- Test - lists.nanog.org

Any additional info. on BT DDoS?
by Fergie (Paul Ferguson) 03 Dec '04

03 Dec '04

It would be interesting to know if anyone has any additional information (other than what was reported on CNet) on the reported DDoS on the BitTorrent servers on Wednesday.... http://news.com.com/BitTorrent+servers+under+attack/2100-7349_3-5473754.htm… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Chad Skidmore 03 Dec '04

03 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Justin Ryburn [mailto:justin@ryburn.org] > Sent: Thursday, December 02, 2004 4:18 PM > To: Chad Skidmore; nanog(a)merit.edu > Subject: Re: How many backbones here are filtering the > makelovenotspam scr eensaver site? > > This is what scares me. Who determines the "bad guys?" I > don't know anyone over at Lycos so I have no trust (or lack > there of) in Lycos. Who is to say that Lycos won't decide > next month that Yahoo, Google, MSN, _insert your own network > here_ are "bad guys" and point the screen saver at them. Are > they likely to do it? Probably not; it would be a PR > nightmare for them. But who is to stop them? What if they > don't go so extreme and just point the screen saver at "gray > hat" hosts who are open relays or something? I agree 100%. I believe that I get to decide what is or is not "ok" traffic on my network. I define that in my AUP and customers agree to and understand that when they buy service from me. > My opinion (not that anyone asked) is retaliation is childish > and unprofessional. I remember the Internet before Spam, Also agree 100%. If there is traffic hitting my network that I don't believe is "ok" then I can choose not to carry that traffic on my network. It doesn't give me the right to attack the originator of that traffic or the person that I "believe" to be the originator of that traffic. That's why I am a very firm believer in the power of "ip route x.x.x.x y.y.y.y null0" command. :) Makes the problem go away for me (for the most part) and doesn't cause anyone else any pain as a result except my customers, who agreed to let me use that power when they purchased service from me. > botnets, DDOS, etc. > and dream of a day when these are "under control" again just > as much as the next geek. However, stooping to the level of > the miscreant is not the answer to the problem in my opinion. > > Justin Ryburn > justin(a)ryburn.org > > "Dance like nobody's watching; love like you've never been > hurt. Sing like nobody's listening; live like it's heaven on > earth." > -- Mark Twain - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+yXU2RUJ5udBnvEQLX1gCglUjYXtQXyrSMFdfsQeZg9beq/xsAoI/C jOJ77EI+PIQs01sPNEnBphWK =ZScz -----END PGP SIGNATURE-----

