- Test - lists.nanog.org

Re: What TO DO and what NOT TO DO [Re: DOS Attacks - Almost Caught One!]
by Quark Physics 24 Oct '00

24 Oct '00

> Btw - I am thinking it will end in some kind of _anty hacker_ ISP assotiation which wove to prosecute any attempt to hack every > if it is harmless itself. Just again, it's the only way. Do you remember why in ansient culture any attempt to forbid the rules > was prosecuted - not because it was very important, but to stop another ones from going this way. > > Technically, it's not big deal to found the hacker - but it's a big work. The hard part is not the technology, it's the customer(s) They want their box back operational ASAP, yet complain when you tell them the must use SSH (putty.exe rocks!) and such. I have gotten less than no help when I find the persons box they hacked to get to the box I found. The key to an anti-hacker ISP association would be a very special ip address / contact person lookup database. ie: who/how to contact for the 'SWAT' response for a particular IP address. --Mike--

6 10

Re: whois breakage
by Joshua Goodall 24 Oct '00

24 Oct '00

I would contend that it *is* broken, because it doesn't DWIM (I can see people pouting already), and that there should be an implied $ on the end of any search-string, since dns become more specific to the left. I don't see an argument in favour of free-form searches in this database. Spoof entries like these, however, are an argument against them. J On Tue, 24 Oct 2000, Timothy Hunt wrote: > That's not broken. One is a host record for a terrorists.net host. > And it's NOT "enough said". > > The response also says: > To single out one record, look it up with "xxx", where xxx is one of the > of the records displayed above. If the records are the same, look them up > with "=xxx" to receive a full display for each record. > > So, if you do whois -h whois.internic.net =microsoft.com > you get the respose you expected. > > regards, > > Timothy Hunt > XO Communications > > > > > > $ whois -h whois.internic.net microsoft.com > > > > Whois Server Version 1.3 > > > > Domain names in the .com, .net, and .org domains can now be registered > > with many different competing registrars. Go to http://www.internic.net > > for detailed information. > > > > MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET > > MICROSOFT.COM > > > > > > Enough said. Similar for apple.com. The web-based whois client at > > nsiregistry.com is giving correct results, as are the gtld-servers, as > > does -h networksolutions.com > > > > FreeBSD and at least one release of Linux I've tested query > > whois.internic.net by default. If anyone is using automated whois in > > production (very likely), check your results! > > > > J > > > > > > > >

1 0

Re: whois breakage
by Omachonu Ogali 24 Oct '00

24 Oct '00

Not necessarily breakage, but I would assume it's a problem (or feature) in someone's regular expression matching patterns, since it looks for any entry that contains the specified string if it doesn't end in '.anything', in other words, "it's the result of a 'loose grep'". And if you're using anything automated based off of results from whois.internic.net, then you should be checking for multiple entries, i.e. domains that use their domain name as a nameserver resulting in 2 entries, (example: netsys.com) if you're heavily affected by this, then it's time to take a closer look at your code. Joshua Goodall wrote: > $ whois -h whois.internic.net microsoft.com > > Whois Server Version 1.3 > > Domain names in the .com, .net, and .org domains can now be registered > with many different competing registrars. Go to http://www.internic.net > for detailed information. > > MICROSOFT.COM.IS.SECRETLY.RUN.BY.ILLUMINATI.TERRORISTS.NET > MICROSOFT.COM > > Enough said. Similar for apple.com. The web-based whois client at > nsiregistry.com is giving correct results, as are the gtld-servers, as > does -h networksolutions.com > > FreeBSD and at least one release of Linux I've tested query > whois.internic.net by default. If anyone is using automated whois in > production (very likely), check your results! > > J -- Virtual Development Incorporated http://www.vdi.net Omachonu Ogali missnglnk(a)vdi.net Network Engineer (973) 815-2799

