- Test - lists.nanog.org

RE: The Death of TCP/IP
by Roeland Meyer 06 Aug '01

06 Aug '01

> From: Wojtek Zlobicki [mailto:wojtekz@idirect.com] > Sent: Sunday, August 05, 2001 7:26 PM > > From: "Roeland Meyer" <rmeyer(a)mhsc.com> > To: "'Wojtek Zlobicki'" <wojtekz(a)idirect.com>; <nanog(a)merit.edu> > > > > From: Wojtek Zlobicki [mailto:wojtekz@idirect.com] > > > Sent: Sunday, August 05, 2001 3:09 PM > > > > > > <RANT> > > > > > > Nothing other than anti-Microsoft propaganda. You cannot > > > blame Microsoft > > > for high market share. > > > > But you can blame them for making Vbasic available to every > email message > > that wants to rape your system. Boy, what a brain-fart that > was. It still > > stinks. Repeat after me; nothing in an email message should > be executable > > without express and very deliberate operator intervention. > > Agreed, BUT .... as stated by Cringley himself, Microsoft > tailors their software to the populus. Aside from that fact that I think Cringley's still living in the haze-daze, I think that you've been sucking down that MS Kool-Aid too hard. What MSFT says and what MSFT does are two very different things. They're very good at stroking you so that you don't notice it when they cut your throat, until the cutting's done. Then it's too late. MSFT learned triple-level agendii from the best in the business ... IBM. If you don't read at least three levels of meaning into every MSFT press release then you're being very nieve. Every word in those things is manacured to perfection. You can bet that they are the absolute truth, that they are absolutely accurate, and absolutely incomplete. But, incomplete in such a way that you will not notice. It's the goals and agendii that are very well hidden. > Wow a software company listening to its users, what a travesty. What's a travesty is that they don't have the user's primary best interest at heart at all. Users may benefit, and probably will, but MSFT will benefit even more. Options that do not include a MSFT benefit are not even considered. > > > The main reason that *Nix hosts are generally more > > > resilient to these type of worms is that it is less > likely for a non > > > informed administrator to administer a *Nix sever. > > > > False. A very large portion of the *nux machines are in this sad > condition. > > False, many popular exploits (such as those with BIND) are > fixed/patched much faster. Uh huh, wu-ftp ... anyone? It's been *years* already. How about PINE? Let us not forget qpopper. I *do* hope that you're not mounting your PDC's NTDS files on anything less than a hardware RAID1 array. If that file evaporates, you will have to re-install *every* DC in the house. > Now a really scarry worm would be one that exploits Apache. why? What about the new Oracle 9i application server? I'm just looking at that now, I'm sure that there are some issues there. BTW, the first-ever worm was created in a *nix box and infested other *nix boxen, via uucp. In the same time-period, FidoNet was worm-proof. > I used *NIX and not Linux for a reason. Many UNIX boxes are much better secured. > Joe Sixpack that installs his favourite distro of Linux is just as vulnerable as a > windows users. I will give you > the fact that there are still many unsecure/unpatched boxes > in both worlds. It all comes > down to the poor management of Internet connected devices. I think that I made that point. It is even more true today. *nix boxen cost sufficiently much that you generally find them only in professionally-run shops. *nux boxen are found everywhere else. But, also in professionally run shops... right next to the *nix boxen. Latest pricing, of OpenUnix, is right at $1K. *nux is generally around fifty bucks. Guess which one Joe home-user will buy? Guess which one Joe Corp-user will buy? There's lots behind that, which I won't go into here. No, it isn't that clean a cut. This is basic marketing, folks. > I am really encouraged > by the new option of auto installing updates in Windows XP. That doesn't scare you? If someone figures out a way to tap into that update channel then they *own* your WinXP box. Especially since, there isn't a human in that loop. Like no one has ever stolen a MSFT cert before? One bogus update and put a fork in you .. you're done. You only *thought* that CodeRed spread fast. BTW, look at Caldera's Volution sometime.

