- Test - lists.nanog.org

This fall in LA
by Susan Harris 01 Sep '05

01 Sep '05

Greetings everyone - registration is now open for the fall NANOG meeting, to be held Oct. 23-25 in Los Angeles. This is our fourth back-to-back meeting with ARIN - a joint venture that's proven very successful at giving operators direct access to the all-important folks who hand out IP addresses and ASNs in North America. ARIN meets just after NANOG, from Oct. 26-28. NEW THIS FALL: an in-depth "Getting Started With IPv6" workshop, to be held Sunday from 9am-4:30 p.m. Workshop info and registration is here: http://www.arin.net/ARIN-XVI/ipv6_workshop.html NANOG registration is here: https://www.merit.edu/nanog/registration.form.html See you in Los Angeles!

2 2

Re: Has someone in Asia exploited Cisco
by Robert Guess 01 Sep '05

01 Sep '05

Offhand, I would be tempted to say it is the activity of a not exceedingly competent attacker trying to exploit a very old bug. The sender is probing for the HTTP Authentication Bypass Issue from June 27 2001. Original Advisory http://www.cisco.com/warp/public/707/IOS-httplevel-pub.html Malicious request: http://<device_addres>/level/16/exec/ Analyze the timing and source of log events to determine if it is an automated issue. Robert Guess Assistant Professor, Information Systems Technology Tidewater Community College (757) 822-5022 () ascii ribbon campaign /\ against html email >>> "J. Oquendo" <sil(a)politrix.org> 09/01/05 9:07 AM >>> After doing some logfile analysis briefly yesterday, I noticed what seems to be some form of bot, worm, something, searching for what could seems to point to a Cisco exploitation of sorts. (http://tinyurl.com/df9d8) All the hosts who've tried searching for the string are coming from APNIC. So I'm wondering... Has someone taken Michael Lynn's paper "Holy Grail" and produced a "DaVinci Code" to exploit the flaws Lynn spoke of... Code snippet below is of "cisco_scanner.c" which searches for the same particular /level/16/exec/-///pwd string however the code can be modified (obviously) and a search turns up less than one page of results on Google. Author's page seems to be gone like the wind... Anyhow. # grep "/level/16/exec/-///" access_log |awk '{print $1,"\t\t"$7}' 58.236.50.75 /level/16/exec/-///pwd 221.141.168.137 /level/16/exec/-///pwd 221.138.93.31 /level/16/exec/-///pwd 218.53.244.16 /level/16/exec/-///pwd 222.232.84.34 /level/16/exec/-///pwd 222.238.128.14 /level/16/exec/-///pwd 218.50.74.189 /level/16/exec/-///pwd 218.239.26.42 /level/16/exec/-///pwd 218.232.83.18 /level/16/exec/-///pwd 211.208.254.67 /level/16/exec/-///pwd whois.apnic.net $ABOVE_HOSTS Code snippet... /* Multi-thread Cisco HTTP vulnerable scanner v0.2 by Inode */ #define HTTP_REQUEST "GET /level/16/exec/-///pwd HTTP/1.0\n\n" So now I have yet another mod_security rule added ;) SecFilterSelective THE_REQUEST "/level/16" "redirect:http://www.cisco.com" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 It is much easier to suggest solutions when you know nothing about the problem. -- Niklaus Wirth

