- Test - lists.nanog.org

RE: Afghanistan
by Hallgren, Michael 18 Sep '01

18 Sep '01

> > > At 11:43 AM 9/18/2001 -0500, Basil Kruglov wrote: > > > >On Tue, Sep 18, 2001 at 12:23:58PM -0400, Smith, Rick wrote: > >> Has anyone started to deny all traffic to/from Afghanistan ? > >> > >> Wouldn't that be worth it ? > >> > >> Or did I miss that post? > > > >Do they even have Internet? > > > >http://www.cia.gov/cia/publications/factbook/geos/af.html > >Internet Service Providers (ISPs): NA > > It is my understanding that the free flow of ideas and > discussion of same > is detrimental to an extremist or dictatorial government. > Such governments > rarely (ever?) survive open discussions and flow of ideas. > > Either that, or their beliefs are so strongly held, so pure, > so obvious > that other ideas / beliefs need not even be examined. > Apparently the "boys > and girls" are simply told what to believe, and the reasoning > behind or, or > counter arguments to it, are irrelevant. No discussion or > substantiation > is necessary, "people with clue" told them so. > > > I vote for #1. What does the rest of NANOG think? > #1, (provided the open minded people over there do enjoy access to such a free flow of information, something I can't tell from my horizon.) mh > > >-Basil > > -- > TTFN, > patrick >

2 1

Re: Cisco PIX 515-->520?
by Lisa Napier 18 Sep '01

18 Sep '01

Hi all, Answers below: >From: Todd Suiter >Date: Wed Sep 12 20:19:02 2001 > > > I'm hearing rumors of problems with the 515 series PIX: > > '...that in some cases Cisco has opted to replace customers' 515 Pixes > with 520's at no charge because the 515 in some cases accepts packets > with spoofed source addresses that it should be able to reject.' This is untrue. >has anyone heard of this? Far as I know the sw is the same, but hw is >different. The hardware is different - that's why there are different product numbers - however the difference is in processing power and speed. Currently on the PIX, the anti-spoofing checks are all done in SOFTWARE, so anti-spoofing will be consistent across all hardware platforms. Hope that helps, Lisa Napier Product Security Incident Response Team Cisco Systems http://www.cisco.com/warp/public/707/sec_incident_response.shtml PGP: A671 782D 2926 B489 F81A 3D5E B72F E407 B72C AF1F ID: 0xB72CAF1F, DH/DSS 2048/1024

1 0

RE: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

There has already been a massive application of the patches, according to www.netcraft.com at http://www.netcraft.com/survey/#August, Code Red vulnerability has dropped to less than 20%, since July. It continues to drop. Your general characterization of cluelessness is a bit unfair. It is puzzeling that root.exe vulnerability is the only indicator that continues to rise, albeit slowly. Netcraft shows it to be >10% at the moment. BTW, I'm still seeing massive scanning activity. |> From: sigma(a)pair.com [mailto:sigma@pair.com] |> Sent: Tuesday, September 18, 2001 10:37 AM |> |> Along those lines, weren't there some projects last time |> around to find and |> clean up the affected machines? Clearly there are LOTS of |> vulnerable NT |> servers still out there. Presumably these are being |> responded to just like |> Smurf amplifiers, and the problem is just that the admins |> are clueless or |> unreachable? |> |> So far the most prolific network probing us has belonged to |> 9NetAve, which |> was bought by Concentric shortly before they became XO. |> > Hopefully the notification does some good. |> > |>

1 0

Re: Worm probes
by Ulf Zimmermann 18 Sep '01

18 Sep '01

On Tue, Sep 18, 2001 at 11:18:58AM -0700, Michael Martin wrote: > I was getting a huge number of probes on my Bay Area @home cablemodem until > about an hour and a half ago and it looked to be exclusively from @home > space. At that point the traffic I was seeing to my two IPs dropped from > about 200 kbit/sec to zero. It looks like @home put some filters in place. > I in the Bay Area too with @Home service (also got Speakeasy business DSL). As for 11:39am PDT I still see probes on @Home still. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

