February 2007 - Test - lists.nanog.org

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by Fergie 21 Feb '07

21 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gadi Evron <ge(a)linuxbox.org> wrote: >And this is before we get into the academic off-topic discussion of what a >bot actually is, which after almost 11 years of dealing with these I find >difficult to define. Is it an IP address? A computer? Perhaps an instance >of a bot (and every machine could have even hundreds). > >Welcome to the realm of Internet security operations and the different >groups and folks involved (and now industry). It is about Internet >security rather than this or that network security or this and that sample >detection. Interestingly enough, I discovered during my trip to Tokyo this week that the Japanese government is _mandating_ that the national ISPs address the botnet problem, specifically. I'm still gathering details on the framework -- which is still being defined, if I'm not mistaken -- but I applaud them for taking the lead in this regard. If they are even marginally successful, I hope it will be an example for others around the world to stop making excuses and begin addressing the problem. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFF2+dhq1pz9mNUZTMRAhd9AJ9FqULfYzAXzwlhSRdrU2a5Xd5frwCcDedO XAQipmVgJwGfqq34fANSy7w= =mAC6 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Interland dead?
by Michael Loftis 20 Feb '07

20 Feb '07

Anyone know what's going on? -- "Genius might be described as a supreme capacity for getting its possessors into trouble of all kinds." -- Samuel Butler

3 2

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 20 Feb '07

20 Feb '07

> I've concluded three things (by doing experiements like > that). (a) Where > there are Windows boxes, there are zombies. "Securing > Microsoft operating > systems adequately for use on the Internet" is not a solved problem in > computing. I disagree. Since 1994 I have been in the habit of setting up MS Windows boxes with Win98 and up, by installing from CD, connecting to the net and installing various patches and updates from the Windows Update service. I've never had a virus infection, a bot, a root kit or whatever. The secret is simple. These machines never connected directly to the Internet but went through a NAT box. Way back when it was a FreeBSD machine running TIS Firewalls Toolkit. These days it is an off-the-shelf Ethernet switch with DSL modem and NAT built-in. Therefore, I assert that securing systems adequately for use on the Internet is indeed a SOLVED PROBLEM in computing. However, it isn't yet solved in a social or business sense. On the business side, I wonder why PC's don't come with a built-in firewall/NAT device. It is cheap enough to do these days. This means that a computer would have no Ethernet ports on it. Instead, an internal Ethernet port would be directly connected to a NAT/firewall device on the same circuit board (or via PCI/PCMCIA/etc.). The external Ethernet port would belong to the firewall/NAT device. On the social side, people don't realize that such a solution is possible and therefore they aren't demanding computer vendors to build it in. The box vendors only build what the OS vendors want and the OS vendors are not interested in a piece of hardware that runs its own OS, most likely FreeBSD or Linux. In the UK, companies who sell TV services (cable and satellite) give there customers a box to connect with. Why can't ISPs also sell their services with a proper box included? By proper, I mean a NAT/firewall, not a USB-connected DSL modem. > (c) Amusingly, it's possible > to detect new end-user allocations and service rollouts by noting when > spam starts to arrive from them. (e.g. the Verizon FIOS > deployment, if I > may use hostnames of the form *.fios.verizon.net as a guide, is going > well in NYC, Dallas, DC, Tampa, Philly, LA, Boston and > Newark, but lags > behind in Seattle, Pittsburgh, Buffalo and Syracuse.) I wonder if Verizon is violating any SEC rules by not reporting this information publicly? This is a good example of something that would not be revealed if they provided a NAT/firewall box to every customer who didn't already have one. Has anyone implemented a tool that ISPs could use to detect whether or not a NAT/firewall device is present? Perhaps based on OS fingerprinting? Or even based on an agent that must be installed by the customer? If such tools are available then an ISP could offer customers a discount for being compliant with a NAT/firewall rule in their contract. --Michael Dillon

