- Test - lists.nanog.org

DCC-Exploit for mIRC 6.x
by Mehmet Akcin 13 Oct '03

13 Oct '03

yo It might be wrong place to inform, but since we might have people interested in IRC, and using mIRC 6.x, there is an exploit found. For more info visit link http://www.irchelp.org/irchelp/mirc/exploit.html Mehmet Akcin

1 0

Abuse Departments
by Andrew D Kirch 13 Oct '03

13 Oct '03

After 3 Denial of Service attacks in the last 4 days, I'm beginning to wonder if there should be a standardization of some sort of abuse departments. Or perhaps if there are some companys that should REALLY THINK (TM) about perhaps installing some. When my domain is under attack by yours, that means you've done something WRONG, and you need to take care of it, the same as I would if mine is under attack. How it's even concievable that you can operate without someone that has the authority to act on abuse 24/7 from your AS number's Org-Abuse is inconceivable. Quite frankly the FBI cares not at all about Denial of Service attacks, because if they did such attacks wouldn't happen. If I try to break into and cease the abusive actions of these hosts, I am myself committing a felony to defend my site from attack. They however don't have someone on hand to stop the attacks and quite honestly the damage of not having a connection to the internet isn't expressable simply in monatary loss. Real change needs to happen as far as accountability across the internet. If everyone's going to run windows and kiddies are going to have packetnets that extend to millions of hosts, then someone needs to be on call at large consumer ISP's to yank cords when their customers boxes get compromised, the next ISP that tells me "we'll have someone call you about that tomorrow is going to get listed on nanog, and CC'd to an ISP hall of shame somewhere of my own making. Please, please impart clue on your abuse department. Allowing hosts in your domain to participate in DoS attacks is WRONG. -- Andrew D Kirch | trelane(a)2mbit.com | Security Admin | Summit Open Source Development Group | www.sosdg.org

8 13

Re: AOL mail server problems?
by Brian Bruns 12 Oct '03

12 Oct '03

----- Original Message ----- From: Joshua Levitsky To: Brian Bruns Cc: jlewis(a)lewis.org ; nanog(a)merit.edu ; Suresh Ramasubramanian Sent: Sunday, October 12, 2003 3:10 PM Subject: Re: AOL mail server problems? > What is the PTR record for your mail server? If you don't have one or if it reads like a residential one then I've heard of that > getting blocked. Also be advised you can contact postmaster(a)aol.net or AOL Postmaster HelpDesk at 1-703-265-4670 or 1- > 888-212-5537. > Before you email or call you should try this to verify that you have a PTR and that it doesn't read like a residential. (For example >dsl081-214-123.nyc2.dsl.speakeasy.net. ) Ah yeah, we have an ameritech PTR right now (working on that problem as well). I guess I'll have one of my guys call ameritech and complain about the PTR. -------------------------- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org ICQ: 8077511

1 0

RE: BellSouth prefix deaggregation (was: as6198 aggregation event)
by McBurnett, Jim 12 Oct '03