6 6

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 03 Dec '04

03 Dec '04

> -----Original Message----- > From: Lionel [mailto:nop@alt.net] > Sent: Thursday, December 02, 2004 8:40 AM > To: Hannigan, Martin > Cc: nanog list > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > On Thu, 2 Dec 2004 08:27:38 -0500 , "Hannigan, Martin" > <hannigan(a)verisign.com> wrote: > > >> > Hosted on a cablemodem? Tch, tch, how the mighty have fallen > > > > > >The blocks are widespread. > > > >The reports of hackers are incorrect. The blackholes are > what is stopping > >them. > > What amazing efficiency. I can't help but wonder if these > same providers > are as quick at blackholing spamsite hosts, or blocking the zombies on > their user networks from spewing spam on port 25? If you tied all the spammers into a few controllers, you see it happen immediately. I've been following the news reports on this. Here's a quick summary of "what I know" without making any judgement or opinion: - The lycos screensaver campaign activated Tuesday - Major networks began activating blocks - When the controllers can't be reached, the clients die off - If screensaver is active when controllers die, it runs off the current target list. - If screensaver deactivates, then activates, it can't contact the servers and tells the user it's "off the internet" (I can't verify the veracity of the update process i.e. if it will die while active) - Blocks started going up early Wednesday morning - The press began reporting hackers due to an apparentdefacement being seen by many users. What they actually saw was the banner of an ISP that had blackholed the traffic and redirected port 80 to a notice. - Lycos moved their application to a hosting facility with bigger pipes - Target sites began using redirects sending the traffic back to Lycos - Press reports are coming out today regarding the blackholes - SpamCop is the source of the target list via a page that is public off of the SpamCop site (SpamCop is does not appear to have complicity) - The effectiveness of the blackholes is rising - There are a reported 100K clients downloaded. Less than you would expect due to the voluminous press coverage. Probably a result of the blackhole activity as well. I'm really not sure if Lycos knows about the blackholes at this point as the press has been reporting "hackers" all the while. If you think it's hacked, check the route. Here's some operational data captured via ethereal The target list generated by the botnet controller: GET /xml/69426058014054/94772079193788/35264029467456/12122010129438/CONFIG_2865 2023942308.xml HTTP/1.1 Referer: http://backend.makelovenotspam.com/xml/69426058014054/94772079193788/3526402 9467456/12122010129438/CONFIG_28652023942308.xml x-flash-version: 7,0,19,0 User-Agent: Shockwave Flash Host: backend.makelovenotspam.com Cache-Control: no-cache HTTP/1.1 200 OK Server: Resin/2.1.14 Content-Type: text/xml; charset=UTF-8 Content-Length: 2889 Connection: close Date: Thu, 02 Dec 2004 15:22:00 GMT <?xml version="1.0" encoding="UTF-8"?> <mlns><targets location="US"><target id="TVRBd01EQXdOVGt5" domain="myshopinternetcompany.com" url="http://myshopinternetcompany.com/?e=aa5100" bytes="357460680" hits="2572309" percentage="100" responsetime01="498" responsetime02="0" location="BR" /><target id="TVRBd01EQXdOVEk0" domain="grlswaiting4u.com" url="http://grlswaiting4u.com/" bytes="206765667" hits="1488797" percentage="100" responsetime01="11866" responsetime02="0" location="US" /><target id="TVRBd01EQXdOVGc0" domain="1stwebsitetheyourshop.com" url="http://1stwebsitetheyourshop.com/?e=aa5100" bytes="317867325" hits="2288427" percentage="100" responsetime01="507" responsetime02="0" location="BR" /><target id="TVRBd01EQXdOVGcx" domain="cheap-r-x.com" url="http://cheap-r-x.com/" bytes="355920802" hits="2565612" percentage="100" responsetime01="787" responsetime02="0" location="CN" /><target id="TVRBd01EQXdOVGcz" domain="www.hlplmanhds.biz" url="http://www.hlplmanhds.biz/" bytes="317590861" hits="2269503" percentage="100" responsetime01="785" responsetime02="0" location="CN" /><target id="TVRBd01EQXdOVEkz" domain="r.vtm.homewo.com" url="http://r.vtm.homewo.com/" bytes="367630639" hits="2248424" percentage="100" responsetime01="5542" responsetime02="0" location="CN" /><target id="TVRBd01EQXdOVE0w" domain="www.incentiverewardcenter.com" url="http://www.incentiverewardcenter.com/xg_reg.htm?SID=ab9ee352c3402bdc858 e5540b887d28a--landing_page=1--show=zip--=--p=92375--c=5411-toys250_720_emc- -catalog_id=14--a=--affil=5408--subid=1" bytes="1028999994" hits="6992693" percentage="-144200" responsetime01="1442" responsetime02="-1" location="US" /><target id="TVRBd01EQXdOVEk1" domain="www.macromed.ws" url="http://www.macromed.ws/" bytes="742958780" hits="5063804" percentage="100" responsetime01="1212" responsetime02="0" location="RU" /><target id="TVRBd01EQXdOVEEz" domain="www.curdom.com" url="http://www.curdom.com/" bytes="734756904" hits="4831221" percentage="46" responsetime01="2134" responsetime02="4541" location="CN" /><target id="TVRBd01EQXdOVGt4" domain="www.bacbwefds.info" url="http://www.bacbwefds.info/" bytes="422036604" hits="2463679" percentage="100" responsetime01="3375" responsetime02="0" location="CN" /></targets><conf><key name="source-xml" value="http://backend.makelovenotspam.com/xml" /><key name="interval-diagram" value="10000" /><key name="interval-hit" value="10000" /><key name="post-data-length" value="5" /><key name="refresh-xml" value="1200000" /><key name="current-version" value="1.0" /><key name="spray-filter-count" value="39" /><key name="url-report" value="http://backend.makelovenotspam.com/report" /></conf><stats><key name="average-percentage" value="100.0" /><key name="bytes" value="143003829363" /><key name="hits" value="859880020" /><key name="downloads" value="103803" /><key name="target-count" value="69" /></stats></mlns> Here's what they appear to receiving a lot as a result: <makeLOVEnotSPAM>IN`TS</makeLOVEnotSPAM> .<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>501 Method Not Implemented</title> </head><body> <h1>Method Not Implemented</h1> <p><makeLOVEnotSPAM>IN`TS</makeLOVEnotSPAM> to /index.html not supported.<br /> </p> </body></html>

