- Test - lists.nanog.org

What Worked - What Didn't
by Sean Donelan 18 Sep '01

18 Sep '01

As the New York Stock market re-opens, and some things are returning to normal, I'd like to look at how well the Internet performed last week. At the Oakland NANOG I'd like to give a presentation about what worked, and what didn't work during the last week in regards to the Internet. I would like to gather what details I can from both small and large providers in New York, the rest of the USA, and even overseas about what they saw, what problems they experienced, and what things worked. You can send me private mail if you wish, with or without attribution. This is a personal effort, not assocated with my employer. Oakland NANOG is several weeks away, so I don't expect an immediate response. I expect many ISPs will be conducting their own internal reviews. But if you could, please consider responding. I'm looking for input from small, medium and large providers. Thank you. A few questions, all related to the time between Sept 11 and 17: 1. Briefly tell me who you are, and generally where your operations were located? 2. What worked? 3. What didn't work? 4. Did you activate your emergency response plan? 5. Were you required to do anything different operationally? Did you make preventive operational changes? 6. Were any infrastructure administration functions impaired, such as DNS registration, routing registry, address delegation? 7. Were you able to communicate NOC-to-NOC when needed? 8. Were any means of communications nonfunctional or impaired (direct dial telephone, toll-free telephone, pager, e-mail, fax) when you attempted to communicate with other NOC's? 9. Did you ask for or receive a request for mutual aid from any other providers? Was it provided? 10. Within the limits of safety and rescue efforts, where you able to gain access to your physical facilities? 11. Did hoaxes or rumors impact your operations? 12. Do you have any recommendations how Internet providers could have responded differently?

20 34

RE: What Worked - What Didn't
by Roeland Meyer 18 Sep '01

18 Sep '01

|> From: Randy Bush [mailto:randy@psg.com] |> Sent: Monday, September 17, 2001 1:45 PM |> inter-isp peering and intra-isp ibgp to be covered fairly quickly. i |> would suggest having one's provisioning folk working with |> bgp customers |> to close that avenue as well, starting with the more |> critical customers. |> |> also, think about your igp. Why, IGP shouldn't even be visible from outside the border, neh? Internal issues are, internal issues. If it leaks, plug the leak.

4 3

Nimda Worm
by Mike Jackson 18 Sep '01

18 Sep '01

One of the spread methods has to do with retrieving a file called "readme.eml" from the infected web servers. Adding this to my Cisco HBAR code red config seems to at least keep my customers from becoming infected using that method. class-map match-any http-hacks .. code red stuff.. match protocol http url "*readme.eml" Can anyone confirm exactly what filenames the email spread version uses? -- Mike Jackson <mhjack(a)tscnet.com> Vice-President TSCNet, Inc. Phone: 360-308-0205 Fax: 360-698-7789 http://www.tscnet.com

1 0

Embargos and proscriptions
by Roeland Meyer 18 Sep '01

18 Sep '01

The following link details various embargos in effect. http://pmdtc.org/country.htm Almost all of these entail defense and munitions. ITAR has long considered cryptographic material a munition, under ITAR category XVII (see: http://pmdtc.org/usml.htm) Personal opinion: we may see this definition expanded, as it has in the past. The problem is, expansion is easy, contraction is somewhat more difficult. [disclaimer] MHSC has been involved in ITAR issues since 1997. Our initial business plan was to provide secured services and individual privacy through encryption techniques and services, for both individuals and organizations. We couldn't get that past ITAR initially and when we could, the market wasn't there yet (couldn't get any traction. Most folks frankly, don't give a rat's tush about security, especially if they have to do anything extra for it). MHSC goes out of its way to avoid even the appearance of legal violations and to limit its risk of legal liability. MHSC is no longer in this business (see: http://www.mhsc.net/services.htm) -- IANAL = I Am Not A Lawyer. Before taking legal action based on anything I say or write, you are strongly encouraged to seek the advice of an attorney. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company tel: +1 925 373 3954 cel: +1 925 352 3615 fax: +1 925 373 9781 http://www.mhsc.com |> -----Original Message----- |> From: Tim Devries [mailto:tim.devries@inquent.com] |> Sent: Tuesday, September 18, 2001 12:56 PM |> To: Smith, Rick; nanog(a)merit.edu |> Subject: Re: Afghanistan |> |> |> |> Does anyone even have a list of IP blocks allocated on a national or |> regional level? |> |> ----- Original Message ----- |> From: "Smith, Rick" <rsmith(a)atsworld.com> |> To: <nanog(a)merit.edu> |> Sent: Tuesday, September 18, 2001 9:23 AM |> Subject: Afghanistan |> |> |> > |> > |> > Has anyone started to deny all traffic to/from Afghanistan ? |> > |> > Wouldn't that be worth it ? |> > |> > Or did I miss that post? |> > |> > R |> > |>