12 Oct '03

> > IMHO, I think we should create a route-set obj like call > it... RS-DEAGGREGATES and list all the major irresponsible > providers's specific /24's in it... CASE: Business has a /24 from X provider in order to multihome. That /24 is de-aggregated from a /19, with this policy that /24 may not be routed. possible exception: When 2002-3 get passed by ARIN, this could even take on new meaning. ARIN says they will use a single /8 for the handing out of /22-/24 for multihoming end users. will you then filter those /24's also? Also: What happens when that /24 for Business Y noted above is dual routed by ISP A and ISP B, and ISP A's upstream filters but ISP B's does not? Will there be asymmetric routing? Finally: Can anyone from BellSouth, explain the end goal of the de-aggregation? I suspect with 40 + ASs they may be rebuilding their network with a recently announced list of new IP services and DSL growth as asked for under the Federal government Rural DSL regulations... (I'm not trying to defend them, just giving some possibilities) > So some ASes who wish to not accept deaggregated specifics > using RPSL can update their AS import policy to not import > RS-DEAGGREGATES... > > Just my humble opinion.. Comments/critics welcome :) > > -hc > > -- > Haesu C. > TowardEX Technologies, Inc. > Consulting, colocation, web hosting, network design and implementation > http://www.towardex.com | haesu(a)towardex.com > Cell: (978)394-2867 | Office: (978)263-3399 Ext. 170 > Fax: (978)263-0033 | POC: HAESU-ARIN > > > On Sun, Oct 12, 2003 at 11:26:49AM -0400, Jared Mauch wrote: > > > > On Sun, Oct 12, 2003 at 01:02:57PM +0000, Stephen J. Wilcox wrote: > > > > > > > Can anyone from BellSouth comment? What if a few other > major ISPs were > > > > to add a thousand or so deaggregated routes in a few > weeks time? Would > > > > there be a greater impact? > > > > > > one word - irresponsible > > > > This clearly stands out to me as a reason to keep and use > > prefix filtering on peers to reduce the amount of junk in > the routing > > tables. If bellsouth needs to leak more specifics for load > balancing > > purposes, fine, just make sure those routes don't leave > your upstreams > > networks and waste router memory for the rest of us that > don't need to > > see it. > > > > - Jared > > > > > > (Note: The above numbers are based on data from > cidr-report.org. Some > > > > other looking glasses were also checked to see if > cidr-report.org's view > > > > of these AS's is consistent with the Internet as a > whole. This appears > > > > to be the case, but corrections are welcome.) > > > > > > > > -Terry > > > > > > > > > -----Original Message----- > > > > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > > > > Behalf Of Terry Baranski > > > > > Sent: Sunday, October 05, 2003 3:01 PM > > > > > To: 'James Cowie'; nanog(a)merit.edu > > > > > Subject: RE: as6198 aggregation event > > > > > > > > > > > > > > > > > > > > James Cowie wrote: > > > > > > > > > > > On Friday, we noted with some interest the > appearance of more > > > > > > than six hundred deaggregated /24s into the global routing > > > > > > tables. More unusually, they're still in there > this morning. > > > > > > > > > > > > AS6198 (BellSouth Miami) seems to have been > patiently injecting > > > > > > them over the course of several hours, between > about 04:00 GMT > > > > > > and 08:00 GMT on Friday morning (3 Oct 2003). > > > > > > > > > > If you look at the 09/19 and 09/26 CIDR Reports, > BellSouth Atlanta > > > > > (AS6197) did something similar during this time > period -- they added > > > > > about 350 deaggregated prefixes, most if not all /24's. > > > > > > > > > > > Usually when we see deaggregations, they hit > quickly and they > > > > > > disappear quickly; nice sharp vertical jumps in the > table size. > > > > > > This event lasted for hours and, more importantly, > the prefixes > > > > > > haven't come back out again, an unusual pattern for > a single-origin > > > > > > change that effectively expanded global tables by > half a percent. > > > > > > > > > > That AS6197's additions are still present isn't encouraging. > > > > > > > > > > -Terry > > > > > > > > > > > > > > > > > -- > > Jared Mauch | pgp key available via finger from > jared(a)puck.nether.net > > clue++; | http://puck.nether.net/~jared/ My > statements are only mine. > >

2 1

AOL mail server problems?
by Brian Bruns 12 Oct '03

12 Oct '03

Hello everyone, I've noticed some weird things going on with AOL's smtp servers today - 2003-10-12 12:37:48 1A8k8X-0002OC-0c Remote host mailin-04.mx.aol.com [64.12.138.89] closed connection in response to initial connection 2003-10-12 12:37:55 1A8k8X-0002OC-0c Remote host mailin-04.mx.aol.com [64.12.136.153] closed connection in response to initial connection 2003-10-12 12:38:35 1A8k8X-0002OC-0c Remote host mailin-04.mx.aol.com [152.163.224.122] closed connection in response to initial connection Have about 40 of these in my mail logs going to different AOL smtp servers. Trying to connect by hand using telnet results in the mail servers closing the connection right away without giving a reason. I did however, out of about 20 tests, got through once and actually got the server's welcome message. Any ideas? -------------------------- Brian Bruns The Summit Open Source Development Group Open Solutions For A Closed World / Anti-Spam Resources http://www.sosdg.org ICQ: 8077511

3 5

New mail blocks result of Ralsky's latest attacks?
by Bob German 12 Oct '03

12 Oct '03

A colleague informed me this morning that Alan Ralsky is doing widespread bruteforce attacks on SMTP AUTH, and they are succeeding, mainly because it's quick, painless (for him), and servers and IDS signatures don't generally offer protection against them. Could this be why everyone's locking up their mail servers all of a sudden? Does anyone know of a way to stop them? Bob

