing the > > operating system (still have all the original CDs and keys > and product > > > activation codes and and and)? Connect to the Internet to > download the > > > patches. Time to download patches 60+ minutes. > > Time to infection 5 minutes. > > Its possible its a problem on dialup, but in our ISP office I setup > new win2000 servers and first thing I do is download all the patches. > I've yet to see the server get infected in the 20-30 minutes it takes > to finish it > (Note: I also disable IIS just in case until everything is patched..). > > Similarly when settting up computers for several of my relatives (all > have dsl) I've yet to see any infection before all updates are > installed. > > Additional to that many users have dsl router or similar device and > many such beasts will provide NATed ip block and act like a firewall > not allowing outside servers to actually connect to your home > computer. > On this point it would be really interested to see what percentage of > users actually have these routers and if decreasing speed of > infections by new virus (is there real numbers to show it decreased?) > have anything to do with this rather then people being more carefull > and using antivirus. > > Another option if you're really afraid of infection is to setup proxy > that only allows access to microsoft ip block that contains windows > update servers > > And of course, there is an even BETTER OPTION then all the above - > STOP USING WINDOWS and switch to Linux or Free(Mac)BSD ! :) > > > Patches are Microsoft's > > intellectual property and can not be distributed by anyone without > > Microsoft's permission. > I don't think this is quite true. Microsoft makes available all > patches as indidual .exe files. There are quite many of these updates > and its really a pain to actually get all of them and install updates > manually. > But I've never seen written anywhere that I can not download these > .exe files and distribute it inside your company or to your friends as > needed to fix the problems these patches are designed for. > > > The problem with Bots is they aren't always active. That > makes them > > difficult to find until they do something. > As opposed to what, viruses? > Not at all! Many viruses have period wjhen they are active and > afterwards they go into "sleep" mode and will not active until some > other date! > > Additionally bot that does not immediatly become active is good thing > because of you do weekly or monthly audits (any many do it like that) > you may well find it this way and deal with it at your own time, > rather then all over a sudden being awaken 3am and having to clean up > infected system. > > -- > William Leibzon > Elan Networks > william(a)elan.net > > >

1 0

FW: Worms versus Bots
by Eric Krichbaum 04 May '04

04 May '04

I see times more typically in the 5 - 10 second range to infection. As a test, I unprotected a machine this morning on a single T1 to get a sample. 8 seconds. If you can get in 20 minutes of downloads you're luckier than most. Eric -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of william(at)elan.net Sent: Monday, May 03, 2004 11:49 PM To: Sean Donelan Cc: Rob Thomas; NANOG Subject: Re: Worms versus Bots On Mon, 3 May 2004, Sean Donelan wrote: > On Mon, 3 May 2004, Rob Thomas wrote: > > ] Just because a machine has a bot/worm/virus that didn't come with > > a ] rootkit, doesn't mean that someone else hasn't had their way with it. > > > > Agreed. > > Won't help. What's the first thing people do after re-installing the > operating system (still have all the original CDs and keys and product > activation codes and and and)? Connect to the Internet to download the > patches. Time to download patches 60+ minutes. > Time to infection 5 minutes. Its possible its a problem on dialup, but in our ISP office I setup new win2000 servers and first thing I do is download all the patches. I've yet to see the server get infected in the 20-30 minutes it takes to finish it (Note: I also disable IIS just in case until everything is patched..). Similarly when settting up computers for several of my relatives (all have dsl) I've yet to see any infection before all updates are installed. Additional to that many users have dsl router or similar device and many such beasts will provide NATed ip block and act like a firewall not allowing outside servers to actually connect to your home computer. On this point it would be really interested to see what percentage of users actually have these routers and if decreasing speed of infections by new virus (is there real numbers to show it decreased?) have anything to do with this rather then people being more carefull and using antivirus. Another option if you're really afraid of infection is to setup proxy that only allows access to microsoft ip block that contains windows update servers And of course, there is an even BETTER OPTION then all the above - STOP USING WINDOWS and switch to Linux or Free(Mac)BSD ! :) > Patches are Microsoft's > intellectual property and can not be distributed by anyone without > Microsoft's permission. I don't think this is quite true. Microsoft makes available all patches as indidual .exe files. There are quite many of these updates and its really a pain to actually get all of them and install updates manually. But I've never seen written anywhere that I can not download these .exe files and distribute it inside your company or to your friends as needed to fix the problems these patches are designed for. > The problem with Bots is they aren't always active. That makes them > difficult to find until they do something. As opposed to what, viruses? Not at all! Many viruses have period wjhen they are active and afterwards they go into "sleep" mode and will not active until some other date! Additionally bot that does not immediatly become active is good thing because of you do weekly or monthly audits (any many do it like that) you may well find it this way and deal with it at your own time, rather then all over a sudden being awaken 3am and having to clean up infected system. -- William Leibzon Elan Networks william(a)elan.net

