- Test - lists.nanog.org

Re: Effective ways to deal with DDoS attacks?
by Lincoln Dale 05 May '02

05 May '02

At 03:34 AM 5/05/2002 +0000, Christopher L. Morrow wrote: >I was hoping someone else might mention this, BUT what about the case of >customers providing transit for outbound but not inbound traffic for their >customers? two methods: [1] if your customer has their own AS, have them route the (valid) networks to you with the no-export bgp attribute set. [2] if they're not BGP connected, then surely you have some idea of what subnet(s) they're sending traffic out from? (i hope so). if so, then you'd have static-routes for those subnets pointing at their interface. you don't necessarily have to include those static-routes in announcements to your peers. both of [1] & [2] may mean that more traffic may 'prefer' the link from you to the customer. (probably doubly so given you're uunet and the amount of transit that goes thru you). in that case, perhaps using the no-advertise community so that the route stays 'local' to a router (or local to a city) will prove sufficient. cheers, lincoln.

1 0

Re: anybody else been spammed by "no-ip.com" yet?
by Dave Israel 05 May '02

05 May '02

Content providers have to recieve and hold spam mail before they delete it. People and mailing lists who have well-published addresses can recieve hundreds of spam messages a day. I know that, without my filters, I would easily spend 30-45 minutes a day downloading, identifying, and deleting spam mail. Not counting the frustration, that's costing the company money. I heard somewhere that ~$2 of an AOL users' monthly bill goes towards spam management. (IS there an AOLer who can confirm or deny?) AOL has some 10 million users. That's a lot of dough a month to handle what appears to be no big deal. SPAM is a milder version, but it is no better than if telemarketers called you collect to try to sell you crap. -Dave p.s. Also, if you're a parent, do you think the spammer knows how old you are before sending you "Teenage Girls Doing Farm Animals! Click here?" On 5/3/2002 at 15:27:08 -0700, Scott Granados said: > > I realize this statement I'm about to make is going to open a huge... > can o worms but ... and hoefully everyone knows I mean this in the most > friendly responsible way ever but I'm not sure entirely what the big > deal with spam is. Honestly sure I get it like everyone else, in some > of my accounts more than others but I also get a real truckload in my > snailmail box. Just as with all the pottery barn catalogs <no offense > to pottery barn I guess>:) I have a delete key just like my trash can. > I know at one time the argument was made, and quite correctly that > people were paying to receive this service and these messages cost them > money. Today with flat rate access and many people not paying on a per > packet basis it seems to me that the responsibility lies with the end > user to filter properly and or dress that delete key. I always shut > down customers who spam and disrupt service simply because I don't want > the backlash or want specific ips blocked but in a way I don't feel its > right that the carriers do the filtering it seems tome up to the end > user. > > On Fri, 3 May 2002, Mitch Halmu wrote: > > > > > > > On Fri, 3 May 2002, Paul Vixie wrote: > > > > > > I hate to sound like the big idiot here, but what exactly in the email > > > > you received indicates no-ip.com spammed? It looks to me like you just > > > > have some secret "admirer" who thought you wanted a no-ip.com account, > > > > and no-ip.com emailed you to confirm that you do want the account. > > > > > > spam is like pollution in that (a) whenever you're not sure if you're > > > doing it, you probably are, and (b) if everybody did whatever it is, > > > life would be universally worse for, well, everybody. > > > > > > > Random disclaimer: Yes, we're a competitor of no-ip.com's... And yes, we > > > > used to send similar emails to people signing up for an account, > > > > although nowadays instead of sending them an initial password we send a > > > > confirm URL instead. > > > > > > that's the right approach. no-ip's problem was they presumed my permission. > > > > > > > You don't even have to be in the "big idiot" league to figure out that in > > both the "wrong" and the "right" approach as sanctioned above by a higher > > authority, an email message (aka spam) is sent to the presumed subscriber. > > > > One sends a password, one asks for permission to issue a password on their > > site. What's the difference in the annoy factor, if indeed one were to be > > subscribed by a secret "admirer"? > > > > Mr. Halmu chose to think, rather than bindly obey... > > > > --Mitch > > NetSide > > > -- Dave Israel Senior Manager, IP Backbone Engineering

