- Test - lists.nanog.org

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Mike Tancsa 09 Oct '03

09 Oct '03

Looks like attachments wont go through, so I will repost without the attachment. If anyone wants a copy, let me know ---Mike At 01:28 PM 09/10/2003, Andy Ellifson wrote: >Oops... Try this again... > >And as soon as you call law enforcement what happends? The spammer is >located offshore. Then what? Actually, in the case of the wired article (removeform.com) it seems to be connected to a site in Florida. I asked my programmer (gabor(a)sentex.net) to decode the obfuscated java script/page that is served up by one of the zombies (On FreeBSD fetch -B 18192 -o danger.html http://www.removeform.com/d - I got it from 207.5.215.72 at the time). I have attached it as a zip file with its contents. You will note that the form post goes back to form action="http://207.36.47.68/cgi-bin/addinfo.cgi" OrgName: CyberGate, Inc. OrgID: CYBG Address: 3250 W. Commercial Blvd. Suite 200 City: Ft. Lauderdale StateProv: FL PostalCode: 33309 Country: US ---Mike >--- Hank Nussbacher <hank(a)att.net.il> wrote: > > > > On Thu, 9 Oct 2003, Suresh Ramasubramanian wrote: > > > > > * "Follow the money" - find out the spammer / the guy who he spams > > for, > > > from payment information etc.Sic law enforcement on them. > > > > > > srs > > > > I think we can all safely assume that the people behind this are most > > probably on NANOG or reading the archives and are now aware of your > > idea > > :-) > > > > -Hank > >

1 0

Sitefinder and DDoS
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

Let's assume for a moment that Verisign's wildcards and Sitefinder go back into operation. Let's also assume someone sets up a popular webpage with malware HTML causing it, perhaps with a time delay, to issue rapid GETs to deliberately nonexistent domains. What would be the effect on overall Internet traffic patterns if there were one Sitefinder site? (flashback to ARPANET node announcing it had zero cost to any route) How many Sitefinder nodes would we need to avoid massive single-point congestion? AFAIK, the issues of distribution of Sitefinder, and even a formal content distribution network, were not discussed. I asked some general questions that touched on this at the ICANN ISSC committee meeting, but I think they were interpreted as directed toward the reliability of the Sitefinder service in operation, rather than potential vulnerabilities it might create. I am NOT suggesting this simply as an argument against Sitefinder, and I'd like to see engineering analysis of how this vulnerability could be prevented.

2 1

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Gregory Hicks 09 Oct '03

09 Oct '03

> Date: Thu, 9 Oct 2003 10:51:08 -0500 > Subject: Re: Wired mag article on spammers playing traceroute games with trojaned boxes > From: Chris Boyd <cboyd(a)gizmopartners.com> > To: nanog(a)merit.edu > > > > On Thursday, October 9, 2003, at 10:04 AM, Suresh Ramasubramanian > wrote: > > > > > http://www.wired.com/news/business/0,1367,60747,00.html > > > > -- > > srs (postmaster|suresh)(a)outblaze.com // gpg : EDEDEFB9 > > manager, outblaze.com security and antispam operations > > > > > > > > I found one of these today, as a matter of fact. The spam was > advertising an anti-spam package, of course. > > The domain name is vano-soft.biz, and looking up the address, I get > > Name: vano-soft.biz > Addresses: 12.252.185.129, 131.220.108.232, 165.166.182.168, > 193.165.6.97 > 12.229.122.9 > > A few minutes later, or from a different nameserver, I get > > Name: vano-soft.biz > Addresses: 131.220.108.232, 165.166.182.168, 193.165.6.97, 12.229.122.9 > 12.252.185.129 > > This is a real Hydra. If everyone on the list looked up vano-soft.biz > and removed the trojaned boxes, would we be able to kill it? This is NOT a hydra. The IP addresses are the same but presented differently. This happens because of THIS setup in DNS: vano-soft.biz. IN A 131.220.108.232 IN A 165.166.182.168 IN A 193.165.6.97 IN A 12.229.122.9 IN A 12.252.185.129 This setup is called "Round-robin" because the name server provides the first IP address FIRST to the first query; the second IP address first to the second query; the third IP address first to the third query; ... to the fifth query. Then it starts over with the first IP Address in response to the sixth query... In each case, ALL IP addresses are provided in response to each query. Yes, the TTL may be a bit low, but it is a workable setup... And no, I am NOT condoning what vano-soft.biz is doing, just trying to explain why, when you checked the first time, you got one answer, and when you checked sometime later, you got a different answer... (Donning flameproof underwear...) Regards, Gregory Hicks ------------------------------------------------------------------- "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

