- Test - lists.nanog.org

Re: Port blocking last resort in fight against virus
by Steven M. Bellovin 13 Aug '03

13 Aug '03

In message <Pine.GSO.4.53.0308131452310.19594(a)rampart.argfrp.us.uu.net>, "Chris topher L. Morrow" writes: >This is the point, atleast I, have been trying to make for 2 years... end >systems, or as close to that as possible, need to police themselves, the >granularity and filtering capabilities (content filtering even) are >available at that level alone. > It's just not possible. Believe it or not, I don't much like firewalls. But see slide 5 of a talk I gave in May, 1994 (http://www.research.att.com/~smb/talks/firewalls.ps or http://www.research.att.com/~smb/talks/firewalls.pdf) for why we need them. We'll *always* have buggy code. Yes, Microsoft has shipped buggy code. So has everyone else. For fun, I tallied up the source of the responsible vendor for every CERT advisory issued last year or this. There have been 57 of them. 17 were miscellaneous -- other vendors, incidents (like the current worm), etc. 9 were about Sun. 13 were about Microsoft. And 18 were about open source software -- a couple of Apache bugs, some ssh issues, etc. Looking beyond CERT advisories, I recently tallied up how many times someone could have penetrated my machines, and I run them about as tightly as possible. Given problems in ssh, various PDF readers, gv, etc., I tallied about a dozen times I could have been had. Now, that tally is the tip of the iceberg. Microsoft itself had 72 bulletins last year and 31 this year -- there's no doubt that they've shipped awful code (and worse yet, they have an awful architecture from a security perspective). But they're not the only villain, and the open source software implicated runs on most of the open source Unix systems (Linux in its many incarnations, *BSD, etc) and even on some of the proprietary ones. **The purpose a firewall is to keep the hackers away from the buggy code.** Should ISPs filter? Sometimes there's no choice. Note that there are two distinct forms of "network security" problems. The classic type -- the kind firewalls were designed to deal with -- aren't really network security problems. They're host security problems where the network is the conduit. I suspect that ISPs should not filter most such traffic, except with the consent of (and often payment from) the site. (I'll also note that there are designs for doing such filtering on the end systems, though it's easier to block traffic there than to selectively permit it.) The other kind of problem is one that affects the infrastructure. DDoS is the classic example, but worms are another instances where some filtering is often necessary -- not to protect the end users, but to protect the network for everyone else. On this list, I don't have to repeat the full litany problems that worms can cause -- I'm sure many of you remember the clogged ARP caches from Code Red-triggered scans of cable modem routers, or the near-collapse of many networks from Slammer. We're living in an exceedingly imperfect software world. Firewalls and the like are just one form of defense -- but I'll take any defense I can get. --Steve Bellovin, http://www.research.att.com/~smb

2 1

How much longer..
by Len Rose 13 Aug '03

13 Aug '03

How much longer will people put up with the millions of dollars of losses in time, resources and service inflicted on the net by the joke vulnerabilities in the toy operating system known as Windows? Enough is Enough. Sure, let's just filter everything..all service providers please become M$'s virtual firewall now please. Haven't you windows lamers learned anything yet? Len

3 3

Re: How much longer ..
by John Neiberger 13 Aug '03

13 Aug '03

>http://www.theregister.co.uk/content/55/30072.html > >"The Klez virus last year cost businesses $9 billion worldwide in lost >productivity," When I read stuff like this I always wonder if these businesses count the time spent patching their systems as 'lost' productivity. John --

1 0

Fw: Detecting worm infection by remote
by james 13 Aug '03

13 Aug '03

Well the lame moderator at intrusions(a)incidents.org will not let this message pass. Anyone have any ideas ? Sorry as this is off topic, too bad a security list has problems with questions like this ! I would like start having support call infected users, once the storm passes. james : ----- Original Message ----- : From: "james" <jamesh(a)cybermesa.com> : To: <intrusions(a)incidents.org> : Sent: Wednesday, August 13, 2003 2:46 PM : Subject: Detecting worm infection by remote : : : : I am trying to build a list of infected users, is it possible to just nmap : : tcp port 4444 ? Does anyone know of a scanner I could use ? We had : : to lock ports 135-139 down all over the state to bring this under control : : as the users were scanning local users & causing slowdowns. So I cannot detect infections via : : port 135-139 tcpdumps or Snort. : : : : James Edwards : : Routing and Security Administrator : : jamesh(a)cybermesa.com : : At the Santa Fe Office: Internet at Cyber Mesa : : Store hours: 9-6 Monday through Friday : : : :

1 0

Port blocking last resort in fight against virus
by Sean Donelan 13 Aug '03

13 Aug '03

This is the first trade publication I've seen that's covered some of the issues with ISPs blocking or not blocking ports. Port blocking last resort in fight against virus Long term problems can be caused by port blocking by Paul Brislen and James Niccolai, Auckland and San Francisco http://computerworld.co.nz/webhome.nsf/UNID/BEC6DE12EC6AE16ECC256D8000192BF… "While some end users are calling for ISPs to block certain ports relating to the Microsoft exploit as reported yesterday (Feared RPC worm starts to spread), most ISPs are reluctant to do so."