5 4

Drone Armies C&C Report - 19 Feb 2007
by c2report＠isotf.org 19 Feb '07

19 Feb '07

This is a periodic public report from the ISOTF's affiliated group 'DA' (Drone Armies (botnets) research and mitigation mailing list / TISF DA) with the ISOTF affiliated ASreport project (TISF / RatOut). For this report it should be noted that we base our analysis on the data we have accumulated from various sources, which may be incomplete. Any responsible party that wishes to receive reports of botnet command and control servers on their network(s) regularly and directly, feel free to contact us. For purposes of this report we use the following terms open the host completed the TCP handshake closed No activity detected reset issued a RST This month's survey is of 5730 unique, domains (or IPs) with port suspect C&Cs. This list is extracted from the BBL which has a historical base of 15292 reported C&Cs. Of the suspect C&Cs surveyed, 682 reported as Open, 1990 reported as closed, and 749 issued resets to the survey instrument. Of the C&Cs listed by domain name in the our C&C database, 7228 are mitigated. Top 20 ASNes by Total suspect domains mapping to a host in the ASN. These numbers are determined by counting the number of domains which resolve to a host in the ASN. We do not remove duplicates and some of the ASNs reported have many domains mapping to a single IP. Note the Percent_resolved figure is calculated using only the Total and Open counts and does not represent a mitigation effectiveness metric. Percent_ ASN Responsible Party Total Open Resolved 19318 NJIIX-AS-1 - NEW JERSEY INTERN 133 16 88 13301 UNITEDCOLO-AS Autonomous System of 89 35 61 4766 KIXS-AS-KR 63 17 73 30058 FDCSE FDCservers.net LLC 45 14 69 23522 CIT-FOONET 45 24 47 7132 SBC Internet Services 41 3 93 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 39 8 79 8560 SCHLUND-AS 37 3 92 14779 INKT Inktomi Corporation 36 0 100 9318 HANARO-AS 35 2 94 33597 InfoRelay Online Systems, Inc. 31 0 100 174 Cogent Communications 31 27 13 4713 OCN NTT Communications Corporation 28 24 14 3561 Savvis 28 0 100 4134 CHINANET-BACKBONE 27 6 78 16265 LEASEWEB AS 26 5 81 24611 AS24611 Datacenter Luxembourg S.A. 26 0 100 12832 Lycos Europe 25 0 100 9121 TTNet 25 1 96 3786 ERX-DACOMNET 23 9 61 Top 20 ASNes by number of active suspect C&Cs. These counts are determined by the number of suspect domains or IPs located within the ASN completed a connection request. Percent_ ASN Responsible Party Total Open Resolved 13301 UNITEDCOLO-AS Autonomous System of 89 35 61 174 Cogent Communications 31 27 13 4713 OCN NTT Communications Corporation 28 24 14 23522 CIT-FOONET 45 24 47 25973 Mzima Networks, Inc. 20 18 10 4766 KIXS-AS-KR 63 17 73 30506 Blacksun Technologies 17 17 0 19318 NJIIX-AS-1 - NEW JERSEY INTERN 133 16 88 30058 FDCSE FDCservers.net LLC 45 14 69 23832 SPACELAN KANAZAWA CABLE TELEVISION 11 11 0 29339 MBBG-AS Markus Bach Betriebs Gesell 10 10 0 31103 KEYWEB-AS Keyweb AG 11 10 9 11260 Andara High Speed Internet c/o Hali 10 9 10 3786 ERX-DACOMNET 23 9 61 4837 CHINA169-Backbone 22 8 64 9800 UNICOM 18 8 56 13213 UK2NET-AS UK-2 Ltd Autonomous Syste 39 8 79 24989 IXEUROPE-DE-FRANKFURT-ASN IX Europe 21 7 67 25761 STAMIN-2 Staminus Communications 21 7 67 8001 Net Access Corporation 13 7 46 A version of this report with addition rankings can be found via the isotf.org home page. Randal Vaughn Gadi Evron Professor ge at linuxbox.org Baylor University Waco, TX (254) 710 4756 randy_vaughn at baylor.edu

1 0

Road Runner (as10994) NOC contact?
by David Hubbard 19 Feb '07

19 Feb '07

All of their listed contact info is for abuse and that just gets you a voice greeting that tells you to email abuse and then hangs up on you. Trying to troubleshoot an issue between Road Runner Tampa and Level 3. Thanks, David

1 0

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> > Now, even those people have shifted to a hierarchical > architecture of > > instant-messaging servers. > > In what way is IM hierarchial? > Jabber/XMPP has a mesh-of-stars topology That is hierarchy. One level is a star topology, the next level is a mesh. > which is the same as email's > modulo some simplifications (mainly owing to the lack of forwarding). In other words, it is not the same as email's. Of course it may end up that way but we can hope. > ISTR that you were arguing in favour of a chain-of-trust > system for email > back in November on the IETF list. I pointed out that the > architecture you > are proposing is essentially the same as inter-domain routing > (IP & BGP) > and Usenet, and you failed to explain how your ideas would solve the > unwanted traffic problem for email given that the same architecture > doesn't solve the unwanted traffic problem for IP or NNTP. An abstract simplification of an architecture is not equal to the architecture itself. The fact that you can simplify different architectures into a similar abstract model, doesn't mean that they have the same problems. Problems often arise in the details of implementation, not in the theoretical models. I never claimed that my proposed email model would solve the unwanted mail problem. It was intended to carry authenticated sender info to the receiver, and to provide an authenticated reverse path for complaints to postmaster. And since it was based on negotiated bilateral email peering agreements, if the chain of trust was subverted at some point in the chain, the peer would have legal recourse to cut service. --Michael Dillon

1 0

Hackers hit key Internet traffic computers
by Roy 19 Feb '07

19 Feb '07

Its amazing how reporters has to butcher technology information to make it understood by their editors http://www.cnn.com/2007/TECH/internet/02/06/internet.attacks.ap/index.html?…