Re: Wired mag article on spammers playing traceroute games with trojaned boxes
by Joe St Sauver 09 Oct '03

09 Oct '03

Hi, #I think even if we get all the ones for this domain name today,=20 #assuming we can muster even man hours to get it today, another #5000 will be added tomarrow. Actually, we wrote a little tool to systematically track the dotted quads associated with the vano-soft domain name. We have been seeing a steady stream of new dotted quads advertised for that host, but no where near thousands per day. There have also been some Usenet posts talking about this particular site and the methodology it uses; see: http://groups.google.com/groups?selm= pan.2003.10.03.19.40.44.564854%40frontiernet.net&output=gplain Regards, Joe

1 0

Re: Finding clue at comcast.net
by Sirius F. Crackhoe 09 Oct '03

09 Oct '03

-----Original Message----- From: Sirius F. Crackhoe [mailto:sirius@crackhoe.com] Sent: Thursday, October 09, 2003 12:37 PM To: 'Howard C. Berkowitz' Comcast's Technical and Customer Support is outsourced to EDS and is based in the EDS call center in Hallifax. I believe they were also taking calls in the Winchester, KY call center, which was an old MCI/WorldCom Outsourced Call Center that they sold to EDS a few years back. They are setup the same as MSN, WebTV and RoadRunner. I used to do implementations for WorldCom's outsourced call centers and call tell you for sure, they have no access to the NOC or their staff. They are merely paid phone operators. :) Sirius -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Howard C. Berkowitz Sent: Thursday, October 09, 2003 11:21 AM To: nanog(a)merit.org At 9:29 AM -0500 10/9/03, Austad, Jay wrote: >Comcast's phone support department is the *worst*, WORST, I've ever >dealt with. I think they are outsourced, they have to go by a script, >and many of them probably hardly know what a computer even is. Once I >called because of a problem on their network, and I told the person on >the phone that there was a problem on their network, and I pinned it >down to a couple of routers where the problem may be, and she >responded, very sternly, "Sir, WE DON'T HAVE ANY ROUTERS" Same thing here. Last night, I was told that no escalation personnel were available. On the couple of occasions where I got escalation, I once had an informal conversation with a 3rd level. Their phone center is in Halifax, NS -- didn't find out if it is outsourced or not. While the person with whom I spoke was reasonably clueful, he told me that customer support had no interactive communication with network operations -- at best, they could send an email about a routing, SMTP, etc. problem and hope somebody would respond. At the time, I was paying for their "Pro" service, intermediate between regular residential and full business. My contact said that while that was supposed to get better customer support, an early plan to route it to business Comcast failed, and there really was NO separate Pro support organization. I dropped the Pro service after I learned that residential service no longer insisted you remove any local routers and firewalls before deigning to troubleshoot. They still ask you to do that, but repeated NO responses can get them to proceed. A few NANOGs back (Atlanta), I did a presentation on customer satisfaction, which, frankly, was in many respects a case study of how I'd reform customer support at my then ISP/DSL, cais.net. If NANOG ever did formal documents, I'd like to see a guideline on how to run customer support. > >In any case, if you manage to get the call escalated a couple of times >(after lying about rebooting your computer 47 times), You forgot reinstalling Windows. On a Mac. >you'll get someone >good. Also, there are some good people who read this list. But >calling their phone support to get anything useful is like trying to >squeeze blood from a rock. > >-jay > >> -----Original Message----- >> From: Howard C. Berkowitz [mailto:hcb@gettcomm.com] >> Sent: Wednesday, October 08, 2003 7:36 PM >> To: nanog(a)merit.org >> Subject: Finding clue at comcast.net >> >> >> >> I'm rapidly beginning to believe this is equivalent to finding the >> pot of gold at the end of the rainbow. When my broadband alternative >> is Verizon and it's looking better, this is scary. >> >> Sometime today, their SMTP server started bouncing messages with >> more than 3 addressees. When I called customer support, I was told >> "we only handle troubleshooting, not mail service." The operator >> "guessed" they might be doing software updates on the mail service, >> had no information, and said there was no person to which it could be >> escalated. >> >> She insisted that I call my local cable office to find out when the >> "server repair" would be completed, because "they schedule all >> repairs." >> >> Is this a bad dream? >>

