May 2005 - Test - lists.nanog.org

Internet Attack Called Broad and Long Lasting by Investigators
by Steven M. Bellovin 10 May '05

10 May '05

SAN FRANCISCO, May 9 - The incident seemed alarming enough: a breach of a Cisco Systems network in which an intruder seized programming instructions for many of the computers that control the flow of the Internet. Now federal officials and computer security investigators have acknowledged that the Cisco break-in last year was only part of a more extensive operation - involving a single intruder or a small band, apparently based in Europe - in which thousands of computer systems were similarly penetrated. .... http://www.nytimes.com/2005/05/10/technology/10cisco.html?hp&ex=1115784000&… --Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

4 5

RE: DOS attack tracing
by Chris Ranch 10 May '05

10 May '05

Correcting a typo... > Yes, the 7206vxr with whatever processor really checks out > when under any kind of real flood through it. It's big > brother, the 7304-NSE100 does as well. But the 7304-NPE100 > with the PXF can forward that (d)DoS very well. Even with > fairly extensive ingress filters. The kick in the head is > that the processors are the same price. I don't know why > they even sell the NPE100... I don't know why they even sell the NSE100. You want the NPE with the PXF. Chris

1 0

Unusual IN ANY DNS Traffic
by Douglas E. Warner 10 May '05

10 May '05

Since about 03:00 UTC this morning I've been seeing a huge increase in "IN ANY" requests for "msn.com.". While my name servers have not seen much, if any, "IN ANY" queries in the past, now I'm seeing ~ 50 queries/second. I'll include a tcpdump sample below. Actually, while I was writing this post the queries seem to have stopped (15:05 UTC). Is this typical of a botnet or some worm propogating? Any experience in this type of traffic would be very much appreciated. -Doug ==== tcpdump - times in EDT ==== # tcpdump -nn dst port 53 | grep 'ANY' tcpdump: listening on eth0 10:27:16.748561 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 6+ ANY? msn.com. (25) (DF) 10:27:16.751724 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 15+ ANY? msn.com. (25) (DF) 10:27:16.758276 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 16+ ANY? msn.com. (25) (DF) 10:27:16.758440 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 3+ ANY? msn.com. (25) (DF) 10:27:16.758443 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 10+ ANY? msn.com. (25) (DF) 10:27:16.759799 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 16+ ANY? msn.com. (25) (DF) 10:27:16.761228 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 10+ ANY? msn.com. (25) (DF) 10:27:16.762209 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 6+ ANY? msn.com. (25) (DF) 10:27:16.764992 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 7+ ANY? msn.com. (25) (DF) 10:27:16.765981 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 16+ ANY? msn.com. (25) (DF) 10:27:16.766676 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 6+ ANY? msn.com. (25) (DF) 10:27:16.766798 66.59.xxx.xxx.53 > 205.166.xxx.xxx.53: 8+ ANY? msn.com. (25) (DF) -- Douglas E. Warner <dwarner(a)ctinetworks.com> Network Engineer CTI Networks, Inc. http://www.ctinetworks.com +1 717 975 9000

2 2

Report: Hacker infiltrated government computers
by Fergie (Paul Ferguson) 10 May '05

10 May '05

>From CNN: The FBI confirmed Tuesday the accuracy of a New York Times report that software on routers, computers that control the Internet, were compromised last year by a hacker who claimed that he had infiltrated systems serving U.S. military installations, research laboratories, and NASA. The Times reported, and the FBI confirmed, that the focus of the investigation is a youth in Uppsala, Sweden, who has been charged as a juvenile. http://www.cnn.com/2005/TECH/05/10/govt.computer.hacker/index.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: DOS attack tracing
by Chris Ranch 10 May '05

10 May '05

On Tuesday, May 10, 2005 5:06 AM, Suresh wrote: > On 5/10/05, Hannigan, Martin <hannigan(a)verisign.com> wrote: > > DDOS' is rather infrequent to zero for most enterprises. That DDOS > > golden banana is rather yummy with sprinkles on top. Don't get me > > wrong, the DDOS problem is real, but not for everyone, and not as > > frequently as it's being hyped up to be. A managed service > is a better > > way to go if they're worried, IMO. > > There's also the "minimze risk" thing .. take a conscious > business decision not to host one of the typical DDoS magnets > (dont allow people to run IRC bots on your colo farm, for example) Dumping our IRC customers dropped our DDoS frequency by an order of magnitude. We've certainly slept better as a result. Chris -------------------------------- Chris Ranch Director of Network Architecture Affinity Internet, Inc.

