September 2005 - Test - lists.nanog.org

Bell South or Telcove help needed in NOLA
by Lucy E. Lynch 01 Sep '05

01 Sep '05

passing a message: "If anyone who works for or has connections with Bell South or Telcove is reading this, tell us what it's going to take to get those OC3s back up and running. We will try to coordinate and make it happen." http://www.livejournal.com/users/interdictor/ Lucy E. Lynch Academic User Services Computing Center University of Oregon llynch @darkwing.uoregon.edu (541) 346-1774

1 0

Bell South or Telcove contacts.
by andrew matthews 01 Sep '05

01 Sep '05

The guys over at http://www.directnic.com/ are looking for contacts to find out what it will take to get a few oc3's back up. http://www.livejournal.com/users/interdictor/ *If anyone who works for or has connections with Bell South or Telcove is reading this, tell us what it's going to take to get those OC3s back up and running. We will try to coordinate and make it happen. * just passing the information over. Hoping someone from those companies reads nanog :) Thanks

1 0

ATTN: Bell South of Telcove
by Chris Gilbert 01 Sep '05

01 Sep '05

Sent on behalf of the guys over at InterNIC. They probably have better things to do, but it's the least I can do to help. [snip] If anyone who works for or has connections with Bell South or Telcove is reading this, tell us what it's going to take to get those OC3s back up and running. We will try to coordinate and make it happen. [/snip] Apparently they are down to one upstream provider. (as predicted they would loose them earlier on the list) Also: [snip] Huge convoy of fuel and generator engineer types affiliated with Bell South just moved down the street toward their building. That's where 2 of our OC3s that went down are at Bell's main. [/snip] Best of luck to everyone. -- Regards, Chris Gilbert

1 0

OT: Attn Federal NS/EP types
by Jay R. Ashworth 01 Sep '05

01 Sep '05

If there's anyone in black sunglasses reading this positioned sufficiently high to do any good, please go read http://www.livejournal.com/users/interdictor/39438.html?mode=reply (Please do not reply on list to this posting. Anyone who feels the need to yell at me, please do it off-list.) Cheers, -- jra -- Jay R. Ashworth jra(a)baylink.com Designer Baylink RFC 2100 Ashworth & Associates The Things I Think '87 e24 St Petersburg FL USA http://baylink.pitas.com +1 727 647 1274 "NPR has a lot in common with Nascar... we both turn to the left." - Peter Sagal, on Wait Wait, Don't Tell Me!

1 0

nanog-futures list
by Susan Harris 01 Sep '05

01 Sep '05

It's back - thanks to the Steering Committee for prompting us to get the list going again. There's no need for action if you're already subscribed; for others there's subscription info here: http://www.nanog.org/email.html

1 0

trying to move web site for New Orleans schools
by Mark Boolootian 01 Sep '05

01 Sep '05

Outside the NANOG charter, but given the current circumstances, this seemed to be a reasonable forum for suggestions on solving this problem. --- Subject: Web aid Date: Thu, 01 Sep 2005 09:05:22 -0500 >From: Paul Tatarsky <paul(a)tatarsky.com> This is something that until a few minutes ago I never even considered as part of this whole Hurricane fallout. I got a call from a high school friend who lived in New Orleans. He's in Florida now. There is a emerging need to use the web to help scattered folks get status from schools, businesses, etc. Many many servers are gone. People are at relatives homes and are trying to use the Internet to get status. They want to swing DNS for their kids school to a new server but cannot contact their sysadmin who has the accounts at Network Solutions. Does anybody have an idea how to solve that? But, I'm starting to setup a template BSD machine to provide basic web vhosts and squirrel mail. We're going to start with his kids school. Here's all that is currently left electronically: http://64.233.167.104/search?q=cache:009iQtpHviwJ:www.stuarthall.org/+&hl=e… -------------------------------------------------------------------- Paul Tatarsky paul(a)tatarsky.com Sysadmin Consultant (608) 441-7365 http://www.tatarsky.com/ --------------------------------------------------------------------