1 0

Code Red Hammering Away
by Lou Katz 06 Aug '01

06 Aug '01

My little Class C seems to be getting 3-6 attempts per second to connect to Port 80 on various IPs at the present time. Is this about average? -=[L]=-

11 15

Re: nanog 23
by Marshall Eubanks 05 Aug '01

05 Aug '01

I am very sorry, that message was not intended for you. (I am in London for the IETF and am running on little sleep). Again, my apologies Marshall Eubanks >****** Forwarded Message Follows ******* > > >On Fri, 3 Aug 2001, Carol Wadsworth wrote: > >> Hotel Information URL: >> >> http://www.nanog.org/mtg-0110/hotel.html > >For those of you in uncertain financial situations (and I know there are >several of you out there) and are looking to save the extra buck, the >Washington Inn, just down the street from the Mariott is offering a >corporate rate of $128. Their number is 510-452-1776. > >-- >Brandon Ross 404-522-5400 >EVP Engineering, NetRail http://www.netrail.net >AIM: BrandonNR ICQ: 2269442 >Read RFC 2644! > Marshall Eubanks tme(a)21rst-century.com

2 1

Re: nanog 23
by Marshall Eubanks 05 Aug '01

05 Aug '01

Also, I have meetings in San Jose Augsut 16 and in LA August 17. Please get me a flight for this (leaving on the 15th and returning redeye on the 17th). Please send me an email tomorrow with options etc. Marshall >I will speak there. Please register Art Trudel and >get us a room together. > >Marshall >****** Forwarded Message Follows ******* > > >On Fri, 3 Aug 2001, Carol Wadsworth wrote: > >> Hotel Information URL: >> >> http://www.nanog.org/mtg-0110/hotel.html > >For those of you in uncertain financial situations (and I know there are >several of you out there) and are looking to save the extra buck, the >Washington Inn, just down the street from the Mariott is offering a >corporate rate of $128. Their number is 510-452-1776. > >-- >Brandon Ross 404-522-5400 >EVP Engineering, NetRail http://www.netrail.net >AIM: BrandonNR ICQ: 2269442 >Read RFC 2644! > Marshall Eubanks tme(a)21rst-century.com

1 0

Fwd: Re: Code Red variants
by Jeff Ogden 05 Aug '01

05 Aug '01

FYI >Date: Sat, 04 Aug 2001 20:16:55 -0700 >To: Jeff Ogden <jogden(a)merit.edu> >From: John Moore <misclists(a)tinyvital.com> >Subject: Re: Code Red variants > >At 07:48 PM 8/4/2001, you wrote: > >>Do we know if anyone has looked at the code for variants of the >>worn in detail recently? I've seen announcements about new >>versions with better random IP address generation. Does anyone >>know if other aspects of the worm are the same? Is it still set to >>spread itself until the 19th and then switch to attacking the IP >>address that was once www1.whitehouse.gov or are their variants >>with different dates and different IP address or attack scenarios? > > >Jeff, > I tried sending info to the list but may not have posting >priveleges. Anyway, you can relay this. > >I have a home system on Sprint Broadband, with a little sniffer on >port 80 to see the full payload of what is coming in. Starting this >morning a new variant of CodeRed started hitting, with a lot more >frequency than I ever saw from the original. > >This variant has the text "CodeRedII" in the payload. It also has >the names of the windows registry entries you would want to hit to >install a rebootable trojan. It does not have any domain name in it, >and nothing about "Hacked by Chinese." It has XXXXXXXXXXXXXXXXXXX in >the payload instead of NNNNNNNNNNNNNNn > >The class A domain with by far the greatest number of hits belongs to Sprint. > >I dumped some statistics on which class A prefixes had at least >three hits. I also dumped the total number of CodeRedII hits by hour. > >I don't have time to disassemble it - I am just watching out of >curiousity, so I don't know what else it is doing. > >here are my hourly stats so far. Time is GMT. > >08040113 1 >08040114 4 >08040115 10 >08040116 5 >08040117 13 >08040118 10 >08040119 12 >08040120 9 >08040121 18 >08040122 15 >08040123 16 >08050100 18 >08050101 20 >08050102 26 > >Here is the domain breakdown: >Class A # > 168 3 > 112 3 > 249 3 > ? 21 > 221 80 > 43 3 > 190 4 > >Feel free to mention this to the list if you want, since my mail is >not getting through. > >Thanks > >John > > > > >John Moore > >john(a)tinyvital.com - http://www.tinyvital.com/ >Tiny Vital Software, Inc > >The only good weather is bad weather! >Storm Chasing - the Best extreme sport! > >(SKYWARN,ARRL,AZ AMS,AZTC,NJ7E)

3 2

CodeRedII worm..
by Valdis.Kletnieks＠vt.edu 05 Aug '01

05 Aug '01

Given that initial analysis of the CodeRedII worm indicates that it leaves a backdoor laying around, I hereby request that those people who made lists of infected hosts available last time *NOT* do so again. Although said lists *were* helpful in the analysis and study of the worm's tactics, the benefits are certainly outweighted by the fact that the new worm creates a known backdoor. I'm certain that both the CodeRedII author and other black hats would love for us to compile a list of afflicted hosts for them to use. So please everybody - if you're sending IP's in to be added to a table, make sure you're sending them to a white hat, not to a black hat who's managed to social-engineer you. If you're a white had compiling a list, make sure the guy's hat is at least a light grey before you give them a copy. ;) Valdis Kletnieks Operating Systems Analyst Virginia Tech

