September 2005 - Test - lists.nanog.org

Has someone in Asia exploited Cisco
by J. Oquendo 01 Sep '05

01 Sep '05

After doing some logfile analysis briefly yesterday, I noticed what seems to be some form of bot, worm, something, searching for what could seems to point to a Cisco exploitation of sorts. (http://tinyurl.com/df9d8) All the hosts who've tried searching for the string are coming from APNIC. So I'm wondering... Has someone taken Michael Lynn's paper "Holy Grail" and produced a "DaVinci Code" to exploit the flaws Lynn spoke of... Code snippet below is of "cisco_scanner.c" which searches for the same particular /level/16/exec/-///pwd string however the code can be modified (obviously) and a search turns up less than one page of results on Google. Author's page seems to be gone like the wind... Anyhow. # grep "/level/16/exec/-///" access_log |awk '{print $1,"\t\t"$7}' 58.236.50.75 /level/16/exec/-///pwd 221.141.168.137 /level/16/exec/-///pwd 221.138.93.31 /level/16/exec/-///pwd 218.53.244.16 /level/16/exec/-///pwd 222.232.84.34 /level/16/exec/-///pwd 222.238.128.14 /level/16/exec/-///pwd 218.50.74.189 /level/16/exec/-///pwd 218.239.26.42 /level/16/exec/-///pwd 218.232.83.18 /level/16/exec/-///pwd 211.208.254.67 /level/16/exec/-///pwd whois.apnic.net $ABOVE_HOSTS Code snippet... /* Multi-thread Cisco HTTP vulnerable scanner v0.2 by Inode */ #define HTTP_REQUEST "GET /level/16/exec/-///pwd HTTP/1.0\n\n" So now I have yet another mod_security rule added ;) SecFilterSelective THE_REQUEST "/level/16" "redirect:http://www.cisco.com" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 It is much easier to suggest solutions when you know nothing about the problem. -- Niklaus Wirth

1 0

Boing Boing: Clearinghouse for Katrina tech assistance contacts
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Since gripes here on the list about opsts regarding the Hurricane Katrina aftermath issues, I just wanted to point out that Bong Boing has seemingly become the clearinghouse for much tech info on efforts to provide some sort tech and communications assistance in the Gulf Coast region. So, I'd stay tuned over on Boing Boing if you want to stay in the loop on that particular issue: http://boingboing.net/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: August 2005: Drone Army Botnet C&C listing
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Yes. And thanks. - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > 30058 FDCSERVERS - FDCservers.net LL 123 43 > 21840 SAGONET-TPA - Sago Networks 53 26 > Much better. And no IL-CERT. :-) Is it safe to say the resolutions, at least in these two cases, are because of others mitigation activities i.e. snatching back the RR's, shutting off the domain, black holes, etc? -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0