3 2

RE: trying to move web site for New Orleans schools
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Good advice. The miscreants have already been busy in that regard... - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > Outside the NANOG charter, but given the current > circumstances, this seemed > to be a reasonable forum for suggestions on solving this problem. I suggest everyone move with caution on making any unauthenticated changes on the fly for anyone claiming to be impacted by the storm. I know we all feel badly, but this is a good opportunity for miscreants, phishers, and scammers to wreak havoc. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: trying to move web site for New Orleans schools
by Hannigan, Martin 01 Sep '05

01 Sep '05

> > Outside the NANOG charter, but given the current > circumstances, this seemed > to be a reasonable forum for suggestions on solving this problem. I suggest everyone move with caution on making any unauthenticated changes on the fly for anyone claiming to be impacted by the storm. I know we all feel badly, but this is a good opportunity for miscreants, phishers, and scammers to wreak havoc. -M<

1 0

This fall in LA
by Susan Harris 01 Sep '05

01 Sep '05

Greetings everyone - registration is now open for the fall NANOG meeting, to be held Oct. 23-25 in Los Angeles. This is our fourth back-to-back meeting with ARIN - a joint venture that's proven very successful at giving operators direct access to the all-important folks who hand out IP addresses and ASNs in North America. ARIN meets just after NANOG, from Oct. 26-28. NEW THIS FALL: an in-depth "Getting Started With IPv6" workshop, to be held Sunday from 9am-4:30 p.m. Workshop info and registration is here: http://www.arin.net/ARIN-XVI/ipv6_workshop.html NANOG registration is here: https://www.merit.edu/nanog/registration.form.html See you in Los Angeles!

2 2

Re: Has someone in Asia exploited Cisco
by Robert Guess 01 Sep '05

01 Sep '05

Offhand, I would be tempted to say it is the activity of a not exceedingly competent attacker trying to exploit a very old bug. The sender is probing for the HTTP Authentication Bypass Issue from June 27 2001. Original Advisory http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html Malicious request: http://<device_addres>/level/16/exec/ Analyze the timing and source of log events to determine if it is an automated issue. Robert Guess Assistant Professor, Information Systems Technology Tidewater Community College (757) 822-5022 () ascii ribbon campaign /\ against html email >>> "J. Oquendo" <sil(a)politrix.org> 09/01/05 9:07 AM >>> After doing some logfile analysis briefly yesterday, I noticed what seems to be some form of bot, worm, something, searching for what could seems to point to a Cisco exploitation of sorts. (http://tinyurl.com/df9d8) All the hosts who've tried searching for the string are coming from APNIC. So I'm wondering... Has someone taken Michael Lynn's paper "Holy Grail" and produced a "DaVinci Code" to exploit the flaws Lynn spoke of... Code snippet below is of "cisco_scanner.c" which searches for the same particular /level/16/exec/-///pwd string however the code can be modified (obviously) and a search turns up less than one page of results on Google. Author's page seems to be gone like the wind... Anyhow. # grep "/level/16/exec/-///" access_log |awk '{print $1,"\t\t"$7}' 58.236.50.75 /level/16/exec/-///pwd 221.141.168.137 /level/16/exec/-///pwd 221.138.93.31 /level/16/exec/-///pwd 218.53.244.16 /level/16/exec/-///pwd 222.232.84.34 /level/16/exec/-///pwd 222.238.128.14 /level/16/exec/-///pwd 218.50.74.189 /level/16/exec/-///pwd 218.239.26.42 /level/16/exec/-///pwd 218.232.83.18 /level/16/exec/-///pwd 211.208.254.67 /level/16/exec/-///pwd whois.apnic.net $ABOVE_HOSTS Code snippet... /* Multi-thread Cisco HTTP vulnerable scanner v0.2 by Inode */ #define HTTP_REQUEST "GET /level/16/exec/-///pwd HTTP/1.0\n\n" So now I have yet another mod_security rule added ;) SecFilterSelective THE_REQUEST "/level/16" "redirect:http://www.cisco.com" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 It is much easier to suggest solutions when you know nothing about the problem. -- Niklaus Wirth

1 0