Is it just me that feels that blocking a port which is known to be used to perform billions of scans is only proper?

the second, and important part of the, question is whether there are legitimate packets to that port which want to cross your border. for 135, i am not aware of any that should cross my site's border un-tunneled. randy

On Tue, 12 Aug 2003, Sean Donelan wrote:

I think filters/firewalls are usefull. I believe every computer should have one. I have several. I just disagree on who should control the filters.

in your opinion who should control them? (just curious)

Sean, All Watching this thread I can't resist a question if ISPs would see any use for automated propagation of information to be filtered/blocked to all of their (and possibly) neighbours border routers ? I am sure you have noticed my & Pedro's recent draft: draft-marques-idr-flow-spec-00.txt Just checking for possible feedback of interested ISPs if any on this one ... The example listed in the draft is targeted to address DDoS, but the concept is equally applicable to virus fights as well. Thx, R.

Sean Donelan wrote:

On Tue, 12 Aug 2003, Randy Bush wrote:

...

...

Is it just me that feels that blocking a port which is known to be used to perform billions of scans is only proper?

the second, and important part of the, question is whether there are legitimate packets to that port which want to cross your border. for 135, i am not aware of any that should cross my site's border un-tunneled.

Who should determine what protocols can cross your site's border router? You or your ISP (ignoring the fact a lot of people on this list are their own ISP)?

80% or more of customers wouldn't notice if you blocked everything on their connection except HTTP/HTTPS and DNS. So why do ISPs let all the other infection laden protocols reach their customers?

Fix spam - block port 25 Fix Slammer - block port 1434 Fix Blaster - block port 135 Fix KaZaA - block everything

I think filters/firewalls are usefull. I believe every computer should have one. I have several. I just disagree on who should control the filters.

That is fine. The amount of information to be carried is easily extensible. So if you can help us to determine the required fields we will be more then glad to add them. R.

Randy Bush wrote:

bellovin et al. have shown that the signaling protocol needs to convey far more characterization than you propose.

randy

Subject: Re: Port blocking last resort in fight against virus Date: Tue, Aug 12, 2003 at 10:42:38PM -0400 Quoting Sean Donelan (sean@donelan.com):

I think filters/firewalls are useful. I believe every computer should have one. I have several. I just disagree on who should control the filters.

Bingo! -- Måns Nilsson Systems Specialist +46 70 681 7204 KTHNOC MN1334-RIPE Inside, I'm already SOBBING!

--On Wednesday, August 13, 2003 11:00:56 +0300 Petri Helenius <pete@he.iki.fi> wrote:

...

...

I think filters/firewalls are useful. I believe every computer should have one.

Firewalls are a patch to broken network application architechture. If your applications would have been properly designed, you would not have the need for firewalls. They are for perimeter defence only anyway.

The important wording here is "every computer should have one"; indicating that it is the host that protects itself. This said, I do agree that properly written operating systems not even need this. One free Unix-clone I happen to run manages to reach this level of properness; so it is definitely possible. -- Måns Nilsson Systems Specialist +46 70 681 7204 KTHNOC MN1334-RIPE We're sysadmins. To us, data is a protocol-overhead.

Spoken like a true advocate! And I have had the same experience since joining OpenBSD back in 2.6 ;-) its only getting better. spamd, pf, altq, and snort all very nice. I have one desktop at home running 3.3 --current too and no complaints even with following bleeding edge. I hope OpenBSD does get more support! my 2¢ ------------------------------------------------------------ (_ ) Jason Houx, CCNA <coldiso@houx.org> \\\'',) ^ Com.net Inc. \/ \( Bright.net Network Operations .\._/_) OpenBSD Unix - live free or DIE! ------------------------------------------------------------ On Wed, 13 Aug 2003, neal rauhauser 402-301-9555 wrote:

Måns Nilsson wrote:

...

...

Firewalls are a patch to broken network application architechture. If your applications would have been properly designed, you would not have the need for firewalls. They are for perimeter defence only anyway.

Right on - if you can't plug a machine directly in to the internet and rely on its own defenses & well written code to keep it safe, why are you plugging it in at all?

...

