- Test - lists.nanog.org

RE: DomainSiren.com Whois records alert service
by Roeland Meyer (E-mail) 07 May '00

07 May '00

Cute dude. OTOH, this probably has enough operational content to merit posting to NANOG. Now all we need is for some script-kiddee to figure it out <groan>. > Behalf Of domainiac > Sent: Saturday, May 06, 2000 4:08 PM > > I figured out a way to completely hijack a domain in less > than week under > the new shared system. And by hijack I do not mean simply > redirect the DNS, > etc. I mean completely change the whois record to a new > owner. I won't post > specific directions but I am sure others could do the same > trick as it is > not that complicated. I passed the specific directions onto > ICANN but who > knows if they are likely to do anything. The vulnerability > only applies to > NSI domains with MAIL-FROM (or when their CRYPT-PW system screws up). > > I set up an automated system that reads both the registry and > registrar > records, compares it the stored records, and automatically > e-mails contacts > with the changed info. It also can be used to track domains > about to be > released. > > http://DomainSiren.com > > Russ Smith > http://ChangeYourDomain.com

1 0

Re: DACS blamed for MCI / CSX train problems last week
by Joe Abley 06 May '00

06 May '00

[apologies in advanced for the pitiful layout that Outlook Express will no doubt inflict on you after I click send] -----Original Message----- From: Sean Donelan <sean(a)donelan.com> To: nanog(a)merit.edu <nanog(a)merit.edu> Date: Saturday, May 06, 2000 3:04 PM Subject: DACS blamed for MCI / CSX train problems last week >This isn't the first DACS problem nor is MCI the only carrier affected >by DACS problems. Bell Atlantic had a multi-day DACS problems, I've >experienced 18+ hour MCI DACS problems in the past. What is it about >DACS systems which seem to lead to such catastrophic problems? I don't believe there is anything unherently unreliable in a DACS (we call them Digital Cross-Connects, or DCCs, down here). In fact, most DCCs I have seen are extrordinarily redundant and would probably quite happily continue to function at 100% after a good seeing-to with an axe. The problem lies elsewhere. "Modern" telecommunications equipment seems to come equipped with two configuration paradigms: [1] will usually be a vendor-supplied Unix solution, probably running on Sun or HP hardware, which provides a full database back-end and a simple point-and-click interface for end-to-end service management. This is what the engineering planning people see when the system is demonstrated to them, and this obvious money-saving wonder is what will justify the inflated budget required to purchase it. [2] will probably be 9600 bps terminal access to a protracted series of cryptic menus, about sixteen levels deep, through which the only practical way to navigate is to type ahead protracted strings such as "1,4,9,13-17,3,3,1" and then walk away for ten minutes to drink coffee. [1] will usually stop working properly about four weeks after the vendors disappear from site. Various technicians who have either a vague idea of the network technology, or a self-taught-at-home expertise in Linux, will attempt to fix the problem. The IT department will be called in, and will limp through a SunOS 4.1.3 install from QIC tape, and may even get as far as completing a successful reinstallation of the vendor's management system (at which point it will become clear that the back-end is an embedded version of Informix, for which the licence keys are either missing or have mysteriously transformed themselves into one-week demo licences for some completely unrelated product). Hence [1] will quickly cease to be a useful tool for provisioning services. Of course, the business doesn't stop just because one management system is broken; we always have [2]. [2] is extremely vulnerable to radical accidental reprogramming of the network due to caffeine-induced finger-shake, but quickly becomes a preferred tool for programming the network for a certain subset of the network provisioning technicians. Those who discover that they can script routine tasks using shareware terminal packages will also become able to perform radical accidental reprogramming of the network whilst standing on the keyboard, reaching back to tape laser-printed Dilbert cartoons or semi-pornographic calendars to cubicle walls. Any change using [2] will naturally never be reflected in the database of [1]. This fact will be recognised whenever someone manages to get [1] temporarily back on its feet, and will trigger a seemingly endless series of network audit projects, which will never succeed due to the underground popularity of [2] and the fact that anybody competent enough to perform a network audit does their very best to escape from the project at the earliest opportunity, leaving no indication whatsoever of what they have found out so far. The unreliability of any network records means that any troubleshooting is likely to involve far more random guesswork than is healthy, and the probability of a cascade of outages following routine maintenance on a minor issue is much higher than you would expect. On the other hand, it could be simply that marketing departments have observed that customers are happy with the phrase "DACS outage" and therefore use it as a generic term to describe any incident which might otherwise cause a customer to complain :)

1 0

What is wrong with COVAD?
by Dirk Harms-Merbitz 06 May '00

06 May '00

Right now a number of COVAD circuits in LA are down again. This is the 6th time this year that our COVAD customers are down. What is going on? Is anybody else using COVAD? Are you seeing a similar amount of problems? Dirk

2 1

Enough!
by Shawn McMahon 05 May '00

05 May '00

Can we stop sending copies of the worm and various cleaner scripts back and forth here in the list, please? Everyone here has the resources to go get either, and even if we didn't we wouldn't need 50 goddamn copies of it, OK? Besides, who in his right mind would run a VBS that says "Cleaner" that is received via unsolicited email attachment? Stop!

