- Test - lists.nanog.org

Re: Code Red 2 cleanup; reporting..
by Steven M. Bellovin 11 Aug '01

11 Aug '01

In message <3B7360B4.71755CA7(a)deaddrop.org>, Etaoin Shrdlu writes: > >mike harrison wrote: >> >> > FWIW, I just tried to telnet to the 20 most recent hosts I got Code Red II >> > probes from, and didn't get a shell prompt on any of them. Are people >> > cleaning up their boxes that quickly? >> >> I have been told, but not personally conformed confirmed of non IIS >> machines being infected with CodeRed (I or II not known, assume II). >> Infection method: running an file from somewhere? They still scan out >> and seek victims, just no webserver running. > >Spent nearly two days convincing someone who was managing a server that he >was beating up machines all over the company. It finally took someone at >close to VP level to get him to fix it. Last I heard, he was saying >something on the phone like "Yes sir, you're right sir. Sorry sir." The >thing that sucks is that he KNEW he couldn't be a problem, since he wasn't >running IIS. I had the packet captures and obvious grabs for default.ida to >prove it. > >Believe it. I have at least three verified, and that was using web server >logs they'd hit, and ethereal running on the openbsd machine in my office, >which sits right next to the local building router. [Yes, it's true. IRL, I >work for Big Company X.] So -- if he wasn't running IIS, what was he running? --Steve Bellovin, http://www.research.att.com/~smb

3 3

Re: [NANOG] Was: Code Red 2 cleanup -- SHOULD NSPs PULL THE PLUG? Solutions?
by z＠s0be.net 10 Aug '01

10 Aug '01

On Sat, 11 Aug 2001, matt carter wrote: > I don't think in any situation, aggravating the problem by 'returning > fire' serves any purpose. Put filters on your routers if it's that much of > a problem, get your upstream to do likewise if it's that serious.. > <--( SNIP )--> Helu, In the case of a lot of networks that are affected by this problem in particular, putting filters on your routers isn't a solution. It localizes the problem, sure, however do you just let the problem continue ad inifinitum? Also, the filtering of ingress/egress scanning attempts can be fairly resource intensive and is a very short-term 'measure' ( I say measure, because it doesn't offer a solution ). You might not 'return fire', but you should probably be thinking further ahead to an ultimate solution. In doing so, what are the possible solutions.. and how does elapsed time come into play when determining which solution fits the situation? This extends past the Code Red debacle, and into the ethereal 'what if?'. .z

1 0

Another one bites the dust...
by Andy Dills 10 Aug '01

10 Aug '01

http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/08-1… Rhythms is disbanding their network. Andy xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Andy Dills 301-682-9972 Xecunet, LLC www.xecu.net xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Dialup * Webhosting * E-Commerce * High-Speed Access

2 1

RE:
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: Jim Shankland [mailto:nanog@shankland.org] > Sent: Friday, August 10, 2001 11:04 AM > > Roeland Meyer <rmeyer(a)mhsc.com> writes: > > > ... and I just saw a Rythms truck, on the San Mateo bridge, > Wednesday. > > Which side were they pushing it over? The San Mateo side, going to Hayward, I believe. It was rush-hour, no one was going anywhere.

1 0

RE: Another one bites the dust...
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: Andy Dills [mailto:andy@xecu.net] > Sent: Friday, August 10, 2001 9:15 AM > > http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/w > ww/story/08-10-2001/0001552511&EDATE= > > Rhythms is disbanding their network. ... and I just saw a Rythms truck, on the San Mateo bridge, Wednesday.

2 1

Re: Was: Code Red 2 cleanup -- SHOULD NSPs PULL THE PLUG? Solutions?
by z＠s0be.net 10 Aug '01

10 Aug '01

On Fri, 10 Aug 2001, Etaoin Shrdlu wrote ( sanitized by z(a)s0be.net ): > z(a)s0be.net wrote: > > > I think an interesting solution to this problem, no matter how > > unethical would be to write a program that leverages the vulnerability to > > patch the infected machine. In fact, it surprises me that this hasn't > > been done. > > It's illegal. Really. What's the difference between someone breaking into > my machine and destroying stuff, and someone breaking into, say, > x.x.x.x., and "fixing" it? None. It's illegal. And yes, I HATE the > machine that is on the other end of that IP. It is apparently installed > with either mandarin or cantonese, which means that it bothers me a LOT > when it bothers me. > > It's a poorly configured win2k machine, with no proper reverse entry > (although I know it belongs to OWNER_OF_x.x.x.x). Looking isn't > illegal. I've even connected to his smtp server (but not bothered to send > mail, since vrfy doesn't really guarantee that someone is there, and I have > no evidence that he'd read email sent to administrator in any case). Sad, > really. > > It's still illegal. Yes, it'd probably be a kindness. It's still illegal. > <--( SNIP )--> Helu, I'm in agreement that it is illegal as well, however it does raise an interesting issue: Under what terms, if any, should various parties whose infrastructure is under some form of attack be able to defend themselves and what is the extent of that defense for a given situation? I think that due dilligence should be carried out in any situation, to give someone the chance to stop ( in most situations ), but where do you draw the line? NOTE: I'm not exactly condoning counterattacks, but I think in certain situations I could definitely justify it in my mind if someone were to take that course of action after exhausting their options for resolving a situation in which they are under some form of attack. .z

