- Test - lists.nanog.org

RE: Microsoft problems?
by Joe Johnson 11 Oct '04

11 Oct '04

I got some sort of announcement popup on Gaim from MSN that said they would be going down for 5 minutes. That was this morning at about 11-ish (Central time). Came back after 2 minutes and has been fine since. Joe Johnson -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Miguel Mata-Cardona Sent: Monday, October 11, 2004 1:48 PM To: nanog(a)merit.edu Subject: Re: Microsoft problems? same here at .sv here we felt it as inconsistent service but then in got kaputt. On 11 Oct 2004 at 14:26, Chaim Fried wrote: > > Anybody know of any prolonged outages at Microsoft (MSN > messenger)today? > > > -- Miguel Mata-Cardona Intercom El Salvador mmata(a)intercom.com.sv voz: ++(503) 278-5068 fax: ++(503) 265-7024 "Intercom, sus Telecomunicaciones en buenas manos"

1 0

Re: FW: MSN Mobile Emergency Notification - MSN Messenger Roll-back
by Ken Gilmour 11 Oct '04

11 Oct '04

Ar Mon, 11 Oct 2004 14:58:42 -0400, scríobh Jim.Rigney(a)VerizonWireless.com: <snip> Thank you Mr. Rigney :-)

1 0

Re: short Botnet list and Cashing in on DoS
by J. Oquendo 11 Oct '04

11 Oct '04

>> Most ISP's truly don't want this as their own problem. I personally >> don't blame them. Luckily the ISP I work for has no home users. Most ISP's wouldn't have to deal with this problem if corporations took the time to release better products. I was faced with the question of "What do you do for infected clients?" What can an ISP do. Most of the times ISP's become the de facto MS technical support team and it is rather unfair and costly to have technical support staff on the phone constantly putting out MS' fires. They are left with the prospect of losing clients when the client is told "It's an MS problem you have to contact MS", yet they've called MS and spoke with someone likely in another country who has no clue, called Dell and spoke with yet another clueless person, and all they wanted to do was surf the net. What do you tell a client when they start stating "Well then I want to cancel my service" because they don't understand, and won't care to since they're frustrated. Sure take a hit with one client cancelling an account, what happens when it grows? As for the prior responses of "You will get DoS'ed" this I am aware of. Problems that concerned me were more of the tracking issues, coupled with the fact that there would be no guarantee that admins would do anything about it. Take the case of that one Californian who hijacked a /16 a while back I believe from a county over there. Admins like this are liable to sit back and do nothing since along the line someone is going to be paying money for the traffic. It is rather sad, and worse when you contact their upstream and they too do little. Consider (and I will keep mentioning them this since it bugs me) EV1, Everybody's Internet. Not only do they host some botnets, malware spewing servers, spam relays, terrorists related sites, their excuse is "Well we don't know who we rent to" Now I know laws are being worked in along the way, but if you own a home and rent it out, then it gets subletted, the re-sub'ed, let's say fifty transactions occurred, you own the home. If someone down the line is running drugs out of the apartment your house is gone. Yes their is little that can be done right now, but yet there ARE things that CAN BE DONE. I'm one that is skeptical about laws since laws abroad would mean nothing here and vice versa, but where are things headed? Spend more on infrastructure to support these issues when you shouldn't have to or buy bigger equipment to handle filtering when you shouldn't have to. I say nip it at the bud, if you're an upstream provider and you see some of these issues, three strikes shut these things down, or nullroute them, don't just sit twiddling your thumbs "Oh but that won't help your idea is silly because foo_x reason." Have something better in mind propose it. I'm sure some of these networks that are getting DoS'ed out of existence would love to hear them. Hell some might even pay you to implement them. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "How can we account for our present situation unless we believe that men high in this government are concerting to deliver us to disaster?" Joseph McCarthy "America's Retreat from Victory"