3 2

Re: Large ISPs doing NAT?
by Tony Rall 04 May '02

04 May '02

On Monday, 2002-04-29 at 08:43 MST, Beckmeyer <beck(a)pacbell.net> wrote: > Is anybody here doing NAT for their customers? I hope not. If you're NATing your customers you're no longer an ISP. You're a sort-of-tcp-service-provider (maybe a little udp too). NAT (PAT even more so) breaks so many things that it would be unconscionable to advertise as an ISP. Even some tcp apps fail under NAT. The NAT box may include a number of "fix-ups" but such will never be equivalent to giving the customer a public address. An Internet Service Provider gives the customer a full connection to the Internet. All IP protocols should work. I'm in favor of using NAT only where there is a good argument for it and the customers are given the straight story about what they're buying and what it won't be able to do. Don't call yourself an ISP. Tony Rall

17 31

RoadRunner abuse?
by E.B. Dreger 04 May '02

04 May '02

Greetings all, Sorry to post this, but it appears that past emails to RoadRunner re a spammer (sending out attachments to boot) have been ineffective. Only ~150kB, but multiply that by however many victims... I'd think and hope *someone* cares. Back to on-topic material. I just wanted to see if there's anyone out there before I go whining to MAPS, et al. -- Eddy Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

5 4

Re: anybody else been spammed by "no-ip.com" yet?
by Paul Vixie 04 May '02

04 May '02

> ... not only does it cost usually very little to receive these messages ... even if i granted to a third party the right to determine the value of my time, which i don't, the fact is that an hour or more of my time per day is too high a price to pay "to receive these messages", by _any_ standard. to understand the scale, here's what came in during my trip home tonight. 456 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 457 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 458 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 459 05/03 "Big Brother" Protect your family on the Internet<<<HTML> <BOD 460 05/04 FreeSampleCenter Win $20,000! Win $20,000 to RENOVATE your Home!< 463 05/04 my_own_business20 If a 15 year old boy can earn $71,000 in just a 464 05/03 "mike" YOUR HEALTH zNAUiqxgEx<<This is a multi-part mes 465 05/03 National Financia InvestorFacts: NasdaqNM: DSSI -Data Systems and 466 05/02 "Pamila Binkley" don't Pay another monthly Bill until you read th 469 05/04 Tax.Relief(a)isc.or Large Annual Tax Savings!<<<html> <head> <title> remember, it would be ~4X higher without filtering, according to my syslogs.

2 1

Re: anybody else been spammed by "no-ip.com" yet?
by rs＠seastrom.com 04 May '02

04 May '02

<measl(a)mfn.org> writes: > > It does not cost "very little" to recieve spam. > > It costs the end-user very little to recieve spam. I'll echo Paul's comments about the cost of my time. In my case, a half hour a day seems about right (compared to Paul's hour a day). I suspect you may have a very different perception about the value of your time than Paul and I have about the value of ours. I am sure that we have customers whose time is worth a lot and whose time is worth very little. Over half of our customers, however, are in countries where there is a per-minute cost to being off-hook on a dialup. They see a very direct cost to download spam, aside from the human costs. > Whether we like it or not however, this is a cost of doing business now, and > is a normal part of determining your cost of goods sold (at least it *should* > be). Counting inventory shrinkage costs as part of the cost of doing business at a retail establishment does not change the fact that shoplifting is a crime. > > Spam is theft, plain and simple. > > Spam is a reality that none of us, either alone or in concert, will ever be > able to eradicate. That makes the general gnashing of teeth == tilting at > windmills. Your position is noted. > Our time is probably the most expensive part of an ISPs "spam > cleanups" budget - automating a filter system (for those who specifically ask > for it, of course) via the purchase of services from Vixie or your favorite > equivalent is likely to be a reasonably inexpensive alternative to having us > spinning our wheels. <asbestos underwear in place ;-> You have incomplete information. That's all I'm going to say about it. ---Rob