1 0

RE: MPLS VPNs or not?
by Kavi, Prabhu 10 Aug '01

10 Aug '01

> -----Original Message----- > From: Vadim Antonov [mailto:avg@exigengroup.com] > Sent: Wednesday, August 08, 2001 3:45 AM > To: Christian Kuhtz > Cc: nanog(a)merit.edu > Subject: Re: MPLS VPNs or not? <snip> > I'm known for making strong statements, you are right. > However, so far > I've heard no convincing argument against these positions; > and I tried to > solicit opinions by offering the opinions in question for the public > review. Frankly, i was disappointed by the "let's wait and > see which one > works" attitude. As Randy was kind to point out, that > attitude already > gave us a slew of DOA networking technologies, to the tune of billions > wasted. I don't think UUNET considered it a waste. UUNET could not have grown as quickly as it did during the mid to late 90s without L2 (Frame and ATM) technologies. Fortunately for them, they did not have any pure IP only zealots that prevented the pragmatic use of other technologies in their networks. Otherwise they probably would not have been able to outrun the other ISPs. UUNET received two benefits from it: 1. Speed, since at the time L2 switches were faster than routers, and 2. Traffic engineering, which saved them money in transport costs. Point 1 is no longer valid. Point 2 is still valid. UUNET built bigger and better networks at the time because of this. The market decided that UUNET was right. UUNET's shareholders were well rewarded because of what you called this "waste". I guess the real question should be how much market cap did other companies lose because of certain people's zealotry? Any answers Vadim? Prabhu ---------------------------------------------------------------------- Prabhu Kavi Phone: 1-978-264-4900 x125 Director, Adv. Prod. Planning Fax: 1-978-264-0671 Tenor Networks Email: prabhu_kavi(a)tenornetworks.com 100 Nagog Park WWW: www.tenornetworks.com Acton, MA 01720

9 8

RE: Code Red 2 cleanup; reporting..
by Tim Devries 10 Aug '01

10 Aug '01

-----Original Message----- From: Roeland Meyer [mailto:rmeyer@mhsc.com] Sent: Friday, August 10, 2001 11:22 AM To: 'up(a)3.am'; nanog(a)merit.edu Subject: RE: Code Red 2 cleanup; reporting.. > From: up(a)3.am [mailto:up@3.am] > Sent: Friday, August 10, 2001 8:09 AM > > On Fri, 10 Aug 2001, Roeland Meyer wrote: > > > Win2K boxen are ALWAYS running IIS. It doesn't matter > whether you have Pro > > or Server. ALL Win2K systems need to run the patch. MSFT > chose to integrate > > much of the IIS stuff into DLLs with other system critical > stuff. As a > > result, IIS can't be completely removed without killing off > other critical > > functions. Yes, what they proved in court is even more true > with Win2K than > > with Win98 (Duh! MSFT didn't lie, but they didn't tell the > whole truth > > either). WinXP is even more in that direction, from all reports. > > I admit to knowing very little about Win2k, but on the only box I've > installed Win2k on, it doesn't *appear* to be running: > > Port State Protocol Service > 135 open tcp loc-srv > 139 filtered tcp netbios-ssn > 445 open tcp microsoft-ds > 1025 open tcp list > > ...unless it runs on one of those 3 other open ports? This was Win2k > Client, not server, BTW...perhaps you mean every Win2k Server? Win2k proffesional can run IIS. Goto add remove programs -->add/remove windows components ---> IIS. You probably did not select the component on the install. So I guess that means that not every w2k box is vulnerable. Tim

1 0

RE: Code Red 2 cleanup; reporting..
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: up(a)3.am [mailto:up@3.am] > Sent: Friday, August 10, 2001 8:09 AM > > On Fri, 10 Aug 2001, Roeland Meyer wrote: > > > Win2K boxen are ALWAYS running IIS. It doesn't matter > whether you have Pro > > or Server. ALL Win2K systems need to run the patch. MSFT > chose to integrate > > much of the IIS stuff into DLLs with other system critical > stuff. As a > > result, IIS can't be completely removed without killing off > other critical > > functions. Yes, what they proved in court is even more true > with Win2K than > > with Win98 (Duh! MSFT didn't lie, but they didn't tell the > whole truth > > either). WinXP is even more in that direction, from all reports. > > I admit to knowing very little about Win2k, but on the only box I've > installed Win2k on, it doesn't *appear* to be running: > > Port State Protocol Service > 135 open tcp loc-srv > 139 filtered tcp netbios-ssn > 445 open tcp microsoft-ds > 1025 open tcp list > > ...unless it runs on one of those 3 other open ports? This was Win2k > Client, not server, BTW...perhaps you mean every Win2k Server? Have you installed a Win2K Domain (Active Directory)?

2 1

RE: Code Red 2 cleanup; reporting..
by Roeland Meyer 10 Aug '01

10 Aug '01

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Friday, August 10, 2001 12:32 AM > > In message <3B7360B4.71755CA7(a)deaddrop.org>, Etaoin Shrdlu writes: > >Spent nearly two days convincing someone who was managing a > server that he > >thing that sucks is that he KNEW he couldn't be a problem, > since he wasn't > >running IIS. I had the packet captures and obvious grabs for > So -- if he wasn't running IIS, what was he running? Win2K boxen are ALWAYS running IIS. It doesn't matter whether you have Pro or Server. ALL Win2K systems need to run the patch. MSFT chose to integrate much of the IIS stuff into DLLs with other system critical stuff. As a result, IIS can't be completely removed without killing off other critical functions. Yes, what they proved in court is even more true with Win2K than with Win98 (Duh! MSFT didn't lie, but they didn't tell the whole truth either). WinXP is even more in that direction, from all reports. BTW, is any motion happening, in the direction of finding the author(s)? I'd like to personally thank them, with a new neck-tie. The other end is attached to a huge California oak tree.

3 2