<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<TITLE>Re: Destructive botnet originating from Japan</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<BR>
<P><FONT SIZE=2>(jon I know you didn't say, but the original must have got nailed in my spam filters)<BR>
<BR>
The best thing about this statement is that since I don't report to nanog nsp-sec, or Tyler Durden, the first rule of fight club can kiss my arse.<BR>
<BR>
But then again, this really isn't NANOG's business now is it? Or is it?<BR>
<BR>
Happy Christmas folks!<BR>
<BR>
:)<BR>
<BR>
<BR>
Marty<BR>
<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: Jon Lewis [<A HREF="mailto:jlewis@lewis.org">mailto:jlewis@lewis.org</A>]<BR>
Sent: Sun Dec 25 17:37:57 2005<BR>
To: blyon@prolexic.com<BR>
Cc: NANOG<BR>
Subject: Re: Destructive botnet originating from Japan<BR>
<BR>
<BR>
On Sun, 25 Dec 2005, Rubens Kuhl Jr. wrote:<BR>
<BR>
> The first rule of nsp-sec is, you do not talk about nsp-sec<BR>
> The second rule of nsp-sec is, you DO NOT talk about nsp-sec<BR>
<BR>
<A HREF="https://puck.nether.net/mailman/listinfo/nsp-security">https://puck.nether.net/mailman/listinfo/nsp-security</A><BR>
<BR>
There's nothing secret about the existence or purpose of the list.<BR>
<BR>
I don't know enough about Barrett to guess as to whether or not he'd<BR>
qualify.<BR>
<BR>
Also, I was considering emailing Barrett privately, but since there seems<BR>
to be so much misinformation going around, others will probably benefit<BR>
from this. If you want to send out list of IPs suspected of being bots or<BR>
really any other class of insecure/0wn3d systems, to make it easier for<BR>
those who care to find their IPs in your list, run it through the Team<BR>
Cymru whois server first.<BR>
<BR>
<A HREF="http://www.cymru.com/BGP/whois.html">http://www.cymru.com/BGP/whois.html</A><BR>
<BR>
Then sort the list numerically by ASN. That way, people can scroll<BR>
through it, or search by ASN, and quickly determine if there's any further<BR>
action worth taking.<BR>
<BR>
It's also a really good idea to include timestamps, ideally exact ones in<BR>
GMT per IP. In this case (unix bots) it's not as likely, but typical<BR>
windows bots frequently show up on end-user systems with dynamic IPs.<BR>
Telling me one of my dial pool IPs was a bot "recently" is not as useful<BR>
as telling me it was a bot 2005-12-25 02:30:45 GMT.<BR>
<BR>
----------------------------------------------------------------------<BR>
Jon Lewis | I route<BR>
Senior Network Engineer | therefore you are<BR>
Atlantic Net |<BR>
_________ <A HREF="http://www.lewis.org/~jlewis/pgp">http://www.lewis.org/~jlewis/pgp</A> for PGP public key_________<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>