2 1

RE: Worms versus Bots
by Buhrmaster, Gary 03 May '04

03 May '04

Microsoft has said Windows XP SP2 will have the firewall turned on by default, and that they have "considered" reissuing the installation CD's such that a new installation will have the firewall enabled to deal with just this problem. I do not know the current state of the consideration, but to me it seems reasonable that Microsoft should at least make the offer of a new CD (to anyone who has a valid XP license key?) No, many people will not request a new CD, but then many people never apply patches either. I think this is a horse and water problem. Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Eric Krichbaum > Sent: Monday, May 03, 2004 8:13 PM > To: nanog(a)merit.edu > Subject: FW: Worms versus Bots > > > I see times more typically in the 5 - 10 second range to > infection. As > a test, I unprotected a machine this morning on a single T1 to get a > sample. 8 seconds. If you can get in 20 minutes of downloads you're > luckier than most. > > Eric > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of > william(at)elan.net > Sent: Monday, May 03, 2004 11:49 PM > To: Sean Donelan > Cc: Rob Thomas; NANOG > Subject: Re: Worms versus Bots > > > On Mon, 3 May 2004, Sean Donelan wrote: > > > On Mon, 3 May 2004, Rob Thomas wrote: > > > ] Just because a machine has a bot/worm/virus that didn't > come with > > > a ] rootkit, doesn't mean that someone else hasn't had their way > with it. > > > > > > Agreed. > > > > Won't help. What's the first thing people do after > re-installing the > > operating system (still have all the original CDs and keys > and product > > > activation codes and and and)? Connect to the Internet to > download the > > > patches. Time to download patches 60+ minutes. > > Time to infection 5 minutes. > > Its possible its a problem on dialup, but in our ISP office I > setup new > win2000 servers and first thing I do is download all the patches. I've > yet to see the server get infected in the 20-30 minutes it takes to > finish it > (Note: I also disable IIS just in case until everything is > patched..). > > Similarly when settting up computers for several of my relatives (all > have dsl) I've yet to see any infection before all updates are > installed. > > Additional to that many users have dsl router or similar > device and many > such beasts will provide NATed ip block and act like a firewall not > allowing outside servers to actually connect to your home computer. > On this point it would be really interested to see what percentage of > users actually have these routers and if decreasing speed of > infections > by new virus (is there real numbers to show it decreased?) > have anything > to do with this rather then people being more carefull and using > antivirus. > > Another option if you're really afraid of infection is to setup proxy > that only allows access to microsoft ip block that contains windows > update servers > > And of course, there is an even BETTER OPTION then all the > above - STOP > USING WINDOWS and switch to Linux or Free(Mac)BSD ! :) > > > Patches are Microsoft's > > intellectual property and can not be distributed by anyone without > > Microsoft's permission. > I don't think this is quite true. Microsoft makes available > all patches > as indidual .exe files. There are quite many of these updates and its > really a pain to actually get all of them and install updates > manually. > But I've never seen written anywhere that I can not download > these .exe > files and distribute it inside your company or to your > friends as needed > to fix the problems these patches are designed for. > > > The problem with Bots is they aren't always active. That > makes them > > difficult to find until they do something. > As opposed to what, viruses? > Not at all! Many viruses have period wjhen they are active and > afterwards they go into "sleep" mode and will not active until some > other date! > > Additionally bot that does not immediatly become active is good thing > because of you do weekly or monthly audits (any many do it like that) > you may well find it this way and deal with it at your own > time, rather > then all over a sudden being awaken 3am and having to clean > up infected > system. > > -- > William Leibzon > Elan Networks > william(a)elan.net > > >

