July 2004 - Test - lists.nanog.org

RE: xDSL hardware
by Michel Py 14 Jul '04

14 Jul '04

> Charles Sprickman wrote: > I found an ADSL card (WIC-1ADSL), but Covad is unable > to tell us if this works with their dslams or not. I doubt it would, as the WIC-1ADSL does only ADSL, not SDSL and all the Covad I have seen so far is SDSL. However, there is a Single Port G.shdsl WAN Interface Card (WIC-1SHDSL-V2), the question is does Covad use G.SHDSL or old-style proprietary SDSL. There are some low-end Cisco routers such as the 828 that do G.SHDSL as well. I don't get why you need to be aware of the link status though, as the SDSL is your backup not your primary. If the SDSL was the primary and the backup was dial-on-demand ISDN I would understand, but not with a T1. Michel.

2 1

RE: Spyware becomes increasingly malicious
by Brian Battle 13 Jul '04

13 Jul '04

William Warren wrote: >not all the variants are that easy..how about doing a google on >coolwebsearch..scumware.com has a good writeup as well as >spywareinfo.com...the newer variants are not that easy.... I second that. The version I saw required a third party registry editor and booting up into the recovery console from an XP cd (safe mode didn't cut it) just to remove a hidden dll. Had it not been for the forums out there at http://forums.spywareinfo.com and the cwsshredder, which got most, but not all, of the cruft installed by this piece of bastard software, my grandmother's computer would still be popping up those tens of pages of garbage randomly. The authors of these coolwebsearch variants are extremely intelligent programmers with far more understanding of the bowels of the windows platform than your average script kiddies. If you get hit with the version I saw, it's no 10 minute piece of cake. What I don't understand is how exploiting bugs in a program (internet explorer) to install software without the consent or even acknowledgement from the owner/user is legal behavior. To me, it's just like someone abusing a bug in bind, and installing a rootkit, which last time I checked, could end up getting someone in legal troubles. For another hastily-thought-out analogy, it's like someone breaking into your house and reprogramming your cable box to keep changing the channel to the home shopping club every 30 seconds. -Brian

3 2

RE: Spyware becomes increasingly malicious
by Hannigan, Martin 13 Jul '04

13 Jul '04

This appears to have been dealt with at the browser level in MS Security Bulletin MS03-011. I have a hard time blaming MS for everything since in most cases of these things they do react. How do they force the users to update? Could they implement a switch that says "no update, no working browser"? At least for IE? Scob was dealt with via the hammer, this could be too. There's 39 variants at the moment: http://www.spywareinfo.com/~merijn/cwschronicles.html The difficulty in cleaning is due to the variants: http://www.spywareinfo.com/~merijn/cwschronicles.html#cwshredder Disclaimer: That site "looks/feels" credible, but I did just a little correlation. Thanks. ARIN: The IP number for their website is allocated to cogent, but not SWIP'd. Apparent last mile: 16 p6-0.core01.jfk02.atlas.cogentco.com (66.28.4.82) 107.092 ms 104.713 ms 107.080 ms 17 p5-0.core01.jfk01.atlas.cogentco.com (66.28.4.9) 108.177 ms 108.023 ms 109.115 ms 18 g49.ba01.b001362-1.jfk01.atlas.cogentco.com (66.28.66.42) 106.147 ms 105.769 ms 109.537 ms 19 HyperSpace_Communications.demarc.cogentco.com (66.250.5.30) 110.872 ms 108.745 ms 106.978 ms 20 66.250.74.150 (66.250.74.150) 107.939 ms 108.364 ms 104.599 ms Apparent Registration: domain: coolwebsearch.com status: production organization: InterWeb Solutions Inc owner: InterWeb Solutions Inc email: admin(a)iweb-commerce.com address: P.O. Box 362 address: Road Town city: Tortola postal-code: 65113 country: IO admin-c: admin(a)iweb-commerce.com#0 tech-c: admin(a)iweb-commerce.com#0 billing-c: admin(a)iweb-commerce.com#0 nserver: ns1.maximumhost.com nserver: ns2.rosexxxgarden.com registrar: JORE-1 created: 2001-06-01 04:51:34 UTC JORE-1 modified: 2004-03-17 14:59:02 UTC JORE-1 expires: 2007-05-31 22:51:23 UTC source: joker.com -M -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 Network Engineer IV Operations & Infrastructure hannigan(a)verisign.com coolwebsearch: > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Paul Vixie > Sent: Monday, July 12, 2004 12:19 PM > To: nanog(a)merit.edu > Subject: Re: Spyware becomes increasingly malicious > > > > somebody, probably sean, mentioned scaling earlier in this thread. > > > >> coolwebsearch has become more and more sneaky.. so bad that > > >> development of cws shredder has been abandoned by its developer.. > ... > > > the first time only about 3 days ago and I got rid of it > in 10 minutes! > > > I can see how it would be a problem for a newbie but it > shouldn't be > > > anything more than 10 minutes work for anyone here with Windows > > > experience. > ... > > There are dozen of variants, obviously you've seen only one. > > so, this bit of spyware (which was resistant to ad-aware as > of last week, > though ad-aware seems to publish a new definition file every > day now) relies > on a web site, and that web site relies on the spyware for > its traffic and > eyeballs, and the spyware and website are > owned/operated/"published" by the > same company. the website does not move around, it's at a > fixed location. > > the scaling issue, please: > > "why does that company still have an internet connection?" > > or, to put it less mildly: > > "why does that company's provider still have an upstream?" > > or, to put it in terms you can all understand: > > "why does that provider's upstream still have bgp peers?" > > if you give people the means to hurt you, and they do it, and > you take no > action except to continue giving them the means to hurt you, > and they take > no action except to keep hurting you, then one of the ways > you can describe > the situation is "it isn't scaling well." > -- > Paul Vixie >

