- Test - lists.nanog.org

Re: Virus emails from nanog mail list
by Steven M. Bellovin 19 Aug '03

19 Aug '03

In message <p05200f04bb680320c606(a)[64.202.132.204]>, David Diaz writes: > >Spam may be off topic but in this case relevant. Has anyone else >noticed bounced emails that appear to have origionated from their >nanog email boxes and contain viruses? > >Obviously some bot has gone threw the nanog list and is now forging >headers such that they appear to come from those addresses, and they >are attaching viruses. > >The IP address (which may or may not be accurate) appears to be >[195.157.87.253]. > >Has anyone else noticed this recently? I've gotten hundreds of such bounce messages today. Only a few have Received: lines, but those have differed. I don't know for sure if it's the nanog list, since I don't use a different email address for it. --Steve Bellovin, http://www.research.att.com/~smb

2 1

Why do you use Netflow
by lance_tatman＠agilent.com 19 Aug '03

19 Aug '03

Are operators frequently using netflow nowadays? I assume that if you are, you turn it on only for some limited duration to collect your data and then go back and do your analysis. Is this assumption correct? What are you looking at when you analyze this data? I've seen uses such as top 10 destination AS's for peering evaluations. What else? Billing? -Lance-

10 11

anybody know the owner of 209.251.0.0/19?
by Paul Vixie 19 Aug '03

19 Aug '03

i'm getting spammed from there... [sa:i386] ./find-spam.pl 209.251.0.0/19 SELECT HOST(s.relay) AS relay, s.entered, s.md5, s.body_md5, LENGTH(s.header)+LENGTH(b.body)+1 AS size, s.header FROM spam s LEFT JOIN bodies b ON s.body_md5 = b.md5 WHERE relay <<= '209.251.0.0/19' ORDER BY entered LIMIT ALL spam: [002515 2001-12-09 23:37:37+00 209.251.20.7] lart: {12370 209.251.20.7 source mailer} mail: (0 007557 ) spam: [005626 2003-07-31 22:14:54.367173+00 209.251.28.142] lart: {316925 209.251.28.142 source mailer} spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) spam: [001260 2003-08-13 14:28:06.363234+00 209.251.28.142] lart: {332664 209.251.28.142 relay mailer} mail: (0 002207 20030813142817.C3EF013980(a)sa.vix.com) ...but there is no whois... [sa:i386] whois -h whois.arin.net 209.251.28.142 No match found for 209.251.28.142. # ARIN WHOIS database, last updated 2003-08-18 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database. ...and they seem to have transit through both AS209 and AS6076... noc(a)re0.r7.pao1> show route 209.251.28.142 ... 209.251.0.0/19 *[BGP/170] 2w3d 23:55:24, MED 2147483647, localpref 100 AS path: 209 11036 I > to 198.32.176.52 via ge-2/1/0.6 [BGP/170] 1w2d 10:47:58, MED 2147483647, localpref 100 AS path: 3549 8011 6076 11036 I > to 208.50.13.57 via ge-1/3/0.501 [BGP/170] 2w3d 23:55:12, MED 10, localpref 90 AS path: 2914 209 11036 I > to 129.250.16.157 via so-1/2/2.0 [BGP/170] 1w4d 16:20:31, MED 10, localpref 90 AS path: 701 209 11036 I > to 198.32.176.2 via ge-2/1/0.6 [BGP/170] 04:33:44, MED 10, localpref 90 AS path: 6453 209 11036 I > to 207.45.196.65 via so-1/2/0.0 ...although both AS11036 (the origin) and AS6076 (one of the transits) are in the same geo area, one of them (voyager.net) was i thought out of business. am i being spammed from pirated address space?

2 1

Don't beat me, but i've noticed a huge influx of these .pif virii today.
by Drew Weaver 19 Aug '03

19 Aug '03

Don't kill me for posting this, it may be slightly off topic but I have noticed a very odd spike in traffic with these virii that have .pifs attached to them. The subject is random. The body always says: "See attached file for details" and they're always a pif file. Anyone else notice this? -Drew