1 0

Don't forget physical security: Network Card Theft Causes Internet Outage
by Sean Donelan 03 May '04

03 May '04

Network Card Theft Causes Internet Outage May 3, 2004 By Sean Gallagher A handful of corporate customers were left without e-mail and Internet access Monday after the theft of networking equipment from a New York City office late Sunday. Law enforcement officials said four DS-3 cards were reported missing from a Manhattan co-location facility owned by Verizon Communications Inc. The theft at 240 E. 38th St. occurred just after 10:30 p.m. on Sunday and is being investigated by New York City Police and members of the joint terrorism task force, according to NYPD spokesman Lt. Brian Burke. http://www.eweek.com/article2/0,1759,1583359,00.asp

1 0

Re: Infrastructure Mapping Project Website
by sgorman1＠gmu.edu 03 May '04

03 May '04

Yup - on April 20th I passed my defense and I'll be walking May 15th. The committee agreed the dissertation was worth while, that is just four people, but I ain't complaining. "Now Supposedly" Dr. Gorman ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Monday, May 3, 2004 1:55 pm Subject: Re: Infrastructure Mapping Project Website > On Mon, 3 May 2004 sgorman1(a)gmu.edu wrote: > > If the work looks helpful to > > anyone or if you have an feedback please pass it along. > > But what everyone wants to know: Did the school finally decide to > awardyou a degree for your work? > > >

1 0

Infrastructure Mapping Project Website
by sgorman1＠gmu.edu 03 May '04

03 May '04

Hi Everyone, We have a website up for our infrastructure mapping project here at George Mason that might be of interest to some of the folks on the list: http://policy.gmu.edu/imp/ Also I though we would add our little take from the thread a while back that asked if our maps showed the 2003 blackout. While is is hard to show a cascade or predict a blackout I think the maps do point out some structural vulnerability where the cascade started: http://policy.gmu.edu/imp/research.html (Map #6) If the work looks helpful to anyone or if you have an feedback please pass it along. best, sean

2 1

routing between AOL and 217.21.144.0/20
by Anand Buddhdev 03 May '04

03 May '04

Hi, I'm having trouble sending packets to AOL from the network 217.21.144.0/20. I've tried to contact AOL at the address "routepolicy(a)aol.net" which I found from the RADB database, but my email bounced! Are there any engineers from AOL on this list would could contact me to try and resolve this issue? Regards, -- Anand Buddhdev

1 1

Netlantis tools when are they returning ???
by Henry Linneweh 03 May '04

03 May '04

I miss this essential toolset now that I do not have it -Henry

2 1

RE: Mexico City Internet Bandwidth suggestions
by Paul Jasa 03 May '04

03 May '04

Thanks, Brian, for your response. If we were to take a rough poll, which one of the two, Alestra or Avantel, would get the prize for highest uptime/availability? I'll call both and check them out, just curious how you'd rank them. Thanks again for helping me find these!! Paul ====================================== Paul Jasa Network Engineer Univision Communications, Inc. 305-470-8072 DNOC 305-992-6220 Mobile 305-471-1539 Desk 786-264-3384 Fax ====================================== -----Original Message----- From: Brian Moore [mailto:bmoore@amungus.org] Sent: Thursday, April 29, 2004 09:38 PM To: Paul Jasa Cc: nanog(a)merit.edu Subject: Re: Mexico City Internet Bandwidth suggestions Importance: High > I was curious if anyone could share any suggestions and experiences > with providers of internet bandwidth ranging from T1 to OC3 in Mexico City. > Telmex is the obvious in-house Mexico monopoly, but was wondering if > there were any other legitimate, competitive providers in the game > over there. Alestra (affiliated in some way with AT&T), and Avantel (affiliated in some way with Worldcom) gave us reasonable pricing (reasonable for Mexico City anyway) on E3/T3 solutions. A couple years ago they were peered with Telmex in Monterrey I think, which was acceptable given the difference in pricing (Telmex and GBLX were both *much* costlier). We got an uplink to both and run bgp. It's been fairly solid. When one's down, the other's up :) Brian The information contained in this e-mail and any attached documents may be privileged, confidential and protected from disclosure. If you are not the intended recipient you may not read, copy, distribute or use this information. If you have received this communication in error, please notify the sender immediately by replying to this message and then delete it from your system.

2 1