- Test - lists.nanog.org

RE: advise on network security report
by Mike Callahan 01 Nov '06

01 Nov '06

>I beg to differ, wither I aggregate my announcements does not impact the >$50B charge identity theft puts on the US economy. Perhaps a better start on impacting this would be for the credit card companies to pursue the people that abuse their cards/systems instead of just writing fraudulent purchases off as a loss and not pursuing them any further. I been through it myself and I know for a fact that at least one major cc company operates in this way. In this model there's nothing to discourage someone from using stolen numbers. Just my $.02 ~M -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Rick Wesson Sent: Tuesday, October 31, 2006 8:02 PM To: Barry Greene (bgreene) Cc: nanog(a)merit.edu Subject: Re: advise on network security report Barry Greene (bgreene) wrote: > Postings like this to NANOG will not have any impact. So if your goal is > instigate action, posting is not going to work. The core data point is > the weekly CIDR report. It only works if you have peers using the weekly > list to apply peer pressure to the networks listed to act. I beg to differ, wither I aggregate my announcements does not impact the $50B charge identity theft puts on the US economy. would it assist if I associated a dollar value for each bot hosted, we can estimate the number of credit cards stolen per bot and extrapolate in to something with some zeros on it. > Sharing summaries to communities like dshield, NSP-SEC, DA, SANs and > other security mitigation communities along with a subscription web page > that would allow an organization to get enough details to take action. nsp-sec players still won't let us in their sand-box... but we will share to the communities you have enumerated. -rick

2 1

rbnnetwork.org
by Alexander Harrowell 01 Nov '06

01 Nov '06

Is hosting a phishing site and bouncing abuse reports.. ---------- Forwarded message ---------- From: Alexander Harrowell <a.harrowell(a)gmail.com> Date: Oct 31, 2006 2:38 PM Subject: Phisher To: abuse(a)rbnnetwork.org We're receiving large volumes of comments spam advertising a site hosted in your network. http://onlineinvestmentworld.com is located at 81.95.146.166, which is your netblock: inetnum: 81.95.144.0 - 81.95.147.255 netname: RBNET descr: Russian Business Network admin-c: RBNR-ORG tech-c: RBNR-ORG mnt-by: RBN-MNT status: ASSIGNED PA country: RU remarks: INFRA-AW changed: noc(a)rbnnetwork.com 20060 Tracert: 1 0 1 1 0.6 ms 66.36.240.2 AS14361 HOPONE-DCA c-vl102-d1.acc.dca2.hopone.net. 255 US Unix: 14:38:16.496 2 0 2 6 0.6 ms [+0ms] 66.36.224.232 AS0 IANA-RSVD-0 gec2.core1.dca2.hopone.net. 0 miles [+0] 254 US Unknown: 833f257b 3 0 0 1 0.7 ms [+0ms] 66.36.224.233 AS0 IANA-RSVD-0 gec2.core2.dca2.hopone.net. 0 miles [+0] 254 US Unix: 14:07:58.580 4 6 8 6 6.5 ms [+5ms] 198.32.160.102 AS0 IANA-RSVD-0 gi3-0.nyc-002-inter-1.interoute.net. 0 miles [+0] 253 US Unix: 14:37:46.936 5 * 75 77 74 ms [+67ms] 212.23.43.177 AS8928 INTEROUTE gi0-0.nyc-002-inter-1.interoute.net. 0 miles [+0] 248 GB Unix: 14:37:47. 45 6 * 75 75 74 ms [+0ms] 212.23.43.150 AS8928 INTEROUTE po3-0.lon-wal-core-2.interoute.net. 0 miles [+0] 250 GB Unix: 14:37:47.128 7 * 74 74 74 ms [+0ms] 217.118.119.26 AS8928 INTEROUTE te9-1.lon-wal-access-4.interoute.net. 0 miles [+0] 250 GB Unix: 14:37:47.162 8 * 85 78 78 ms [+3ms] 84.233.231.138 AS8928 INTEROUTE unknown.net.uk 0 miles [+0] 248 GB Unknown: 8100e8e2 9 * 124 125 124 ms [+46ms] 81.95.156.34 AS0 IANA-RSVD-0 gbit-eth-34-uk.sbttel.com. 0 miles [+0] 247 RU Unix: 14:37:16.972 10 * 125 124 124 ms [+0ms] 81.95.156.58 AS0 IANA-RSVD-0 oc-3-sbttel.rbnnetwork.com. 0 miles [+0] 55 RU Unix: 14:35:47.772 11 * 143 149 143 ms [+19ms] 81.95.146.166 ASN=40989[Destination Unreachable] ip-146-166.rbnnetwork.com.