RE: Worm probes
by Smith, Rick 18 Sep '01

18 Sep '01

For the past 2 weeks or so, we were averaging 1,200 probes per hour. As of 8 or so this morning, we started averaging > 25,000 per hour! I've noticed that at the same time, we started getting probes from our provider's space (uniquely 23 addresses there), but not our own. Until this morning, we had *0* probes from inside our provider's space. Maybe this is the next round kicking off, looking for things to infect locally before searching the world again. Rick P.S. - Right now: (looks like it will be a bit over 25k this hour :) [root /usr/local/bin]# checkcodered.bash Code Red Log Checker Beginning Time: 10:00:00 Ending Time: 10:32:42 Number of attacks... 31730 Number of unique addresses... 3344 -----Original Message----- From: Daniel Senie [mailto:dts@senie.com] Sent: Tuesday, September 18, 2001 10:26 AM To: sigma(a)pair.com; nanog(a)merit.edu Subject: Re: Worm probes At 09:54 AM 9/18/01, sigma(a)pair.com wrote: >Has anyone else been seeing a dramatic increase in /scripts/.. NT worm >probes this morning? We're seeing about 8000/second, starting around 9:15 >Eastern time, to and from a wide variety of addresses. > >Is CodeRed or one of its relatives scheduled to start sweeping again today? >We've never seen this level of traffic related to the NT worms. Even >though we don't run any NT at all, we still have to suffer :( First ones appeared today, and so far I see 17650 attempts on just one of my servers. We don't run any Microsoft stuff either, but that doesn't keep our servers from getting hammered... ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

4 3

Re: Re: FW: Worm probes
by Frank Coluccio 18 Sep '01

18 Sep '01

re < readme.exe > : http://www.cert.org/current/current_activity.html#port80 > > > There is also an email vector where README.EXE is sent via email to > > numerous accounts. > > It also seems to set the from address in both the envelope and > header to an address, possibly from the address book(?). I've seen > a number of bounces come back to one of our NOC addresses, and a > couple of reports from humans. :( > > Rob >