1 0

Incident response (was Re: whois ) (fwd)
by multics＠ruserved.com 24 Oct '00

24 Oct '00

If I'm researching an intrusion incident the things that are important to me are: 1) The organization I'm contacting can at least confirm that they have records that are useful in tracking down the hacker. 2) There is someone there who can look at their records since if I'm tracking down a hacker, it has often been a case that the source I've tracked things to has also been hacked. 3) The organization contacted takes the incident serious and will at least make sure they preserve any evidence/logs/records/etc that may be of use in further tracking of the culprit. 4) I can get enough information, even if its a yes or no, to determine if its worth filing a police report. Forwarded message: > On Tue, 24 Oct 2000 Valdis.Kletnieks(a)vt.edu wrote: > > :Umm... would you be satisfied with a "We've referred it to the appropriate > :people" response? > : > :At least here, and probably many other universities, we're stuck not being > :able to say much more than that due to student confidentiality rules... > :Yes, we take action. No, we usually can't say what we did. > > A general incident response capability would be usefull, but unfortunately > this requires more cooperation than most companies are willing to give. > > Would it be worthwhile to include security incident handling policies > and procedures in peering agreements? i.e a peering agreement also > includes a testable disaster recovery plan, and a security incident > response plan. > > It is fairly obvious by now that a peering agreement is more than simply > an agreement on a router configuration. > > I'm wondering if anyone would consider something like this a little more > robust than the centralized CIRTs and industry associations, as it would > be relative to local policy, and the participants have a direct existing > relationship with each other. This, as opposed to dependance on a neutral > co-ordinating centre which may be dealing with other problems. > > > -- > batz > Reluctant Ninja > Defective Technologies > > > -- Richard Shetron multics(a)ruserved.com multics(a)acm.rpi.edu NO UCE What is the Meaning of Life? There is no meaning, It's just a consequence of complex carbon based chemistry; don't worry about it The Super 76, "Free Aspirin and Tender Sympathy", Las Vegas Strip.

1 0

Goobers with Firewalls
by Jay Stewart 24 Oct '00

24 Oct '00

This was received by our support staff late last night. Apparently the guy thought 192.168.1.2 was "hacking him", 'nuff said. Jay Stewart Internet Network Engineer Olympia Networking Services - "The Northwest's Premier ISP" A wholly owned subsidiary of Advanced TelCom Group, Inc. ----- Original Message ----- From: "Identity Concealed to Protect the Clueless" To: <webmaster(a)olywa.net> Sent: Monday, October 23, 2000 9:39 PM Subject: Server USC in California hacking ports Whoops I forgot to add the security log in previous mail. I know that you share a DNS server 216.173.192.10) with Vircom.net. The website at USC is hacking the DNS servers and it is now hacking you server. I contacted the Web master at USC and states this is normal activity for his server and suggests I have something misconfigured on my network. I am using the assigned static IP's given to me by Vircom.net. I am running a NAT router and Firewall for security alerts. This hacking only started to happen in the past week. It only happens when running W2K and active directory. It does not happen with the same computer, router and firewall when Win98 or NT4 is run. Are you concerned about this hacking from USC upon your DNS server ? [concealed identity] Starting Sybergen Secure Desktop service... '10/23/2000 17:41:59' 'Initiate Service...' {347EA98F-5AB5-4E57-982C-B4A50CC35891} window value :0 {A15BD57F-A76E-413E-963C-06DC24111DD8} window value :0 Opening Local Area Connection:{A15BD57F-A76E-413E-963C-06DC24111DD8}...192.168.1.2 WS: WS 2.3.3113 opened, id = 1 '10/23/2000 17:43:50' 'Switch to network interface 'Local Area Connection'' '10/23/2000 17:43:50' 'Configuration has been changed' '10/23/2000 17:43:51' 'High security is active' '10/23/2000 17:43:53' 'Access pop3.vircom.net' '10/23/2000 17:45:06' 'Access windowsupdate.microsoft.com' '10/23/2000 17:45:48' 'Access 26.64.9.128.in-addr.arpa' '10/23/2000 17:45:49' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '216.173.200.126' '' 'Inbound' Successful to send email '10/23/2000 17:45:58' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '216.173.220.130' '' 'Inbound' Successful to send email '10/23/2000 17:46:07' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '216.173.201.241' '' 'Inbound' Successful to send email '10/23/2000 17:46:16' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' Successful to send email '10/23/2000 17:46:20' 'Access 200.173.216.in-addr.arpa' '10/23/2000 17:46:20' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1444' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:46:22' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' Successful to send email '10/23/2000 17:46:23' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1444' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:46:28' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '157.130.177.41' '' 'Inbound' Successful to send email '10/23/2000 17:46:29' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1444' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:46:31' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '157.130.177.41' '' 'Inbound' Successful to send email '10/23/2000 17:46:34' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '146.188.200.242' '' 'Inbound' Successful to send email '10/23/2000 17:46:41' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1470' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:47:02' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '1497' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:47:24' 'Access blackhole.isi.edu' '10/23/2000 17:47:39' 'Access 168.192.in-addr.arpa' '10/23/2000 17:52:54' 'ICMP Message Detected' 'Error' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' Successful to send email '10/23/2000 17:53:19' 'ICMP Message Detected' '' '192.168.1.2' '' '128.9.64.26' '' 'Inbound' '10/23/2000 17:54:34' 'Access 29.43.12.207.in-addr.arpa' '10/23/2000 17:54:34' 'ICMP Message Detected' '' '192.168.1.2' '' '207.12.43.29' '' 'Inbound' '10/23/2000 17:57:23' 'Access 200.173.216.in-addr.arpa' '10/23/2000 17:57:23' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '2300' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:57:44' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '2327' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:58:05' 'Initiate non-expected TCP connection' 'Error' '192.168.1.2' '2354' 'pop3.vircom.net' '53' 'Outbound' Successful to send email '10/23/2000 17:58:27' 'Access blackhole.isi.edu' '10/23/2000 17:58:42' 'Access 168.192.in-addr.arpa'