1 0

Re: anybody else been spammed by "no-ip.com" yet?
by blitz 04 May '02

04 May '02

When I re-read my post, I'd like to clarify the "clean" part a bit. I mean technically clean, as in all of the parts working properly as best as the fine people represented on this list can make it happen that is...so lets say "properly operating"...to be a little more specific. The Internet certainly isn't "clean" by moral standards, and as I see it, those are individual choices individuals make, and I certainly don't want anyone, especially the "gooberment" mandating those choices for me. Gooberment does have a place in this, though I'd rather those bastards stay the hell away from anything thats working well. I wouldn't mind if a few more states made spam illegal, like Calif and Oregon have made it. I don't give a rat's rectum about advertisers, in fact I place them in the same category as shysters, the world could live life just fine (and cheaper) without their ilk around. At 18:44 5/3/02 -0700, you wrote: >uWell I tend to always error on the side of free expression verses >making something illegal and I definitely disagree with the statement >that its a clean internet otherwise but just like non electronic space >there are many differing standards and shades of things something I >actually think brings a lot to the quality and adventure of the thing.

5 5

RE: anybody else been spammed by "no-ip.com" yet?
by Ron Snyder 04 May '02

04 May '02

They're not paying the recipient, but it does increase their costs. http://harvee.billerica.ma.us/~esj/camram.html -ron > -----Original Message----- > From: Forrest W. Christian [mailto:forrestc@imach.com] > Sent: Saturday, May 04, 2002 1:15 AM > To: nanog(a)trapdoor.merit.edu > Subject: Re: anybody else been spammed by "no-ip.com" yet? > > > > On Sat, 4 May 2002, Forrest W. Christian wrote: > > > What I envision is some sort of micropayment protocol > extension to SNMP. > -------------------------------------------------------------- > -------^^^^ > > Make that SMTP :) I guess I've been working on network monitoring too > much recently..... > > - Forrest W. Christian (forrestc(a)imach.com) AC7DE > ---------------------------------------------------------------------- > The Innovation Machine Ltd. P.O. Box 5749 > http://www.imach.com/ Helena, MT 59604 > Home of PacketFlux Technogies and BackupDNS.com (406)-442-6648 > ---------------------------------------------------------------------- > Protect your personal freedoms - visit http://www.lp.org/ >

1 0

anybody else been spammed by "no-ip.com" yet?
by Paul Vixie 04 May '02

04 May '02

as a coauthor of rfc2136, my curiousity is always piqued when spammers use the technology. can i get private forwards of other similar messages? (see below.) (and yes, i'll also be in touch with level3, who serves 166.90.15.236, from whence this message came.) (time was, anyone who could use postfix and php would also know better than to spam, or at least, to spam *me*. <grump> <grumble>.) re: ------- Forwarded Message Return-Path: nobody(a)www.no-ip.com Delivery-Date: Fri May 3 07:44:25 2002 Return-Path: <nobody(a)www.no-ip.com> Delivered-To: vixie(a)as.vix.com Received: from isrv3.isc.org (isrv3.isc.org [204.152.184.30]) by as.vix.com (Postfix) with ESMTP id 2360D28B6B for <vixie(a)as.vix.com>; Fri, 3 May 2002 07:44:25 -0700 (PDT) (envelope-from nobody(a)www.no-ip.com) Received: from www.no-ip.com (yoka.vitalwerks.com [166.90.15.236]) by isrv3.isc.org (8.11.2/8.9.1) via ESMTP id g43EiOT08718 for <vix(a)vix.com>; Fri, 3 May 2002 14:44:25 GMT env-from (nobody(a)www.no-ip.com) Received: by www.no-ip.com (Postfix, from userid 99) id 4A10F833A4; Fri, 3 May 2002 07:54:40 -0700 (PDT) To: vix(a)vix.com Subject: Your password for no-ip.com From: No-IP Registration <webmaster(a)no-ip.com> Reply-To: webmaster(a)no-ip.com X-Mailer: PHP/4.1.2 Message-Id: <20020503145440.4A10F833A4(a)www.no-ip.com> Date: Fri, 3 May 2002 07:54:40 -0700 (PDT) Hello, Welcome to No-IP.com. Your number one stop for dynamic dns services. Your password is: jnMgta To logon to no-ip.com go to http://www.no-ip.com/ and enter your email address and the password above. Once you logon you may change your password by clicking the "Change Password" link. Remember that you can use our dynamic update client to keep our system is sync with your IP address. These clients are available at http://www.no-ip.com/downloads.php Also, keep in mind that No-IP offers services for use with personal domain names. This service, No-IP Plus, allows you to use YOUR domain name with our dynamic dns, and other facilities. More information on this and other services is at http://www.no-ip.com/services.php. If you have any further questions about this service, please refer to our FAQ at http://www.no-ip.com/faq.php. If the FAQ doesn't answer your question(s) contact us at support(a)no-ip.com. Enjoy! The No-IP Team webmaster(a)no-ip.com http://www.no-ip.com/ ------- End of Forwarded Message