4 3

some wide-scale airline reservations issue
by Joe Abley 19 Aug '03

19 Aug '03

I'm sitting on the tarmac on AC63 from YVR to ICN which was due to take off about half an hour ago. So far they have about a quarter of the plane loaded. The problem I am hearing is that there's a system-wide network issue with Air Canada, and other airlines as well: "apparently everybody" is the uninformed opinion here in the J class cabin. Fingers are vaguely being pointed at "Bell" and "Telus" (depending on which coast people are from). Since all computer systems are unavailable, all passengers and all bags are having to be checked by hand. They just gave up trying to allocate seats, and are about to start "open boarding". Excuse me while I hold on to my seat. The consistent component of the ongoing rumour mill is that this is due to "some computer virus". Anyway, irritating vague rumours aside, here's some operational content: if you're waiting for parts, spares or staff to arrive by plane from somewhere, and especially if the flight is not direct, be prepared for delays. Joe

3 2

CBC on Air Canada virus
by Fred Heutte 19 Aug '03

19 Aug '03

http://calgary.cbc.ca/regional/servlet/View?filename=ca_aircanada20030819 Web Posted Aug 19 2003 01:36 PM MDT Air Canada hit by computer slowdown Calgary - A pair of computer viruses is being blamed for major disruptions in airports across North America Tuesday, including Calgary International. Edmonton International was mostly unaffected. Air Canada's self check-in kiosks were hit mid-morning, while its other computers were slowed by the viruses leading to delays for its passengers. In Calgary, passengers choked the concourse Tuesday morning, while baggage was hand-checked and working computers were shared. Brad Powers, who waited for more than an hour to get checked in for his flight to Japan, said it was bad timing for Air Canada, which has been battling slower service because of layoffs and a virtual shut down of its North American flights last week when the power blackout hit Toronto. Most flights Tuesday were delayed by 25 minutes. The viruses, offshoots of last weeks Blaster Worm virus, hit hundreds of thousands of computers in Canada in the early morning, including many of those at local hotels, hospitals and airports. The so- called Blaster and White Hat viruses first hit unsuspecting computer users Monday, and has since been spreading at a rapid pace, computer experts say. "As of yesterday, it's affected about 600,000 computers in North America that we know of," Phil Bradley, of Computer Support Experts in Mississauga, said.

1 0

RE: some wide-scale airline reservations issue
by Ingevaldson, Dan (ISS Atlanta) 19 Aug '03

19 Aug '03

Joe- Sounds like this: http://story.news.yahoo.com/news?tmpl=story&cid=581&ncid=581&e=1&u=/nm/2 0030819/tc_nm/airlines_aircanada_virus_dc -d -----Original Message----- From: Joe Abley [mailto:jabley@isc.org] Sent: Tuesday, August 19, 2003 3:40 PM To: nanog(a)nanog.org Subject: some wide-scale airline reservations issue I'm sitting on the tarmac on AC63 from YVR to ICN which was due to take off about half an hour ago. So far they have about a quarter of the plane loaded. The problem I am hearing is that there's a system-wide network issue with Air Canada, and other airlines as well: "apparently everybody" is the uninformed opinion here in the J class cabin. Fingers are vaguely being pointed at "Bell" and "Telus" (depending on which coast people are from). Since all computer systems are unavailable, all passengers and all bags are having to be checked by hand. They just gave up trying to allocate seats, and are about to start "open boarding". Excuse me while I hold on to my seat. The consistent component of the ongoing rumour mill is that this is due to "some computer virus". Anyway, irritating vague rumours aside, here's some operational content: if you're waiting for parts, spares or staff to arrive by plane from somewhere, and especially if the flight is not direct, be prepared for delays. Joe

1 0

RE: some wide-scale airline reservations issue
by Mark Segal 19 Aug '03

19 Aug '03

I heard.. (via CBC I think).. That their computer system in Toronto crashed during the power outage.. My guess is they have some serious problem with their DB. I just booked a ticket.. Hopefully I am going somewhere. :) Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Joe Abley [mailto:jabley@isc.org] Sent: August 19, 2003 3:40 PM To: nanog(a)nanog.org Subject: some wide-scale airline reservations issue I'm sitting on the tarmac on AC63 from YVR to ICN which was due to take off about half an hour ago. So far they have about a quarter of the plane loaded. The problem I am hearing is that there's a system-wide network issue with Air Canada, and other airlines as well: "apparently everybody" is the uninformed opinion here in the J class cabin. Fingers are vaguely being pointed at "Bell" and "Telus" (depending on which coast people are from). Since all computer systems are unavailable, all passengers and all bags are having to be checked by hand. They just gave up trying to allocate seats, and are about to start "open boarding". Excuse me while I hold on to my seat. The consistent component of the ongoing rumour mill is that this is due to "some computer virus". Anyway, irritating vague rumours aside, here's some operational content: if you're waiting for parts, spares or staff to arrive by plane from somewhere, and especially if the flight is not direct, be prepared for delays. Joe

