- NZNOG - lists.nznog.org

Re: More on DDOS Attacks
by Donald Neal 22 Feb '00

22 Feb '00

2 1

[bb@nsimail.com: Regarding Webmail]
by Joe Abley 22 Feb '00

22 Feb '00

In case anybody is still in any doubt as to the sensitivity of these webmail.net.nz people to the issue of spam, see attached message. Apparently it is ok for webmail.net.nz to send commercial, unsolicited mail because it is "useful information", as opposed to other unsolicited, commercial e-mail which is apparently not. Ho hum. File under "moron spam haven" and take appropriate precautions. Joe ----- Forwarded message from bb(a)nsimail.com ----- From: bb(a)nsimail.com Date: 21 Feb 2000 20:50:40 -0800 X-Sent: 22 Feb 2000 04:50:40 GMT To: jabley(a)patho.gen.nz X-Mailer: Web Mail 3.5.1.4 Subject: Regarding Webmail Hi Joe, We have had great feedback and alot of people have joined our service from the general public. We have been offering this state of the art free service to anyone who wishes to use it, and have been astounded by some harsh responses from people who themselves work in the industry. We have offered leading edge technology in NEW ZEALAND for new zealanders and cannot understand some of the hostile responses we have had, almost all from IT proffesionals, when we have had such a great response from the general public. Because of the pressure put on us by a few in the industry we will not be emailing anybody else but feel that the issue of spamming is such a grey area that useful information is being put in the same circle as email suggesting you buy a ticket to africa at your local travel branch in Vancouver. I am sorry if i have caused undue stress by emailing you, but it was only our intention to inform nz'ers of this superior technology that is free for them to operate as they please. Kindest Regards Billy. ------------------------------------------------- Get personalized e-mail and a web address or your own free e-mail at http://www.networksolutions.com. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

None
by None 22 Feb '00

22 Feb '00

13]) by johnwayne.waikato.ac.nz (8.9.1a/8.9.1/Debian/GNU) with ESMTP id = TAA14625 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:33 +1300 Received: from localhost (dave2(a)localhost) by wakko.burlap.net.nz (8.9.3/8.9.3/Debian/GNU) with ESMTP id TAA08222 for <nznog(a)list.waikato.ac.nz>; Tue, 22 Feb 2000 19:43:31 +1300 X-Authentication-Warning: wakko.burlap.net.nz: dave2 owned process doing = -bs Date: Tue, 22 Feb 2000 19:43:30 +1300 (NZDT) From: David Zanetti <dave2(a)earthling.net> X-Sender: dave2(a)wakko.burlap.net.nz To: nznog(a)list.waikato.ac.nz Subject: Re: More on DDOS attacks In-Reply-To: <20000222133907.A5270(a)styx.clear.net.nz> Message-ID: <Pine.LNX.4.10.10002221936550.8170-100000(a)wakko.burlap.net.nz> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=3DUS-ASCII On Tue, 22 Feb 2000, Chris Wedgwood wrote: > > I've been meaning to have another try with a newer version of 12 > > (especially as 12 has gone GD) so your experience is only going to > > encourage me, can I ask what version of IOS and on what platform you = lab > > setup was using?=20 [clip]=20 > That's not to say it is very stable, the last I tried 12.0.7(S) > was pretty horrible. I have '9 down but not tested yet. Speaking of the stablity of different IOS versions, we have a 3640 with 12.0(4)T on it that needs rebooting after about 7 weeks of uptime. Starts spamming the console port with memory allocation failures, although still manages to route stuff. It's not a particullarly odd setup, just routing between a couple of FE ports, but we are using dynamic packet filtering on it, ala "permit ... reflect outbound".=20 Ring any bells for anyone? Couldn't see anything that jumped out at me in the later release notes, and wasn't keen on an upgrade just to "try it out"..=20 --=20 David Zanetti <dave2(a)earthling.net> | (__) Mr Moo says: Moderator, nz.politics.announce | ( oo #include <geek/unix.h> | /L_=3D ... ( Eat more porridge ) =20 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Media announcement on free webmail. -Reply
by Geoff Thompson 21 Feb '00