4 3

RE: Cogent now peering with Sprint?
by Bob Collie 01 Nov '06

01 Nov '06

That looks like a transit connection that Cogent bought at Ashburn, VA, not SFI peering connection. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Ed Ray Sent: Tuesday, October 31, 2006 12:11 AM To: nanog(a)merit.edu Subject: Cogent now peering with Sprint? I never thought Sprint would ever renew its relationship with Sprint: Tracing the route to portus.netsecdesign.com (66.6.208.6) 1 sl-bb24-rly-9-0.sprintlink.net (144.232.14.122) 0 msec 0 msec 0 msec 2 sl-st22-ash-6-0.sprintlink.net (144.232.20.189) 0 msec 4 msec 0 msec 3 p15-2.core01.iad01.atlas.cogentco.com (154.54.13.61) [AS 174] 4 msec 4 msec 0 msec 4 v3492-mpd01.iad01.atlas.cogentco.com (154.54.3.222) [AS 174] 16 msec 80 msec 196 msec 5 v3497.mpd01.dca01.atlas.cogentco.com (154.54.5.65) [AS 174] 4 msec 4 msec 4 msec 6 t9-3.mpd01.iah01.atlas.cogentco.com (154.54.2.222) [AS 174] 44 msec 44 msec 48 msec 7 t2-3.mpd01.lax01.atlas.cogentco.com (154.54.3.186) [AS 174] 72 msec 72 msec 72 msec 8 g2-0-0.core01.lax01.atlas.cogentco.com (154.54.2.101) [AS 174] 72 msec 72 msec 72 msec 9 g49.ba01.b002698-1.lax01.atlas.cogentco.com (66.250.12.130) [AS 174] 72 msec 72 msec 72 msec 10 PAJO-Networks.demarc.cogentco.com (38.112.9.190) [AS 174] 72 msec 76 msec 72 msec 11 dcap04.pcap.lax01.tierzero.net (216.31.128.14) [AS 11509] 72 msec 76 msec 72 msec 12 mmic-gw.dcap6.lax.us.tierzero.net (216.31.188.94) [AS 11509] 76 msec 80 msec 80 msec 13 dazedandconfused.netsecdesign.com (66.6.208.4) [AS 11509] 84 msec 84 msec 88 msec 14 portus.netsecdesign.com (66.6.208.6) [AS 11509] 84 msec 84 msec 88 msec Next I will see pigs flying :) Wonder how long it will last based on Cogent's past behavior as noted here. Edward Ray ------------------------------------------------------------- This mail was scanned by BitDefender For more informations please visit http://www.bitdefender.com -------------------------------------------------------------

7 6

FYI: Explosions Reported At eBay PayPal Building In SJ, All Cool Now
by Fergie 01 Nov '06

01 Nov '06

No one injured, no operations interrupted on this, Oidhche Shamhna. http://cbs5.com/local/local_story_305004735.html Cheers, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

(OT)MSN/hotmail postmaster contact
by Edward F. Klimowicz 01 Nov '06

01 Nov '06

Is there a postmaster from MSN/Hotmail out there? Mail from my domain to any of yours is being junked and randomly blackholed. No progress has been made yet with the normal tech support. Please reply off list if you can help. -- Edward F. Klimowicz Voicenet Systems Administration edwardk(a)voicenet.com 215.259.2131

5 5

Reciprocal billing by independent LECs
by Ashe Canvar 31 Oct '06

31 Oct '06

Hi all, I am investigatng the reciprocal compensation model in use today between the ILECs and some independents. Specifically, many companies are offering multi party conferencing for free as a side effect of of this reciprocity fee. Seems like there were some disputes about it in the past : http://telephonyonline.com/mag/telecom_draining_incumbent_us/ So is this still a valid business model or is a crackdown by the ILECs in the cards ? All info appreciated. Thanks, Ashe Canvar.

1 0

ELI Issues in Seattle (Tukwila)?
by Bill Sehmel 30 Oct '06

30 Oct '06

Anyone else noticing ELI latency issues around the Seattle (Tukwila) area? Thanks Bill Sehmel -- Bill Sehmel - bsehmel(a)HopOne.net -- 1-206-242-2743 Systems Administrator, HopOne Internet Corp. SEA2 NOC Bandwidth & full range of carrier/web host colo + networking services: http://www.hopone.net#

1 0

RE: Sagonet - Failing miserably with network security Someone needs to handle this.
by Lasher, Donn 30 Oct '06

