- Test - lists.nanog.org

Sagonet - Failing miserably with network security Someone needs to handle this.
by Chris Jester 29 Oct '06

29 Oct '06

65.110.62.120 Sagonet, We have a serious hacker here who is ACTIVLY engaged in logins on our network (have him in a honeypot at the moment). He is running exploits from your network and also I have been hearing from others that you have been notified of this a few times yet have done nothing about it. Can we get someone to handle this immediately please? This hacker has rooted at least 35 servers on a friends network (friendly competitor) and now hes scanning ours... This is what was said by my friend after contacting you guys about this: "Good... They will not listen... I have provided them logs, screen shots, etc..." Additionally, I would LOVE to know what is on that server... this guy is not to be taken lightly, he is VERY methodical and patient. He's problably owning your network too. [root@mail /home]# netstat -an Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN tcp 0 0 :::38300 :::* LISTEN tcp 0 0 ::ffff:66.11.112.15:38300 ::ffff:65.110.62.120:59979 ESTABLISHED ESTABLISHED

3 2

Re: Sagonet - Failing miserably with network security Someone needs to handle this.
by Chris Jester 29 Oct '06

29 Oct '06

> Chris, > > What kind of activity are you seeing once he's in the servers? At > Webair we're primarily web hosting, and some customer boxes were > compromised over recent months. > > I'm curious because you say he was very patient and methodical. I've asked > around with a few friends and they have seen this guy too.. just as in > your case > > Anyway, it fits the profile of the guy we had. He was inserting references > to megacount.net, and some obfuscated javascript code. He has been hard to > get rid of.. > > Sincerely, > > ---------------------------------------- > Brian Hourigan > Lead Technical Support Specialist/ > Programming Development Team > Webair Internet Development, Inc. > Fax: 516.938.5100 > http://www.webair.com > ---------------------------------------- > We are interested in any feedback you might have about the service > you received. Please contact our technical support consumer care manager > directly 1.866.WEBAIR1 or e-mail customercare(a)webair.com > > On Sun, 29 Oct 2006, Chris Jester wrote: > >> >> 65.110.62.120 >> >> Sagonet, >> >> We have a serious hacker here who is ACTIVLY engaged in logins >> on our network (have him in a honeypot at the moment). He is running >> exploits from your network and >> also I have been hearing from others that you have been notified of this >> a few times yet have done nothing about it. Can we get someone to >> handle >> this immediately please? >> >> This hacker has rooted at least 35 servers on a friends network >> (friendly >> competitor) and now hes scanning ours... >> >> This is what was said by my friend after contacting you guys about this: >> "Good... They will not listen... I have provided them logs, screen >> shots, >> etc..." >> >> Additionally, I would LOVE to know what is on that server... this guy is >> not to be taken lightly, he is VERY methodical and patient. He's >> problably >> owning your network too. >> >> [root@mail /home]# netstat -an >> Active Internet connections (servers and established) >> Proto Recv-Q Send-Q Local Address Foreign Address >> State >> tcp 0 0 0.0.0.0:21 0.0.0.0:* >> LISTEN >> tcp 0 0 :::38300 :::* >> LISTEN >> tcp 0 0 ::ffff:66.11.112.15:38300 >> ::ffff:65.110.62.120:59979 >> ESTABLISHED >> ESTABLISHED >> >> > In the honeypot server we have him in, he is storing files in /dev/k4rd Bash has been replaced with a "key logging" bash, het gets everything you type, passwords included, emailed back to him at root(a)65.110.62.120 There seems to be ALOT of files in /dev/k4rd, a bin directory and etc. He hacked the kernel so good that its VERY difficult to track his moves without booting off another drive first. We boot off a live linux cd enviornment to do studies on what he is up to, but before we do that we let him hack it up nicely so we get all his tricks. Note: he cannot really touch any other servers as he is stuck in a faked network enviornment at this moment. Pinging yahoo.com for example will generate a reply and a faked dns entry, but the packets never leave the zone he is in. His motivation seems to be to gather nats affilaite and customer data. He has an exploit that works on any and all nats installations. Were not going to release that until nats has been notified and had time to secure it. Were also seeing "traffic skimming" being attempted. He is searching for scripts (that we put there just to see what he does with them) that log traffic hits and etc.... He modifies these scripts so that randomly, but rarely, hits are re-directed to a web site called cgi-dnsl.com ( porn ). I dont mean to be a brat to Sagonet, but this is always the source of this hacker and his home never changes, its always on that single ip. Chris Jester NJesterIII

1 0

Re: BCP38 thread 93,871,738,435 (was Re: register.com down sev0?)
by Fergie 29 Oct '06

29 Oct '06

No. I think that is indicative of the problem. Don't you? - ferg -- Sean Donelan <sean(a)donelan.com> wrote: On Thu, 26 Oct 2006, Fergie wrote: > I don't want to detract from the heat of this discussion, as > important as it is, but it (the discussion) illustrates a point > that RIPE has recognized -- and is actively perusing -- yet, ISPs > on this continent seem consistently to ignore: The consistent > implementation of BCP 38. > > It is nothing less than irresponsible, IMO... > > Why _is_ that? Do you have any data concerning the actual consistent deployment of BCP38++ in different parts of the world? -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