The important wording here is "every computer should have one"; indicating that it is the host that protects itself. This said, I do agree that properly written operating systems not even need this. One free Unix-clone I happen to run manages to reach this level of properness; so it is definitely possible.

I agree completely with this - several years ago I expunged Microsoft products from my life with the sole exception of one internet free box for playing Civilization II and my blood pressure dropped dramatically. A little while later I expunged Red Hat in favor of FreeBSD and I experienced a decrease in trouble that was nearly as satisfying as the Windows => Red Hat transition.

Now there is a brand new OpenBSD box here. The major release upgrade process is not nearly as nice as FreeBSD, but you have to just love that non executeable stack, ssh privilege separation, and all the other details that are just taken care of by the OBSD crew. Perhaps it'll start making inroads on my FreeBSD installed base.

Subject: Re: Port blocking last resort in fight against virus Date: Wed, Aug 13, 2003 at 09:57:56AM +0100 Quoting Stephen J. Wilcox (steve@telecomplete.co.uk):

Sorry I see where you're coming from on this but firewalls are more than just patches to broken OS's.

In your world DoS traffic would be free to roam the networks as it pleased without being throttled sensibly at ingress?

Providing one makes people responsible for what their boxes (not aggregates of networks) cause, and enforces this, there will be no DoS traffic; given a perfect world. Even in an imperfect world, the solution lies in the edge, not even the CPE, but the end node, if you want to do more than pathetic bandaiding of the inherent problem of insecure applications on end nodes. -- Måns Nilsson Systems Specialist +46 70 681 7204 KTHNOC MN1334-RIPE My face is new, my license is expired, and I'm under a doctor's care!!!!

Subject: Re: Port blocking last resort in fight against virus Date: Wed, Aug 13, 2003 at 10:14:22AM +0100 Quoting Stephen J. Wilcox (steve@telecomplete.co.uk):

What if the people running the boxes are irresponsible, perhaps even harboring malicious intent

surely, you have an AUP? Then, null0 is your friend.

I dont have control of all end nodes but I do control my edge.

So give up trying to control the actions of the end nodes by destroying the edge. Make sure that complaints reach the correct responsible person. Limit your involvement to careful excerpts from your customer/IP-address database, or better yet, register them in the RIR registry so that others having complaints can reach them without wasting your time. -- Måns Nilsson Systems Specialist +46 70 681 7204 KTHNOC MN1334-RIPE Your CHEEKS sit like twin NECTARINES above a MOUTH that knows no BOUNDS --

Christopher L. Morrow wrote:

This is the point, atleast I, have been trying to make for 2 years... end systems, or as close to that as possible, need to police themselves, the granularity and filtering capabilities (content filtering even) are available at that level alone.

I agree with you Chris, but I also believe that temp filters do have a role, even at backbones. One of my peers appears to be helping out my bandwidth and peer cpus with filtering. Helping people temporarily ease massive infection rates is a good thing. My helpdesk has seen 150% increase in call volume handling this worm. If I just kick the infected user's off the Internet, they don't have a chance to patch and fix their system without a) knowing someone who isn't infected that can give them the patch on cd or diskette or b) pay a computer tech. Tomorrow is judgement day for us. EU contact, patch by Friday or have the account suspended. All accounts actively sending Friday will be suspended. Saturday, there will be no DOS packets from my network. Next week is a stage process for allowing user's to get infected that haven't patched, but blocking their spreading ability outbound. They'll fix by specified time or be suspended. No later than Friday of next week, all gateways will be open. Honestly, it would be nice to offer different classes of service, allowing user's that are semi-protected and user's that are free and clear. The issue with doing so is dealing with the liability of offering protection. Although I've debated allowing for a class that supports common blocks in exchange for not immediately suspending accounts (due to the fact they'll just get filtered), while full access accounts will follow our current policies which entail suspension until they are fixed. Ports to filter? (25,135-139,445 to start) Of course, I don't have to mention the fun of doing per account class filtering. Fun, fun. -Jack

In your world DoS traffic would be free to roam the networks as it pleased without being throttled sensibly at ingress?

Throttling is a different from blocking. Sensible traffic management does not break applications nor network transparency. You are free to choose when to forward each packet.

