- Test - lists.nanog.org

Re: Hard data on network impact of the "Code Red" worm?
by k claffy 30 Jul '01

30 Jul '01

In-Reply-To: <20010730111612.2308.cpmta(a)c011.sfo.cp.net>; from sean(a)donelan.com on Mon, Jul 30, 2001 at 04:16:12AM -0700 As several government agencies gear up today to get additional funding, what hard data about the impact of the code read worm on the Internet exists? CAIDA posted some data about the speed of infection. But I was looking at overall Internet performance during the time period. actually we did see some difference in macroscopic performance from the skitter topology data, we're still writing that up but are a little more concerned with tracking the patching of systems at the moment (any grad students free, there are a few theses lurking in this data...) The worm tended to revisit the same systems over, and over again, so I would agree those people may have been severely affected. But 350,000 hosts isn't that big of a number any more. The Morris Internet Worm infected an estimated 10% of the internet hosts of the day. What do you think had more world-wide impact on the Internet? 1. The train accident in Baltimore 2. The "code red" worm am a little more concerned about the latter since i don't think the train accident is programmed to recur this tuesday, and the survey i mentioned caida is doing suggests that the patch rate is as slow as we feared so, 1 aug midnite GMT (tomorrow 17:00 in california), codered goes back into 'spread' mode. within a few hours, we'll have 100,000-300,000 globally infected machines again. and presumably they won't stop at the end of the day to start phase two this time. (remember CRv2 only had a day before it went into phase two the first time) the peak of infection will not hit until after normal business hours (in the US). note that even if you've patched, it may affect you (printers, routers, web load balancers, dsl modems, general 0.5-1.5 Tbps bandwidth that will be consumed, etc). do operators have some contigency plans? if everyone fiercely encouraging their customers to patch? do operators have an AUP that would allow them to filter port 80 (in this case) to hosts that are verified to be vulnerable? (mixed strategy since then that machine can't download the patch...) do you (nanog) want caida to provide a web page of stats of patched/unpatched systems by AS? in particular we find a LOT of unpatched systems behind cable modem providers (home.com, rr.com) we don't really have time to email each AS poc individually... but we don't want to upset the community either. http://worm-security-survey.caida.org/ also, we do expect that someone is writing a strain of it that will actually do 'g.c.f.' damage, yes? scary. really scary. k

2 1

Re: Hard data on network impact of the "Code Red" worm?
by Steven M. Bellovin 30 Jul '01

30 Jul '01

In message <00a501c1192b$dc200a60$0602a8c0@wojtek>, "Wojtek Zlobicki" writes: > >I just received an "URGENT" MS Security Advisory (I have never seen one >labeled as URGENT in the past). There is apparenlty a new mutation that is >to go out today :( Actually, while there may be new variants, the older ones are still of interest -- on 1 August, they'll go back into "spread" mode. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Wojtek Zlobicki 30 Jul '01

30 Jul '01

Um ..... brain in SirCam Mode :) Oops!! ----- Original Message ----- From: "Larry Sheldon" <lsheldon(a)creighton.edu> To: <wojtekz(a)idirect.com> Cc: <lsheldon(a)creighton.edu> Sent: Monday, July 30, 2001 2:03 PM Subject: Re: Hard data on network impact of the "Code Red" worm? > > > Also, is it possible that the critter got through firewalls and "did > > harm", > > > but could not get back out again? I don't know of any cases like that. > > > > Well this just makes it a good idea to proxy outbound SMTP, just set up an > > access list for only allowing outbound TCP port 25 from certain hosts > > (verified mail servers). > > Umm.....Code Red Worm is all HTTP--port 80, no? > > I disremember any SMTP -- port 25 involvement. > > -- > -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- > . . > - L. F. (Larry) Sheldon, Jr. - > . Unix Systems and Network Administration . > - Creighton University Computer Center-Old Gym - > . 2500 California Plaza . > - Omaha, Nebraska, U.S.A. 68178 Two identifying characteristics - > . lsheldon(a)creighton.edu of System Administrators: . > - 402 280-2254 (work) Infallibility, and the ability to - > . 402 681-4726 (cellular) learn from their mistakes. . > - 402 332-4622 (residence) - > . http://www.creighton.edu/~lsheldon Adapted from Stephen Pinker . > -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-

2 1

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 30 Jul '01

30 Jul '01

On Mon, 30 July 2001, Sean Donelan wrote: > What do you think had more world-wide impact on the Internet? > > 1. The train accident in Baltimore > 2. The "code red" worm What I found interesting is they both had about the same impact on the typical network performance measurements of packet loss, latency, reachability of the world-wide internet as measured by several public internet performance measurement companies. Perhaps someone like Akami has better data. Its somewhat of a rarity for a "security incident" to show up on the global network performance measurements close to the severity of a fiber cut like the Baltimore train wreck. Most security incidents, even typical DDOS attacks, have a significant affect on a few individual networks. But they tend to disappear into the noise when you look at global measurements. I needed to go back to the February 2000 DDOS attacks to find another security incident which had as severe an impact on global Internet performance.