1 0

Has someone in Asia exploited Cisco
by J. Oquendo 01 Sep '05

01 Sep '05

After doing some logfile analysis briefly yesterday, I noticed what seems to be some form of bot, worm, something, searching for what could seems to point to a Cisco exploitation of sorts. (http://tinyurl.com/df9d8) All the hosts who've tried searching for the string are coming from APNIC. So I'm wondering... Has someone taken Michael Lynn's paper "Holy Grail" and produced a "DaVinci Code" to exploit the flaws Lynn spoke of... Code snippet below is of "cisco_scanner.c" which searches for the same particular /level/16/exec/-///pwd string however the code can be modified (obviously) and a search turns up less than one page of results on Google. Author's page seems to be gone like the wind... Anyhow. # grep "/level/16/exec/-///" access_log |awk '{print $1,"\t\t"$7}' 58.236.50.75 /level/16/exec/-///pwd 221.141.168.137 /level/16/exec/-///pwd 221.138.93.31 /level/16/exec/-///pwd 218.53.244.16 /level/16/exec/-///pwd 222.232.84.34 /level/16/exec/-///pwd 222.238.128.14 /level/16/exec/-///pwd 218.50.74.189 /level/16/exec/-///pwd 218.239.26.42 /level/16/exec/-///pwd 218.232.83.18 /level/16/exec/-///pwd 211.208.254.67 /level/16/exec/-///pwd whois.apnic.net $ABOVE_HOSTS Code snippet... /* Multi-thread Cisco HTTP vulnerable scanner v0.2 by Inode */ #define HTTP_REQUEST "GET /level/16/exec/-///pwd HTTP/1.0\n\n" So now I have yet another mod_security rule added ;) SecFilterSelective THE_REQUEST "/level/16" "redirect:http://www.cisco.com" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 It is much easier to suggest solutions when you know nothing about the problem. -- Niklaus Wirth

1 0

Boing Boing: Clearinghouse for Katrina tech assistance contacts
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Since gripes here on the list about opsts regarding the Hurricane Katrina aftermath issues, I just wanted to point out that Bong Boing has seemingly become the clearinghouse for much tech info on efforts to provide some sort tech and communications assistance in the Gulf Coast region. So, I'd stay tuned over on Boing Boing if you want to stay in the loop on that particular issue: http://boingboing.net/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: August 2005: Drone Army Botnet C&C listing
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Yes. And thanks. - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > 30058 FDCSERVERS - FDCservers.net LL 123 43 > 21840 SAGONET-TPA - Sago Networks 53 26 > Much better. And no IL-CERT. :-) Is it safe to say the resolutions, at least in these two cases, are because of others mitigation activities i.e. snatching back the RR's, shutting off the domain, black holes, etc? -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

August 2005: Drone Army Botnet C&C listing
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Keeping is step with Gadi's language from last month: Below is a periodic public report from the Drone Army(DA)/Botnet Research and mitigation mailing list. For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our analysis of information we have conducted thus far, we are now publishing our regular reports, with some additional information, which may vary from time to time, as needed. As of this July 2005, any responsible party that wishes to receive information about botnet C&C's in their net space can contact us and be added to our notification list. The principle contact is Paul Ferguson (Fergie). - ferg ==== Special appreciation is due to Staminus who took quick action to resolve the suspect C&Cs of the last report and rapidly resolved all of the suspect C&Cs which appeared during this current survey. AS responsible Parties ranked by top 10 open unresolved suspect C&Cs: ASN Responsible Party Total Open 30058 FDCSERVERS - FDCservers.net LL 123 43 21840 SAGONET-TPA - Sago Networks 53 26 13680 AS13680 Hostway Corporation Ta 23 23 15083 INFOLINK-MIA-US - Infolink Inf 37 21 6461 MFNX MFN - Metromedia Fiber Ne 28 17 8560 SCHLUND-AS Schlund + Partner A 26 17 30083 SERVER4YOU - Server4You Inc. 37 16 13237 LAMBDANET-AS European Backbone 15 12 9800 UNICOM CHINA UNICOM 14 11 27645 ASN-NA-MSG-01 - Managed Soluti 18 11 Historical Report ranked by past suspect C&Cs mapping into the AS: ASN Responsible Party Total Open Percent Resolved 14742 INTERNAP-BLOCK-4 - Internap Ne 142 2 99% 14744 30058 FDCSERVERS - FDCservers.net LL 123 43 65% 10913 INTERNAP-BLK - Internap Networ 84 0 100% 25761 STAMINUS-COMM - Staminus Commu 58 0 100% 21840 SAGONET-TPA - Sago Networks 53 26 51% 3356 LEVEL3 Level 3 Communications 43 5 88% 21844 THEPLANET-AS - THE PLANET 38 5 87% 30083 SERVER4YOU - Server4You Inc. 37 16 57% 15083 INFOLINK-MIA-US - Infolink Inf 37 21 43% 11739 DIGITAL-FOREST-NW - digital.fo 29 0 100% 16237 NXS Nxs Internet BV 29 0 100% The report summary includes a Percent Resolved Column in order to recognize the mitigation efforts of the AS Responsible Parties. The Opens Unresolved column represents the number of unique C&C which reported as open to the survey's connection attempts and which have neither been investigated nor cleared by the Responsible Party (to the extent of our knowledge). The Total mapping count may include multiple names mapping to a single IP within an AS. We count each mapping count as a unique C&C. Stats for the DA group compiled by: Randal Vaughn Professor Information Systems Baylor University Randy_Vaughn (at) Baylor.edu -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Peering Contact Database
by Deepak Jain 31 Aug '05