1 0

FCC Rules (fwd)
by Alex 24 Oct '00

24 Oct '00

(relatively non-operational) Interesting ruling that hit my e-mail.. ---------- Forwarded message ---------- Yesterday, the FCC implemented measures to ensure that building owners do not unreasonably deny competing telecommunications service providers access to customers in residential and commercial buildings or other multiple tenant environments ("MTEs"). In a News Release, the FCC indicated it was taking the following actions: 1. The FCC forbade telecommunications carriers from entering into exclusive contracts, preferred provider agreements and similar arrangements that effectively prohibit property owners from permitting other providers to access their property. This does not appear to impact agreements previously executed. 2. The FCC established procedures to facilitate moving the demarcation point to the minimum point of entry ("MPOE") just inside the building at the building owner's request in order to reduce the competitive carriers' dependence on the incumbent local exchange carrier ("ILEC"), the local Baby Bell company, to gain access to wiring inside the building. Under current law, the demarcation point may be located at either the MPOE just inside the building or further inside the building. 3. The FCC determined that the Telecom Act of 1996 required that ILECs must afford telecommunications carriers and cable service providers reasonable and nondiscriminatory access to conduits and rights-of-way located in MTEs, to the extent such conduits and rights-of-way are owned or controlled by the ILEC. 4. The FCC prohibited restrictions that impair the installation, maintenance or use of certain video antennas on property within the exclusive use or control of the antenna user. In addition, the FCC requested, among other things, further comment on whether (1) today's prohibition on exclusive contracts in commercial buildings should be extended to residential buildings, and (2) it should proscribe carriers from entering into contracts that grant them preferences other than exclusive access, such as exclusive marketing to tenants or the payment of landlord bonuses. Although the FCC recognized that the real estate industry has taken "positive steps" to facilitate tenant choice of telecommunications providers by working toward the development of best practices and model agreements, it noted that the adopted measures may well be "insufficient" in themselves to secure a full measures of choice for customers located in MTEs. Accordingly, it stated that it will "closely monitor" industry actions to resolve access concerns. If such actions are not productive, the FCC is prepared to take further action, including rules that mandate access to MTEs. It appears that the only immediate impact of these measures on real estate owners is the prohibition on execution of exclusive and similar contracts; however, the complete text of the FCC's report and order has not yet been published. We will provide a more detailed report on this matter at that time.