16 26

[OT] Good Anti-Spam Boilerplate
by Charles Sprickman 11 Oct '04

11 Oct '04

Howdy, After some senseless Googling, I'm at a loss. I'm looking for a very comprehensive, up-to-date example of an AUP that covers spam. When I say "modern", I mean that I want it to include not just direct spamming, but abuse of remote open-relays, abuse of remote trojaned boxes, sending through a third party that circumvents the local AUP, etc. Some good definition of "requested email" would be great - ie: double opt-in, or single opt-in with some documentation that the user requested the mail on a web form or similar. Some language that covers penalties would also be helpful, such as equipment seizure for non-payment of penalties. Please reply privately and I'll summarize. I do not wish to get into any debates about what qualifies as spam on this list. Thanks, Charles -- Charles Sprickman spork(a)inch.com

3 3

Question on IP address used by anycast DNS cache server
by Joe Shen 11 Oct '04

11 Oct '04

Hi, I'm , but I met some questions when reading those paper from ISC on F-root anycasting. 1. As it's descripted in J.Abley's paper, DNS server in anycast group should be configured with a real IP on its NIC and one or two service IP on loopback interface(s). BIND listen on both real IP and service IPs. Any DNS answer packet will be encapsulated with source address as service IP. To my understanding, this is OK for root servers because they do not invoke recursive lookup procedure. But, if the DNS server is a member of ISP's DNS Cache server farm, recursive lookup packets to other DNS server MUST be encapsulated with real IP address. Is BIND or other DNS software capable of distinguishing between DNS answer back packet and recursive lookup packets? or could this be done automatically by operating system like Solaris, Linux, FreeBSD? 2. If we want to design a hierachical DNS service system which distribute across multiple private AS of an ISP, is there any problem to select service IP randomly from unused address pool? thanks in advance. Joe __________________________________________________ Do You Yahoo!? Log on to Messenger with your mobile phone! http://sg.messenger.yahoo.com

4 3

Re: BCP38 making it work, solving problems
by J. Oquendo 11 Oct '04

11 Oct '04

> I have received complaints from people about NOT being able to spoof > packets. <moronicy> Technical Support: "This is CompanyX, how can I help you?" 31337kiddi0t: "wHy c0m3 3ye c4nt sp0of?!$!*@" </moronicy> With all of the different standards which tend to add confusion, too much time seems to be going to waste drafting them while networks and businesses suffer from what's currently in place. From my perspective if someone mentioned this to me via complaints their account would be cancelled immediately since there is no benefit to sending out spoofed packets. "But it's a pen test audit!" Even in situations where a security admin needed to test certain elements an aware admin would find a way to get around doing what they had to do. Blocking elements such as SMTP do have its place and I'm sure most know this is not the "definitive" solution nothing more than patch work but it still has its advantages. The same way spammers can adapt, so should an engineer be able to for those who would like to contest the notion that one would be making "smarter idiots" who send spam and create malice. I've been digging more into RFC's in hopes of learning more from a technical perspective for my own sake and to date, all I've seen is more of less patchwork. Instead of reinventing the wheel as the old saying goes, sometimes a patch can get you moving on a flat tire. Sure it is a temporary solution, but it is a solution. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "There is no greater mistake than the hasty conclusion that opinions are worthless because they are badly argued." -- T.H. Huxley

1 0

looking for an urgent contact at ucsd.edu (138.23.0.0/16)
by Gadi Evron 11 Oct '04

11 Oct '04

Thanks for your help, sorry for the OT post. Gadi Evron.

