- Test - lists.nanog.org

RE: BL of Compromised Hosts?
by Michel Py 23 Feb '04

23 Feb '04

> Robert E. Seastrom wrote: > [..] Keep in mind one thing: the draft is aimed at developing/standardizing the mechanism to propagate filtering info, _not_ to regulate nor recommend the way it should be done in production nor who should do it. I have not heard anything so far about this being unclear, as I presented it at the last IETF: http://arneill-py.sacramento.ca.us/redisfilter.ppt. It seems to me that you are jumping into the boat late without a complete understanding of the history behind it. You put the car before the horse: we don't have such a mechanism yet, how could you judge it? One step at a time: first, we need vendors to implement. So far, only Cisco has shown some interest in it (CSCed45744). Some of us have set aside a 7500 to monkey with the beta code when it finally arrives [hint]. Then, all interesting parties (an when I whois AS29467 I see some legitimacy here) will evaluate how good the extended BGP feed mechanism is. If you think it stinks, just don't use it. As of myself, I welcome the efforts of Deepak and Daniel and invite them to join their efforts to a diverse group that is willing to spend some time for the common good. Michel. -----Original Message----- From: Robert E. Seastrom [mailto:rs@seastrom.com] Sent: Sunday, February 22, 2004 3:20 PM To: Michel Py Cc: Deepak Jain; nanog(a)merit.edu Subject: Re: BL of Compromised Hosts? "Michel Py" <michel(a)arneill-py.sacramento.ca.us> writes: > There is a regrouping of BGP feeds for various "questionable" hosts and > networks around AS29467; read > http://arneill-py.sacramento.ca.us/draft-py-idr-redisfilter-01.txt and > feel free to contact the authors. It behooves the prospective user of said feed to read and understand draft-py, carefully research the pedigree of the data sources that go into the soup, and draw his own conclusions - taking as conservative and discriminating an approach as he deems necessary in terms of what he accepts. I anticipate wide variance in the quality of feeds provided, based on previous conduct of the proposed initial participants. As the primary author has said in a private communique, "it's like RBL mailing lists: there are good and bad ones". Unfortunately, my reading of draft-py is that in this case, they're to be rolled up into a single feed, discernable only by community. I believe that's a step away from goodness. Wait, you say, filtering routes is easily done by any experienced user, right? Well, yes. Not everyone's an experienced user, though. My primary concern here is one of education; the danger with a roll-up feed such as this one is that the default case is to accord equal credence to every blacklist; the naive end-user would discover that not only had he signed up for the spiritual equivalent of MAPS (conservative, responsive, and responsible) but also SPEWS (hard-to-reach, petty, vindictive, and probably going to list my home mail server or maybe my whole /24 in retalliation for casting them in a negative light in a public forum). Of course, the RBL-consumer will learn about this when his customers call. Surprise, surprise, surprise... > The different sources have different but commonly known communities. ... which are undocumented in draft-py itself, and among the URLs listed in Section 2 for more information, only Team Cymru offers a BGP community advisory on their web page. So, I must not be part of the "in-crowd" to know these "commonly known" communities... ---Rob

1 0

BL of Compromised Hosts?
by Deepak Jain 22 Feb '04

22 Feb '04

Would anyone be interested in receiving a text or BGP feed of IPs of hosts known/suspected to be compromised and used as parts of DDOS attacks? Would anyone be interested in contributing their BGP views? We have (and I'm sure we're not isolated) been seeing attacks from several thousand/tens of thousands of unique hosts generated >2Gb/s, >1Mpps attacks. I am not necessarily suggesting that providers use this list to blackhole at their edge, but its certainly a good candidate for that. It could alternatively be used by access providers to notify their customers or filter on their customers. I am sure it would also be a good list to use to deny traffic to SMTP servers from/to. I'm not really an activist, so if there is real interest, I will be glad to set it up and contribute our own significant list of sources. If this is already done and I don't have a good set of skills with Google, please let me know. Thanks in advance, Deepak Jain AiNET