2 1

Re: Worm Probes
by Roeland Meyer 18 Sep '01

18 Sep '01

The damned thing continues to burn bandwidth here. My IIS systems were patched long ago and my Apache servers are inherently immune. But, that does not prevent vulnerability scans and it's those scans that are burning the pipe. Firewalling the scans sort of blocks those services too. So, that isn't the answer. Fortunately, I have long been a fan of having really huge boxen sip their internet through straws (any single box can saturate the uplink (100baseTX), at <50% CPU utilization and the WAN:LAN link never exceeds 1:10. So, my servers are just loafing. Still, this comes real close to being a DDOS attack because the WAN port is showing almost 40% usage from scans right now. I'm real glad that I have another set of zone servers, piggy-backed in AboveNet. Has anyone made any progress towards locating origination of these worms? They seem to be steadily mutating. This means that a/some programmer(s) is/are behind this somewhere. I'm sure that I'm not the only one that wants to know. -- R O E L A N D M J M E Y E R Managing Director Morgan Hill Software Company tel: +1 925 373 3954 cel: +1 925 352 3615 fax: +1 925 373 9781 http://www.mhsc.com

4 3

RE: Worm probes
by Smith, Rick 18 Sep '01

18 Sep '01

I've seen 2,614 unique addresses. I'd be willing to do the same. Or contribute to the effort. -----Original Message----- From: Ulf Zimmermann [mailto:ulf@Alameda.net] Sent: Tuesday, September 18, 2001 2:32 PM To: sigma(a)pair.com Cc: nanog(a)merit.edu Subject: Re: Worm probes On Tue, Sep 18, 2001 at 01:36:48PM -0400, sigma(a)pair.com wrote: > > > Along those lines, weren't there some projects last time around to find and > clean up the affected machines? Clearly there are LOTS of vulnerable NT > servers still out there. Presumably these are being responded to just like > Smurf amplifiers, and the problem is just that the admins are clueless or > unreachable? > > So far the most prolific network probing us has belonged to 9NetAve, which > was bought by Concentric shortly before they became XO. I got so far about 205 unique IPs from the scans. If anyone is interested I can put them on a webpage. Or even put quickly a script with db in the back for other people to provide their list of IPs. > > Kevin > > > Hopefully the notification does some good. > > > > -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

2 1

RE: Afghanistan
by Hallgren, Michael 18 Sep '01

18 Sep '01

> > >> Has anyone started to deny all traffic to/from Afghanistan ? > > It is my understanding that the free flow of ideas and > discussion of same > > is detrimental to an extremist or dictatorial government. > Such governments > > rarely (ever?) survive open discussions and flow of ideas. > > so i guess we should not advocate cutting off that flow, eh? > Yes (any channel for potentially constructive discussions, keep open). > resist the cycle of violence and hate. . mh > > randy >

1 0

Worm leveling off RE: Worm impact - September 18 2001
by Sean Donelan 18 Sep '01

18 Sep '01

The worm's impact appears to be leveling off. Any word if the infection rate has slowed like the CodeRed I/II worms?

