Subject: [Ieprep] RE: [I prep] FYI: Virus-Like Infection Slows Internet Traffic

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Sat, 25 Jan 2003 11:44:11 -0600

> What isn't being said is that inter-ISP Security 
> communication systems worked and 

just curious. You mean uRPF, Black Hole Filtering
and Sink Holes, which was discussed before?

> this worm was roughly contained within hours of the 
> discovery. We're currently in the phase of more  
> tightly containing the infected servers. 

which helped better? the inundating Microsoft's
security patches or the techniques which this list discussed
last month ( egress/ingress filtering etc..
ftp://ftp-eng.cisco.com/cons/isp/security/ )
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: "Barry Raveendran Greene" <[email-masked]>
Date: Sat, 25 Jan 2003 10:32:21 -0800

No. I'm taking about people E-mailing (via the closed nsp-sec operational
security alias) and talking to each other (combination of regular phone and
iNOC-DBA phones). 

This problem is not fixed - it is contained. ACLs stopping all UDP traffic to
port 1434.

The key thing is that ISPs were talking to each other and applying the block
even before they were seriously infected. So the spread of the worm was
mitigated by good old inter-ISP communication.

> -----Original Message-----
> From: Ayyasamy, Senthilkumar (UMKC-Student) [mailto:[email-masked]]
> Sent: Saturday, January 25, 2003 9:44 AM
> To: [email-masked]; King, Kimberly S.; [email-masked]
> Subject: RE: [I prep] FYI: Virus-Like Infection Slows Internet Traffic
> 
>

---

From: Bill Woodcock <[email-masked]>
Date: Sat, 25 Jan 2003 11:07:36 -0800 (PST)

> and Sink Holes, which was discussed before?

No, those are means of response.  The _inter-ISP security communications
systems_ worked.  That is, ISPs were able to effectively and
efficiently communicate with each other regarding the diagnosis and
solution to the problem.

    > > discovery.

The patch is of no use, since in order for it to do anything, individual
offending hosts have to be tracked down, customers found, customers woken
up, customers convinced that this really is their problem, patches
conveyed to customers, customers drive to colo site, customers sit around
twiddling with their box for some hours.  In other words, many months.

Packet filtering contained the problem quickly, on the other hand.

                                -Bill