On Tue, 11 Jun 2013, Vlad Grigorescu wrote:

We got hit with this in September. UDP/19 became our most busiest port overnight. Most of the systems participating were printers. We dropped it at the border, and had no complaints or ill effects.

Dropping the TCP and UDP "small services" like echo (not ICMP echo), chargen and discard as part of default firewall / filter policies probably isn't a bad idea. Those services used to be enabled by default on Cisco routers, but that hasn't been since probably around 11.3 (mid-late 90s). Other than providing another DDoS vector, I'm not aware of any legitimate reason to keep these services running and accessible. As always, YMMV. jms

On Tue, 11 Jun 2013 12:06:36 -0400, Brielle Bruns <bruns@2mbit.com> wrote:

Are these like machines time forgot or just really bag configuration choices?

All of the above plus very poorly managed network / network security. (sadly a Given(tm) for anything ending dot-e-d-u.) a) why are *printers* given public IPs? and b) why are internet hosts allowed to talk to them? I actually *very* surprised your printers are still functional if the whole internet can reach them. Being an edu, even if they aren't globally reachable, there is *plenty* mischievousness already inside the borders! Securing a campus from the world... easy; securing a campus from it's own users... good luck with that. --Ricky

On Tue, Jun 11, 2013 at 4:57 PM, Majdi S. Abbas <msa@latt.net> wrote:

I have a hard time blaming a school for this. I have an easy time wondering why printer manufacturers are including chargen support in firmware.

Isn't that what printer do? Generate characters? It was in the design spec. /me thinks of PHB going down port list, "yep, need that one!" -- Joe Hamelin, W7COM, Tulalip, WA, 360-474-7474

On Tue, 11 Jun 2013 21:37:04 -0400, "Ricky Beam" said:

Indeed I have. Which is why I haven't for a great many years. Academics tend to be, well, academic. That is, rather far out of touch with the realities of running / securing a network.

Do you have any actual evidence that a .edu of (say) 2K employees is statistically *measurably* less secure than a .com of 2K employees? We keep hearing that meme - and yet, looking at the archives of this list, I see a lot more stories of network providers who should know better doing stupid stuff than I see of .edu's doing stupid stuff. The Verizon report says small business is actually the biggest cesspit of abuse: http://money.cnn.com/2013/04/22/smallbusiness/small-business-cybercrime/inde... http://www.verizonenterprise.com/DBIR/2013/ ~100 employee firms in health care appear to be a particular lost cause.

This is basically untrue. I can deal with a good rant as long as there's some value in it. As it is (I'm sorta sorry) I picked this apart. On Jun 12, 2013 12:04 AM, "Ricky Beam" <jfbeam@gmail.com> wrote:

On Tue, 11 Jun 2013 22:55:12 -0400, <Valdis.Kletnieks@vt.edu> wrote:

...

But seriously, how do you measure one's security?

Banks and insurance companies supposedly have some interesting actuarial data on this.

The scope is constantly changing.

Not really. The old tricks are the best tricks. And when a default install of Windows still allows you to request old NTLM authentication and most people don't think twice about this, there's a problem.

While there are companies one can pay to do this, those reports are *very* rarely published.

It seems you are referring to two things - exploit writing vs pen testing. While I hate saying this, there are automated tools that could clean up most networks for a few K (they can also take down things if you aren't careful so I'm not saying spend 2k and forget about it). Basically, not everyone needs to pay for a professional test out of the gate - fix the easily found stuff and then consider next steps. As for exploit writing, you can pay for this and have an 0day for between $10 and $50k (AFAIK - not what I do with my time / money) but while you've got stuff with known issues on the net that any scanner can find, thinking someone is going to think about using an 0day to break into your stuff is a comical wet dream.

And I've not heard of a single edu performing such an audit.

And you won't. I'm not going to tell you about past problems with my stuff because even after I think I've fixed everything, maybe I missed something that you can now easily find with the information I've disclosed. There are information sharing agreements between entities generally in the same industry (maybe even some group like this for edu?). But this will help with source and signatures, if your network is like a sieve, fix that first :)

The only statistics we have to run with are of *known* breaches.

As I indicated above, 0days are expensive and no one is going to waste one on you. Put another way, if someone does, go home proud - you're in with the big boys (military, power plants, spy agencies) someone paid top dollar for your stuff because you had everything else closed.