1 0

Customer support tutorial
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

I was about to answer a request for my presentation about customer support, but I had a cat-on-keyboard exploit and I don't know who asked. In any event, the Atlanta presentation is at http://www.nanog.org/mtg-0102/cust.html I did it as a two-part with an intermediate BGP tutorial. In one of the two, there is an RFC 2270 slide. Please, please ignore it -- my brain went out to lunch on that one! Actually, this raises the interesting point -- is there an interest in updating and having running commentary on older presentations, keeping some content up to date? Is this something the NANOG site could support?

1 0

Why can't all my routers do FOO ?
by George M Jones 09 Oct '03

09 Oct '03

I'm trying to finish off the operational security requirements draft (http://www.ietf.org/internet-drafts/draft-jones-opsec-01.txt) which is a collection of operational security requirements for routers and other network infrastructure. The last major change that needs to happen is splitting out the Best Current Practice (BCP) info from the other items. This is where I'd like some feedback. If you're so motivated take 5 minutes to brainstorm two lists. The first is "*security features* I use everywhere now" (logging, aaa, filters...). The second is everything else: "I can't believe no vendor does FOO...", "Vendor A does BAR, life/security would be so much better if all vendors did it" etc. I'll take your lists and try to correctly align them with the drafts. If you're more motivated, you can see exactly which features have migrated from the BCP draft (opsec-01a-toc.txt) to the "info" draft (opsec-info-00.txt) by looking at the table of contents of the work-in-progress drafts @ http://www.port111.com/opsec/ Replies can come to the list (preferred to avoid duplication, allow discussion) or to me directly. Thanks, ---George Jones

1 0

News coverage, Verisign etc.
by Howard C. Berkowitz 09 Oct '03

09 Oct '03

I have gotten a reasoned response from the technology editor of the Washington Post, and we are discussing things. While I wouldn't have done it that way, he had a rational explanation of why the story was written the way it was, and definitely indicating there will be continuing coverage of the issue. He believes there's always room for improving coverage.

13 19

NANOG 29 hotels
by Simon Lockhart 09 Oct '03

09 Oct '03

Gah, the hotels seem to have suddenly all got booked up. Can anyone recommend a hotel close to NANOG29, sub $200/night room rate, with internet access in the room, with availability 18-22 Oct? I can't find any on the list on www.nanog.org with availability (or are > $200/night). Simon -- Simon Lockhart | Tel: +44 (0)1628 407720 (x37720) | Si fractum Technology Manager | Fax: +44 (0)1628 407701 (x37701) | non sit, noli BBC Internet Operations | Email: Simon.Lockhart(a)bbc.co.uk | id reficere BBC Technology, Maiden House, Vanwall Road, Maidenhead. SL6 4UB. UK

5 5

Transit and Paid Peering Exchanges
by Daniel Golding 09 Oct '03

09 Oct '03

Doing some research.... Anyone have a list of Transit and Paid Peering exchange fabrics? I am interested in both US and EU locations, particularly in interesting sites like 111 8th Ave (NYC), Telehouse North (London) and other major telco hotel type facilities. I'll summarize for the list and repost. Thanks, -- Daniel Golding

2 4