30 Oct '06

Not that this is his real name, or business, but a whois on the IP yields: [whois.arin.net] Sago Networks SAGO-20030401 (NET-65-110-32-0-1) 65.110.32.0 - 65.110.63.255 Anton Tenev SAGO-65-110-62-120 (NET-65-110-62-120-1) 65.110.62.120 - 65.110.62.129 -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Chris Jester Sent: Sunday, October 29, 2006 11:29 AM To: nanog(a)nanog.org Cc: abuse(a)sagonet.com Subject: Sagonet - Failing miserably with network security Someone needs to handle this. 65.110.62.120 Sagonet, We have a serious hacker here who is ACTIVLY engaged in logins on our network (have him in a honeypot at the moment). He is running exploits from your network and also I have been hearing from others that you have been notified of this a few times yet have done nothing about it. Can we get someone to handle this immediately please? This hacker has rooted at least 35 servers on a friends network (friendly competitor) and now hes scanning ours... This is what was said by my friend after contacting you guys about this: "Good... They will not listen... I have provided them logs, screen shots, etc..." Additionally, I would LOVE to know what is on that server... this guy is not to be taken lightly, he is VERY methodical and patient. He's problably owning your network too. [root@mail /home]# netstat -an Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 :::38300 :::* LISTEN tcp 0 0 ::ffff:66.11.112.15:38300 ::ffff:65.110.62.120:59979 ESTABLISHED ESTABLISHED

3 2

Re: advise on network security report
by Scott Weeks 30 Oct '06

30 Oct '06

Rick Wesson <wessorh(a)ar.com> wrote: : I would appreciate a bit of advise on : a service I am about to deploy. Thank you for asking rather than just doing! :-) : I'm expecting to post a weekly report once a : month to nanog, would this be disruptive? Only if you don't tag the subject line. Please tag it with something so those not interested can filter it out. mahalo! scott