31 Aug '05

Hey. Hopefully this is operational. If someone could send me a copy of the current (or most recent) Peering Contact Database. I know Bill Norton used to distribute it, but I seem to have fallen off the distribution list or its getting eaten by my spam filters. (really operational: I want to make sure there are no prospective peers at Equinix/Ashburn that I may have missed on my last survey). Thanks, Deepak Jain AiNET

3 2

Re: Yahoo! -- A "Phisher-friendly" hosting domain?
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Someone is... or trying to, at least, watch and contact the responsible owners/registrars, but in some cases they aren't apparently eager to assist. That's why the ones that are caught end up in various RBL's... - ferg -- Alex Rubenstein <alex(a)nac.net> wrote: Shouldn't someone be watching these, though? root@sodium:~# whois paypal.com [...] PAYPAL.COM.SV04.COM PAYPAL.COM.LIMITSPEED.NET PAYPAL.COM While I agree in concept that this is not how the internet runs, and I am not proposing a domain name police force be instituted, it seems to me that things like this are easily caught. Not to mention, the purpose of them is clear. On Wed, 31 Aug 2005, Fergie (Paul Ferguson) wrote: > > That's good, however, I regret that the issue had to be > aired here because it didn't get attention it deserved > through "proper channels" and elsewhere... > > - ferg > > > -- Florian Weimer <fw(a)deneb.enyo.de> wrote: > >> But it caught my eye that SOMEBODY at Yahoo! ought to be reviewing >> domain names like "bankofthewestupdate.com" > > Registrars should as well, but this is not the way the Internet works. > Sometimes, this is a good thing, sometimes, it's not. > > It seems that the A RR has been pulled around 2005-08-30 21:00 UTC, so > this particular issue has already been resolved. > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ > -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben Net Access Corporation, 800-NET-ME-36, http://www.nac.net

2 1

RE: Katrina: directNIC Stays Online - Blog + Images
by Peering 31 Aug '05

31 Aug '05

Some ISPs managed to get FEMA to let a tanker through and that's how we're back up. It wasn't pretty though. Marshall Eubanks: I remember that after 9/11 the real network hits started about 3 days later, when the diesel generators started running out of fuel in the downtown telco hotels, and there was no way to physically get fuel trucks to their location. The equipment and generators were fine, they just ran out of fuel. If you look at the flooding in downtown New Orleans, it looks like this might happen again there.

1 0

Re: Yahoo! -- A "Phisher-friendly" hosting domain?
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

That's good, however, I regret that the issue had to be aired here because it didn't get attention it deserved through "proper channels" and elsewhere... - ferg -- Florian Weimer <fw(a)deneb.enyo.de> wrote: > But it caught my eye that SOMEBODY at Yahoo! ought to be reviewing > domain names like "bankofthewestupdate.com" Registrars should as well, but this is not the way the Internet works. Sometimes, this is a good thing, sometimes, it's not. It seems that the A RR has been pulled around 2005-08-30 21:00 UTC, so this particular issue has already been resolved. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2