2 1

Fwd: Re: Virus emails from nanog mail list
by David Diaz 19 Aug '03

19 Aug '03

Forwarding this for Mark, he deserved some credit for verifying the IP but did not want his other addy harvested. It's like you need a wing man now for posting to mail lists! Cougar >Subject: Re: Virus emails from nanog mail list >From: "Mark J. Scheller" >To: David Diaz <techlist(a)smoton.net> >Date: Tue, 19 Aug 2003 13:21:55 -0400 >X-MailScanner-Information: Please contact the ISP for more information >X-MailScanner: Found to be clean > >On Tue, 2003-08-19 at 12:42, David Diaz wrote: >> Spam may be off topic but in this case relevant. Has anyone else >> noticed bounced emails that appear to have origionated from their >> nanog email boxes and contain viruses? >> >> Obviously some bot has gone threw the nanog list and is now forging >> headers such that they appear to come from those addresses, and they >> are attaching viruses. >> >> The IP address (which may or may not be accurate) appears to be >> [195.157.87.253]. >> >> Has anyone else noticed this recently? > >Earlier today I received 2 bounce messages from AOL stating they were >not delivered due to a virus and originated from that very IP! So >you're not alone and/or imagining things.... thanks for mentioning its >harvesting source. > >mS (mjs(a)yoink.net) >

1 0

RE: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?)
by Mark Segal 19 Aug '03

19 Aug '03

<Snip> UPDATED: The Nachi worm will infect vulnerable Windows XP and 2000 machines using the same exploit used by the MS Blast worm family. The main difference between Nachi and MS Blast, is that Nachi will remove and disable MS Blast infections that it encounters, and download and install the correct MSRPC DCOM patch from Microsoft. This action will permanently close the MSRPC DCOM vulnerability. The Nachi worm will not patch the WebDAV vulnerability on Windows 2000 Servers. </snip> Patches DCOM and removes MBLAST.. Why doesn't Microsoft release this, or did they? :). mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com Futureway Communications Inc. is now FCI Broadband -----Original Message----- From: Ingevaldson, Dan (ISS Atlanta) [mailto:dsi@iss.net] Sent: August 19, 2003 12:30 PM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) The "Nachi" worm propagates via MSRPC DCOM and the IIS WebDAV bug. It may be causing this storm because it runs 300 scanning threads, and it pings each IP first. http://xforce.iss.net/xforce/alerts/id/150 MS Blast wasn't multithreaded. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Paul Jasa [mailto:pjasa@univision.net] Sent: Tuesday, August 19, 2003 12:19 PM To: nanog(a)merit.edu Subject: AT&T Blocking ICMP (was RE: AT&T US Network Slowdown?) A call to AT&T Worldnet confirms that AT&T Worldnet service is blocking ICMP in order to deal with an undefined emergency. Nothing posted on their site, nor any other info is available. If anyone has info related to this "icmp outage", please advise. Thanks! pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Sean Crandall [mailto:sean@megapath.net] Sent: Tuesday, August 19, 2003 02:12 AM To: Paul Jasa; nanog(a)merit.edu Subject: RE: AT&T US Network Slowdown? Importance: High > > Dear Nanogers, > Is anyone aware of a "slowdown" issue throughout the US AT&T network > since 8/18 at around 4pm which is causing a lot of internet circuits > (including DSL) to be inaccessible and/or appear down from the outside > world? AT&T says this has been escalated to "Level 4" with no ETA and > affecting the whole country. I am seeing this problem in the San > Francisco area. Just wondering if anyone else is experiencing > anything that would confirm AT&T's claim, and fishing for more info > about the possible cause and ETA. Thanks! We are currently seeing the slowdown on our network in San Jose. Started about exactly the time frame that you mentioned. The rest of the country (oddly) seems unaffected by this at the moment, but San Jose is getting hammered by something. Still trying to sort out exactly where it is coming from. -Sean Sean P. Crandall VP Engineering Operations MegaPath Networks Inc. Pleasanton, CA 94588 (925) 201-2530

1 0