21 Feb '00

Keith Davidson wrote: > > > They've presumably been trawling the list archive web pages. I've changed > the list config only to accept postings from subscribers. (Two years without > having had to do that surprises me.) I'll wait and see whether that creates > any problems. > > > > Donald Neal > > Donald, > > Certainly not a trawl of the list archive. I only subscribed to this list > this morning. > > My first message - spam! :-( > > Keith Davidson Guys (and Gals), To add my two penith worth... Both myself and Andrew Donkin here at Waikato have been hit. I was contemplating the fact that they may have just crawled over 'waikato.ac.nz', but then there have been a quite a few people down my corridor that haven't been hit. I'm not sure what source (or part of source) that they've used, but it looks like I'm tending towards it being only the list server, rather than our whole site. Our headers were : From: reply(a)webmail.net.nz Received: from shiraz.x.co.nz (210-55-40-205.adsl.xtra.co.nz [210.55.40.205]) by mailserv.waikato.ac.nz (8.9.3/8.9.0) with ESMTP id NAA13378 for <geofft(a)waikato.ac.nz>; Tue, 22 Feb 2000 13:08:27 +1300 Received: from www.webmail.net.nz ([192.168.0.106]) by shiraz.x.co.nz (8.9.3/8.9.3) with SMTP id MAA27843 for <geofft(a)waikato.ac.nz>; Tue, 22 Feb 2000 12:27:41 +1300 if that helps track down the culprit. The domain 'webmail.co.nz' is owned by 'Andrew Prast <andrew(a)prast.net>', and seems to be registered via ICONZ (using their nameservers). As for 'x.co.nz', we are also talking ownership by Andrew Prast, but this time with the email address of 'andrew(a)nz.com'. This domain seems to be registered via WebNZ Ltd. And yet there's an Xtra ADSL dialup connection in the mix. Does this gel with the messages that you received? Geoff. ---------------------------------- Geoff Thompson <geofft(a)waikato.ac.nz> University of Waikato, Hamilton, New Zealand Ph: (07) 838 4748 Random Quote of the Minute : And now for something completely the same. ---------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Media announcement on free webmail. -Reply
by Donald Neal 21 Feb '00

21 Feb '00

>>> "Chris Wedgwood" <chris.wedgwood(a)clear.co.nz> 22/February/2000 01:49pm >>> > These guys win today's prize for the least clue displayed in a public > forum. I have tried to think of a more moronic way for them to advertise > their product, and I have failed. They've presumably been trawling the list archive web pages. I've changed the list config only to accept postings from subscribers. (Two years without having had to do that surprises me.) I'll wait and see whether that creates any problems. Donald Neal List Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

More on DDOS attacks
by Arron Scott 21 Feb '00

21 Feb '00

>From Cisco, for any one who hasn't seen it already. Title: Distributed Denial of Service (DDoS) News Flash URL: http://www.cisco.com/warp/public/707/newsflash.html Posted: February 9, 2000 Summary: This Security Advisory talks about Distributed Denial of Service (DDoS). More specificvally, it will help you: 1) Recognize programs used to facilitate DDoS attacks 2) Apply measures to prevent the attacks 3) Gather forensic information if you suspect an attack 4) Learn more about host security I have recently had the opportunity to try the "ip verify unicast reverse-path" command in a lab environment, it works with CEF on Cisco IOS 12.0. It seems relatively effective with about a 30% increase in distributed CPU utilisation (ie. 10% becomes 13%, not 40%). We had every packet flooding an interface with bogus source addresses, it happily discarded them all. And yes, it even forwarded the packets with valid source addresses ;-) It seems best suited to run at the edge of the network in from your downstream customers. There is no point running it on links in from upstream providers in most cases. We also lab tested Turbo Access-Lists, and found them very effective on long access-lists, the worst case the CPU increased loading on a VIP by about 40%, as opposed to a 200 entry non-Turbo Access-list which increased distributed CPU utilisation by as much as 95%. Arron Scott Telecom NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 6

Media announcement on free webmail.
by reply＠webmail.net.nz 21 Feb '00

21 Feb '00

Show Off New Zealand announces the launch of its free web-based Email service Webmail.net.nz in conjunction with American Email giant Commtouch. Webmail.net.nz introduces leading edge Email technology that is user friendly, feature rich and fun to use. Moreover, Webmail allows you to access all of your Email, (including old fashioned pop Email), from any web browser in the world. Web-based Email with its easy graphics interface is rapidly overtaking FAX for instant business communication. Find out why for yourself. We cordially invite you to secure your business name, private name, or alias , while there is still good name availability. To check out the service click here http://www.webmail.net.nz Best wishes Billy Brown --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Large Scale Internet Attacks - Technical article.
by Roger De Salis 20 Feb '00