6 5

Spam and the Law Conference Presentations Available (including Audio)
by Anne P. Mitchell, Esq. 22 Feb '04

22 Feb '04

All, The proceedings of last month's Spam and the Law conference are now available through us. They are available as individual sessions, or you can get the entire conference (broken out into individual sessions). Each presentation includes the full audio of the speaker's presentation (and the quality is excellent - our sound guy did a superb job), along with any handouts, PowerPoints, etc.. There is a 25% discount for list members (only! Please don't share the discount link! If you want to tell someone about the availability of the proceedings, please just give them our website address at http://www.isipp.com) To get the discount, use this link: http://www.1shoppingcart.com/app/adtrack.asp?AdID=68216 It will redirect you to our site, and when you check out it will automatically apply the discount. Anne

1 0

Verizon clients DOS own site?
by Elkind_Rob＠emc.com 22 Feb '04

22 Feb '04

Anyone else seeing this, it started up a few weeks ago. We have a number of home users that VPN to our corporate network who are using Verizon DSL as their Internet provider. While they are connected to the corporate network they are generating tons of hits to 'supportcenter.verizon.net' (206.46.187.54) Here's a basic trace: host.on.my.net -> 206.46.187.54 TCP 49980 > HTTP [ACK] host.on.my.net -> 206.46.187.54 HTTP GET /sbconfigservlet/sbconfigservlet HTTP/1.1 206.46.187.54 -> host.on.my.net HTTP HTTP/1.1 404 Not found Here's the text of the transaction: host.on.my.net GET /sbconfigservlet/sbconfigservlet HTTP/1.1 Accept: */* Accept-Language: en If-Modified-Since: Mon, 09 Feb 2004 22:49:47 GMT User-Agent: Motive HTTP Client Host: supportcenter.verizon.net Connection: Keep-Alive Cache-Control: no-cache reply from 206.46.187.54 HTTP/1.1 404 Not found Server: Netscape-Enterprise/6.0 Date: Tue, 10 Feb 2004 19:37:05 GMT Content-type: text/html Content-length: 292 <HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html;charset=ISO-8859-1"><TITLE>Not Found</TITLE></HEAD><H1>Not Found</H1> The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you have it. This repeates over and over again many times a second while the client is connected. My guess is that these client files are the ones that initiate the conversation from the client: C:\program files\verizon\online\supportcenter\bin\matcli.exe C:\program files\verizon\online\supportcenter\bin\mpbtn.exe I'm seeing millions of hits to this site from just our ~100 users using Verizon per week. I have to think that world wide, Verizon clients are generating enough traffic to DOS themselves. I've tried contacting Verizon via email but I haven't received a response and their tech support had no information on this. Although we're now blocking this site and trying to clean up the clients, this is still generation a lot of noise on our network. Any ideas on how to get Verizon to take a look at this? Any input is welcome. Thanks, > Rob Elkind Information Security Engineer > EMC² > where information lives > > Email: elkind_rob(a)emc.com > >

13 17

RE: M$ CD patches
by Michel Py 21 Feb '04

21 Feb '04

> Sean Donelan wrote: > Regardless of the distribution method, geniune Microsoft > patches are always cryptographically signed by Microsoft. > Whether consumers can figure out how to check the signature > is a different question. Lots can't. I recently put a fake "identity seal" on my personal web site (go to https://arneill-py.sacramento.ca.us and put the mouse cursor over the padlock on the left). It's completely bogus: not only the artwork has been greatly inspired by Comodo's thing (view the real thing here: http://www.instantssl.com/ssl-certificate-products/ssl-certificate-trust logo.html) when the actual SSL certificate comes from freessl.com, but it also works even if you view the insecure page http://arneill-py.sacramento.ca.us/. Besides, I do not have a credit card processing system, although I do accept donations in cash and gold bullions. So, what you're looking at is nothing more than a little photoshop and javascript. Guess what: I have received many questions that say in substance "how much does it cost to get the same seal as yours and can you come install it on my web server?" Michel.