3 2

The Cidr Report
by cidr-report＠potaroo.net 03 Dec '04

03 Dec '04

This report has been generated at Fri Dec 3 21:40:03 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 26-11-04 149492 103159 27-11-04 149527 103159 28-11-04 672118764 103159 29-11-04 -1077937252 103159 30-11-04 -1077936760 103159 01-12-04 672037797 103159 02-12-04 -1077937324 103159 03-12-04 134555056 103159 AS Summary 0 Number of ASes in routing system 0 Number of ASes announcing only one prefix 1405 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 0 Largest address span announced by an AS (/32s) pÀ( : Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 03Dec04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 149527 103159 46368 31.0% All ASes AS18566 754 6 748 99.2% CVAD Covad Communications AS4134 831 179 652 78.5% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 807 228 579 71.7% TWTC Time Warner Telecom AS7018 1405 994 411 29.3% ATTW AT&T WorldNet Services AS27364 444 33 411 92.6% ARMC Armstrong Cable Services AS22773 405 20 385 95.1% CXA Cox Communications Inc. AS6197 806 429 377 46.8% BNS-14 BellSouth Network Solutions, Inc AS701 1226 881 345 28.1% UU UUNET Technologies, Inc. AS22909 415 87 328 79.0% CMCS Comcast Cable Communications, Inc. AS1239 934 623 311 33.3% SPRN Sprint AS9929 340 34 306 90.0% CNCNET-CN China Netcom Corp. AS17676 382 78 304 79.6% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS7843 478 177 301 63.0% ADELPH-13 Adelphia Corp. AS4355 384 99 285 74.2% ERSD EARTHLINK, INC AS6478 435 156 279 64.1% ATTW AT&T WorldNet Services AS21502 273 3 270 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS4766 531 268 263 49.5% KIXS-AS-KR Korea Telecom AS14654 262 6 256 97.7% WAYPOR-3 Wayport AS9443 362 113 249 68.8% INTERNETPRIMUS-AS-AP Primus Telecommunications AS15557 371 126 245 66.0% LDCOMNET LDCOM NETWORKS AS6140 373 131 242 64.9% IMPSA ImpSat AS721 1039 803 236 22.7% DNIC DoD Network Information Center AS25844 244 17 227 93.0% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS2386 847 622 225 26.6% ADCS-1 AT&T Data Communications Services AS1221 790 567 223 28.2% ASN-TELSTRA Telstra Pty Ltd AS6198 434 221 213 49.1% BNS-14 BellSouth Network Solutions, Inc AS4814 210 6 204 97.1% CHINA169-BBN CNCGROUP IP network¡ªChina169 Beijing Broadband Network AS5668 417 213 204 48.9% CIH-12 CenturyTel Internet Holdings, Inc. AS9583 554 358 196 35.4% SIFY-AS-IN Sify Limited AS15270 232 38 194 83.6% PDP-14 PaeTec.net -a division of PaeTecCommunications, Inc. Total 16985 7516 9469 55.7% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.17.0.0/18 AS174 COGENT Cogent/PSI 64.17.32.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.33.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.17.37.0/24 AS5024 BRIDGE-75 BridgeNet, LC 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.57.160.0/19 AS3561 SAVVI-3 Savvis 64.92.128.0/19 AS3561 SAVVI-3 Savvis 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 64.209.192.0/18 AS3561 SAVVI-3 Savvis 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 ELISA-AS Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.81.182.0/24 AS719 ELISA-AS Elisa Oyj 192.81.183.0/24 AS719 ELISA-AS Elisa Oyj 192.81.184.0/24 AS719 ELISA-AS Elisa Oyj 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS3541 DISAUN DISA/UNRRA 199.114.136.0/24 AS27044 DNIC DoD Network Information Center 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS27033 DNIC DoD Network Information Center 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS27034 DNIC DoD Network Information Center 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.72.68.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.69.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.70.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.71.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.72.0/21 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.72.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.73.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.75.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.76.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.78.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.72.79.0/24 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 TELEONE-HK TeleTeleOne (HK) Limited 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.99.0.0/19 AS17746 ORCONINTERNET-NZ-AP Orcon Internet 203.170.14.0/23 AS6648 ASN-SKYINTERNET Autonomous System Number peering of Sky Internet - BAYANTEL Inc. - Philppines 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 206.29.168.0/21 AS10248 IPI Internet Partners, Inc. 206.128.104.0/21 AS11709 VIIN VIRTUAL INTERACTIVE CENTER 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.253.190.0/23 AS8123 POLYBA Polybase 207.47.254.0/24 AS701 UU UUNET Technologies, Inc. 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 208.138.48.0/20 AS7955 SOURCE-48 SourceNet Corporation 209.17.71.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.17.79.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.17.80.0/24 AS32272 CLEAR-17 ClearSkye Communications Inc 209.27.51.0/24 AS14132 INTERN-582 Internet Gateway Inc. 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.184.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.185.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.186.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.187.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.188.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.189.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.190.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.191.0/24 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.168.64.0/19 AS174 COGENT Cogent/PSI 216.171.96.0/20 AS3356 LEVEL3 Level 3 Communications 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Hannigan, Martin 03 Dec '04