1 0

Re: DOS Attacks and reliable network contact data.
by David Lesher 24 Oct '00

24 Oct '00

{...........} > Then, perform a specific query for that nic-handle 'YO020JP', ie: > $ whois -h whois.nic.ad.jp YO020JP/e > > a. [JPNIC Handle] YO020JP > c. [Last, First] Oishi, Yuichi > d. [E-Mail] oishi(a)allnet.ad.jp > g. [Organization] TITUS COMMUNICATIONS CORPORATION > > (etc). > > The RIPE-style databases (RIPE, APNIC etc) provide you with the referenced > nic-handles (if available) as part of the output, as seperate database > objects. It Sure Would be Nice iffen someone would script up this, and add it to Sam Spade..... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

decreased caching efficiency?
by Christian Kuhtz 24 Oct '00

24 Oct '00

Hey gang, Has anyone else around here noticed a decrease in caching efficiency over say, the past year or so? Seems we've seen a radical drop (order of magnitude). Seems popular sites are using more and more entirely dynamic, rapidly changing content.. If there's indeed a reduction in efficiency, caches simply introduce more transactional latency and provide no benefit to offset cost. What do people consider reasons to be to keep caching in the network? Have caching infrastructures materialized as starting points for content distribution, or have you guys ultimately rebuilt your infrastructure to serve that specific purpose? Faced with high hw cost, licensing fees, and reduced efficiencies, it appears business cases to keep the caches in the network (with all the effort and uglyness it takes to maintain exclude lists) seems difficult to make. Cheers, Chris PS: if you feel there's a place better suited to discussing this, shoot me a pointer. thx. -- Christian Kuhtz Architecture, BellSouth.net <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm Atlanta, GA "Speaking for myself only."

16 40

PCMCIA Floppy required at NANOG20
by Simon Lockhart 24 Oct '00

24 Oct '00

Due to user error, I seem to have rendered my Libretto laptoipp unbootable. Does anyone have a pcmcia floppy drive (preferably toshiba) and a windows/ linux bootable floppy? If not, dpooes someone have a bootable CD I can use for a few minutes? Many tahhanks, Simon

1 0

DOS Attacks and reliable network contact data.
by Jason Slagle 24 Oct '00

24 Oct '00

I've seen an increase in DOS attacks over the past week or so, of a form I really haven't encountered before. Below are some logs. 22:30:52.821705 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack 1062615418 win 0 22:30:52.821956 202.172.120.255.80 > 205.133.127.30.6667: R 0:0(0) ack 3046052966 win 0 22:30:52.822208 168.17.227.0.80 > 205.133.127.30.6667: S 21259901:21259901(0) ack 1412091198 win 2144 <mss 536> 22:30:52.822459 255.255.255.255.80 > 205.133.127.30.6667: R 0:0(0) ack 2473479669 win 0 22:30:52.822711 210.251.128.255.80 > 205.133.127.30.6667: R 0:0(0) ack 529389642 win 0 22:30:52.822962 195.53.123.0.80 > 205.133.127.30.6667: . ack 1625272127 win 9112 (DF) 22:30:52.823213 152.158.37.127.80 > 205.133.127.30.6667: R 0:0(0) ack 1362286194 win 0 Lots and lots of TCP ACK's from broadcast addresses. Looks like a new kind of indirect SYN/ACK flood based on broadcast addresses. Which led me to sort through my logs and do my best to get the amps shut down, which led me to my current problem/gripe. Their exists no reliable way to get the contact of a network without first querying arin, then apnic, then the .jp registry for instance. This is a royal PITA and is in no way scriptable that I can see. Am I wrong? Does such a thing exist? What can we do bout these attacks. Jason --- Jason Slagle - CCNA - CCDA Network Administrator - Toledo Internet Access - Toledo Ohio - raistlin(a)tacorp.net - jslagle(a)toledolink.com - WHOIS JS10172 -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GE d-- s:+ a-- C++ UL+++ P--- L+++ E- W- N+ o-- K- w--- O M- V PS+ PE+++ Y+ PGP t+ 5 X+ R tv+ b+ DI+ D G e+ h! r++ y+ ------END GEEK CODE BLOCK------

10 11