And that's a very bad metric as a company with no security at all that's had no (reported) intrusions appears to have very good security, while a company with extensive security looks very bad after a few breaches.

I'll take that metric any day :) Most companies only release a break in if they leak customer data. The only recent example I can think of where this wasn't true was the Canadian company that develops SCATA software disclosing that China stole their stuff. Second, if you look at the stocks of public companies that were hacked a year later, they're always up. The exception to this is HBGary who pissed of anonymous and are no longer in business (they had shady practices that were disclosed by the hack - don't do this).

One has noone sniffing around at all, while the other has teams going at it with pick-axes.

If you have no one sniffing around, you've got issues.

One likely has noone in charge of security, while the other has an entire security department.

Whether you have a CSO in name or not might not matter. Depending on the size of the organization (and politics), a CTO that understands security can do just as much.

On Wed, Jun 12, 2013 at 4:51 AM, Jimmy Hess <mysidia@gmail.com> wrote:

On 6/12/13, shawn wilson <ag4ve.us@gmail.com> wrote:

...

...

The scope is constantly changing. Not really. The old tricks are the best tricks. And when a default install By best, you must mean effective against the greatest number of targets.

By best, I mean effective - end of story.

...

of Windows still allows you to request old NTLM authentication and most people don't think twice about this, there's a problem.

Backwards compatibility and protocol downgrade-ability is a PITA.

Yes, telling people that NT/2k can't be on your network might be a PITA, but not using software or hardware that has gone EOL is sometimes just a sensible business practice.

...

It seems you are referring to two things - exploit writing vs pen testing. While I hate saying this, there are automated tools that could clean up most networks for a few K (they can also take down things if you aren't careful so I'm not saying spend 2k and forget about it). Basically, not

For the orgs that the 2K tool is likely to be most useful for, $2k is a lot of cash. The scan tools that are really worth the trouble start around 5K, and people don't like making much investment in security products, until they know they have a known breach on their hands. Many are likely to forego both, purchase the cheapest firewall appliance they can find, that claims to have antivirus functionality, maybe some stateful TCP filtering, and Web policy enforcement to restrict surfing activity; and feel safe, "the firewall protects us", no other security planning or products or services req'd.

I don't really care to price stuff so I might be a little off here (most of this stuff has free components). Nessus starts at around $1k, Armitage is about the same (but no auto-pown, darn), Metasploit Pro is a few grand. My point being, you can have a decent scanner (Nessus) catching the really bad stuff for not much money (I dislike this line of thought, but if you aren't knowledgeable to use tools and just want a report for a grand, there you go).

...

As I indicated above, 0days are expensive and no one is going to waste one on you. Put another way, if someone does, go home proud - you're in with [snip]

I would call this wishful thinking; 0days are expensive, so the people who want to use them, will want to get the most value they can get out of the 0day, before the bug gets fixed.

Odays are expensive, so when you see them, someone (Google, Firefox, Adobe, etc) have generally paid for them. Once you see them, they are not odays (dispite what people like to call recently disclosed public vulns - it ain't an 0day).

That means both small numbers of high value targets, and, then... large numbers of lesser value targets. If you have a computer connected to the internet, some bandwidth, and a web browser or e-mail address, you are a probable target.

No, this means Stuxnet, Doqu, Flame. This means, I spent a million on people pounding on stuff for a year, I'm going to take out a nuclear facility or go after Google or RSA. I want things more valuable than your student's social security numbers.

If a 0day is used against you, it's most likely to be used against your web browser visiting a "trusted" site you normally visit.

I don't have anything to back this up off hand, but my gut tells me that most drive by web site malware isn't that well thought out.

The baddies can help protect their investment in 0day exploit code, by making sure that by the time you detect it, the exploit code is long gone, so the infection vector will be unknown.

If the US government can't prevent companies from analyzing their work, do you really think random "baddies" can? Seriously?... No really, seriously? Here's the point, once you use an Oday, it is not an 0day. It's burnt. It might still work on some people, but chances are all your high value targets know about it and it won't work on them.

On Wed, Jun 12, 2013 at 7:14 AM, Aaron Glenn <aaron.glenn@gmail.com> wrote:

On Wed, Jun 12, 2013 at 11:17 AM, shawn wilson <ag4ve.us@gmail.com> wrote:

...

