- Test - lists.nanog.org

Warning - new trend of attempts to infect ISP users (possibly virus)
by william(at)elan.net 05 Mar '04

05 Mar '04

I have just seen emails (several different kinds) pretending to be sent from 3 of my isp domains to users of those domains warning users that their email account would be disabled and asking to open a .pif attachment. I know largest ISPs probably have expierenced this but I believe what I have seen today means they are after ISPs (or possibly just after any domains with number of email addresses under them) of all sizes right at the moment. All emails we received from the same source ip - 129.59.206.187 Please check your email base for what looks like the following (in the examples I changed everything to elan.net, actually every isp domain received different example of this, only first one is exact). Example 1: --- From: management(a)elan.net To: xxxxx(a)elan.net Subject: Email account utilization warning. Hello user of Elan.net e-mail server, Your e-mail account has been temporary disabled because of unauthorized access. For further details see the attach. Best wishes, The Elan.net team http://www.elan.net --- Example 2: --- From: administration(a)elan.net To: xxxx(a)elan.net Subject: Warning about your e-mail account. Dear user of "Elan.net" mailing system, Our main mailing server will be temporary unavaible for next two days, to continue receiving mail in these days you have to configure our free auto-forwarding service. Further details can be obtained from attached file. Cheers, The Elan.net team http://www.elan.net --- Example3: --- To: xxxxx(a)elan.net Subject: Warning about your e-mail account. From: administration(a)elan.net Dear user, the management of Elan.net mailing system wants to let you know that, Some of our clients complained about the spam (negative e-mail content) outgoing from your e-mail account. Probably, you have been infected by a proxy-relay trojan server. In order to keep your computer safe, follow the instructions. Please, read the attach for further details. The Management, The Elan.net team http://www.elan.net

7 9

Re: dealing with w32/bagle
by Dr. Jeffrey Race 05 Mar '04

05 Mar '04

On Thu, 4 Mar 2004 10:17:47 -0800, Stephen Milton wrote: > >dropload.com seems to me to be the perfect model for anonymous file >delivery over the internet. I have also bookmarked, but have never used: http://www.sharemation.com/xythoswfs/webui?action=login&subaction=newuser http://www.kturn.com/ http://www.swapdrive.com/ Anyone who has used please report results back Jeffrey Race

1 0

RE: Bagle, not that smart
by Alon Tirosh 04 Mar '04

04 Mar '04

Bagle seems to simply grab everything up to and not including the second '.' Right-to-Left. I doubt they took subdomains into consideration... Im sure that now that you mentioned it here, this will be fixed in the next revision (I wonder if they file bugs with themselves?) -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Rubens Kuhl Jr. Sent: Thursday, March 04, 2004 4:05 PM To: nanog(a)merit.edu Subject: Bagle, not that smart This is a bagle sample I've received; it seems they have somewhat to learn about ccTLDs (there is no org.br domain), and to what FROM to choose (an address for university adminissions wouldn't send you a support message). Rubens ----- Original Message ----- From: admissions(a)--some-university--.edu> To: <sugestoes(a)antispam.org.br> Sent: Thursday, March 04, 2004 3:50 PM Subject: [blacklist] Notify about using the e-mail account. Dear user, the management of Org.br mailing system wants to let you know that, We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. For details see the attached file. In order to read the attach you have to use the following password: 46742. Kind regards, The Org.br team http://www.org.br [As partes desta mensagem que não continham texto foram removidas] -------------------------------------------------------------------- Enviar mensagens: mailto:pataquada@egroups.com Sair do grupo : mailto:pataquada-unsubscribe@egroups.com eGroups : http://br.egroups.com/group/pataquada/ ==================================================================== Links do Yahoo! Grupos Para visitar o site do seu grupo, acesse: http://br.groups.yahoo.com/group/pataquada/ Para sair deste grupo, envie um e-mail para: pataquada-unsubscribe(a)yahoogrupos.com.br O uso que você faz do Yahoo! Grupos está sujeito aos: http://br.yahoo.com/info/utos.html