8 11

Postini contact in the house ??
by John Brown (CV) 12 Oct '03

12 Oct '03

Hi list, seems there is no technical email contact listed for Postini on their website. a client is having an issue with postini, if there is someone with clue from postini on the list please contact me off list john at chagres d0t net thanks

1 0

DDOS Today?
by Greg Valente 12 Oct '03

12 Oct '03

I just got on today. Was there any large DDOS attacks today. Any specific networks impacted? -----Original Message----- From: Jeroen Massar [mailto:jeroen@unfix.org] Sent: Friday, October 10, 2003 8:16 PM To: 6bone(a)ISI.EDU; nanog(a)merit.edu Subject: Reserved ASN 64702, 6to4, 2 ghosts, other oddities and still no working contacts... -----BEGIN PGP SIGNED MESSAGE----- Checking http://www.sixxs.net/tools/grh/lg/?show=bogons&find=::/0 People might want to filter on private ASN's also when that ASN is being used as "transit"... 2001:a40::/32 AS64702 is reserved (path: 15516 3257 2497 4697 2914 10109 4538 4787 64702 20646 8763 5539 1930 9186) Ghost Route (14/12) 3ffe:3500::/24 3ffe:4005:fefe:: 25396 1752 10109 4538 4787 64702 20646 8319 We still have these 6to4 specifics btw: 2002:c2b1:d06e::/48 More specific 6to4 prefix (194.177.208.110/32) from AS5408 2002:c8a2::/33 More specific 6to4 prefix (200.162.0.0/17) from AS15180 2002:c8c6:4000::/34 More specific 6to4 prefix (200.198.64.0/18) from AS15180 2002:c8ca:7000::/36 More specific 6to4 prefix (200.202.112.0/20) from AS15180 And nopes, no contact has been made yet, apparently having your email address listed in the registry frees you of any obligations... Another funny one: 3ffe:3::/32 Subnet of 3ffe::/24 Mismatching origin ASN, should be 4555 (now: 29216) While there also is an announcement for: 2001:7fe::/32 I-rootserver-net-20030916 The ghosts of this month: 3ffe:1f00::/24 3ffe:2400::/24 Both with "10318 5623" common in their paths, obvious isn't it ? Oh and yes, still no contact from anybody at nortel, apparently that company doesn't know what IPv6 is. AS10318 (check above also) is still announcing *their* block and still haven't made any comment or reply back whatsoever. AS10318 have their own pTLA but apparently are not contactable for that pTLA either. If anybody knows someone alive for 3ffe:1300::/24 or AS762 or AS10318 please notify them. Maybe posting to nanog raises some people from sleep. Mailing the whois contacts directly doesn't help apparently. Greets, Jeroen -----BEGIN PGP SIGNATURE----- Version: Unfix PGP for Outlook Alpha 13 Int. Comment: Jeroen Massar / jeroen(a)unfix.org / http://unfix.org/~jeroen/ iQA/AwUBP4dLximqKFIzPnwjEQKluACglQJ+2QtJZ6O2fJZShwxLe0Z6Fz8AnRym p0Clq/HyC9EoC/RsaYudqZey =XBo4 -----END PGP SIGNATURE-----

3 2

internet consumers forum?
by Richard Welty 11 Oct '03

11 Oct '03

_please reply offlist_ i've sent some time (at least 20 minutes) considering that while there are forums for operators and engineers to discuss issues (nanog, ietf, others too numerous to mention), there aren't really forums for informed consumers of internet services to exchange notes (or for uninformed consumers to become informed.) if anyone knows of such, please let me know. otherwise, i'm considering starting an unmoderated but carefully monitored mailing list for business oriented discussion from the viewpoint of consumers. i'd probably want to tie this in with the development of FAQs and tutorials targeted at business consumers of internet services. again, comments offlist, please. richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security

3 3

edge interface bits
by Petri Helenius 11 Oct '03

11 Oct '03

Does anyone know, either on the east coast US, London, Stockholm, Copenhagen, Amsterdam or Helsinki transit providers which would allow edge/handoff interface control to different traffic classes using BGP communities? (for example to announce DDoS destinations and/or sources with different community which would drop the precedence of those packets to a lower level and thus de-prioritize them and allow legitimate traffic to have better performance) Pete

3 2