1 0

Apache::Nimba released
by David Ulevitch 18 Sep '01

18 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: MD5 Hello Nanog'ers, I just released a dirty apache module to detect and if wanted, block Nimba via iptables. It's small, it's 0.1 but it works. I posted it here: http://www.everydns.net/~davidu/Apache-Nimba-0.1.tar.gz Any questions or comments can be directed here. I'll have a better version in a few hours but I'm late for my CS102 class. Thanks, David Ulevitch mailto:davidu@everydns.net Founder, EveryDNS.net http://www.everydns.net p.s: note that if you use the iptables part it's totally insecure for obvious reasons. I'll try to think of a fix while in class. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQIVAwUAO6efVUhMBortpHrDAQEMaRAAgb8um4ES8sbn21IOLOy/3aXnsTBAij0J Vdi9ak5CJ+UbdBYCU7pqpUzXT7M8jYHfelsi34pwhC+bHjeg6vY8YkI593GecVhG O9J+co/2NK5Wwqm2Xq0fO3OA30Ow/++N7TV6N0OI2wLlt8tGJN75fCYJ6RVAEZ9a DUFNUMWRFRm9hEQMuO1ToKwZF4QA1x7P3sFt2FwGH47qebRKUU0we6TCORoCNqC/ R3QIPf06ARW/J4Z4LFyG/vNj9T413i7FtbZz9sB1zE9VxcJDa6XF85Z+wvo68qB7 6y0CSpMTYsF1riHB1KgKAdpaCnqpN4S4rhvd4+sDV59xaTS77AXwlLBlOuSMkxq2 axPG+O5LRR89YLjBYvkIKeYV49u1vg8h/iv/Jjazy29Aeu9tBRaDEBP7cGV6LvTb 9LqKCfTQd/uZVD16QH6FEjGNvOL597XdPI5U/59Ux8ZCP1wxcBP2pjjDoURngEdu QjLADWEabn/l9iCX6aGn9bzg9n9af6F0Ub7/bWlf7wNh0ALPtkAz4Aoz31esxK6/ K7iksieSxlbKOqVS0Mp3lSlA4LmgPcaVzMcO7q4vhlWLaMwogL2n835qIeD71Pwe daA3lFL3qRrJEdXbmWEgq0T2H+0aaCH04/Xv41jTFdlm/Wfj7QU4hulU0cdZxx+B RGm2B0N2l6k= =IlZy -----END PGP SIGNATURE-----

1 0

Re: [isp-linux] RE: Massive port 80 hits
by Bill Larson 18 Sep '01

18 Sep '01

#!/usr/bin/perl # IISBLOCK - Infected IIS server blocking utility. # by Bill Larson <blarson(a)compu.net> of Compu-Net Enterprises. # http://www.compu.net. This header must be kept intact if you # wish to redistribute the script. my $check = 0; my $line = ""; my $weblog = "/etc/www/logs/access_log"; my $infection = "/root/infected"; my $removelist = "/root/fwclean"; # create the removelist file so that you can chmod it later and # automatically clear the firewall.. chmod 700 iisblock open (HTFILE3, ">$removelist"); print HTFILE3 "#!/bin/sh\n"; close(HTFILE3); #open the web server log file specified above and start processing open (HTFILE, "$weblog"); until (eof (HTFILE)) { $line =<HTFILE>; chop ($line); #Pattern match on IIS Attempts then strip down to the hostname/ip addresss if ($line =~ /.*\/winnt\/system32\/.*/) { $line =~ s/\ -.*//gi; # This host is infected so lets do something about it. &infected; } } close(HTFILE); sub infected { $check = 0; # begin a check to ensure that we only take action once. open (HTFILE2, "$infection"); until (eof (HTFILE2)){ $dupe =<HTFILE2>; chop ($dupe); if ($line =~ /$dupe/){ $check = 1; } else { } } close(HTFILE2); # If this is a unique host continue if ($check eq "0") { # time to add to the list of infected hosts open (HTFILE2, ">>$infection"); print HTFILE2 "$line\n"; close(HTFILE2); # add using the specified add command # firewall software will print an error on invalid hostnames. # Zap them one at a time maunally system ("/sbin/ipchains -I input -s $line -j DENY -l"); # write firewall removal line to the remove list file # modify this line for your specific firewall software open (HTFILE3, ">>$removelist"); print HTFILE3 "/sbin/ipchains -D input -s $line -j DENY -l\n"; close(HTFILE3); } # That's all folks! }

1 0