03 Dec '04

> -----Original Message----- > From: Florian Weimer [mailto:fw@deneb.enyo.de] > Sent: Thursday, December 02, 2004 2:01 PM > To: Brett > Cc: Hannigan, Martin; nanog list > Subject: Re: How many backbones here are filtering the makelovenotspam > scr eensaver site? > > > > I think Lycos did not think this through enough. Their response is > > HUGE. They've essentially launched a Denial of Service on > themselves. > > The site that is being blackholed isn't on their network, AFAICS. > > Actually, I think this is an ingenious PR campaign, but it probably > doesn't work the way it was conceived, though I blieve that the net > outcome for Lycos will be utterly positive. Possibly. What will happen if the Lycos botnet gets hijacked? The conversations between the clients and the servers don't appear to be keyed. If a million clients got owned, it would be the equivalent of an electronic Bubonic Plague with no antidote. -M<

4 6

Fw: [pignet]
by Michael Painter 03 Dec '04

03 Dec '04

----- Original Message ----- From: <andrew(a)ipasifika.net> To: "Pacific Internet Users Group Mailing List" <pignet(a)lyris.spc.int> Sent: Thursday, December 02, 2004 2:47 PM Subject: [pignet] The Politics are starting > I found this in the Washington Post - Interesting? > By Shaun Waterman > UNITED PRESS INTERNATIONAL > Published December 2, 2004 > > Former CIA Director George J. Tenet yesterday called for new security > measures to guard against attacks on the United States that use the > Internet, which he called "a potential Achilles' heel." > "I know that these actions will be controversial in this age when we still > think the Internet is a free and open society with no control or > accountability," he told an information-technology security conference in > Washington, "but ultimately the Wild West must give way to governance and > control." > The former CIA director said telecommunications -- and specifically the > Internet -- are a back door through which terrorists and other enemies of > the United States could attack the country, even though great strides have > been made in securing the physical infrastructure. > The Internet "represents a potential Achilles' heel for our financial > stability and physical security if the networks we are creating are not > protected," Mr. Tenet said. > He said known adversaries, including "intelligence services, military > organizations and non-state actors," are researching information attacks > against the United States. > Within the federal government, the Department of Homeland Security has the > lead role in protecting the Internet from terrorism. But the department's > head of cyber-security recently quit amid reports that he had clashed with > his superiors. > Mr. Tenet, who retired in July as director of the CIA after seven years, > warned that al Qaeda remains a sophisticated group, even though its > first-tier leadership largely has been destroyed. > It is "undoubtedly mapping vulnerabilities and weaknesses in our > telecommunications networks," he said. > Mr. Tenet pointed out that the modernization of key industries in the > United States is making them more vulnerable by connecting them with an > Internet that is open to attack. > The way the Internet was built might be part of the problem, he said. Its > open architecture allows Web surfing, but that openness makes the system > vulnerable, Mr. Tenet said. > Access to networks like the World Wide Web might need to be limited to > those who can show they take security seriously, he said. > Mr. Tenet called for industry to lead the way by "establishing and > enforcing" security standards. Products need to be delivered to government > and private-sector customers "with a new level of security and risk > management already built in." > The national press, including United Press International (UPI), were > excluded from yesterday's event, at Mr. Tenet's request, organizers said. > > > > > Copyright © 2004 News World Communications, Inc. All rights reserved. > Reagrds = Andrew > > *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=* > To unsubscribe send a blank email to : > unsubscribe-pignet(a)lyris.spc.int > *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=* > To be on this list you must be an ISOC member: > Register at www.isoc.org it is free. > Select the Pacific Islands Chapter. >