2 1

tunnel PMTUD with mss adjustment
by Joe Maimon 13 Jul '04

13 Jul '04

Hello All, I have been talking to "Company C' Tac trying to understand if this is a problem. ( For reference to some things mentioned here see http://www.cisco.com/en/US/tech/tk827/tk369/technologies_white_paper09186a0… ) 1) C has a command to adjust the tcp mss option downward on packets that traverse an interface. 2) C has a command to set the ip mtu on an interface 3) C has a command that enables a IPSEC/GRE tunnel to conduct PMTUD on its path (by copying the df bit from encapsulated packet into the resulting packet) I had been trying to convince TAC that 1 and 3 might not work properly together and that is a problem. I gave them this scenario. Host A ================= HOST D || MTU 1500 Router A ( || MTU 1492 ) ( ISP A ) IPSEC/GRE Tunnel A ( || MTU 1492 ) Initial MTU 1432 (ISP B ) ( || MTU 1492) Router B || Router C ============= HOST C (PMTUD works) || Router D || Firewall A (Breaks PMTUD) || Host B Router A and Router B are configured for int tunnel 0 tunnel path-mtu-discover ! Physical MTU (pppoe) - GRE - IPSEC transport mode ip mtu 1432 ip tcp adjust-mss 1392 Now lets assume that ISP B lowers mtu between ISP A to 1476 bytes and TUNNEL A detects this and both ROUTER A and ROUTER B lowers its tunnel mtu during an exchange of packets between HOST D and HOST C (which are configured for PMTUD and have the df bit set). Now the tunnel mtu is effectively 1416. When HOST A send a packet to HOST B with a mss-adjusted option of 1392, and HOST B sends an IP packet of length 1432 back to HOST A and Router B drops the packet (because it has DF set since HOST B is configured to do PMTUD and the packet is 16 bytes larger than the current tunnel mtu) and sends an ICMP unreachable which gets blocked by FIREWALL A, HOST A will find itself unable to communicate with HOST B because of a PMTUD blackhole. SO in this scenario the ip tcp adjust-mss fails to achieve its stated goal of miniming PMTUD blackholes by aggresively seeking to limit the PMTU to a known interface mtu size. What would be reasonable to expect is that the tunnel layer would inform the mss-adjust layer that the original assumption of interface mtu is no longer valid and behave accordingly. Had the adjustment of the MSS option in the packet from HOST A to HOST B taken into account the now 16 bytes lower tunnel mtu, and adjusted to 1376 instead of 1392, the packet from HOST B would have been sized at 1416 and would have traversed (hopefully) to HOST A safely. At this point I am just a tad confused, so I was wondering if any NANOGers had some light they could shed on this. Thanks, Joe