Banks and insurance companies supposedly have some interesting actuarial data on this.

Do you know of any publicly available sources?

I don't. There's a US entity that represents credit card companies that has their own type of "Verizon Data Breach Investigations Report" where you might find some iinfo of this type. You might also look at how/if AlienVault and others rank threats which should give you the "how hard is this hack" and "how hard is this to fix" figure. The theory behind generating this type of actuarial data should be more available than it is. I have a feeling that companies who have this information look at entities in the same type of business and make educated guesses on how breaches affected their bottom line based on stock vaule and the like. There is probably some private data sharing here as well.

On 6/11/13, Majdi S. Abbas <msa@latt.net> wrote:

On Tue, Jun 11, 2013 at 07:52:02PM -0400, Ricky Beam wrote:

...

All of the above plus very poorly managed network / network security. (sadly a Given(tm) for anything ending dot-e-d-u.) a) why are *printers* given public IPs? and b) why are internet hosts allowed to talk to them? I actually *very* surprised your printers are still functional if the whole internet can reach them.

Who really has a solid motive to make them stop working (other than a printer manufacturer who wants to sell them more) ?

Guess what, they have /16s, they use them, and they like the ability to print from one side of campus to the other. Are you suggesting gigantic NATs with 120,000 students and faculty behind them?

A per-building NAT would work, with static translations for printers in that building, and an ACL with an allow list including IPsec traffic to the printer from the campus' IP range. They don't have to use NAT though to avoid unnecessary exposure of services on internal equipment to the larger world.

I have a hard time blaming a school for this. I have an easy time wondering why printer manufacturers are including chargen support in firmware.

They probably built their printer on top of a general purpose or embedded OS they purchased from someone else, or reused, that included an IP stack -- as well as other features that were unnecessary for their use case. Or the chargen tool may have been used during stress tests to verify proper networking, and that the IP stack processed bits without corrupting them; with the manufacturer forgetting/neglecting to turn off the unnecessary feature, forgetting to remove/disable that bit of software, or seeing no need to, before mass producing.

--msa -- -JH

Getting back to the topic. I just saw quite a few of our hosts scanned for this by 192.111.155.106 which doesn't say much on its own as http://dacentec.com/ is a hosting company. On Tue, Jun 11, 2013 at 11:27 PM, Ricky Beam <jfbeam@gmail.com> wrote:

On Tue, 11 Jun 2013 22:52:52 -0400, Jimmy Hess <mysidia@gmail.com> wrote:

...

Who really has a solid motive to make them stop working (other than a printer manufacturer who wants to sell them more) ?

Duh, so people cannot print to them. (amungst various other creative pranks)

From a cybercriminal pov, to swipe the things you're printing... like that CC authorization form you just printed, or a confidential contract, etc. (also, in many offices, the printer is also the scanner and fax)

--Ricky

I can just see someone spoofing a packet from victimA port 7/UDP to victimB port 19/UDP. --Dave -----Original Message----- From: Leo Bicknell [mailto:bicknell@ufp.org] Sent: Tuesday, June 11, 2013 3:13 PM To: Bernhard Schmidt Cc: nanog@nanog.org Subject: Re: chargen is the new DDoS tool? On Jun 11, 2013, at 10:39 AM, Bernhard Schmidt <berni@birkenwald.de> wrote:

This seems to be something new. There aren't a lot of systems in our network responding to chargen, but those that do have a 15x amplification factor and generate more traffic than we have seen with abused open resolvers.

The number is non-zero? In 2013? While blocking it at your border is probably a fine way of mitigating the problem, I would recommend doing an internal nmap scan for such things, finding the systems that respond, and talking with their owners. Please report back to NANOG after talking to them letting us know if the owners were still using SunOS 4.x boxes for some reason, had accidentally enabled chargen, or if some malware had set up the servers. Inquiring minds would like to know! -- Leo Bicknell - bicknell@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/

On Jun 12, 2013, at 2:13 AM, Leo Bicknell wrote:

The number is non-zero? In 2013?

These are largely modern printers and other 'embedded' devices which are running OS configurations apparently cribbed out of 20-year-old gopher docs. ;> ----------------------------------------------------------------------- Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton