July 2006 - Test - lists.nanog.org

Open Source NMS Software
by Gary T. Giesen 21 Aug '06

21 Aug '06

I'm looking at depolying an open source-based NMS solution, and I'm looking at a couple products, mostly OpenNMS (http://www.opennms.org) and Zenoss (http://www.zenoss.org) I like the looks of Zenoss, but I've never really heard of it and I'm wondering if anyone has any experiences with it that they can share before I go and spend hours on an install/configuration. Is there something wrong with it, and that's why I've never heard of anyone using it? Am I just out of the loop? Even better would be someone who's used both products and could give me a quick comparison. I'd also welcome suggestions of another product (as long as it's not bb, nagios, or hobbit) that I should be looking at. Thanks, Gary Giesen

4 3

Anyone else lost power at Fisher Plaza this afternoon?
by Jonathan Claybaugh 07 Aug '06

07 Aug '06

If anyone else lost power at Internap's Fisher Plaza facility in Seattle this afternoon and have any info related to exact duration or cause please hit me back off-list. Cheers, Jonathan

5 7

mitigating botnet C&Cs has become useless
by Gadi Evron 03 Aug '06

03 Aug '06

The few hundred *new* IRC-based C&Cs a month (and change), have been around and static (somewhat) for a while now. At a steady rate of change which maintains the status quo, plus a bit of new blood. In this post I ask the community about what you see, against what we have observed, and try and test my conclusions and numbers against your findings. The subject line "why mitigating botnet C&Cs has become useless" is misleading. It has been useless for a long time, but someone had to hold back the tide, which several online mitigation communities have been doing. Today it has become (close to) completely useless. I will present the case on why that is in my opinion, in a few bullets, and we can discuss what alternatives we have, or if perhaps I am misreading what's going on. *. When a botnet C&C is mitigated, it is immediately re-created on another host on the same ISP or another. *. Most botnet C&Cs are a part of a larger group, such as an IRC network or another, possibly hidden "behind the scenes" network. lusers are being redirected on the spot or reconnect to another host. *. Most botnet C&Cs are a compartmentalized group out of the whole, possibly a sub-group several tiers down. Much like a terrorism cell. *. If the above measures and features fail, most botnets have a secondary control channel with which an immense host can be re-directed. This has been seen back a few years ago. *. Many botnet C&Cs now use fast-flux technology, moving IP addresses quite often. *. When the C&C is taken down, the bot may not jump to a new host, a new one may simply be installed. *. Coordinated take-down of entire networks is extremely difficult, relies on incomplete intelligence and only takes care of the problem for an extremely short period of time until re-assembly. The name of the game is the SPBC: Simple Primitive Botnet Control (C&C). Simple - as it is simple, vs. a complex dynamic control channel. Primitive - old and quite unimpressive. Botnet - d'oh C&C - Command and Control It's simple, we can see most of them with our tools. Primitive, hey, they have been using these for a long long time. It works. As what we mainly did is concentrate on taking the C&C down, as well as academically study how to detect or quantify it, what we achieved was teaching the Bad Guys their business. That is yesterday's news. They are an oiled machine. We don't hurt them any more. Botnet have become mainstream. They are part of sales pitches now. SPBC for the botnet controllers these days relies on proven and tested techniques, concentarting and backing themselves on: Reliability - Efficient and stable. Robust - Easily replaced. Diverse - varying control channels, from DNS, other IRC servers and direct connect to a downloader ready to download a new bot or re-infect a known bad network. Distributed - need I speak of that one? What taking down C&C's does achieve? 1. Coordination on security issues between ISP's, continued and peer-pressure based. Slowly but surely becoming more and more LEO, regulation and vendor-run in comparison to what it used to be. 2. Responsiveness to abuse - gaging ISP response is interesting and shows how interested they are. 3. Feeling good - cleaning the back yard and moving the problem to someone else (another ISP). Hmm, yeah.. not really. In most cases the same ISP's have the same problems month after month. They just make the C&C's "unknwon" vs. "yes, we know where they are". We are now past the point where killing C&Cs has been harmful. It was. These days the only real use a C&C can have for an organization with a network, is to check for infected clients connecting in. When it was harmful, creating the current situation, we were comfortable with it as it helped hold back the immediate problem - which was important by itself. That's my educated opinion, following this since 1996, and gathering statistics for several years, some of which are seen by this community every month. Please, I would love to hear your opinions, disputes and how you find the operational intell on botnet C&Cs useful to this day on networks for mitigation purposes. Then I would like to try and check my facts against your findings as well, and see if my conclusions hold up or if I miscalculated. Please try and limit your answers on this thread (unless you start another) to network mitigation issues. Thank you all for your input. Oh, and I wasn't very accurate. Killing C&Cs these days is still harmful, just that now it doesn't even hold back the tide. Gadi. Note: this is also being sent to the public botnets mailing list.