1 0

Banned on NANOG
by nanog gonan 03 Dec '04

03 Dec '04

: Susan Harris' supervisor at MERIT. Chances are, I : will be censored for this and banned almost This whole censorship thing has me wondering as to the continued viability of this list as a place where the clue-heavy hang out and speak freely. Paul Vixie has been warned, randy Bush has been banned. Who else has been banned that'd be considered a clue-heavy NANOG poster? Why are folks being banned? Last I heard, procmail still works. Folks are becoming afraid to post due to worries about being banned. S/N: Isn't the goal to increase S and reduce N? If you reduce both S and N, you don't get a better signal. With randy gone, the S has definitely decreased. Who else is gone that reduces S? __________________________________ Do you Yahoo!? Yahoo! Mail - You care about security. So do we. http://promotions.yahoo.com/new_mail

5 4

Re: [OT] Re: Banned on NANOG
by Paul Vixie 03 Dec '04

03 Dec '04

> From: Daniel Golding <dgolding(a)burtongroup.com> > ... > Its entirely possible for nanog-l to be self policing, or, failing > that, for users to simply use procmail on those who wander off-topic > (for some definition of off-topic). Putting an [OT] subject banner on > such posts is also nice. i don't want widescale procmail to be the only way nanog@ is readable by a big subset of the netops community, simply because i know a lot of the folks here (lazy overworked disorganized bums, mostly) and if it takes way more effort to be subscribed than not, many will just unsubscribe. > There's such a thing as throwing the baby out with the bathwater. When > highly clued, genuinely contributing folks are treated poorly for the > occasional in-joke or comment, the S:N ratio will suffer in the longer > term. nope nope nope no-no-nope. that's a subjective standard. there's no way to moderate based on "does more good than harm" without strong and formal and objective definitions of what "good" is and what "harm" is, plus an appeals process. trust me: we don't want "strong" "formal" "process". (my own system, which has produced only two warnings in about 10 years, is to make the good:harm ratio high enough in any given message that the "in" jokes are merely a tolerable percentage of the mass of THAT message; what i see some other bums doing, though, is pure-"in"-joke messages.) > I'm certainly hoping that the network operations community will feel > no need to "talk with their feet" after we all sit down with the Merit > staff and let our feelings be known, but that is certainly a possibility. like the libertarians say, "use your dollar votes!" i'm comfortable with a system whereby susan occasionally turns around in the front seat of ye olde station wagon and says "you'd better stop that right now, because if i have to stop this car and come back there, you'll be sorry" and the rest of the time we just keep the fighting down to (bloodless) dull roar. but if you have a better system in mind you should propose it; and if you can't get traction for it inside nanog, there's always room for another ops list. (in Usenet days we used to say "could you move this thread to $other_group, where it will be on-topic, and where i'm not a subscriber?" and it WORKED a lot of the time, just to wake folks up and show that topic-consensus was a property both nec'y and desireable in ALL forums, digital or otherwise.)