1 0

Bagle, not that smart
by Rubens Kuhl Jr. 04 Mar '04

04 Mar '04

This is a bagle sample I've received; it seems they have somewhat to learn about ccTLDs (there is no org.br domain), and to what FROM to choose (an address for university adminissions wouldn't send you a support message). Rubens ----- Original Message ----- From: admissions(a)--some-university--.edu> To: <sugestoes(a)antispam.org.br> Sent: Thursday, March 04, 2004 3:50 PM Subject: [blacklist] Notify about using the e-mail account. Dear user, the management of Org.br mailing system wants to let you know that, We warn you about some attacks on your e-mail account. Your computer may contain viruses, in order to keep your computer and e-mail account safe, please, follow the instructions. For details see the attached file. In order to read the attach you have to use the following password: 46742. Kind regards, The Org.br team http://www.org.br [As partes desta mensagem que não continham texto foram removidas] -------------------------------------------------------------------- Enviar mensagens: mailto:pataquada@egroups.com Sair do grupo : mailto:pataquada-unsubscribe@egroups.com eGroups : http://br.egroups.com/group/pataquada/ ==================================================================== Links do Yahoo! Grupos Para visitar o site do seu grupo, acesse: http://br.groups.yahoo.com/group/pataquada/ Para sair deste grupo, envie um e-mail para: pataquada-unsubscribe(a)yahoogrupos.com.br O uso que você faz do Yahoo! Grupos está sujeito aos: http://br.yahoo.com/info/utos.html

1 0

Routing Policy
by Beprojects.com 04 Mar '04

04 Mar '04

Does anybody have a list of the hot-potato/cold-potato routing policy of the 10-20 biggest ISP's (MCI, Sprint, AT&T, Verio, etc)? I know Boardwatch used to publish that in their yearly ISP guide, but I haven't been able to find it since they went out of print. Peder

1 0

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 04 Mar '04

04 Mar '04

I struggled with this, and came up with the following. We basically use a standard route-map for all customers where the first term looks for the community. The customer also has a prefix-list on their neighbor statement allowing their blocks le /32. The following terms (term 2 and above) in the route-map which do NOT look for the customer discard community, have a different standard/generic prefix-list evaluation which blocks cruft and permits 0.0.0.0/0 ge 8 le 24. By doing this, I only accept a customer /32 from his dedicated prefix-list when it has the DOS discard community, otherwise I catch them with the ge 8 le 24 in the following terms. Jason Lumenello IP Engineering XO Communications > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Stephen J. Wilcox > Sent: Wednesday, March 03, 2004 3:48 PM > To: james > Cc: nanog(a)merit.edu > Subject: Re: UUNet Offer New Protection Against DDoS > > > > I'm puzzled by one aspect on the implementation.. how to build your > customer > prefix filters.. that is, we have prefix-lists for prefix and length. > Therefore > at present we can only accept a tagged route for a whole block.. not good > if the > announcement is a /16 etc ! > > Now, I could do as per the website at secsup.org which means we have a > route-map > entry to match the community before the filtering .. but that would allow > the > customer to null route any ip. > > What we need is one to allow them to announce any route including more > specifics of the prefix list - how are folks doing this? > > Steve > > On Wed, 3 Mar 2004, james wrote: > > > > > Global Crossing has this, already in production. > > I was on the phone with Qwest yesterday & this was one > > of this things I asked about. Qwest indicated they are > > going to deploy this shortly. (i.e., send routes tagged with > > a community which they will set to null) > > > > > > James Edwards > > Routing and Security > > jamesh(a)cybermesa.com > > At the Santa Fe Office: Internet at Cyber Mesa > > Store hours: 9-6 Monday through Friday > > 505-988-9200 SIP:1(747)669-1965 > > > >