4 4

Re: APC Matrix 5000 question(s)
by up＠3.am 03 Aug '06

03 Aug '06

On Thu, 27 Jul 2006, Michael J Wise wrote: > On Jul 27, 2006, at 5:10 AM, Ray Van Dolson wrote: > > > In any case, give APC support a holler. > > Definitely. > > > I'm always nervous doing any sort of maintenance on our Symmetra. > > The Symmetra is a completely different animal from the 5000, though. > I <3 the Symmetra. > > Oh yes, one more point... best to check the 5000's battery packs for > heat and bulging, as some of the packs may be about to vent the Hot > Sauce, and cleaning that up is always "Fun". Aloha mai Nai`a! -- "Please > have your Internet License http://kapu.net/~mjwise/ Update: I replaced the batteries today, and indeed, several of the old ones (mostly in the first pack) were split and some had popped a couple of their "sealed" tops. I left for several hours and came back to the house stinking like burning rubber. The new batteries are apparently melting the terminal rubber insulation. I had to throw it back into bypass mode and unplug that pack (the only one with new batteries!) Any ideas to the cause? The status screens looked ok. ("no bad batteries" again) James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

7 7

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 01 Aug '06

01 Aug '06

----- Original Message Follows ----- From: Paul Vixie <vixie(a)vix.com> > > Today it has become (close to) completely useless. ... > > i wish that the value of this activity were zero. instead > , it's negative. see <http://fm.vix.com/internet/security/superbugs.html> > for details. -- That's all fine and dandy until you consider the international base of these things. I'd like to see "...jackbooted [US is implied in the text] government thugs...kicking in a door somewhere and confiscating every powered device and every living person in the building" in China, an African country, Russia, or <insert country of choice here>. These things span continents and countries and every time you cutoff the current head, it immediately spawns another and not always in a country that cares. scott

4 3

Panama NAP/PNAP
by Paul English 31 Jul '06

31 Jul '06

Hi, Can someone tell me where the Panama NAP/PNAP is located (ie: what building?). I have looked at the archives and most of the information available online is in Spanish and/or quite outdated, and unfortunately I don't speak Spanish. Thanks, Paul

2 2

IETF Last Call on draft-ietf-opsec-current-practices-06
by Ross Callon 31 Jul '06

31 Jul '06

The IETF is currently last calling the document "Operational Security Current Practices". Given the obvious relevance to service providers, and as discussed at the recent Nanog meeting in San Jose, we would also like to solicit comments from the Nanog community. Comments can be sent to the Nanog email list. The document is at: http://www.ietf.org/internet-drafts/draft-ietf-opsec-current-practices-06.t… In order to provide time to review the document, we will extend the last call for a week, until Tuesday August 15th. Thanks, Ross >Date: Mon, 24 Jul 2006 17:01:58 -0400 >To: opsec(a)ops.ietf.org >From: Ross Callon <rcallon(a)juniper.net> >Subject: Begin Last Call on draft-ietf-opsec-current-practices-06 > >This begins working group last call on draft-ietf-opsec-current-practices-06 >"Operational Security Current Practices". The last call will terminate two >weeks from tomorrow (Tuesday August 8th). > >Comments to the list please. > >thanks, Ross

1 0

Re: AW: mitigating botnet C&Cs has become useless
by Gadi Evron 31 Jul '06

31 Jul '06

On Mon, 31 Jul 2006, Dean Anderson wrote: > You are approaching the problem the wrong way. Many failover systems > work very well when the primary fails entirely--when the salesman pulls > the plug. Few work well when the primary doesn't entirely fail, but > just doesn't work correctly, as is usually the case in the real world. Such as? How does it apply to the network world? > Try that approach on the C&Cs: infiltrate and use the C&C to the > botnets' disadvantage. Probably, you can cause an "upgrade" to be > distributed to the infected hosts that doesn't have a secondary control > channel, but that doesn't overly alert the human bot operators until its > too late. Infiltration is intelligence, not network.. uploading a file is illegal and unethical... Good solid ideas, but unfortunately failed in the past. > > Of course, Nanog seems not to appreciate my contributions, so I won't be > sharing anything else I know about the problem. Good luck. > > --Dean > > On Mon, 31 Jul 2006, Gadi Evron wrote: > > > > > On Sun, 30 Jul 2006, Gunther Stammwitz wrote: > > > The really interesting question is when botnets are going to use > > > p2p-technologies since one wouldn't know how to stop them then. > > > Please let that never happen.... > > > > > > > I am not sayin gyou are wrong, or that dynamic channels won't happen far > > more widely. Currently they are not widely used as they are not > > needed. Web, IRC, etc. are quite efficient. > > > > That said, there is one problem to solve with every evolved C&C, the more > > complex it is the easier it is to follow. > > > > Gadi. > > > > > > > > -- > Av8 Internet Prepared to pay a premium for better service? > www.av8.net faster, more reliable, better service > 617 344 9000 > >

2 1

anyone from Yahoo here?
by Robert E.Seastrom 30 Jul '06

30 Jul '06

This is kind of a disgrace. Hopefully public mention of it will cause repairs to happen. ---Rob

1 0

Yahoo contact for dns issue
by Paul - Neoverve 28 Jul '06

28 Jul '06

Hello, Does anyone have a contact at Yahoo that could help with a dns issue on Yahoo's end? I'm getting no where with thir Technical Support number. TIA -- Paul Norton Server Support neoverve neo - new and different. verve - energy and enthusiasm in the expression of ideas. 760.744.7845 800.500.6580 paul(a)neoverve.com www.neoverve.com

10 12