1 0

RE: How many backbones here are filtering the makelovenotspam scr eensaver site?
by Chad Skidmore 03 Dec '04

03 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Steven Champeon [mailto:schampeo@hesketh.com] > Posted At: Thursday, December 02, 2004 1:09 PM > Posted To: NANOG > Conversation: How many backbones here are filtering the > makelovenotspam scr eensaver site? > Subject: Re: How many backbones here are filtering the > makelovenotspam scr eensaver site? > > My point was to Martin's question about what would happen if > - god forbid - there were large botnets under the control of > spammers; a careful reading will suggest that my major point > was, duh, that there already are large botnets under the > control of spammers. I realize that is the point you were trying to make. I also realize that Martin is pretty well aware of botnets and the threat they create. I suspect that most other readers on NANOG are also well aware. What doesn't seem to be as common knowledge as I would expect is that botnets are a commodity. As such they are traded, sold, purchased and even stolen. That last point is particularly important in this case. Lycos has created a large botnet (at least by most people's definition) that is hidden in the guise of a screen saver claiming to only go after the "bad guys". This botnet uses a command and control server that is now well publicized, and uses a communication channel that is not encrypted or obfuscated in any way. That makes it a botnet just asking to be stolen. Fortunately the C&C server is blackholed by what seem to be a large number of providers and the botnet is now fairly useless. > Good point. Simply put, I can (and do) read my own mail server > logs. And I can see that many ISPs - regardless of what they may be > doing in onesy-twosy increments - simply aren't doing enough > to prevent new botnet infections from wasting my server's > cycles in futile attempts to deliver spam, outscatter, virus > warnings, etc. etc. ad infinitum. It is certainly more than "onesy-twosy increments" but I agree that the problem is large enough that it certainly feels like a weak attempt from the average user/operator's point of view. > This costs me time and money, and many of the same ISPs > mentioned above are simply cost-shifting their own > responsibility onto me and everyone else, and I'm tired of it. I encourage everyone to vote with their wallet when it comes to this type of thing. Buy your transit from organizations with dedicated security teams that actively engage in SPAM/Bot/Worm/Viri fighting efforts. Those things cost money and take time and are usually unacknowledged efforts. Larger providers seem to make easier targets when it comes to placing blame and saying that they aren't doing enough to combat miscreant activity. I don't believe that is the case overall. They just have a much larger customer base, higher volumes of traffic to inspect, and more politics to work within. > Not to say there aren't responsible ISPs, and I hope that > anyone who /is/ a part of the solution, rather than the > fertile substrate for the problem, is capable of recognizing > that and not taking offense when I point out there are others > who could do more. I believe that EVERYONE could do more on this front. It is a moving battle that requires constant improvement just to stay afloat, let alone get ahead. For those genuinely interested in improving what they are doing on this front I strongly encourage you to attend the NSP-Sec BOFs at NANOG. You might be surprised what you learn and who you meet that can be helpful. > As for go180.net, you don't show up much on my radar, but on > Nov 9th we were hit by a spammer from > SpokaneHotZone-63.go180.net [66.225.5.63]. > I trust this is not a legitimate mail server and I can block > it and any other host that looks like it within the same > domain, right? Thanks. > Otherwise, you may want to do something to distinguish it > from the other generic hosts in the same range. Glad you don't see much from us, must mean that the effort put forth by some of our team is not going to waste. You are correct, that is not a legitimate mail server but is an IP from a City Wide wireless network. That network has since been secured to restrict TCP 25 outbound (along with other typical miscreant traffic) so you shouldn't see anything again from that network on port 25. If we rise up on your radar in the future feel free to make use of the typical NOC and Abuse e-mail addresses, they do get answered and acted upon here. Regards, Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+VUk2RUJ5udBnvEQJXPQCeMhYgS4vHzmjP2fpgVeEFySQWw4QAn1f/ g70E3QaL3VOcZvILXD80AqjF =he0W -----END PGP SIGNATURE-----

3 2

RE: What good is a noc team? How do you mitigate this? [was: How many backbones ...]
by Chad Skidmore 03 Dec '04

