- Test - lists.nanog.org

TNT issues "workaround"
by Brian Wallingford 23 Aug '03

23 Aug '03

I haven't seen specific details posted here, so: Like many others, we've had a few TNTs online for years without hiccups or reboots until this week. Beginning late Sunday, we saw seemingly random blade reboots, and total system crashes. Errors ranged from memory leaks to infinite loops on the controller blade, but all blades were susceptible. HDLC2 blades seemed to be particularly vulnerable. We saw boxes that had been rock-solid for very long periods suddenly rebooting at periods ranging from 20 minutes to 4 hours, with no obvious cause (i.e., nothing more specific than the above). Border and core filtering of icmp echo * did little good. On the suggestion of some folks on another list, and against my better judgment, we disabled route caching in order to free up additional memory (though memory did not appear fragmented). This stabilized all involved boxes, and surprisingly, did not result in significant degradation of end user performance. Granted, it's not a true fix, but it may get you a few extra Z's at night. hth, brian

1 0

Cisco OC-3c card question
by Stephen Milton 23 Aug '03

23 Aug '03

What is the most cost effective equipment to use to connect two locations with an OC-3c circuit? I currently have 7206VXR routers at both ends, so would prefer slot cards for those if feasible. Excuse my ignorance, but I can't get hold of any pre-sales support at Cisco because the worms are overloading their phone reps. -Steve -- Stephen Milton - Founder/VP Internet (425) 881-8769 x102 ISOMEDIA.COM - Premium Internet Services (425) 869-9437 Fax milton(a)isomedia.com http://www.isomedia.com

3 2

Sobig.f surprise attack today
by Jim Dawson 22 Aug '03

22 Aug '03

F-Secure Corporation is warning about a new level of attack to be unleashed by the Sobig.F worm today. Supposed to take place at 1900 UTC. http://www.f-secure.com/news/items/news_2003082200.shtml Jim -- See what ISP-Planet is saying about us! http://isp-planet.com/services/wholesalers/flexpop.html __________________________________________________________________ Jim Dawson jdawson(a)flexpop.net Flexpop/Navi.Net http://www.flexpop.net 618 NW Glisan St. Ste. 101 v. +1.503.517.8866 Portland, Or 97209 USA f. +1.503.517.8868 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

11 12

RE: Sobig.f surprise attack today
by Austad, Jay 22 Aug '03

22 Aug '03

I don't think the purpose was to DoS them. It looks like some of them were hosts on Comcast's cable network, probably some user machines being used to host the second part of the payload. I just want to know what the second part of this thing does. It's better than watching TV. :) > -----Original Message----- > From: Mark Segal [mailto:MSegal@Corporate.FCIBroadband.com] > Sent: Friday, August 22, 2003 4:05 PM > To: 'netadm'; 'nanog(a)merit.edu' > Subject: RE: Sobig.f surprise attack today > > > > My questions is what were those servers.. Was the purpose to denial of > service attack them? If so we just assisted that.. :) > > mark > > > -- > Mark Segal > Director, Network Planning > FCI Broadband > Tel: 905-284-4070 > Fax: 416-987-4701 > http://www.fcibroadband.com > > Futureway Communications Inc. is now FCI Broadband > > > -----Original Message----- > From: netadm [mailto:netadm@infolink.com] > Sent: August 22, 2003 3:50 PM > To: nanog(a)merit.edu > Subject: RE: Sobig.f surprise attack today > > > > From http://www.f-secure.com/v-descs/sobig_f.shtml > ----------------------------------------------------------------- > Update on 19:00 UTC > > When deadline for the attack was passed, one machine was still > (somewhat) up. However, immediatly after the deadline, this > machine (located > in the USA) was totally swamped under network traffic. > > We've tried connecting to it, just like the virus does. We do > this from > three different sensors from three different machines in > three different > countries. We haven't been able to connect to it once. If we > can't connect, > neither can the viruses. > > So the attack failed. Whoa. > > We'll keep monitoring until 22:00 UTC. If we're not able to > connect once, we > can safely say that the attack was prevented. > > > -----Original Message----- > From: Andrew Kerr [mailto:andrew_kerr@iamnos.ca] > Sent: Friday, August 22, 2003 3:43 PM > To: Jay Hennigan > Cc: nanog(a)merit.edu > Subject: Re: Sobig.f surprise attack today > > > > Jay Hennigan wrote: > > On Fri, 22 Aug 2003, Andrew Kerr wrote: > > > > > >>Its been posted here, and f-secure has it, but I wrote a > quick script > >>to keep an eye on the 20 servers and dump the output to a > simple page: > >> > >>http://207.195.54.37/sobig.html > >> > >>(Updates about every 5 mins) > > > > > > You're probing the list of NTP servers the worm uses to get > the date, > > not the list of hosts to which it "phones home". > > > > > A few people pointed that out. By the time this message hits > the list, > it should be corrected. >