1 1

Re: short Botnet list and Cashing in on DoS
by Paul Vixie 10 Oct '04

10 Oct '04

someone who wished to remain publically unnamed answered me by saying: > I got chastized a little while ago, too, for a single post, and told that > it was my THIRD warning (having not received any at all before). Feh. i can't think of anyone among all nanog posters since the beginning of time who has not deserved to be smacked around at least once by our erstwhile moderator for saying something on a dead thread or speaking offtopically. i'm up to two warnings, and i think it's a lifetime quota not subject to annual resets (in other words it's three, ever, not three in the last year). it's really improved my thought processes. if i weren't about to say something operationally relevant, i'd already have deleted this without sending it. quality control for crowds is hard; for engineers, also hard; for crowds of engineers, i can't imagine a way it can be accomplished, yet here we all are. so, i'd written: > > 2. Filter aggressively. Run a dark-net, and if one of your customers... > ^^^^^^^^ my nameless friend then asked me: > this sounds intrigueing, but I'm not sure what it is. Is is sort of an > internal honeypot NETWORK? it goes by several names. network telescope, darknet, etc. i called it a darknet above only because rob thomas calls it that, and he'd recently given a talk at the dns-oarc members meeting on this precise topic. yes, it's like a honeypot in some ways (but robt probably winced just now, as he read me saying that.) most of rob's talk is echoed by his web site <http://www.cymru.com/Darknet/index.html>, which is a good read. my own "darknet"-like project is wired up to a database that can answer questions like "what are the worst 25 sources of undesireable smtp since the last time i reset the database?" today's answer is: smtpk=> select * from top25_bysrc; src | howmany | earliest | latest -----------------+---------+----------------------+---------------------- 61.73.48.141 | 47650 | 03-AUG-2004 08:44:23 | 09-AUG-2004 22:03:55 61.73.49.56 | 39435 | 01-AUG-2004 18:53:03 | 02-AUG-2004 21:10:34 61.73.48.63 | 26938 | 21-JUL-2004 11:52:11 | 21-JUL-2004 12:12:39 210.244.26.120 | 17057 | 27-MAY-2004 04:42:33 | 27-MAY-2004 07:59:56 211.74.62.25 | 12674 | 26-MAY-2004 14:43:47 | 26-MAY-2004 15:31:58 61.73.20.220 | 12092 | 30-JUL-2004 13:43:55 | 31-JUL-2004 07:19:54 220.116.198.64 | 9576 | 05-AUG-2004 15:49:08 | 07-AUG-2004 00:01:31 61.73.49.21 | 9206 | 03-AUG-2004 19:57:01 | 04-AUG-2004 19:32:54 210.68.127.235 | 8367 | 26-MAY-2004 15:32:27 | 26-MAY-2004 16:47:56 222.101.168.37 | 8098 | 05-JUL-2004 03:55:37 | 31-JUL-2004 07:13:08 211.218.2.20 | 6410 | 06-AUG-2004 18:25:05 | 06-AUG-2004 18:51:45 222.117.215.23 | 5698 | 14-JUL-2004 03:56:23 | 18-JUL-2004 05:46:06 61.73.96.158 | 5516 | 06-AUG-2004 20:10:57 | 06-AUG-2004 20:27:48 220.116.197.49 | 5314 | 02-AUG-2004 15:10:37 | 02-AUG-2004 15:19:10 222.101.168.33 | 5066 | 22-JUN-2004 02:00:29 | 16-JUL-2004 13:11:30 211.218.3.167 | 4318 | 30-JUL-2004 12:36:05 | 30-JUL-2004 12:39:07 220.116.196.199 | 4301 | 04-AUG-2004 12:53:26 | 04-AUG-2004 16:23:08 222.117.216.15 | 4072 | 19-JUN-2004 14:16:52 | 22-JUN-2004 13:54:15 61.38.47.221 | 3777 | 04-JUL-2004 14:52:32 | 04-JUL-2004 21:49:40 211.218.5.224 | 3706 | 23-JUL-2004 12:22:55 | 23-JUL-2004 12:25:30 222.117.215.192 | 3624 | 15-JUN-2004 09:55:21 | 15-JUN-2004 14:33:42 222.117.216.112 | 3454 | 20-JUN-2004 19:24:13 | 21-JUN-2004 04:51:15 222.117.215.186 | 3418 | 18-JUN-2004 00:53:58 | 18-JUN-2004 20:46:21 211.218.2.125 | 3387 | 05-AUG-2004 09:28:24 | 05-AUG-2004 20:06:48 218.8.231.25 | 2996 | 16-AUG-2003 03:13:05 | 16-AUG-2003 21:28:31 (25 rows) caida's "network telescope" is also quite interesting. i see some 2001 work located at <http://www.caida.org/outreach/papers/2001/BackScatter/>. see also <http://www.nanog.org/mtg-0110/greene.html>. running an smtp listener in "darkspace" and wiring it to dynamic dns has resulted in a private-only dynamic blackhole list that now stops more spam than any other single public list i subscribe to... and some days more than all of them combined. (so you see, the venture capitalists and politicians were right after all -- there's all kinds of useful information out there, and great advantages available to anyone who can aggregate it in paranormal ways. but i digress.)

