- Test - lists.nanog.org

Cisco vulnerability and dangerous filtering techniques
by Adam Maloney 22 Jul '03

22 Jul '03

I had a passing thought over the weekend regarding Thursday's cisco vulnerability and the recent Microsoft holes. The next worm taking advantage of the latest Windows' vulnerabilities is more or less inevitable. Someone somewhere has to be writing it. So why not include the cisco exploit in the worm payload? Based on past history, there will be plenty of vulnerable Windows hosts to infect with the worm. I would also guess that there are lots of organizations and end-users that have cisco devices that haven't patched their IOS. Furthermore, I wonder how many people have applied filtering only at their border? But packets from an infected host inside the network wouldn't be stopped by filtering applied only to the external side. Basically, if you're filtering access to your interface IP's rather than upgrading IOS, remember that the internet isn't the only source of danger to your network. Adam Maloney Systems Administrator Sihope Communications

6 6

Re: Cisco Vulnerability Testing Results
by neil＠DOMINO.ORG 22 Jul '03

22 Jul '03

> You don't know quite how rife that rumour is over here at the moment. Peter, How so unlike you to take an anti-establishment view! Neil

3 2

Potential downside to using (very) old domain as spam trap.
by David A. Ulevitch 22 Jul '03

22 Jul '03

Hi, I've recently been delegated a domain of a dead ISP which hasn't existed in *any* form for about 5+ years. As a test, we setup an MX for it to see what kind of mail it would get since we noted a lot of DNS lookups for it. After going through a few hundred emails it started to look like the domain might be good fodder for a blacklist. We couldn't find a single legit email that passed through spamassassin and a couple other tools. I've seen people put spamtraps on web pages and at the bottom of emails to use as blacklist fodder but not a whole domain. I suppose more rigorous testing could be done to make sure no legit email is being sent to the domain, but I have a strong feeling that it is very, very dead. (It even expired at one point and was available from a registrar.) Is this done? Advisable? Experiences? Thanks in advance, David Ulevitch ---------------------------------------------------- David A. Ulevitch -- http://david.ulevitch.com http://everydns.net -+- http://communitycolo.net Campus Box 6957 + Washington University in St. Louis ----------------------------------------------------

3 2

Re: Cisco vulnerability and dangerous filtering techniques
by jgraun＠comcast.net 22 Jul '03

22 Jul '03

That is a bit paranoid, but it could happen. I have not seen anybody do anything that intelligent in the past couple of years. Not to say that there arent people out there that couldn't do that but I think many have thought of using one exploit to expose another, DDoS is the closest I have seen on any of my honeypots. I have learned many things about what most people will try to get into a box from the honeypots, but that is a good point. Filtering or patching should take place on the edge and on the most critical spots on your network. Good Luck > > I had a passing thought over the weekend regarding Thursday's cisco > vulnerability and the recent Microsoft holes. > > The next worm taking advantage of the latest Windows' vulnerabilities is > more or less inevitable. Someone somewhere has to be writing it. So why > not include the cisco exploit in the worm payload? > > Based on past history, there will be plenty of vulnerable Windows hosts to > infect with the worm. I would also guess that there are lots of > organizations and end-users that have cisco devices that haven't patched > their IOS. Furthermore, I wonder how many people have applied filtering > only at their border? But packets from an infected host inside the > network wouldn't be stopped by filtering applied only to the external > side. > > Basically, if you're filtering access to your interface IP's rather than > upgrading IOS, remember that the internet isn't the only source of danger > to your network. > > Adam Maloney > Systems Administrator > Sihope Communications >

2 1

RE: Cisco vulnerability and dangerous filtering techniques
by McBurnett, Jim 22 Jul '03