28 43

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> I look forward to your paper on "the end to end concept, and > why it doesn't > apply to email" ;) Clearly the answer is that it never has applied to email in the pasts. Hosts don't email each other, people do. People have always relied on Internet postmaster services to enable Internet email. Given that we have already thrown out the end-to-end concept from day one, why must we maintain such a brain-dead flat architecture. People who wanted the end-to-end concept used to use "talk" on UNIX and Windows popup messages until recently. Now, even those people have shifted to a hierarchical architecture of instant-messaging servers. > I'm not convinced there is an email architecture problem of > relevance to the > discussion. People mistake a security problem for its most > visible symptoms. There is more than one security problem here. A well-thought-out email architecture will only address one of those security problems. > The SMTP based email system has many faults, but it seems > only mildly stressed > under the onslaught of millions of hosts attempting to > subvert it. It depends where you measure that stress. The decline of Internet email mindshare in favour of IM and Web forums indicates to me that it is severely stressed at the user level. > We may need a trust system to deal with identity within the > existing email > architecture, Bingo! > but I see no reason why that need be > hierarchical, indeed > attempts to build such hierarchical systems have often failed > to gather a > critical mass, but peer to peer trust systems have worked > fine for decades > for highly sensitive types of data. Peer-to-peer is a form of hierarchy. If you decide to trust X, Y, and Z and also trust all the hosts that X, Y and Z trust, then you have a trust hierarchy carved out of the peer-to-peer space. So if I trust AOL, Earthlink and Verizon, and I also trust all those trusted by these three, then you can't talk to my mail server until you arrange trust with me, or with one of the three trusted mail systems. Fact is that the email architecture does not include any form of trust and things like Sender-ID and DKIM are only bandaids that don't solve the problem and introduce additional insecurities. Additionally, if we can introduce hierarchy into the mail flow, we also introduce points at which cost-based models of spam prevention can be tried. If you can pay a penny a message to guarantee that your mail gets delivered quickly, bypassing any spam-filtering checkpoints, then that is something that the majority of users would buy into and the money provides grease for the wheels of the system, making it worthwhile to do things like set up an email peering agreement. Let's face it, the Internet of the early 90's is gone. It won't be coming back either. The challenge now is to operate a network that is capable of being *THE* global communications infrastructure. If the public Internet doesn't adapt to this job, then other networks will leverage the IETF's technology to do so. --Michael Dillon

3 2

RE: botnets: web servers, end-systems and Vint Cerf
by michael.dillon＠bt.com 19 Feb '07

19 Feb '07

> NATting firewalls don't help at all with email-delivered malware, > browser exploits, etc. If the firewall is configured to block all outgoing traffic to port 25 servers, then it helps considerably. After all outgoing email should be going to port 587. And if the system designer is creative enough, then this firewall thingy which is reputed to protect you from bad stuff, would also download and install the latest patches to protect against browser exploits. If this is all run on a separate CPU it can also do some pretty in-depth inspection and do things like block .exe attachements in email. None of this is rocket science. The hardware available today can do this. This hardware is not expensive. It does, however, require systems vendors to have a bit of imagination and that seems to be in rather short supply in the modern world. --Michael Dillon

2 1

Re: Measurement data on transit traffic in IP routers?
by Frank Coluccio 19 Feb '07

19 Feb '07

>Your statement makes something of a presumption >as to the architecture of a network. In many >networks, edge aggregation devices do not >participate in backbone routing, but simply >pass the traffic they are aggregating into the core. My first reaction, as well. However, I was reminded by Andrew Odlyzko that the cable tv industry's (MSOs') peering universe constitute a form of flattened 'edge', if one were to consider the larger Internet's core against the MSO community, which makes for another form of interesting analysis, since much of today's (especially more capacious) residential "broadband" flows begin and end on MSOs' networks, and sometimes never touch the larger core, fwiw. And this opens the door to other forms of "walled garden" environments, including intranets, some providers' CDNs, extranets, and so on. Frank A. Coluccio DTI Consulting Inc. 212-587-8150 Office 347-526-6788 Mobile On Sun Feb 18 10:54 , Andrew Lee sent: > >Hi Chris > >Your statement makes something of a presumption as to the architecture >of a network. In many networks, edge aggregation devices do not >participate in backbone routing, but simply pass the traffic they are >aggregating into the core. > >One fairly well instrumented network that does have this edge/core >collapsed model is the Internet2 network. You can find a lot of traffic >and other data for the network at: >http://noc.net.internet2.edu/i2network/live-network-status.html >You should be able to extract all the info you need from there. > >/Andrew > >Chris Develder wrote, On 2/18/07 5:46 AM: >> >> Hi All, >> >> In preparation of a course, I'm looking for reference material (paper, >> report, talk...) giving real world data on the amount of transit traffic >> (ie. not locally dropped or added, but passing through to other >> (backbone) routers) in a "typical" edge router of a core network, esp. >> ratio of local vs passthrough traffic (is it 30%, 40%...?) -- I don't >> need absolute figures, just realistic estimates of that ratio. >> >> Any help in locating such references would be highly appreciated. >> >> Kind regards, >> Chris >>

1 0