1 0

RE: Problems with private justice (was Re: Spyware becomes increasingly malicious)
by Michel Py 13 Jul '04

13 Jul '04

<oops> I just realized that I incorrectly quoted William Warren instead of Brian Battle in my previous post. Sorry guys, cut/paste casualty. </oops> > Sean Donelan wrote: > Could this be a Joe job by someone who doesn't like the > owners of Cool Web Search? The owners of the Cool Web > Search company deny they are the creators nor affiliated > with the creaters of the CWS trojans. Maybe they are > lying. Maybe other Joe jobs have lied too. Good points. > I don't have all the facts. Maybe someone else does. Yep, the guys that write the Trojans :-D As Brian says: > Brian Battle wrote: > The authors of these coolwebsearch variants are > extremely intelligent programmers with far more > understanding of the bowels of the windows > platform than your average script kiddies. The problem I have is not with understanding of the bowels, but with the ability to produce bowel movements. Michel.

2 1

RE: Spyware becomes increasingly malicious
by Michel Py 13 Jul '04

13 Jul '04

> David Schwartz > One wrong turn probing it can render a machine > unusable until it's reloaded. Ah, I'm not the only one it appears. > In the meantime, let's at least blackhole all > their IPs on our networks. Does any of the regular lists keeps try of this and already blacklists? Michel.

1 0

RE: Spyware becomes increasingly malicious
by Michel Py 13 Jul '04

13 Jul '04

> William Warren wrote: > I second that. The version I saw required a third > party registry editor and booting up into the > recovery console from an XP cd (safe mode didn't cut > it) just to remove a hidden dll. Which is why I made the executive decision to re-image instead of trying to fix, as unfortunately a new variant requires spending more time learning it, which is not worth it. :-( > What I don't understand is how exploiting bugs in a > program (internet explorer) to install software without > the consent or even acknowledgement from the owner/user > is legal behavior. <me puts the devil's advocate suit on> There is a grey area between being legal and not being illegal. Compare to the junk fax issue: it was not legal either (as it spent the recipient's money without authorization) but it did take special legislation to make it specifically illegal. If you were to go to court it would not be a slam dunk by any means; it is going to take more nuisance that there has been so far for the legal system to do something about it. Trouble is, it does not prevent you from using the computer, mostly. Michel.

1 0

Re: Spyware becomes increasingly malicious
by Paul Vixie 13 Jul '04

13 Jul '04

> I think depeering is a bit over the top for this situation, ... if their customer was sucking blood from your customer, and if your peer was taking a cut of the proceeds, would the issues be any clearer? > I guess the big question is, is there anyone (other than those profiting > directly from CWS) that would complain if a provider were to do such a > thing... looks like a psi-net "pink contract" inherited by cogent. but since the psi->cogent rollup was an asset sale rather than a corporate merger, cogent probably isn't bound by that contract. somebody needs to get on the phone, i guess.

2 1

Telecom fraud on the rise
by Sean Donelan 12 Jul '04

12 Jul '04

http://www.billingworld.com/archive-detail.cfm?archiveId=7575 Fraud continues to pound the U.S. telecom industry with little sign of letting up. Fraudulent use of networks and theft of services in all sectors of the telecom industry continue to grow between 10 percent and 12 percent annually. Though accurate fraud figures are nearly impossible to pin down, between $4 billion and $22 billion is lost each year, and up to 10 percent of a carrier.s bottom line is lost to simple subscription fraud and other low-tech scams, such as when criminals sign up for service using fake names.

3 3

RE: Spyware becomes increasingly malicious
by Michel Py 12 Jul '04

12 Jul '04

>> William Warren wrote: >> coolwebsearch has become more and more sneaky..so >> bad that development of cws shredder has been >> abandoned by its developer.... The smart computer does not exist (if it did, we would not have a job, would we? ;-) >> Either serious lock down you ie (which with CWS is >> not going to help) or use something other than ie. No argument here. > Gregh wrote: > Are you honestly serious? I came up against it for > the first time only about 3 days ago and I got rid > of it in 10 minutes! I can see how it would be a > problem for a newbie but it shouldn't be anything > more than 10 minutes work for anyone here with > Windows experience. There are dozen of variants, obviously you've seen only one. Michel.

5 4