1 0

MS can't live with it can't live... with it
by J. Oquendo 21 Feb '04

21 Feb '04

> In the future you may be able to obtain patches through other > distribution channels, e.g. your ISP or consumer electronics chain or > original equipment manufacturer. Perhaps MS should pay a fee to companies such as ISP's (would never happen) to distribute their fixes. Judging from my experience now working at an ISP, I can tell you it is a nightmare dealing with their flaws. > Regardless of the distribution method, geniune Microsoft patches are > always cryptographically signed by Microsoft. Whether consumers can > figure out how to check the signature is a different question. Not to kick a horse when its down, but to think that users who have (and most continually) become infected - because they decided to read Hello! and Hi! messages from someone they don't even know, over and over, and constantly wonder why their attachments look funny - will understand or even care what a signature is, is boggling. Maybe MS should take some time and make a "RTFM for Dummies" interactive video so their users can learn a thing or two. Understanding what an MS cert if and why you need it. Why are MS Updates (all 6! per week) are important to install, etc. > Perhaps more significant is Mail Fraud is a well tested law, which has > trained, sworn law enforcement active the United States Postal > Inspection Service. Unlike ISP abuse departments, the USPIS has > badges, carries guns and the legal authority to arrest people. > I wouldn't want to get into a shoot out over this, but if someone were going to do something on this scale, depending on the setup, the US government wouldn't be able to do much if it were set up properly. Regardless of how many guns whoever is carrying. Not to give out suggestions nor get myself in any trouble answering a question, but it could be done to such an extent the USPS, would be null. FBI, on the other hands, depends. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net "Men have been taught that it is a virtue to agree with others. But the creator is the man who disagrees. Men have been taught that it is a virtue to swim with the current. But the creator is the man who goes against the current. Men have been taught that it is a virtue to stand together. But the creator is the man who stands alone." -- Ayn Rand

1 0

RE: M$ CD patches
by Michel Py 21 Feb '04

21 Feb '04

I wonder how many will install worms and viruses from a CD that they got not from Microsoft but from phishing schemes that will inevitably pop up around it..... Michel. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of David Lesher Sent: Saturday, February 21, 2004 1:45 PM To: nanog list Subject: M$ CD patches http://www.internetnews.com/dev-news/article.php/3314501 In a bid to target a security hurdle rampant with dial-up Internet users, Microsoft has rolled out a security update CD giveaway for users of Windows XP, Windows Me, Windows 2000, Windows 98, and Windows 98 Second Edition (SE). The Windows Security Update CD will ship with all of its "critical" patches released by the software giant through October 2003 and free anti-virus and firewall trial software. .... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

3 3

M$ CD patches
by David Lesher 21 Feb '04

21 Feb '04

http://www.internetnews.com/dev-news/article.php/3314501 In a bid to target a security hurdle rampant with dial-up Internet users, Microsoft has rolled out a security update CD giveaway for users of Windows XP, Windows Me, Windows 2000, Windows 98, and Windows 98 Second Edition (SE). The Windows Security Update CD will ship with all of its "critical" patches released by the software giant through October 2003 and free anti-virus and firewall trial software. .... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

PAIX Palo-Alto
by Andre Chapuis 21 Feb '04

21 Feb '04

Anybody else having problems over the PAIX Palo-Alto LAN ? Cheers, André -------------------------------------------------------- Andre Chapuis IP+ Backbone Engineering AS3303 Swisscom Enterprise Solutions Ltd Genfergasse 14, CH-3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 --------------------------------------------------------

1 0

RouteScience PathControl vs. Radware Linkproof
by Dave Temkin 20 Feb '04

20 Feb '04

Looking for anyone who's done a direct comparison of the two (I understand the way they fundamentally work is completely different, however they both try to achieve the same thing). I'm doing my own bake-off here and I'd like to hear others' opinions. Direct replies are OK Thanks, -Dave

1 0