22 Jul '03

EXACTLY!! Company A fired the wrong person. DDoS internally. Company B has a Business partner that has VPN access, that get's infected. Company C has a home user that uses VPN on a cable modem. he gets infected.... Virus writers will see this and use it... What better DDoS method is there than to take down the network equipment.... I see this as a make or break.... If someone does not upgrade, well think of this as a roll-coaster. Remember the sign? This ride is not advised for people with bad backs, pregnant ladies...... This will be a long year of patches and learning experiences... J -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, July 22, 2003 9:55 AM To: Niels Bakker Cc: nanog(a)merit.edu Subject: Re: Cisco vulnerability and dangerous filtering techniques On Tue, 22 Jul 2003 15:40:02 +0200, Niels Bakker <niels=nanog(a)bakker.net> said: > > * adamm(a)sihope.com (Adam Maloney) [Tue 22 Jul 2003, 15:33 CEST]: > > The next worm taking advantage of the latest Windows' vulnerabilities > > is more or less inevitable. Someone somewhere has to be writing it. > > So why not include the cisco exploit in the worm payload? > > Why would a worm disable a vital component on its path to new infections? It's not part of the spread-the-worm code, it's part of the DDoS engine that it leaves behind. If you get lucky, one of your 20K zombies is the other side of a router along with whoever you're pissed at and want to DDoS, so you send the command, and the zombie sprays 76 packets, goes to sleep for 30 mins, sprays another 76.. lather rinse repeat. I'm going to go out on a limb and say that at least 30% of Ciscos are installed in places that would, if hit with this, have NO CLUE why their router needs to be power cycled every 30 mins.....

2 1

Re: The status of consumer rate-limiting?
by Dr. Jeffrey Race 22 Jul '03

22 Jul '03

On Tue, 22 Jul 2003 20:13:35 +0200, Niels Bakker wrote: >We're asking everybody to turn off HTML when they post to mailing lists. Here's some boilerplate I wrote for this purpose: <http://www.camblab.com/nugget/turnoff.txt>

1 0

Williams/UUNET/Sprint
by Deepak Jain 22 Jul '03

22 Jul '03

Has anyone had to deal with this in their BGP filter tables? 5 washdc5lce1-oc48.wcg.net (64.200.95.118) 4 ms 11 ms 4 ms 6 GigabitEthernet5-0.GW4.IAD8.ALTER.NET (157.130.30.245) 4 ms 4 ms 4 ms 7 0.so-1-2-0.XR2.IAD8.ALTER.NET (152.63.41.34) 3 ms 4 ms 6 ms 8 0.so-0-0-0.CL2.IAD5.ALTER.NET (152.63.38.142) 4 ms 5 ms 5 ms 9 201.at-2-0-0.XR2.DCA6.ALTER.NET (152.63.35.49) 6 ms 6 ms 6 ms 0 0.so-1-3-0.XL2.DCA6.ALTER.NET (152.63.35.118) 6 ms 6 ms 6 ms 1 POS7-0.BR4.DCA6.ALTER.NET (152.63.41.233) 8 ms 6 ms 7 ms 2 POS5-3.sl-bb22-rly.sprint.net (204.255.169.130) 8 ms 8 ms 8 ms Is Williams getting transit to Sprint via UUNET or vice versa? Sorry if I have been out of the loop on this. DJ

3 3

Update to completewhois.com whois tool & website. Hijacked IP blocks List
by william＠elan.net 21 Jul '03