9 11

World-wide distributed DoS and "warez" bot networks (fwd)
by blitz 04 May '02

04 May '02

From a forward to me on the DDos stuff...this might shed some light on the DDos problem, if not sorry for the bandwidth. --------begin forward >[Note: I just noticed last night, after giving a talk on this incident, that >several threads on the SANS Unisog list going back as far as February 18, >2002 have discussed this same botnet in generality and in some detail, so I >can't claim to be the first to analyze this botnet. That credit goes to >Christopher E. Cramer of Duke University. (That's what I get for letting >myself get so far behind on email, and for not studying all sources of >information I had available to me when we first started seeing problems. >Hopefully someone on the unisog list will cross-post to >incidents(a)securityfocus.com when a widespread incident like this pops up >next time. ;) > >The Unisog threads can be found here: > > http://staff.washington.edu/dittrich/misc/ddos/unisog-xdcc.txt > >Since all this work was already done, I'll still post what I have assembled >with the assistance of Mike Hornung and Alexander Howard at the UW, in hopes >I'm adding something new in the way of tools and techniques (see my >CanSecWest talk slides referenced at bottom) that will help speed up >response the next time one of these massive botnets is assembled using >compromised computers.] > > >Summary >======= > >Over the months of March through late April of 2002, the University of >Washington has seen multiple incidents of distributed "warez" (pirated >software) and denial of service (DDoS) attacks, coming from Windows 2000 and >NT systems. These systems all have several things in >common: > > o They appeared to be found with no password on the > Administrator account, and control taken over. > > o They had various IRC bots installed on them, including > knight.exe, GTbot, and X-DCC (a distributed "warez" > serving bot.) > > o They had the ServUFTP daemon running on them for incoming > file transfer (to load the "warez".) > > o They had Firedaemon (a program that registers programs for > execution to serve incoming connections, similar to the Unix > "inetd" daemon.) > >Details >======= > >Forensic analysis of hard drive contents and IRC traffic has revealed the >methods and signatures of the malware installed on the compromised systems. >To date we are not 100% sure of exactly how the initial backdoor >installation occurs, but it appears to involve remote shell access (via >telnetd). Whatever it is, the next step is to transfer a script onto the >system and run it to bootstrap the rest of the installation of backdoors, >bots, FTP server, and other support programs, the modification of >directory/file permissions and attributes to hide files, and changes to >registry settings to make programs run at each boot. On some system, FTP is >also used to later transfer files onto the compromised system. > >The script does the following: > >o Creates a directory under the C:\RECYCLER directory, and marks > it hidden and system directory. > >o Kills any previously running instances of itself. > >o Installs Firedeamon, and changes it (and other support programs) > to be system/hidden. > >o Uses tftp to download IRC bot configuration files from a temporary > cache (on another compromised system) > >o Does a "net user administrator changem" and deletes the > ipc$ file share. > >o Starts the Firedaemon and registers services named "Ms32dll", > "SVHOST" and "MSVC5" > >o Creates a file to set the following Registry settings, then > runs "regedit" on this file: > > [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\] > restrictanonymous"="1" > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0\] > "NTLM"="2" > >o Cleans up some files, and stops and deletes the following > services: "tlntsvr" and "PSEXESVC" > >o (Re)Starts the following services: "lmhosts" and "NtLmSsp" > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >user_nick [XDCC]XXXX-649 >slotsmax 20 >loginname XXXXX >filedir C:\RECYCLER\S-1-5-21-2686636377-1107193052-384560437-1000 >uploaddir C:\RECYCLER\S-1-5-21-2686636377-1107193052-384560437-1000 >xdccfile c:\winnt\system32\vmn32\asp\mybot.xdcc >pidfile c:\winnt\system32\vmn32\asp\mybot.pid >server irc.XXXXXX.net 6667 >server irc.XXXXXX.net 7000 >server XXXX.XXXXX.net 6667 >server XXXX.XXXXX.net 7000 >server XXX.XXX.XX.XXX 6667 >logrotate weekly >messagefile c:\winnt\system32\vmn32\asp\mybot.msg >ignorefile c:\winnt\system32\vmn32\asp\mybot.ignl >channel #XDCC -plist 15 >user_realname XDCC >user_modes +i >virthost no >vhost_ip virtip.domain.com >firewall no >dccrangestart 4000 >queuesize 20 >slotsmaxpack 0 >slotsmaxslots 5 >slotsmaxqueue 10 >maxtransfersperperson 1 >maxqueueditemsperperson 1 >restrictlist yes >restrictsend yes >overallminspeed 5.0 >transfermaxspeed 0 >overallmaxspeed 2000 >overallmaxspeeddayspeed 0 >overallmaxspeeddaytime 9 17 >overallmaxspeeddaydays MTWRF >debug no >autosend no >autoword bleh >automsg bleh >autopack 1 >xdccautosavetime 15 >creditline ^2Brought to you by #XDCC^2 >adminpass Xv8h8aXknm8J5z >adminhost *!*(a)*.XXXXXX.net >adminhost *!*(a)*.cia.gov >uploadallowed no >uploadmaxsize 900 >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >A search of Google for the terms "+X-DCC +XDCC +bot" comes up with several >hits, including the following list of the top IRC networks. The X-DCC/XDCC >related channels (including channels found on many of the compromised >systems at the UW) were the majority of the top channels on this site: > > http://62.27.120.133/networks/chanlist.shtml > >The signature of these particular bots can be identified by the string >":Total Offered:" (the amount of disc space used for "warez" on the system, >to be served by the bot): > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >T 2002/04/18 08:30:18.768002 10.1.1.1:6667 -> 192.168.2.2:3852 [AP] > :[f0]-XDCC230!~accute@foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXXX > :.**. .Brought to you by #XXXXXXXXXXXXX. .**...:[f0]-XDCC230!~accute@ > foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXX :.**. .Brought to you by #X > XXXXXXXXXXXX. .**... > >T 2002/04/18 08:30:20.452092 217.199.39.139:7000 -> 128.208.113.130:1031 >[AP] > :[f0]-XDCC230!~accute@foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXXX > :Total Offered: 1223.5 MB Total Transferred: 419.19 MB..:[f0]-XDCC230 > !~accute(a)foo-0000000.bar.asu.edu PRIVMSG #XXXXXXXXX :Total Offered: 1 > 223.5 MB Total Transferred: 419.19 MB..:[f0]-XDCC230!~accute@foo-000 > 0000.bar.asu.edu PRIVMSG #XXXXXXXXX :Total Offered: 1223.5 MB Tota > l Transferred: 419.19 MB.. >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Using this information, a capture of all IRC traffic across the border of >the network was performed and a script written ("findoffer") to parse and >summarize the totals. Sampling IRC traffic to/from a set of 9 compromised >systems (tcpdump filter "tcp port 6667 and tcp port 7000"), and using >"findoffer", as many as 419 bots in 22 IRC channels, serving a total of >556.18 GB (yes, over half a Terabyte!!! and that is just from bots in some >of the X-DCC channels, not all of them.) > >[Note that IRC can be run over any port besides just 6667/tcp and 7000/tcp, >so I expect that these bots will likely move off of public servers to rogue >servers on compromised systems, and to use ports other than the standard >6666/tcp - 7000/tcp.] > >In addition to file sharing, many (all?) of these systems were at least >capable, if not actually used for, distributed denial of service (DDoS) >attacks. Dozens of attacks have been attributed to the same group who >installed these warez bots. Here is one such use: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >T 2002/03/27 02:28:31.434846 192.168.0.220:6667 -> 10.0.0.1:3164 [AP] > :ns.example.net 404 KNIGHT77tdtR #doschan :Cannot send t > o channel..:badd_kittycatN0yb!