1 0

Re: advise on network security report
by Fergie 30 Oct '06

30 Oct '06

Rick, It would interesting to know how you classify "incidents" in the table below.... - ferg -- Rick Wesson <wessorh(a)ar.com> wrote: I would appreciate a bit of advise on a service I am about to deploy. I've spoken at different venues (including nanog) on global infection rates of bots and the general degradation of well behaved hosts. I now track around 2.2M abuse events per day and now have the capability to produce reports for the community on which networks have the largest problems. I am prepared to make reports monthly to the community ordering networks by their volume of issues. I'd like some hints of which might be the most valuable to the community. o are hosts counts or issue counts more important o is a 7 or 30 day window sufficient for aggregation? o I'm not repaired for graphs yet so don't go there. o should I post sub-reports for regions, by RIR? o which kinds of abuse are more interesting. I'm expecting to post a weekly report once a month to nanog, would this be disruptive? We have a mailing list set up for weekly reports, once finalized I'll post the location for its list manager. The global report usually has about 6,000+ networks, the top 100 from last week are below. again, thanks for your feedback. -rick Table 1. Networks with abuse, ordered by #incidents +-------+-----------+------+-------------------------------------+ | asn | incidents | cc | left(asname,35) | +-------+-----------+------+-------------------------------------+ | 4134 | 517830 | CN | CHINANET-BACKBONE | | 9121 | 331955 | EU | TTNet | | 4837 | 289984 | CN | CHINA169-Backbone | | 3320 | 231516 | DE | Deutsche Telekom AG | | 3352 | 211504 | ES | TELEFONICA-DATA-ESPANA Internet Acc | | 5617 | 194685 | PL | TPNET | | 3215 | 181686 | FR | AS3215 | | 3269 | 175858 | EU | ASN-IBSNAZ | | 4766 | 129722 | KR | KIXS-AS-KR | | 19262 | 125003 | US | Verizon Internet Services | | 8551 | 116014 | EU | ISDN-NET-AS | | 3209 | 94981 | DE | UNSPECIFIED | | 3462 | 82089 | TW | HINET | | 9829 | 80538 | IN | BSNL-NIB | | 8151 | 79223 | EU | Uninet S.A. de C.V. | | 8359 | 73640 | RU | MTUONLINE | | 5486 | 65757 | EU | Euronet Digital Communications | | 12322 | 65638 | FR | PROXAD AS for Proxad ISP | | 4788 | 53863 | MY | TMNET-AS-AP | | 9116 | 53375 | IL | Goldenlines main autonomous system | | 4814 | 52712 | CN | CHINA169-BBN | | 22927 | 51899 | AR | Telefonica de Argentina | | 4812 | 46462 | CN | CHINANET-SH-AP | | 1680 | 45848 | IL | NETVISION | | 9105 | 44450 | UK | TISCALI-UK | | 15557 | 42792 | FR | LDCOMNET | | 9498 | 42774 | IN | BBIL-AP | | 8584 | 41914 | US | Barak AS | | 2856 | 41820 | EU | BT-UK-AS | | 13184 | 41688 | DE | HANSENET HanseNet Telekommunikation | | 9318 | 40930 | KR | HANARO-AS | | 12479 | 39009 | EU | UNI2-AS Uni2 Autonomous System | | 6147 | 38716 | US | Telefonica del Peru S.A.A. | | 3243 | 38586 | PT | RIPE NCC ASN block | | 6713 | 35777 | EU | IAM-AS | | 12876 | 35068 | FR | AS12876 | | 6739 | 32639 | ES | ONO-AS | | 8228 | 32352 | FR | CEGETEL-AS CEGETEL ENTREPRISES | | 1267 | 31869 | IT | ASN-INFOSTRADA Infostrada S.p.A. | | 7418 | 30221 | EU | Terra Networks Chile S.A. | | 5462 | 28861 | UK | CABLEINET Telewest Broadband | | 8708 | 28236 | EU | RDSNET | | 5430 | 27245 | DE | FREENETDE | | 7470 | 24729 | TH | ASIAINFO-AS-AP | | 5610 | 24279 | CZ | CZECHTELECOM CZECH TELECOM, a.s | | 16338 | 23956 | ES | AUNA_Telecom-AS | | 4713 | 23650 | JP | OCN NTT Communications Corporation | | 12424 | 22932 | ES | JAZZASN Autonomous System | | 5089 | 21322 | EU | NTL NTL Group Limited | | 17813 | 20792 | IN | MTNL-AP Mahanagar Telephone Nigam L | | 5483 | 20511 | EU | HTC-AS Hungarian Telecom | | 4755 | 19673 | UK | VSNL-AS | | 8764 | 19571 | LT | TELECOMLT-AS | | 28725 | 18369 | CZ | CZ-EUROTEL-AS AS of Eurotel Praha | | 6830 | 18360 | HU | UPC | | 12542 | 17893 | PT | TVCABO Autonomous System | | 9299 | 17854 | PH | IPG-AS-AP | | 18101 | 17325 | IN | RIL-IDC Reliance Infocom Ltd Intern | | 3257 | 16918 | DE | TISCALI-BACKBONE | | 1257 | 16418 | FI | TELE2 AB | | 8881 | 15944 | DE | VERSATEL | | 5713 | 15566 | XX | Telkom SA Ltd. | | 6855 | 15420 | SK | SK SLOVAK TELECOM, AS6855 | | 9304 | 15311 | HK | HUTCHISON-AS-AP | | 5391 | 14937 | EU | T-HT T-Com Croatia Internet network | | 9583 | 14785 | IN | SIFY-AS-IN | | 209 | 14678 | US | Qwest | | 22047 | 14499 | XX | VTR BANDA ANCHA S.A. | | 6849 | 14419 | EU | UKRTELNET | | 24863 | 13616 | EU | LINKDOTNET-AS LINKdotNET AS number | | 8167 | 13184 | BR | TELESC - Telecomunicacoes de Santa | | 20838 | 12898 | ES | YIF-AS | | 6400 | 12563 | XX | Codetel | | 2860 | 12467 | PT | NOVIS Novis Telecom, S.A. | | 13285 | 12347 | UK | OPALTELECOM-AS | | 18403 | 12230 | VN | FPT-AS-AP The Corporation for Finan | | 7132 | 12031 | US | SBC Internet Services | | 20115 | 11683 | US | Charter Communications | | 8452 | 11507 | EU | TEDATA TEDATA | | 4230 | 11385 | BR | Embratel | | 5384 | 10946 | EU | EMIRATES-INTERNET | | 1221 | 10629 | AU | ASN-TELSTRA | | 28573 | 10475 | BR | NET Servicos de Comunicao S.A. | | 8866 | 10434 | BG | BTC-AS | | 9506 | 10126 | SG | MAGIX-SG-AP | | 8997 | 10123 | RU | ASN-SPBNIT SPBNIT-RU Autonomous Sys | | 8404 | 9941 | EU | CABLECOM | | 7693 | 9719 | TH | COMNET-TH | | 12880 | 9663 | IR | DCI-AS | | 6057 | 9432 | XX | Administracion Nacional de Telecomu | | 8402 | 9224 | RU | CORBINA-AS | | 6478 | 8943 | XX | AT&T WorldNet Services | | 5603 | 8913 | SI | SIOL-NET SiOL Internet d.o.o. | | 6327 | 8912 | CA | Shaw Communications Inc. | | 3303 | 8823 | CH | SWISSCOM | | 7552 | 8770 | VN | VIETEL-AS-AP Vietel Corporation | | 11427 | 8757 | XX | Road Runner | | 5466 | 8736 | IE | EIRCOM Eircom | | 6799 | 8634 | GR | OTENET-GR OTEnet S.A. Multiprotocol | | 10318 | 8526 | XX | CABLEVISION S.A. | +-------+-----------+------+-------------------------------------+ -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4