21 Jul '03

I have recently made available new version of completewhois tool and website. There are many new features in the whois engine (see below about that). As far as website of expected interest to NANOG community is the results of investigations into number of hijacked ip blocks (done by me and others in cooperation on hijacked mailing list) - the list of hijacked ip blocks and investigation files (to find and notify proper ip block owner) are available at http://www.completewhois.com/hijacked/ And as far as new features in whois engine, these are: 1. A fully developed website with (hopefully user-friendly) GUI interface http://www.completewhois.com/ 2. An even more complex whois engine with large set of options that can be used by those doing direct queries from unix server (for list of options see http://www.completewhois.com/help.htm) 3. Ability do combined searches, for example do both whois on domain and also have engine do whois on all ips of nameservers for the domain or whois on ip and reverse dns domain for the as well as combine results with dns (3 types of dns queries), radb, etc. 4. Ability to SAVE results for later retrieval (that means query results are saved in our the database and you can quickly access it or have the url reference from the website). This is usefull to preserve whois record in case it may change in the future. 5. CGI now allow direct reference as URL (supports GET paramters), i.e. http://www.completewhois.com/cgi-bin/whois.cgi?query=nanog.org&options=dns 6. Larger set of supported top level domains - around 150 (but this is work currently in progress as all domain settings are being reviewed). 7. Whois on .COM/.NET/.ORG domains have ip of nameserver resolved as part of whois query - both whois in crsnic and dns lookups are used (option can control which is used and how). In the future, this will be supported for number of other domains as well. 8. As always engine maintains best ip whois functionality and follows a lot of refererals to other more specific whois databases run by isps and country nics (announced last week by ARIN "ReferralServer" field is by now supported too). 9. Support for IPv6 should now be working (requires explicit option enable_ip6=on and its still early beta and bit buggy) both for ip whois and for dns, including domain nameservers. Direct IPv6 whois access is in development and will probably be available in September. So now feel free to check this all out and beta test it and send your comments offline to comments(a)completewhois.com. As always this is free tool with no commercial interruptions of any kind :) -- William Leibzon Elan Networks william(a)elan.net

3 2

Warning Someone is using your company name to defraud users: Fw: Transaction #: 34-355-268-52430
by John Palmer (NANOG Acct) 20 Jul '03

20 Jul '03

Got this in my mailbox this afternoon - The URL goes to swiftSpay.com, not swiftpay.com. You're probably aware of this scam - if not, now you know. John P. ----- Original Message ----- From: transfers(a)swiftspay.com To: info(a)adns.net Sent: Sunday, July 20, 2003 2:49 PM Subject: Transaction #: 34-355-268-52430 This is confirmation message for transfer of $1974.50 USD by E-mail from: ********************************************************************* SwiftPay User ID: goldxchangers(a)consultant.com Transaction #: 34-355-268-52430 Ref. #: 04100927 ********************************************************************* To claim your money and confirm the transaction please, follow the link below: http://www.swiftpay.com/transID?=34-355-268-52430±04100927f=US The money will appear in your SwiftPay account balance once you confirm the transaction and then you can withraw the balance to your bank account which you added during the registration process. If you are not an existing member of SwiftPay.com you can signup right now. The registration process is very simple and it takes less than 5 minutes. Swiftpay`s intuitive interface makes sending and receiving money over the web as easy as one two three. Simply logon at Swiftpay.com and select which Swiftpay service you wish to avail of, whether it's to fund your account, send money to friends family or businesses, request money or check your account details. With everything you need available at the click of a mouse, paying with Swiftpay couldn't be easier. Don't forget, we value our commitment to Customer Service at Swiftpay - should you have any queries, please don't hesitate to contact us and we'll do our best to answer your query as soon as possible. Kind Regards, Swiftpay Billing Dept. SwiftPay -The E-Cash solution that brings online shopping closer to home ********************************************************************* SWIFTPAY.COM SECURITY REMINDERS Protect Your Username and Password and NEVER Reveal it to Third Parties! ********************************************************************* WARNING! If you are not the intended recipient, please inform the sender immediately by E-mail and delete this message and all copies from your system.

1 0

draft-savola-bcp38-multihoming-update-nn.txt
by Fred Baker 20 Jul '03

20 Jul '03

Pekka and I have been discussing the impact of ingress filters on multihomed networks - which may be ISPs or edge networks, and may have an arbitrary number of upstream ISPs. We wonder what your thoughts might be regarding http://www.ietf.org/internet-drafts/draft-savola-bcp38-multihoming-update-0…. With your concurrence, we would like to recommend it for BCP status, as an update to BCP 38. Our questions are at two levels: philosophical and at the detail level. If you have significant comments calling for a change of text, it would help us if you proposed text.

2 1