~moonglow@dc00.foonet.gatech.edu PRIVM > SG #doschan :[login accepted].. > >T 2002/03/27 02:28:31.986647 192.168.0.220:6667 -> 10.0.0.1:3164 [AP] > :ns.example.net 404 KNIGHT77tdtR #doschan :Cannot send t > o channel..:badd_kittycatN0yb!~moonglow@d000.foonet.gatech.edu PRIVM > SG #doschan :[packeting 192.168.32.94 at 64000kb/s 10000000 times].. > :vodkidWT!~zoolander@grd0000.foo.uiuc.edu PRIVMSG #doschan :[packet > ing 192.168.32.94 at 64000kb/s 10000000 times].. > > . . . > >T 2002/03/27 05:25:31.491814 192.168.0.220:6667 -> 10.0.0.1:3164 [AP] > :foobar!foo@staff.botnet.net PRIVMSG #doschan :.run c:\w > innt\system32\temp.exe..:XXXXXXXXXXZ2vco!~XXXXXX@A000000.N0.Vanderbilt > .Edu PRIVMSG #doschan :[running c:\winnt\system32\temp.exe].. > >T 2002/03/27 05:25:31.493483 10.0.0.1:3164 -> 192.168.0.220:6667 [AP] > PRIVMSG #doschan :[running c:\winnt\system32\temp.exe].. >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Two DDoS bots have been seen in use in conjunction with this activity: >"knight.exe" and "GTbot". ("knight.exe" is the Unix "knight.c" program, >compiled with the Cygwin development libraries.) These programs are >described here: > > http://www.cert.org/archive/pdf/DoS_trends.pdf > http://bots.lockdowncorp.com/gtbot.html > >The UDP traffic (seen by "tcpdump") during a GTbot attack shows some unusual >packets: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >1017207252.687968 192.168.32.126.1646 > 10.203.32.94.37046: rad-#43 837 [id >32 ] Attr[ Acct_out_octets{length 30 != 4} ARAP_zone_acces{length 46 != 4} >NAS_id{ +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH} Acct_out_packets{length >41 != 4} ARAP _challenge_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154}| >radius} ARAP_challenge_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B20 2B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154}|radius} ARAP_challenge >_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154}|radius} AR >AP_challenge_resp{302B202B202B4154}|radius} >ARAP_challenge_resp{302B202B202B4154 >}|radius} [|radius] >. . . >1017207256.282173 192.168.32.126.1645 > 10.203.32.94.24413: rad-#64 440 [id >64 ] Attr[ Tunnel_type{length 62 != 4} Tunnel_type{length 62 != 4} >Tunnel_type{len gth 62 != 4} Tunnel_type{length 62 != 4} Tunnel_type{length >62 != 4} Tunnel_type {length 62 != 4} [|radius] >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Seen by "ngrep", there is a strange kind of UDP flood: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >U 2002/03/26 21:34:16.284428 192.168.32.126:2892 -> 10.203.32.94:19192 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH > 0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +A > TH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 > >U 2002/03/26 21:34:16.284790 192.168.32.126:3099 -> 10.203.32.94:61749 > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @@@@@@@@@@@@@@@@@@@@ > >U 2002/03/26 21:34:16.285599 192.168.32.126:2767 -> 10.203.32.94:44393 > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@) > >U 2002/03/26 21:34:16.286329 192.168.32.126:4403 -> 10.203.32.94:56289 > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&! > ^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!% > !@#%!