2 1

Code Red variants
by Lou Katz 05 Aug '01

05 Aug '01

I'm seeing about 2:1 "XXXXXXXXXXXX" vs "NNNNNNNNNNNN" entries in today's logs. Also, I have over a factor of 20 more entries in Aug than in July. -- -=[L]=-

6 5

This new CodeRedII is moving way faster than the previous
by Chris Grout 05 Aug '01

05 Aug '01

This thing is hitting hard! I got bored and thought I'd through some stats/info together... So far, since 9:16am on 7/19, I've seen 485 CRv1 attacks from 257 unique IPs on my cable modem. Since 6:49am today, I've been hit 472 times from 133 unique IPs with this new "CRv2" worm. - All infected systems seem to try each scanned IP twice whereas the original only tried once, which probably will help its infection rate. Seems odd though as both tries use the same source port. Could just be my snort rules... - It has the word "CodeRedII" hard coded in the packet, so its obviously a copycat or at least a fairly recent revision. - *Appears* to be hardcoded to use the d:\inetpub\scripts and d:\progra~1 \common~1\system\MSADC directories. Assuming you are not using this path, are you still vulnerable? - Either copies cmd.exe or creates a new file named root.exe in those directories. - I'm seeing almost only cable modem systems now. Appears businesses may have finally gotten their acts together. chris

1 0

RE: Code Red Hammering Away
by Roeland Meyer 05 Aug '01

05 Aug '01

> From: William Allen Simpson [mailto:wsimpson@greendragon.com] > Sent: Saturday, August 04, 2001 4:45 PM > It seems to me that somebody needs to write a version of Code > Red that > wipes all .exe and .dll in the windows directory, forcing an update > of both windows and office. > > Anybody game? Only if you're willing to cover all contingent liabilities and indemnify all parties involved. (that was a joke<g>)

1 0

NANOG 23 Meeting Information
by Carol Wadsworth 05 Aug '01

05 Aug '01

Registration is now *open* for the 23rd Meeting of the North American Network Operators' Group. The meeting will be held October 21-23 at the Oakland Marriott City Center in Oakland, California, and will be hosted by Cisco Systems. Online Registration URL: https://www.merit.edu/nanog/registration.form.html.0110 Hotel Information URL: http://www.nanog.org/mtg-0110/hotel.html *********************************************************** CALL FOR PRESENTATIONS NANOG 23 October 21-23, 2001 The North American Network Operators' Group (NANOG) will hold its 23rd meeting in Oakland, CA, between October 21-23, 2001. The meeting will be hosted by Cisco Systems. NANOG conferences provide a forum for the coordination and dissemination of technical information related to large-scale (i.e., national/international) Internet backbone networking technologies and operational practices. NANOG meetings, held three times each year, include two days of short presentations, plus afternoon/evening tutorial sessions. Meetings are informal, with an emphasis on relevance to current backbone engineering practices. The conference draws over 600 participants, mainly consisting of engineering staff from large national service providers, and members of the research and education community. The meeting will be held at the Oakland Marriott City Center. For more information about NANOG meetings, schedules, and logistics, see: http://www.nanog.org --------------------------------------------------------- CALL FOR PRESENTATIONS The special theme for NANOG23 is Backbone Security. We invite presentations on security topics, including IPSec, traffic filtering, DoS, and configuration and protection of the backbone infrastructure. In addition to the themed security session, NANOG also invites presentations on topics related to backbone engineering and operations. Previous meetings have included presentations on: - Backbone traffic engineering - Coordination of inter-provider QoS - Inter-provider security and routing protocol authentication - Routing scalability in backbone infrastructures - Routing policy specification and backbone router configuration - Building large-scale measurement infrastructure - Cooperative inter-provider caching - Alternatives to hot-potato routing - Recommendations on queue management and congestion avoidance - Experience with differentiated services - Inter-domain multicast deployment - Backbone network failure analysis Tutorials have covered topics such as: - BGP case studies - MPLS fundamentals - IP multicast technologies - ISPs and federal privacy law --------------------------------------------------------- HOW TO PRESENT Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The deadline for proposals is September 10, 2001. While the majority of speaking slots will be filled by September 10, a limited number of slots will be available after that date for topics that are exceptionally timely and important. Submissions will be reviewed by the NANOG Program Committee, and presenters will be notified of acceptance by September 24, 2001. NANOG also welcomes suggestions/recommendations for tutorials, panels and other presentation topics.

2 1