14 23

RE: Reclassification of NON-PORTABLE address space?
by John van Oppen 29 Oct '06

29 Oct '06

Are you referring to space you got directly from ARIN? If so, it is by definition portable. If it is space from a provider it belongs to the provider, not you and is thus not portable. john ________________________________ From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Roldan, Brad Sent: Friday, October 27, 2006 4:52 PM To: nanog(a)merit.edu Subject: Reclassification of NON-PORTABLE address space? Anyone know if there is a precedent for reclassifying blocks of non-portable address space to portable? I didn't see anything in ARIN archives (maybe I didn't look hard enough). Bribery? Threats? Acquisition of the assignor by the assignee? If such a reclassification were simple, I expect that the process would be heavily abused by smaller networks that would like to avoid renumbering. Brad -- Covad Communications 2510 Zanker Road San Jose, CA 95131 +1-408-434-2048

1 0

power cords for .nl
by matthew zeier 29 Oct '06

29 Oct '06

Mozilla going to be opening a POP in Amsterdam in December and I'm trying to get gear and power cords ordered before then (haven't yet figured out where we're going but some of my gear has long lead times). Can anyone help me figure out what sort of power cords I need? I'm interested in using Server Tech's 208-240V/20A PDUs which, according to their datasheet, have IEC603320/C20 inlets with 320/C13 outlets. Is that what I'll find out there? What sort of cords am I looking at for my 6503-Es (Cisco shipped me US cords)? Thanks! -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

3 2

register.com down sev0?
by alex＠pilosoft.com 28 Oct '06

28 Oct '06

I'm seeing *.register.com down (including ns*) from everywhere. Just a heads-up. Would be interesting to see the RFO for that one, including the "why we didn't have any DNS servers offsite or used anycast to at least limit amount of damage". -alex

20 30

Re: register.com down sev0?
by Charles J. Knipe 28 Oct '06

28 Oct '06

Paul, As of right now I'm not prepared to comment on our recent outage in this forum. That said, I do want to discuss your assertion that Register.com is a source of spam. Spam mail is something we take very seriously. As a business we do not send spam email and we have procedures in place to address spam sent by our customers. If you're seeing spam involving us, and haven't gotten any traction from our abuse desk (abuse(a)register.com) I'd like to know about it. I've privately emailed you my phone number, please give me a call, so we can discuss this further. -- Charles Knipe Manager - Infrastructure Services Register.com, Inc.

8 8

ICANN Registrar Policy [Was: Re: register.com down sev0?]
by Fergie 28 Oct '06

28 Oct '06

On a semi-related note, I feel compelled to add that it seems to be getting worse with regards to "due diligence" paid by domain registrars in how domains are being "issued", as well: http://www.f-secure.com/weblog/#00001008 - ferg -- Jeremy Chadwick <nanog(a)jdc.parodius.com> wrote: [snip] The entire situation is depressing, solely because ICANN is doing absolutely nothing to try and stop this sort-of behaviour (both what the DROA does, and registrars selling their customers' WHOIS records to whoever bids the most for it). [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

re: passports for NANOG-39, Toronto
by Alex Rubenstein 28 Oct '06

28 Oct '06

> You may have heard that the US and Canada are going to start requiring > passports for air travel between them beginning "soon". That date is > currently set as 8 Jan 2007, which is before February NANOG. MERIT > has noted this on the web site, but a cursory check of my list > archives didn't turn up mention of it (sorry if I overlooked it; the > last couple of weeks have been hectic), so I figured I'd include the > pointer: FYI, this date only applies to air or sea (which I imagine is the bulk of people going). However, for land crossings: http://travel.state.gov/travel/tips/regional/regional_1170.html "The Intelligence Reform and Terrorism Prevention Act of 2004 requires that, by January 1, 2008, travelers to and from the Caribbean, Bermuda, Panama, Mexico and Canada have a passport or other secure, accepted document to enter or re-enter the United States." [...] The travel initiative requirements will be rolled out in phases. The proposed implementation timeline is as follows: December 31, 2006 - Passport required for all air and sea travel to or from Canada, Mexico, Central and South America, the Caribbean, and Bermuda. December 31, 2007 - Passport required for all land border crossings, as well as air and sea travel.

6 5

Reclassification of NON-PORTABLE address space?
by Roldan, Brad 27 Oct '06

27 Oct '06

Anyone know if there is a precedent for reclassifying blocks of non-portable address space to portable? I didn't see anything in ARIN archives (maybe I didn't look hard enough). Bribery? Threats? Acquisition of the assignor by the assignee? If such a reclassification were simple, I expect that the process would be heavily abused by smaller networks that would like to avoid renumbering. Brad -- Covad Communications 2510 Zanker Road San Jose, CA 95131 +1-408-434-2048

1 0