Subject: Nimda virus and whois search...

From: Franck Martin <[email-masked]>
Date: 30 Sep 2001 09:42:21 +0000

While I was implementing a perl script to catch nimda virus on Apache
(www.digitalcon.ca/nimda/) and send an e-mail to the owner of the IP, I
realised it is rather difficult to automatise whois searches.

First of all there are 3 repositories of IP networks: ARIN, APNIC and
RIPE. There is no whois repository above them to specify which one is in
charge of which range of IP (There is only a text file on the
www.iana.org web site). None of these repositories implement the same
database structure, so a whois query must be adapted to each repository.

Lastly, most IPs are delegated to ISP who could also implement whois
database to specify to which company they have lent their IP addresses.

Basically, it seems there is no heirarchy structure to find the owner of
a certain IP Block.

If there was some kind of standard, it would help fighting worms by
informing IP owners that some machines have been infected. It would also
help all Intrusion detection System to inform system administrator of
potential attacks with a detailed report...

The DNS is well implemented the reverse DNS is not so well done as only
major hosts have a record, and IP whois database are not that
specific...

Just a thought...

Cheers
[email-masked]

---

From: Pekka Savola <[email-masked]>
Date: Sun, 30 Sep 2001 13:35:14 +0300 (EEST)

> potential attacks with a detailed report...

There are some more advanced whois clients which have more knowledge on
where to query and how, e.g. http://freshmeat.net/projects/whois/.

That doesn't say, of course, that there wouldn't be any benefits from
"standardization"...

On the IDS front, I would not like to make the reporting too easy.  I'm
completely fed up with "Top Notch IDS Products" returning "alarms" on e.g.
the following:

 - users running traceroute, on incomoing icmp time exceeded messages
triggering an icmp flood "detection"
 - using a public ftp server, thus generating an ident query
 - using an smtp server, -""-
 - etc.

Most of times, these reports are sent by people who have no idea what is
going on at all.  Spamming operators with these kind of alarms shouldn't
be encouraged.

(b.t.w: is there a web page somewhere which lists and gives
reasons/pointers to usual "false alarms" like listed above?  It might be
useful as a pointer).

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: [email-masked]
Date: Sun, 30 Sep 2001 22:03:01 -0400

>  - using an smtp server, -""-

My personal pet peeve - getting complaints that one of my machines is scanning
some user's machine with source port 123.  Odd that the machine in question
was the target of the CNAME 'ntp-2.vt.edu' ;)

/Valdis