1 0

uuencoded Love Worm variant
by Eric Conrad 05 May '00

05 May '00

I caught one of these uuencoded 'in the wild'. It would have slipped through my filters if not for the standard Subject: line. ---<snip>--- kindly check the attached LOVELETTER coming from me. begin 666 LOVE-LETTER-FOR-YOU.TXT.vbs ---<snip>--- I've since updated my filters to catch uuencodes as well. On a lighter note, a clueless gateway forwarded 6 copies of the worm with the following helpful banner attached: ---<snip>--- kindly check the attached LOVELETTER coming from me. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by the latest virus scan software available for the presence of computer viruses. ********************************************************************** ------_=_NextPart_000_01BFB683.1FF56E54 Content-Type: application/octet-stream; name="LOVE-LETTER-FOR-YOU.TXT.vbs" --<snip>--- ...Eric

4 4

How long before NIPC decides we need one of these?
by Roland Dobbins 05 May '00

05 May '00

http://www.the-times.co.uk/news/pages/sti/2000/04/30/stinwenws01034.html -- ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

8 13

Major .au cw.net fiber cut.
by Roland Dobbins 05 May '00

05 May '00

FYI, there are reports of a major cw.net fiber cut in Australia, with multiple ISPs affected. Side-effects are said to include major degradation of the PSTN, Sydney stock-exchange slowdowns, and cash-machine issues. No precise details or ETR known at this time, nor data concerning North American/trans-Pacific second-order effects, if any. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

2 1

Re: Virus Update
by David Charlap 05 May '00

05 May '00

"Eric A. Hall" wrote: >> >> Many mail programs (including Netscape Communicator) have no VBS >> support in them, so they can not execute virusses like this one. > > Netscape relies on MIME type mappings. If there's a type defined > (which there is if you have Windows Scripting Host installed) then > it's an executable attachment. Right-click, "open in new window." I stand corrected. I just tested it by writing and mailing myself a VBS file. It opened, ran and was able to write my output file (after approving it in the "security warning" dialog.) I assumed that NS would treat VBS like executables. With an EXE attachment, you don't get the choice of launching it - the SaveAs dialog appears immediately. I think I'll inform NS that they've got a bug. They should be treating VBS like EXE and COM files. -- David

1 0

Virus Update
by Branden R. Williams 04 May '00

04 May '00

Ok, this thing is pretty nasty... Here is a quick summary of what it does. Should you run it, you will lose any files of the following extensions. They will be renamed to filename.extension.vbs with a fresh copy of the replication part. File extensions affected: vbs,vbe,js,jse,css,wsh,sct,hta,jpg,jpeg,mp2,mp3. Every file with that extension is overwritten with the virus. It looks to be localized to mounted hard drives. It does not appear to affect mapped network drives. It also makes a dozen or so registry entries including one to reset your start page to the following URL. http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwe… I have not gone to this URL yet to see what it is, but it downloads a copy of a file called WIN-BUGSFIX.exe. In addition, it creates a MIRC script called script.ini to DCC SEND this to whatever channel you are on. Of course it sends it to everyone in your address book with the subject ILOVEYOU. It looks to only affect people who actually run the vbs script. I would assume that if you are not on a Windows platform that you are not affected. I'll let you know more when we find more. Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

9 13

RE: Virus heads-up
by Mark Persiko 04 May '00

04 May '00

Symantec has posted a set of antivirus definitions to a public FTP site, to be used with Norton Antivirus on PC's. Here is the URL: ftp://ftp.symantec.com/public/english_us_canada/antivirus_definitions/norton _antivirus/specdef/ Thanks, Mark - Mark C. Persiko, persiko(a)bvsd.k12.co.us - MIS Dept, Boulder Valley Public Schools > -----Original Message----- > From: Simon Lockhart [mailto:simonl@rd.bbc.co.uk] > Sent: Thursday, May 04, 2000 4:18 AM > To: nanog(a)merit.edu > Subject: Virus heads-up > > > > Heads up on a new virus - ILOVEYOU > > I'm sure you've heard about it already, but you may wish to block > www.skyinet.net (206.101.197.226) at your borders, as that is > where it > fetches part of the actual virus code from: > > 132.185.x.y - - [04/May/2000:10:23:14 +0100] "GET > http://www.skyinet.net/~y > oung1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679n > jbvYT/WIN-BUG > SFIX.exe HTTP/1.0" > > Other than that, it looks like just another Melissa. > > Simon > -- > Simon Lockhart | Tel: +44 (0)1737 839676 > Internet Engineering Manager | Fax: +44 (0)1737 839516 > BBC Internet Services | Email: > Simon.Lockhart(a)bbc.co.uk > Kingswood Warren,Tadworth,Surrey,UK | URL: http://support.bbc.co.uk/

1 0