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 30 Jul '01

30 Jul '01

On Mon, 30 July 2001, Sean Donelan wrote: > What do you think had more world-wide impact on the Internet? > > 1. The train accident in Baltimore > 2. The "code red" worm People, like Akamia, might have better data but I found the train wreck and "code red" worm had almost identical impacts on the packet loss, latency, reachability measurements average of the tens of thousands of networks measured by several performance measurement services on the world-wide Internet. I found the "code red" worm interesting because it did have a measureable impact on overall Internet performance on the scale of a significant fiber cut. Which makes it a bit of a rarity. Most "security incidents" don't show up on global network measurements. Even DDOS attacks, which are hell for the individual network, disappear into the general noise of the Internet's "normal" ebb-and-flow of traffic changes. You need to go back to the February 2000 DDOS attacks to find another security incident which had as large an impact on global Internet performance.

1 0

Southern Cross cable damaged
by Sean Donelan 30 Jul '01

30 Jul '01

The Southern Cross cable was damaged on Sunday about 20 kilometers off-shore from Sydney Australia. At the same time, the alternate path was undergoing maintenance near Oregon. The ETR is 12 days.

2 1

FYI - Last Call for IPv6 Allocation Comments
by Larry Diffey 30 Jul '01

30 Jul '01

<snipped from http://www.arin.net/announcements/ipv6_allocation_policy_rec.html > IPv6 Allocation Policy Last Call On July 19, 2001, the ARIN Advisory Council voted to forward to the ARIN Board of Trustees the following policy: "ARIN will allocate IPv6 addresses according to the Internet Draft http://www.arin.net/library/draft-iesg-ipv6-addressing-recommendations-02.t…. This policy will be regularly reviewed and modified subject to operational experience." This a last call for community comment on this policy prior to the ARIN Board of Trustees review of the proposed policy. This policy will be posted on the ARIN website and the ARIN Public Policy email list. Please send your comments to ppml(a)arin.net. This last call will expire on 23:59 EDT, August 3, 2001

1 0

Choosing ISP for T1 connectivity
by Alexander Avtsin 29 Jul '01

29 Jul '01

Hi, We've been using Earthlink (on ICG backbone) for 4 years for our connectivity. Recently, we started to experience a lot of downtime due to different problems with ICG network and response time was very slow. We're considering to switch to Genutiy, which came up as a first on our list after running comparative analysis of 13 big players in the industry. Did anybody have any BAD experience with Genuity/BBN backbone? Thank you. Alex Avtsin Network Engineer

2 1

Broadwing
by Hansel E. Lee Jr. 29 Jul '01

29 Jul '01

All, I'm considering using Broadwing for some IP transport and am interested in hearing feedback from anyone else who is currently using them. Reliable/Unreliable, Good service? Hansel E. Lee Jr. Director of IP Engineering Western Integrated Networks, LLC ( WINfirst <http://www.winfirst.com> ) 2000 S Colorado Blvd, 2-800 Denver, CO 80222 (303) 407-1685 (office) (303) 601-1174 (cell) (978) 246-0378 (fax)

7 6

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 29 Jul '01

29 Jul '01

> From: Deepak Jain [mailto:deepak@ai.net] > Sent: Saturday, July 28, 2001 3:49 PM > > I am not sure why people complain about telnet-security when > many of these > same people have no qualms whatsoever using FTP on the same account -- > equally plain text and over the general internet. I 100% agree with you and we don't do in.ftpd either (ever since the first wu-ftpd exploit was published). All of those functions here use the various flavors of SSHscp. General downloads and publication are via httpd. Uploads are via JSP to non-executable directories. All of the above are front-ended with tcpd and detailed hosts-allow entries, which is all post-ipchains activity. Actually, we could talk a lot about nasty old MSFT. But, wu-FTP is just as bad, if not worse. How many years has it been and it *still* isn't fixed? I was on a recent HP-UX installation and they *still* had the vulnerability. Maybe it is because MSFT and WU are in the same State? Maybe MSFT's attitude is geo-physically caused? In many ways the open-source community is as bad. How many programmers don't know the difference between strcpy and strncpy and the relevent security implications? Also, why does strcpy/memcpy continue to exist? The fact that we still have buffer overflow problems is living proof that some should not be programming without a license. I recently found out that Emil Dykstra was no longer universally required reading in all Computer Science curriclulii. I stand amazed. No *wonder* we continue to have these problems.

4 3