16 34

RE: A new version on the loose...
by Scott Weeks 13 Aug '03

13 Aug '03

Let's see. They shout "the sky is falling, the sky is falling!!!" ...the world community might face a global Internet slow-down and regional disruption of access to the World Wide Web... and on the same page they say "antivirus: buy and download Kaspersky software online!" I dunno, lemme go back to lurking and attempt to connect the dots... 8-) scott : * From: Jack McCarthy : * Date: Wed Aug 13 16:09:42 2003 : : If you haven't already heard...... : : http://www.kaspersky.com/news.html?id=985370

1 0

ftp.gnu.org compromised
by Len Rose 13 Aug '03

13 Aug '03

http://ftp.gnu.org/MISSING-FILES.README

1 0

RE: How much longer..
by Dan Lockwood 13 Aug '03

13 Aug '03

I have to agree with Ejay. Microsoft is not the only software vendor. It seems silly to argue that one OS is better than the other. Linux needs to be patched to, as do all the various flavors or Unix, solaris, etc from time to time and with varying degrees of urgency. This is a fact of life. Dan -----Original Message----- From: Ejay Hire [mailto:ejay.hire@isdn.net] Sent: Wednesday, August 13, 2003 10:53 To: Len Rose; *Hobbit* Cc: nanog(a)merit.edu Subject: RE: How much longer.. >From my perspective, I don't care what defective operating system a worm uses. If a malevolent worm is spreading via a vulnerability in IIS and I can keep from answering support calls by blocking it at the edge I will. If one of the 31337 crowd ever catches a clue and launches a worm that spreads via the OpenSSH vulnerability, I'll block that too. My objective in blocking is not to bail Microsoft out, my objective is to make sure the people I work with can accomplish useful work and don't have to spend days repeatedly explaining how to download a patch and remove msblast.exe. For the record, I have two folders that catch Microsoft security bulletins and Red hat package update notifications. Right now the score is close at MS 12 vs RH 9. -e -----Original Message----- From: Len Rose [mailto:len@netsys.com] Sent: Wednesday, August 13, 2003 12:26 PM To: *Hobbit* Cc: nanog(a)merit.edu Subject: Re: How much longer.. Hi.. just think if the billions of dollars being spent on M$ products could have been funneled into open source projects. To reinforce the point in the most blunt manner possible: No one had ever better dare postulate that the inherent reason for all of the vulnerabilities in Micro$oft products are due to any special features of note. There is no particular network-enabled feature that Windows has that UNIX didn't implement years before and has done so securely following established internet design standards adopted by the ruling standards body (IETF) after intense study and open participation from all parties who were interested. Now knee-jerk reactions by various network operators is to filter, filter, filter and soon, by the grace of a piece of crap operating system you'll have a much more limited internet to work with because for Micro$oft's sake they've filtered everything. What makes it all ironic is that you can directly thank Micro$oft if the governments decide to pass more draconian laws, even further criminalizing activities which were considered marginally criminal to begin with. Instead of subsidizing the monopoly, keeping sub-standard operating systems alive, they should fine them billions of dollars for the cost of repairing damages, managing overloaded network and system infrastructures (due to the effects of the latest vulnerability). The governments should cease using all Micro$oft products and go back to UNIX which can easily be transformed into a "friendly" operating system for business users (it already has been of course) For the millions of dollars that are spent buying this fake operating system with it's fake applications the government could subsidize development of open software whose quality and security would far exceed that of the closed source garbage that has become "standard" in today's offices. Their operating systems were a joke 10 years ago, and they're still a joke today. The people administering these systems need to start learning UNIX and colleges need to go back to teaching computer science based around a real operating system. It's embarassing for a recent graduate to only know how to point and click while UNIX hackers are unemployed thanks to the disease that is called Micro$oft. Not to mention watching weeks of Micro$oft admins wondering publicly on Full Disclosure (soon to be renamed Microsoft Whining and Crying) what to do about their systems that they can't protect because those systems are rotten to the core with garbage code written by fake programmers who were trained by Universities who use Micro$oft operating systems to teach their curriculum and who are managed by ex-vms programmers (Uncle Bill hired them to write Windows Code) On Wed, Aug 13, 2003 at 11:42:59AM +0000, *Hobbit* wrote: > I often ask the larger question, "how long will it take for millions > of people to realize that having to deal with winbloze has completely > *derailed* their careers for the last ten years, when they could have > been doing so much more productive things on their jobs?" > > But evidently most of them can't think that deep, and get all defensive > about it. > > If all those people had been contributing to free and better replacements > in the linux/bsd/open-source arena, we'd be *so* much farther ahead, > and would have saved countless dollars that are now in Bill's pocket. > > _H*

1 0

Re: I can't reach MS sites
by Gerald 13 Aug '03

13 Aug '03

On Wed, 13 Aug 2003, Stephen Williams wrote: > in attempting to patch systems here (at U of Texas) I have noticed that > over the last two days the windowsupdate url for Microsoft has at times > not responded, or been very slow to respond. Between port scans from > the worm and the demand of people wanting to download patches they may > be getting a bit overwhelmed. On a few of the machines I patched that already had it running, IE would flip to Done with a blank screen. Checked the registry and removed everything except default from Run (with a reg backup of course) and removed everything from the startup menu. Reboot and it pulled up windows update. In one instance had 2 machines sitting side by side. Both had MSN as home page. Both would pull the MSN site up fine. Click on tools/WUPD and one would go every time. The other would open a blank web site. Removed all from Run in registry and cleared startup. Reboot and viola WindowsUpdate pulls up. (Patch, reboot, patch, reboot, driver update, reboot, and then add keys back to registry that were really needed) Note: On one windows XP machine unchecking all in msconfig for registry was not enough. G P.S. Patching my FreeBSD machines twice this last week was soo much easier.

1 0

I can't reach MS sites
by John Obi 13 Aug '03

13 Aug '03

Hello, I can't open www.microsoft.com , windowsupdate.microsoft.com and www.msn.com very slow. It took long time to sign in the msn IM too. Do you see any problems so far? Thanks, -J __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

3 2