4 3

Re: SPAM Prevention/Blacklists
by Anne P. Mitchell, Esq. 04 Mar '04

04 Mar '04

> >>> Also, I like sender verification, but that's me. >> >> i used it for some time, and reluctantly shut it down. blocked a lot >> of email >> abuse, but too many false positives for my taste. > > Could you go into more detail? > > ... > Maybe I have others I just don't know about? How many people send > legit e-mail with return addresses which are bogus? On a related note, for those of you interested, the IADB (ISIPP Accreditation Database) is now up and running, although not publicly announced yet. You can read information about it at: http://www.isipp.com/iadb.php What is unique about the IADB is that it is designed to list not only IP addresses, but also associated domains *if* the listee is publishing an SPF record, and conversely IADB listees will be able to get a unique "accreditation code" to put into their SPF records. Anne Anne P. Mitchell, Esq. President/CEO Institute for Spam and Internet Public Policy Professor of Law, Lincoln Law School of SJ

1 0

w32/bagle variants
by Sam Stickland 04 Mar '04

04 Mar '04

For the people talking about how quickly the variants have been produced ;) http://news.bbc.co.uk/1/hi/technology/3532009.stm Seems the authors are taunting each other in the code. Sam

1 0

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 04 Mar '04

04 Mar '04

No, but it sounds like SLA payouts are made in the event that they fail to respond in 15 minutes after a call is made. Maybe I am misinterpreting their SLA, but this seems much different then offering blanket payments for DoS down time. I will give them credit for guaranteeing a response in 15 minutes or less. Now is a response the opening of a ticket or the null routing of the attack traffic in 15 minutes? Jason > -----Original Message----- > From: Suresh Ramasubramanian [mailto:suresh@outblaze.com] > Sent: Wednesday, March 03, 2004 7:21 PM > To: Randy Bush > Cc: nanog(a)merit.edu; Lumenello, Jason > Subject: Re: UUNet Offer New Protection Against DDoS > > Randy Bush [3/4/2004 6:40 AM] : > > > i think the north american idiom is putting your money where your > > mouth is. > > Thank you. That's exactly what I was driving at. > > Hmm.. one of the people in that "we've been doing this too" thread was > XO. Do I take it then that XO provides for DDoS downtime in its SLA? > > -- > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > manager, outblaze.com security and antispam operations

2 1

RE: UUNet Offer New Protection Against DDoS
by Lumenello, Jason 04 Mar '04

04 Mar '04

> -----Original Message----- > From: Christopher L. Morrow [mailto:christopher.morrow@mci.com] > Sent: Thursday, March 04, 2004 11:50 AM > To: Lumenello, Jason > Cc: Suresh Ramasubramanian; Randy Bush; nanog(a)merit.edu > Subject: RE: UUNet Offer New Protection Against DDoS > > > On Thu, 4 Mar 2004, Lumenello, Jason wrote: > > > > > No, but it sounds like SLA payouts are made in the event that they fail > > to respond in 15 minutes after a call is made. Maybe I am > > fail to get you in touch with 'security expertise' in 15 minutes... > > > misinterpreting their SLA, but this seems much different then offering > > blanket payments for DoS down time. > > > > downtime is seperate from this SLA. > > > I will give them credit for guaranteeing a response in 15 minutes or > > less. Now is a response the opening of a ticket or the null routing of > > the attack traffic in 15 minutes? > > Just speaking to an engineer that can help you. There is no way to > guarantee and end to a DoS in any reasonable amount of time ;( For > instance, Suresh's main 'job' is email, so null routing his MX hosts will > stop the attack, but it is hardly desirable, eh? Same for filtering tcp/25 > syn packets :( > > There is no magic here, you all are smart enough to understand how DoS > works, how to stop it and the complications inherent in both. Well, kudos to you guys for raising the SLA bar to include this provision then. Jason

1 0