1 0

Re: Cisco filter question
by Jack Bates 22 Aug '03

22 Aug '03

matt(a)petach.org wrote: >> ip address (access-lists): 199 > > ^^^ > >>Extended IP access list 181 > > ^^^ > > > > Did you mean to have a mismatch between the numbers? > Or is there some magic configuration detail that links > the two together that I haven't learned about yet? > They are comparitive lists. 181 lists all traffic leaving the router towards my networks while 199 is the list for the routemap that filters inbound icmp traffic of 92 bytes. 181 would be legitimate icmp traffic which is why it's lower than route-map nachi-worm which uses acl 199. -Jack

1 0

RE: Sobig.f surprise attack today
by Mark Segal 22 Aug '03

22 Aug '03

My questions is what were those servers.. Was the purpose to denial of service attack them? If so we just assisted that.. :) mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: netadm [mailto:netadm@infolink.com] Sent: August 22, 2003 3:50 PM To: nanog(a)merit.edu Subject: RE: Sobig.f surprise attack today >From http://www.f-secure.com/v-descs/sobig_f.shtml ----------------------------------------------------------------- Update on 19:00 UTC When deadline for the attack was passed, one machine was still (somewhat) up. However, immediatly after the deadline, this machine (located in the USA) was totally swamped under network traffic. We've tried connecting to it, just like the virus does. We do this from three different sensors from three different machines in three different countries. We haven't been able to connect to it once. If we can't connect, neither can the viruses. So the attack failed. Whoa. We'll keep monitoring until 22:00 UTC. If we're not able to connect once, we can safely say that the attack was prevented. -----Original Message----- From: Andrew Kerr [mailto:andrew_kerr@iamnos.ca] Sent: Friday, August 22, 2003 3:43 PM To: Jay Hennigan Cc: nanog(a)merit.edu Subject: Re: Sobig.f surprise attack today Jay Hennigan wrote: > On Fri, 22 Aug 2003, Andrew Kerr wrote: > > >>Its been posted here, and f-secure has it, but I wrote a quick script >>to keep an eye on the 20 servers and dump the output to a simple page: >> >>http://207.195.54.37/sobig.html >> >>(Updates about every 5 mins) > > > You're probing the list of NTP servers the worm uses to get the date, > not the list of hosts to which it "phones home". > A few people pointed that out. By the time this message hits the list, it should be corrected.

1 0

RE: Sobig.f surprise attack today
by netadm 22 Aug '03

22 Aug '03

>From http://www.f-secure.com/v-descs/sobig_f.shtml ----------------------------------------------------------------- Update on 19:00 UTC When deadline for the attack was passed, one machine was still (somewhat) up. However, immediatly after the deadline, this machine (located in the USA) was totally swamped under network traffic. We've tried connecting to it, just like the virus does. We do this from three different sensors from three different machines in three different countries. We haven't been able to connect to it once. If we can't connect, neither can the viruses. So the attack failed. Whoa. We'll keep monitoring until 22:00 UTC. If we're not able to connect once, we can safely say that the attack was prevented. -----Original Message----- From: Andrew Kerr [mailto:andrew_kerr@iamnos.ca] Sent: Friday, August 22, 2003 3:43 PM To: Jay Hennigan Cc: nanog(a)merit.edu Subject: Re: Sobig.f surprise attack today Jay Hennigan wrote: > On Fri, 22 Aug 2003, Andrew Kerr wrote: > > >>Its been posted here, and f-secure has it, but I wrote a quick script >>to keep an eye on the 20 servers and dump the output to a simple page: >> >>http://207.195.54.37/sobig.html >> >>(Updates about every 5 mins) > > > You're probing the list of NTP servers the worm uses to get the date, > not the list of hosts to which it "phones home". > A few people pointed that out. By the time this message hits the list, it should be corrected.