1 0

RE: DOS attack tracing
by Chris Ranch 10 May '05

10 May '05

On Monday, May 09, 2005 5:49 PM, Richard wrote: > > > > On Mon, May 09, 2005 at 01:35:06PM -1000, Richard wrote: > > > > > We recently experienced several DOS attacks which drove > > > our backbone routers CPU to 100%. The routers are not > > > under attack, but the router just couldn't handle the > > > traffic. There is a plan to upgrade these routers. > > > > What kind of routers? We had problems like this with Cisco > > 7206VXRs with NPE-300s at my last job because they just > > couldn't handle the high volume of packets-per-second from > > certain types of attack. > > Oh... I guess that it would a known issue then... we have the > exactly same type of routers. Our routers normally run at 35% > CPU. What sucks is that the traffic volume doesn't have to be > very high to bring down the router. Yes, the 7206vxr with whatever processor really checks out when under any kind of real flood through it. It's big brother, the 7304-NSE100 does as well. But the 7304-NPE100 with the PXF can forward that (d)DoS very well. Even with fairly extensive ingress filters. The kick in the head is that the processors are the same price. I don't know why they even sell the NPE100... Then you can take whatever measures you like to characterize and mitigate. A combination of upstream null routing (poisoning communities), ingress filters, core null routing, and your favorite ddos mitigation equipment filtering has been very effective for us. Chris -------------------------------- Chris Ranch Director of Network Architecture Affinity Internet, Inc.

1 0

RE: DOS attack tracing
by Hannigan, Martin 10 May '05

10 May '05

> -----Original Message----- > From: Suresh Ramasubramanian [mailto:ops.lists@gmail.com] > Sent: Tuesday, May 10, 2005 8:06 AM > To: Hannigan, Martin > Cc: Kim Onnel; Scott Weeks; nanog(a)merit.edu > Subject: Re: DOS attack tracing > > > On 5/10/05, Hannigan, Martin <hannigan(a)verisign.com> wrote: > > DDOS' is rather infrequent to zero for most enterprises. That DDOS > > golden banana is rather yummy with sprinkles on top. Don't > get me wrong, > > the DDOS problem is real, but not for everyone, and not as > frequently as > > it's being hyped up to be. A managed service is a better way > > to go if they're worried, IMO. > > There's also the "minimze risk" thing .. take a conscious business > decision not to host one of the typical DDoS magnets (dont allow > people to run IRC bots on your colo farm, for example) There's two classes of discussion here. One for service providers who should have DDOS defense, and one for enterprises who should have risk mitigation in mind. I think that operators should have DDOS defense capabilities for themselves and their customers, and I think that enterprises should seriously evaluate their need for a full blown implementation of a DDOS solution based on a solid risk analysis. As far as DOS tracing goes, using the freeware tools locally, and either buying and/or subscribing to a ddos defense service make sense as much as it makes sense to analyze the cost and your own capability as well as your providers capability to quickly and successfully defend against a DDOS. -M<

1 0

RE: DOS attack tracing
by Hannigan, Martin 10 May '05

10 May '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Kim Onnel > Sent: Tuesday, May 10, 2005 4:19 AM > To: Scott Weeks > Cc: nanog(a)merit.edu > Subject: Re: DOS attack tracing > > > > 1) Get 'Cisco guard' , too expensive ? > 2) Get Arbor, Stealthflow, Esphion, too expensive ? Good advice when DDOS' are constant. If this was a first and possibly last for awhile, it may make sense to rely on the software tools and a good 'SOP' with the provider instead. It really depends on the scope of the problem in particular. DDOS' is rather infrequent to zero for most enterprises. That DDOS golden banana is rather yummy with sprinkles on top. Don't get me wrong, the DDOS problem is real, but not for everyone, and not as frequently as it's being hyped up to be. A managed service is a better way to go if they're worried, IMO. [ SNIP ]

3 2

DOS attack tracing
by Richard 10 May '05

10 May '05

Hi, We recently experienced several DOS attacks which drove our backbone routers CPU to 100%. The routers are not under attack, but the router just couldn't handle the traffic. There is a plan to upgrade these routers. One criteria is the ability to track which IP address is under attack and blackhole the traffic quickly. Anyone can share your experience of what kind of router is capable of doing this? Also besides having a powerful router which can handle large volume of traffic, is there any other things that we need to consider in selecting the routers? Thanks, Richard

7 10

Re: NYT: Internet attack called broad and long lasting
by Fred Heutte 10 May '05

10 May '05

NYT: The crucial element in the password thefts that provided access at Cisco and elsewhere was the intruder's use of a corrupted version of a standard software program, SSH. The program is used in many computer research centers for a variety of tasks, ranging from administration of remote computers to data transfer over the Internet. The intruder probed computers for vulnerabilities that allowed the installation of the corrupted program, known as a Trojan horse, in place of the legitimate program. Ouch. Makes me wonder how long before someone cracks the ssh that you can order for T-Mobile Sidekicks like mine. ("Before"? "Already!" . . . whatever) It *is* handy in a pinch, I last used it to check a server quickly while I was sitting in the Rockpile (center field bleachers) at a Denver Rockies game last month :) It's some flavor of ssh2, guess I'll have to ask my friend who works at Danger which one. The notion of launching a DDOS from a cellphone is intriguing in a novelistic sense and worrisome in a real.world sense. -- Fred

1 0