August 2005 - Test - lists.nanog.org

Re: zotob - blocking tcp/445
by MARLON BORBA 16 Aug '05

16 Aug '05

Jiri, Rommon's site does not state clearly if the product is a network appliance (as it appears to be since its interface is web-based) or a software-only product. Abraços, Marlon Borba, CISSP. -- Nova campanha: Centro de Resposta a Incidentes de Segurança da Justiça Federal - Vamos criar! -- >>> "Sane Jiri" <Jiri.Sane(a)elisa.fi> 08/16/05 8:49 AM >>> [...] We have been using rommon for years now and are quite happy with it. It has radically decreased workload of our abuse-handling crew and zotob-infected customers for example got blocked with no extra configuration needed.

1 0

RE: drone armies C&C report - July/2005
by Hannigan, Martin 16 Aug '05

16 Aug '05

> > > > Wall of sheep certainly is humorous, but IL CERT using this > > data as a shaming mechanism is, well, a shame. > > Why you associate IL CERT with this is confusing to others. I am > confident that you know there is little or no connection. We all > have employers. You, me and Gadi included. ;-) I don't know that. I am not part of the project. It was sent from cert.gov.il and had a sig from the manager of the IL CERT. We can go around in circles all day on this, but it seems that the IL CERT was used to give the report credibility so it's fair to give feedback on it as official CERT policy, IMO. > nothing actionable Enough said. -M<

1 0

Re: zotob - blocking tcp/445
by Sane Jiri 16 Aug '05

16 Aug '05

Randy, > though http://www.rommon.com/sandbox.html looks to be a > commercial product (and hence the spawn of evil:-), has > anyone got success/failure stories? it looks to speak > directly to this issue. We have been using rommon for years now and are quite happy with it. It has radically decreased workload of our abuse-handling crew and zotob-infected customers for example got blocked with no extra configuration needed. -- Jiri Sane Elisa Oy (Ltd) Puh. 010 266 2012 jiri.sane(a)elisa.fi

1 0

RE: drone armies C&C report - July/2005
by Hank Nussbacher 16 Aug '05

16 Aug '05

At 05:05 PM 15-08-05 -0400, Hannigan, Martin wrote: >It was noted that IL CERT does a fantastic job seeing that >there are no IL networks listed. Or none that are easily >identifiable. It is not IL-CERT but rather peer pressure on an internal Israeli ISP mailing list. Incidentally, there are 2 Israeli ASNs mentioned in the list which are not easily identifiable as listed below. -Hank >YMMV. > >-M< > > > ASNs with 0ne or more open C&Cs: > > ASNumber Responsible Party > > 8551 BEZEQ-INTERNATIONAL-AS Bezeqin > > 9116 Goldenlines main autonomous sy

1 0

Re: botnet reporting by AS - what about you?
by Fergie (Paul Ferguson) 16 Aug '05

16 Aug '05

Good suggestions for Gadi. ,-) - ferg -- "Christopher L. Morrow" <christopher.morrow(a)mci.com> wrote: cool, among the 800k+ complaints we see a month (yes, 800k) there are quite a few completely useless ones :( Anything sent in as a complaint has to have complete and useful information, else it's hard/impossible to action properly. It'd help if the format it was sent in was also machine parseable :) With 800k+ complaints/month I'm not sure people want to spend time figuring each one out, a script/machine should be doing as much as possible. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

zotob C&C servers
by Gadi Evron 16 Aug '05

16 Aug '05

Hi guys. Zotob, once infected, connects the machine to a botnet C&C (command & control) server. Due to the extremely rapid spread of these worms, here is the C&C servers information that has been confirmed so far: 62.193.233.52:8080 84.244.7.62:8080 204.13.171.157:8080 62.193.233.4:8080 ASN | IP | Responsible Party ----------------------------------------------------------- 12832 | 84.244.7.62 | LYCOS-EUROPE Lycos Europe GmbH 19742 | 204.13.171.157 | MARLIN - Marlin eSourcing Solu 28677 | 62.193.233.52 | AMEN AMEN Network 28677 | 62.193.233.4 | AMEN AMEN Network For your information and possible follow-up on your networks. This is spreading too quickly that wider activity is necessary. For comments back to the drone armies & botnets research and mitigation mailing list, please go through our new PR team lead, "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net>. Gadi.

2 3

RE: drone armies C&C report - July/2005
by MARLON BORBA 16 Aug '05

16 Aug '05

Going further I think IL-CERT is doing a great service to the Internet community. Their alerts allow to responsible network admins to investigate and to preserve their networks clean of debris like spyware and trojans. Do what you want with your networks, but PLEASE keep the Internet clean. Abraços, Marlon Borba, CISSP. -- Nova campanha: Centro de Resposta a Incidentes de Segurança da Justiça Federal - Vamos criar! -- >>> "Hannigan, Martin" <hannigan(a)verisign.com> 08/15/05 6:05 PM >>> The question of self promotion came back split down the middle. It was noted that IL CERT does a fantastic job seeing that there are no IL networks listed. Or none that are easily identifiable. [...]

3 2

RE: drone armies C&C report - July/2005
by Hannigan, Martin 16 Aug '05

16 Aug '05

> the > summaries are primarily useful for C&C's that are still alive > a month later > even though plenty of notices have been sent to the relevant > NOC's. in > other words it's sort of like defcon's "wall of sheep". i > like the approach. Wall of sheep certainly is humorous, but IL CERT using this data as a shaming mechanism is, well, a shame. Once the NOC engages in an excercise of futility based on that list, it will never be read again and the effort ends up being more futile, which is another shame. It's a good project, but it got ripe before it was ready, IMO. BTW, are you vouching for the report?

2 1

RE: zotob - blocking tcp/445
by Church, Chuck 15 Aug '05

15 Aug '05

>'enterprise security folks' are probably not the issue... The fact remains >that lots of folks DO do this :( There are quite a few folks between >'consumer' and 'enterprise' that do all manner of dumb things on the >Internet (where 'dumb' is equivalent to running smb shares across the >public network minus encryption/ipsec). It's their choice to do that, and >their network providers are expected/demanded to pass those packets for >them. >-Chris Surely the ratio of 'useful' traffic compared to 'junk' for a particular protocol must be considered. What percentage of netbios entering a service provider's edge is intentional? 1%? 0.1%? I'm guessing much less than that. If 5 or 6 nines worth of a particular protocol entering or leaving an ISP's network is unintentional, and highly susceptible to viral activity, isn't it in our best interest to block it? With proper notification to subscribers and instructions on setting up host-to-host PPTP/whatever, blocking netbios can solve a large bunch of issues.... Just my .02 though, Chuck

2 1

RE: drone armies C&C report - July/2005
by Hannigan, Martin 15 Aug '05

15 Aug '05

> Going further I think IL-CERT is doing a great service to the > Internet community. Their alerts allow to responsible network > admins to investigate and to preserve their networks clean of > debris like spyware and trojans. The point is that aged data is an eternity when you're talking about botnets, worms, zombies, c/c's, etc which is what made me wonder why it was being posted in the first step. A month is a long time in botland. Yes, I'm all for clean networks. Yes, IL CERT does as good a job as any CERT, I'm sure. -M<

2 1