1 0

Brace yourselves.. W32/Sobig-F about to mutate...
by Valdis.Kletnieks＠vt.edu 22 Aug '03

22 Aug '03

A quick heads up, if anybody hasn't heard: At 1900GMT today, ET phones home, and picks up the next payload of instructions. Nobody knows (yet) what they'll be, but SoBig-E erased itself, put in a password grabber, and then installed a mail proxy for spammer use. This one *may* just play the theme song from Bozo the Clown and erase itself, but I severely doubt it's gonna be that nice. http://www.f-secure.com/news/items/news_2003082200.shtml

6 5

RE: Sobig.f surprise attack today
by Vachon, Scott 22 Aug '03

22 Aug '03

>OK... Maybe I'm smoking crack here, but, if they have the list of 20 >machines,wouldn't it make more sense to replace them with honey-pots that download >code to remove SOBIG instead of just disabling them? Only if we make assumptions that what they state is 100% fact and the whole truth of the matter. They know of 20 but, who is to say a variant in the wild doesn't know of 20 more ? Or 100 more ? Too late anyway. My other list subscriptions show it active now ... ~S~ Disclaimer: my own 2 cents. Learn more about Paymentech's payment processing services at www.paymentech.com THIS MESSAGE IS CONFIDENTIAL. This e-mail message and any attachments are proprietary and confidential information intended only for the use of the recipient(s) named above. If you are not the intended recipient, you may not print, distribute, or copy this message or any attachments. If you have received this communication in error, please notify the sender by return e-mail and delete this message and any attachments from your computer.

2 1

RE: Sobig.f surprise attack today
by Irwin Lazar 22 Aug '03

22 Aug '03

FYI: ------------------------------------------------------------------------ -------- At 1500 GMT, Mikko Hypponen, director of anti-virus research at F-Secure, told New Scientist that 18 of the 20 internet addresses his company had identified in the virus had been blocked. "But if even one machine remains online at the deadline, anything could happen," he warned. Hypponen said F-secure had notified the FBI and internet service providers who run the addresses listed in the worm and said some of the companies have agreed to temporarily block access to those machines. The target machines are based in Canada, USA and South Korea. Unreachable address At 1750 GMT, New Scientist ascertained that all but one of the 20 addresses were inaccessible. The 19 unreachable addresses may have been blocked, or could always have been protected by a firewall. The last open address is in Toronto, and is provided by the internet service provider Sympatico. Its spokesperson told New Scientist: "We are aware of the virus and are working with local law enforcement to identify the person behind the virus." A possible reason for deliberately leaving an address open might be to act as a "honey pot" - an address controlled by the authorities to observe the worm in action. However, the latest analysis of SoBig.F has revealed that even if this attempt to block access to the 20 addresses is successful, more action may be needed. Infected machines are programmed to check twice a week at the same time for new list of servers to contact. This new list could be delivered via a new virus. The existing list of 20 appears to list Windows PCs belonging to home users and connected to the internet via always-on, ADSL broadband connections, says Hypponen. "It is most likely that the party behind SoBig.F has broken into these computers and they are now being misused to be part of this attack." The worm's previous variant, SoBig.E, downloaded a program that removed the virus itself to cover its tracks, and then tried to steal the user's network and web passwords. But the machines infected with SoBig.F will try to connect to port 8998 on one of the hijacked machines. They will transmit a secret 8-byte code, which will cause the hijacked machines to return a web link to a site from which the malicious code can be downloaded. Attempts to discover this target link have so far been foiled, as the worm's writer used a bogus URL. Experts believe that this link would be changed to the real one a few seconds before the deadline, too late for companies to block. David Cohen

1 0