20 Feb '00

Gentlefolk (are there any women on this list????) I thought this sufficiently interesting to post to the NOG, so that it may help anyone who is considering how to avoid these attacks in the future. I have removed all the sales guff (I hope). I hope this is of use. ==================================================================== At one account they were all Cisco. They were blown up by a massive amount of spoofed SYN flood attacks. The PIX did stop the SYN floods it did see, however most of traffic never reached the PIX because the egress router had a of overflow of traffic. I have personal experience with the account. We had recommended they put anti-spoofing filters and CAR filtering for ICMP on the egress routers. They told us they would not put any filters on the routers because they did not want to lose any performance. The attacks were designed to take advantage of a specific flaw in the network design of the target. This discovered by using an automated tool that tries literality hundreds of different exploits till it finds a successful avenue of attack. Since the hackers tools try over hundred types of exploits, it is possible that if the customer had implemented the egress filtering that we had recommend than the hackers would have been able to crash them with some other attack. However, a continual theme is that there are a large number of sites on the Internet, and the well defended sites tend to get ignored by this type of attack. Since these criminals don't tend to be very clever, in fact they seem downright lazy, they only go after sites that can be assaulted with off the shelf tools. In the case of one web portal, the attack was a BSD UNIX specific attack that rides on port 80 like any other HTTP traffic. It went thought the Cisco router and a Checkpoint firewall, just like it is supposed to do. Had the network administrator patched their Web servers with against this known type of attack, then the exploit would have done not worked at all. In one of the e commerce sites, they were blown up by a Smurf attack. However, the attack was against the upstream ISP, not the e commerce site itself. Had the target insisted the ISP put the "no ip directed broadcast" command on the outgoing line from the ISP to the target, then the Smurf would have not worked. ======================================================================== -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L3, 117 Customhouse Qy /) +64 4 473 4912 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 10

RE: Large Scale Internet Attacks - Technical article.
by Dennis Su 14 Feb '00

14 Feb '00

Oops, I simply assumed that most of people here own a C or B with a subnet mask 24 bit. So the filter should really take the way you do subnetting into account. Regards, Dennis > -----Original Message----- > From: Chris Wedgwood [mailto:chris.wedgwood(a)clear.co.nz] > Sent: Tuesday, February 15, 2000 1:51 PM > To: Dennis Su > Cc: 'Roger De Salis'; nznog(a)list.waikato.ac.nz > Subject: Re: Large Scale Internet Attacks - Technical article. > > > > Alternatively, a packet filter on boundary router blocking any > > IP packet destined to *.0 or *.255 would do the trink but you > > still need "no ip directed-broadcast" to deal with the > > directed broadcast originating from your internal network. > > That can and will break access to hosts that are on /n networks > where n!=0 mod 8, for example, 10.0.100.0 and 10.0.0.255 are > perfectly valid host addresses in 10.0.0.0/8. > > > > -cw > > P.S. Alas, ot make matters worse, for machines (for example Suns > boxes) still repond to *.255 pings even when they are on a > (say) /21 network and shouldn't... > > -- > Chris Wedgwood chris.wedgwood(a)clear.co.nz > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Large Scale Internet Attacks - Technical article.
by Dennis Su 14 Feb '00

14 Feb '00

Hi, > In one of the e commerce sites, they were blown up by a Smurf attack. > However, the attack was against the upstream ISP, not the e commerce > site > itself. Had the target insisted the ISP put the "no ip directed > broadcast" > command on the outgoing line from the ISP to the target, then > the Smurf > would have not worked. Just a little opinion of mine. "no ip directed-broadcast" only deals with the directed broadcast to the interface where the command is specified. It does nothing to the transit directed broadcast. To prevent from SMURF attack you have to code this command on each Cisco router interfaces in your network. Alternatively, a packet filter on boundary router blocking any IP packet destined to *.0 or *.255 would do the trink but you still need "no ip directed-broadcast" to deal with the directed broadcast originating from your internal network. Dennis Su ITS, University of Waikato --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1