1 0

FW: Worm probes
by Braun, Mike 18 Sep '01

18 Sep '01

I received this warning from TruSecure regarding the latest worm attack. Mike Braun First American CREDCO -----Original Message----- TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm Date: September 18, 2001 Time: 1000 EDT RISK INDICES: Initial Assessment: RED HOT Threat: VERY HIGH, (rapidly increasing) Vulnerability Prevalence: VERY HIGH, effects IIS servers version 4.0, 5.0, and internal networks. Cost: High, command execution is possible Vulnerable Systems: IIS 4.0 and 5.0 SUMMARY: A new IIS worm is spreading rapidly. Its working name is Nimda: W32.nimda.a.mm It started about 9am eastern time today, Tuesday,September 18, 2001, Mulitple sensors world-wide run by TruSecure corporation are getting multiple hundred hits per hour. And began at 9:08am am. The worm seems to be targeting IIS 4 and 5 boxes and tests boxes for multiple vulnerabilities including: Almost all are get scripts, and a get msadc (cmd.exe) get_mem_bin vti_bin owssvr.dll Root.exe CMD.EXE ../ (Unicode) Getadmin.dll Default.IDA /Msoffice/ cltreq.asp This is not code red or a code red variant. The worm, like code red attempts to infect its local sub net first, then spreads beyond the local address space. It is spreading very rapidly. TruSecure believes that this worm will infect any IIS 4 and IIS 5 box with well known vulnerabilities. We believe that there are nearly 1Million such machines currently exposed to the Internet. Risks Indices: Vulnerability VULNERABILITY PREVALANCE is very high - Milllions of Internet Web server hosts: TruSecure process and essential configurations should generally be protective. The vulnerability prevalence world-wide is very high Threat - VERY HIGH and Growing The rate of growth and spread is exceedingly rapid - significantly faster than any worm to date and significantly faster than any variant of Code red. Cost -- Unknown, probably moderate per infected system. The worm itself is a file called README.EXE, or ADMIN.DLL a 56K file which is advertised as an audio xwave mime type file. Other RISKS: There is risk of DOS of network segments by traffic volume alone There is large risk of successful attack to both Internet exposed IIS boxes and to developer and Intranet boxes inside of corporations. Judging by the Code Red II experience, we expect many subtle routes of infection leading to inside corporate infections. We cannot discount the coincidence of the date and time of release, exactly one week to (probably to the minute) as the World Trade Center attack . REPLICATION: There are at least three mechanisms of spread: The worm seems to spread both by a direct IIS across Internet (IP spread) It probably also spreads by local shares. (this is not known for sure at this time) There is also an email vector where README.EXE is sent via email to numerous accounts. Mitigations TruSecure essential practices should work. Block all email with EXE attachments Filter for README.EXE Make sure IIS boxes are well patched and hardened, or removed from both the Internet and Intranets. Make sure any developer computing platforms are not running IIS of any version (many do so by default if either. Disconnect mail from the Internet Advise users not to double click on any unexpected attachments. Update anti-virus when your vendor has the signature. -----Original Message----- From: Bryan Heitman [mailto:bryanh@communitech.net] Sent: Tuesday, September 18, 2001 8:22 AM To: nanog(a)merit.edu Subject: Re: Worm probes We're also seeing a large increase in this activity. This seems to be more severe than the first time. Have an additional 30 to 40 meg inbound from this. Best regards, Bryan Heitman CommuniTech.Net, Inc. ----- Original Message ----- From: <up(a)3.am> To: <nanog(a)merit.edu> Sent: Tuesday, September 18, 2001 10:05 AM Subject: Re: Worm probes > > > ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k > box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this > time of day, although still well short of capacity...apache server > processor load is WAY up just from the requests, and the logs are growing > like mad. > > On Tue, 18 Sep 2001, deeann mikula wrote: > > > > > On Tue, 18 Sep 2001, ravi pina wrote: > > > > > > > > On Tue, Sep 18, 2001 at 09:54:31AM -0400, sigma(a)pair.com said at one point in time: > > > > > > > > > > > > Has anyone else been seeing a dramatic increase in /scripts/.. NT worm > > > > probes this morning? We're seeing about 8000/second, starting around 9:15 > > > > Eastern time, to and from a wide variety of addresses. > > > > > > affirmative. i just looked at my logs, and it looks like > > > each probe tries a bunch of things. i haven't seen much > > > on the lists, but i'm looking right now. > > > > i'm pretty sure that the worm's attack phase starts on the 20th (which > > of course, depends upon a correctly set system clock) and also that > > attempting to execute something like /scripts/root.ext/c++ something > > is involved. > > > > i think that cert's website would be a good place to look. i'm *not* > > a security/virus chick, but i did host a talk by marty linder of cert > > where he discected code red's activity and presented a summary. > > > > cert is of course, http://www.cert.org. > > > > > > deeann m.m. mikula > > > > director of operations > > telerama public access internet > > http://www.telerama.com > > 1.877.688.3200 > > > > > > > > > > James Smallacombe PlantageNet, Inc. CEO and Janitor > up(a)3.am http://3.am > ========================================================================= > "MMS <firstam.com>" made the following annotations on 09/18/01 08:34:15 ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

3 2

Re: Our Qwest Testimonial: qwestoutage.com
by Paul Vixie 18 Sep '01

18 Sep '01

> This really is way outside most people's "disaster recovery" scenarios. I > can see the thinking now: "If both WTC towers fall over, we have much > bigger things to worry about than fiber cuts." And they were right. Right as far as that goes, yes. But since fiber paths of that kind are used to feed cell towers and other parts of the communications infrastructure including emergency services infrastructure, it IS worth thinking about communications robustness even in the face of destruction on this scale. Not so that folks can surf the web but so that folks in air pockets can call out to their rescuers. -- Paul Vixie <vixie(a)eng.paix.net> President, PAIX.Net Inc. (NASD:MFNX)

1 0

RE: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

2 1

Worm impact - September 18 2001
by Sean Donelan 18 Sep '01

18 Sep '01

I first noticed the worm this morning at the same time the national moment of silence was being broadcast. My web e-mail provider was knocked off the air at that time. I'm using an alternate account. Approximately 1,000 networks of 104,200 vanished from the routing table as seen by Telstra in the past two hours Keynote Internetpulse.com was showning "red" congestion between C&W and Qwest, which has since cleared. InternetTrafficReport.com stopped reporting data. All zeros across the board. Matrix.net Internet Weather Report shows a 3 percent drop in reachability of tested servers.

1 0