^@) > >U 2002/03/26 21:34:16.287070 192.168.32.126:4008 -> 10.203.32.94:39934 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH > 0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +A > TH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + > +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ > + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 > + + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +AT > H0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + + > ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0 >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Apparent IRC traffic confirms there is a DDoS bot on this system: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >T 2002/03/26 21:36:43.468911 192.168.32.126:1135 -> 10.76.175.220:7666 [AP] > PRIVMSG #doschan :.S.ending [.64,000.kb] of Data to (10.203.32.94). >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Seen by "tcpdump", one of the attack methods of this tool uses IP protocol >255 (listed as "Reserved" by IANA). These attacks use both large packets >(requiring fragmentation) and small packets. [Note: Network monitoring >tools that only log TCP, UDP, and ICMP protocols will not see this attack >traffic at all.] > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >Fri Mar 22 20:54:59 2002 >1016859299.879744 192.168.0.1 > 10.209.12.152: ip-proto-255 1480 (frag >37686:1480@0+) 1016859299.879745 192.168.0.1 > 10.209.12.152: (frag >37686:20@1480) 1016859299.881140 192.168.0.1 > 10.209.12.152: ip-proto-255 >1480 (frag 37687:1480@0+) 1016859299.881141 192.168.0.1 > 10.209.12.152: >(frag 37687:20@1480) 1016859299.882465 192.168.0.1 > 10.209.12.152: >ip-proto-255 1480 (frag 37688:1480@0+) 1016859299.882465 192.168.0.1 > >10.209.12.152: (frag 37688:20@1480) 1016859299.883866 192.168.0.1 > >10.209.12.152: ip-proto-255 1480 (frag 37689:1480@0+) > > >Sat Mar 23 13:13:25 2002 >1016918005.627814 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.627905 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.627986 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628120 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628180 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628282 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628342 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >1016918005.628448 192.168.0.1 > 10.99.102.100: ip-proto-255 52 >=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > > >Seen with Foundstone's "FPort" program, the program showed the following >open port: > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= >FPort v1.33 - TCP/IP Process to Port Mapper >Copyright 2000 by Foundstone, Inc. >http://www.foundstone.com > >Pid Process Port Proto Path >2 System -> 80 TCP >187 inetinfo -> 80 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >2 System -> 113 TCP >191 temp -> 113 TCP C:\WINNT\System32\temp.exe >94 RpcSs -> 135 TCP C:\WINNT\system32\RpcSs.exe >2 System -> 135 TCP >2 System -> 139 TCP >2 System -> 443 TCP >187 inetinfo -> 443 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >191 temp -> 1035 TCP C:\WINNT\System32\temp.exe >187 inetinfo -> 1036 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >187 inetinfo -> 1037 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >187 inetinfo -> 2962 TCP C:\WINNT\System32\inetsrv\inetinfo.exe >191 temp -> 9000 TCP C:\WINNT\System32\temp.exe >2 System -> 135 UDP >2 System -> 137 UDP >2 System -> 138 UDP > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > >More information on this botnet, and references to the tools used to analyze >it, were presented at CanSecWest Core02 in Vancouver, BC on May 2. The >slides and references to the tools that were used can be found at the >following location: > > http://staff.washington.edu/dittrich/talks/core02/ > >An example report produced by "findoffer" can be found at: > > http://staff.washington.edu/dittrich/misc/ddos/xdcc-report.txt > >This report has been anonymized, since some of the host are voluntarily >serving files (these networks are NOT exclusively compromised hosts running >bots.) Use this script ONLY to identify hosts on your network, and make sure >you follow all applicable privacy laws and policies of your organization >regarding logging of IRC traffic. > >-- >Dave Dittrich Computing & Communications >dittrich(a)cac.washington.edu University Computing Services >http://staff.washington.edu/dittrich University of Washington

1 0