03 Dec '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > -----Original Message----- > From: Gadi Evron [mailto:ge@linuxbox.org] > Sent: Thursday, December 02, 2004 3:21 PM > To: Chad Skidmore > Cc: Aaron Glenn; nanog(a)merit.edu > Subject: What good is a noc team? How do you mitigate this? > [was: How many backbones ...] > > > Okay, making this an operational issue. Say you are attacked. > Say it isn't even a botnet. Say a new worm is out and you are > getting traffic from 19 different class A's. > > Who do you call? What do you block? > > How can a noc team here help? > > "Please block any outgoing connections from your network to > ours on port 25? Please?" I tried this once.. it doesn't > help. I ended up blackholing an entire country just to > mitigate it a bit, for a few hours. > > Any practical suggestions? > > Gadi. > Well, the easy answer is that it depends. Lets use SQL Slammer as one example that might be comparable to the scenario you mention. During Slammer some networks did stay up. We'd have to ask each one of them what they did to know why they stayed up but I think I can guess at some. Shortly after Slammer there was a NANOG presentation on Slammer and some discussion at the NSP-Sec BOF at that NANOG regarding why some people survived and others didn't. What came out of that was enlightening, if not obvious in hind sight. 1. Those providers that made use of contacts at other providers and worked together, shared information, etc. were less affected than those that did not. 2. Those providers that had various mechanisms in place for just such an issue did better than those that did not. This included, but was not limited to, darknet monitoring & quick reaction to darknet data anomalies, automated and semi-automated sifting of Netflow data, pre-staged classification ACLs on at least key backbone/peering/transit routers, and BGP (or other) triggered blackhole mechanisms. 3. Teams with dedicated incident response teams did better than those that didn't. 4. Those with grossly oversubscribed networks did worse than those with sufficient bandwidth to handle the ebb and flow of traffic that rides the Internet today. Good traffic engineering practices don't mean that you have to purchase lots of excess bandwidth to make this happen. Not being oversubscribed is also not just an issue of circuit utilization. For example, make sure you have enough CPU on your routers, line cards, whatever so that you can turn various features on to help track and mitigate an attack without making your routers fall over. So, armed with that data you can assume the following. With good darknet monitoring practices you would likely see a rapid up tick in scanning, backscatter, etc. and could start investigating the cause prior to the issue becoming service affecting. Maybe it is so crazy and randomized that you don't see it on your darknet monitoring but you see it on your PPS data collection. More often than not I know we see indications of miscreant activity on PPS monitoring first. The classification ACLs are a good way to turn the router into a poor mans sniffer (assuming it isn't so heavily loaded already that it falls over) so you can see what types of traffic you are dealing with. Using MCI/UUs method you could track any spoofed traffic back to where it enters your network pretty easily. I know that Chris and company do it with amazing speed across 701. If it works for them then it likely works for the rest of you. Netflow data would likely lead you to sources of the most pain so you could go after those first. Fighting an attack isn't always about making the attack go away. Often times the key to not getting killed is to find the "big guns" and get them silenced first. Sure, you're still getting shot, but it isn't going to kill you and you can take some additional time to find the smaller guns. If you are seeing the bulk of the attack come from a few sources let their security teams deal with it and take the pain away from you. Armed with the data you glean from this approach you will usually be able to get a positive response from your upstream or peers. If not make a quick note to yourself that you need to replace them once your attack is over and done with. If all else fails blackhole the host under attack at your borders, or even better on your upstream's network via BGP triggered blackhole (if they don't support it make a note to replace them with someone who does when the attack is over). You might sacrifice that host but you'll save the rest of your network and likely buy yourself some more time to track back to the source and kill it. I'm certainly not suggesting I have all the answers or that I have it all figured out. I also realize that the world is not a rosy place where inter-provider communication is perfect and I always get the answers I need when I call them. I'm just tired of seeing people play the victim, complaining how the "Big Providers" won't protect them, etc. without looking in the mirror and deciding that today is the day I take my network back and take care of myself. Gadi and Aaron, this isn't directed specifically at you so please don't take that as a personal flame to you. I've personally had great luck in getting quick reaction from a number of providers when an attack is ongoing. That certainly isn't always the case but more often than not it is. Some that have done a great job in the past that come to mind for me are 701, 2914, 3549, 1239, 3356. That isn't all of them but they are the ones that come to mind the quickest. Chad - ---------------------------- Chad E Skidmore One Eighty Networks, Inc. http://www.go180.net 509-688-8180 -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQA/AwUBQa+tZ02RUJ5udBnvEQJk8QCeLel/Nj4FFIIXInGSEF/i5RovlW0An1E8 UECC1HswfhvbtyIJi0QL8vS0 =FHWN -----END PGP SIGNATURE-----

1 0