1 0

Re: short Botnet list and Cashing in on DoS
by Gadi Evron 09 Oct '04

09 Oct '04

From a recent email I gather this is very off-topic, so I will try to be brief in my reply. > (Geneva.CH.EU.*) since 3+ years. I can say from my experiences I couldn't > make any kind of communication between botnets and spam. Most Trojan codes I > have looked into doesn't have any command/action to make users send spam > emails and such however they try infecting others by different ways that > port 25 can't avoid. Short answer: Many of the infected systems have more Trojan horses installed than the original infecting agent. Many Trojan horses have spam-sending or relaying capabilities.. or even just anonymity capabilities or ID theft/DDoS options. Thing is, there are always more options that can be later installed. As to you not seeing them.. I suppose it's as simple as you not seeing enough of them.. count your blessings. Gadi.

1 0

Re: short Botnet list and Cashing in on DoS
by Paul Vixie 09 Oct '04

09 Oct '04

i was recently chastised for posting non-operational content to nanog, and so, while i am willing to beat the drum for source address validation, i'm very concerned about commenting further in what has to be the 40th or 50th version of this thread in the last ten years. with trepidation, then: > > there are many ways of sending spam that dont use port 25.. > > True, but reducing spam from millions to thousands seems like something > good, no? no. (thanks for asking.) that's not good. network abuse is a very strong economic force -- whether it's spam, ddos-for-hire, or whatever. blocking port 25 will make legitimate smtp permanently hard to use, while making non- legitimate smtp temporarily hard to use. if i learned anything at MAPS, it was that taking actions which merely harden, toughen, and educate spammers is counter-productive. good counteractivity must be recombinant, not just reactive. short term effectiveness is completely irrelevant, and not "good." > > individual rules are costly to implement and users wont use a service > > where you have to pay more for basic services > > Several big ISP's are blocking port 25 now. I believe this will catch. had this been done in 1998 when the anti-spam community first warned about it, then a lot of good could have been done. but network abuse takes many more forms than smtp delivery now. stopping outbound tcp/25 won't make any notable difference to a network's support costs, by the end of the year. on the other hand, source address validation would make a notable difference in support costs, by the end of the first quarter after it was deployed. > It limits the amount of junk coming out from their users, and the usage of > their tubes. no. blocking outbound tcp/25 would not have that effect. doing BCP38 would. > I doubt even 0.001% of dynamic range Cable/DSL users will ever call to ask > for port 25 to be opened. > > This is something ISP's can implement, and it works. if you define "works" very narrowly, perhaps as "causes the next wave of abuse coming from your network to not be in the form of outbound tcp/25", then i'd have to agree. but i don't define "works" that way since it will just shift costs toward the following months, after the attackers retune for their reduced capability (perhaps by inventing some new capabilities). -------- i have a suggestion. if you're going to propose some method of curbing network abuse, which operates at something other than the IP layer, then please find a different forum. also, read vjs's "you might be" article. and when you're educated as to what's been tried and what's been done, and you find a forum where your proposal will be found interesting, then please cast your proposal in the following terms: "we implemented source address validation toward our customers as described in BCP38, and it wasn't good enough, so we did $X as well, and it had benefit $Y and cost $Z". (cc me!)

1 0