Or the dumb [wannabee] IT guy runs some telnet/ftp/filesharing service without passwords and its ok for the whole world to access the private system coz its his fault?

This means your application security infrastructure already failed if some filesharing application is running on a machine which also has access to data in the internal disk shares. Pete

On Wed, 13 Aug 2003, Stephen J. Wilcox wrote:

Or the dumb [wannabee] IT guy runs some telnet/ftp/filesharing service without passwords and its ok for the whole world to access the private system coz its his fault?

there are other actions to be taken... termination being high on that list. (of employment, atleast initially)

IMHO it's a prudent security measure to disallow access to the Windows ports 135,137-139,445, etc. from the Internet at large. We block these ports at the edge, with exceptions for the very few customers who ask for it (generally customers using Exchange who don't know how to properly deploy it across the Internet). So we block, but we make exceptions. Not that restrictive, and not that hard. -Bob -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mans Nilsson Sent: Tuesday, August 12, 2003 11:51 AM To: nanog@merit.edu Cc: Jack Bates Subject: Re: Port blocking last resort in fight against virus Subject: Re: Port blocking last resort in fight against virus Date: Tue, Aug 12, 2003 at 10:36:12AM -0500 Quoting Jack Bates (jbates@brightok.net):

Is it just me that feels that blocking a port which is known to be used to perform billions of scans is only proper? It takes time to contact,

clean, or suspend an account that is infected. Allowing infected systems to continue to scan only causes problems for other networks. I see no network performance issues, but that doesn't mean other networks won't

have issues.

I have two faces, let's hear what they say: "I am a network operator. I do not see issues with my network unless somebody fills it up beyond capacity. Then I might ask somebody a question as to why they are shoveling so many more packets than usual. If it is a panic, I might null0 someone. I just want to keep my network transparent." "I am a systems administrator. Sometimes, there are security problems with my operating systems of choice. Then, I fix those hosts that are affected, and all is well. The network is not bothering me as long as it is transparent." Your chosen path is a down-turning spiral of kludgey dependencies, where a host is secure only on some nets, and some nets can't cope with the load of all administrative filters (some routers tend to take port-specific filters into slow-path). That way lies madness. -- Måns Nilsson Systems Specialist +46 70 681 7204 KTHNOC MN1334-RIPE Oh my GOD -- the SUN just fell into YANKEE STADIUM!!

There is legitimate traffic on 135. All users I've talked to have been

We started blocking 135-139 and 445 a week ago... we got one complaint, and added an exception for those two ip addresses (one remote/one local). We're just a small regional ISP, but we've seen little real use of these ports by our customers across the 'net. This is a good thing.

Christopher L. Morrow wrote:

If people want to use the network they need to take the responsibility and patch their systems. Blocking should really only be considered in very extreme circumstances when your network is being affected by the problem, or if the overall threat is such that a short term network-wide block would help get over the hump.

Correct, and that's what I consider this; a short term network-wide block that would help get over the hump. While my network is stable, that doesn't mean everyone being scanned is stable. There are undoubtably DOS conditions caused by this worm. -Jack

Christopher L. Morrow wrote:

So, if in YOUR network you want to do this blocking, go right ahead, but I wouldn't expect anyone else to follow suit unless they already determined there was a good reason for themselves to follow suit. As an aside, a day or so of 5 minutely reboots teaches even the slowest user to find a firewall product and upgrade/update their systems, eh?

Yeah. I hate to admit it, but there is a lot gained from this worm. The of the worm will secure a lot of systems from other exploits of the same vulnerability which can be used for much worse. From what I've seen, a lot of networks have sent user's to custom webpages to assist in patching and removal of the worm. I wonder if microsoft minds the redistribution of patches in this senario. ;) My outbound ratio of worm to total packets has decreased to 7%. Helpdesk call volume has increased drastically, but we expect things to be close to normal by end week. As a side note, I think one of my peers issued a 135 block in their core (haven't checked). The inbound scan numbers should be much higher than they are. -Jack

I've been looking at out traffic graphs and trying to decide if traffic really is down 10-15% over the last 24 hours or it's just my imagination.

I would say 5-10% below where it should be taking into account seasonal variations, it´s within the error margin, but barely. Pete