Sampsa Laine <sampsa at mac.com> writes:
Just saw this on LABVAX:
%%%%%%%%%%% OPCOM 30-NOV-2013 21:28:47.27 %%%%%%%%%%%
Message from user AUDIT$SERVER on LABVAX
Security alarm (SECURITY) and security audit (SECURITY) on LABVAX, =
system id: 48683
Auditable event: Local interactive login failure
Event time: 30-NOV-2013 21:28:47.21
PID: 22E00220 =20
Process name: _NTY215: =20
Username: <login> =20
Process owner: [SYSTEM]
Terminal name: _NTY215:, 122.138.48.116.static.netvigator.com
Image name: =
$77$DUA0:[SYS10.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Status: %LOGIN-F-CMDINPUT, error reading command input
Confused as it doesn't look like a telnet logon, I thought telnet =
terminal IDs were TN-something?
sampsa <sampsa at mac.com>
mobile +44 7961 149465
Multinet installed???
--
VAXman- A Bored Certified VMS Kernel Mode Hacker VAXman(at)TMESIS(dot)ORG
Well I speak to machines with the voice of humanity.
Just saw this on LABVAX:
%%%%%%%%%%% OPCOM 30-NOV-2013 21:28:47.27 %%%%%%%%%%%
Message from user AUDIT$SERVER on LABVAX
Security alarm (SECURITY) and security audit (SECURITY) on LABVAX, system id: 48683
Auditable event: Local interactive login failure
Event time: 30-NOV-2013 21:28:47.21
PID: 22E00220
Process name: _NTY215:
Username: <login>
Process owner: [SYSTEM]
Terminal name: _NTY215:, 122.138.48.116.static.netvigator.com
Image name: $77$DUA0:[SYS10.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Status: %LOGIN-F-CMDINPUT, error reading command input
Confused as it doesn't look like a telnet logon, I thought telnet terminal IDs were TN-something?
sampsa <sampsa at mac.com>
mobile +44 7961 149465
hey Sampas,
I played and got a high score..
Not sure how to "screen shot" on Mac, but cut and pasted the following from terminal to help verify it.
Oct TETRIS Mark Wickens 7640 1 TETRIS Mike Holmes 9816 18
Sep TETRIS DRB 1040 2 SAMPSA 130 1
Aug SAMPSA [A 126
Jul TETRIS Lanny 740
Jun TETRIS volal 11860
May TETRIS tiguco 2799
Apr TETRIS 14
Mar TETRIS TooCool4Web 4430
Feb TETRIS u 1567
Jan TETRIS 268
Dec TETRIS 128
Nov TETRIS 585
You Are Seated At 1 In tetris Previous Score 2000
Enter Your Name [ Return to Leave ] Current Score 9816
%DCL-E-CAPTINT, captive account - interactive access denied
TETRIS logged out at 30-NOV-2013 03:46:58.48
%REM-S-END, control returned to node MASON::
$
thanks Mike
----------------------------------------
From: sampsa at mac.com
Subject: [HECnet] CHIMPY Retro Tetris Update
Date: Fri, 15 Nov 2013 12:47:15 +0200
To: hecnet at Update.UU.SE
CHIMPY Retro Tetris Update:
Mark Wickens is in the lead with a score of 7,640, followed by Vilaca with 1,574 (score not verified with screenshot so might not count).
Guys, we're still running until 23:59:00 GMT on 31-DEC-2013 so there's plenty of time to win random Arabic money AND certificates of Tetris awesomeness.
Telnet to CHIMPY.SAMPSA.COM or SET HOST CHIMPY, log in as TETRIS.
REMEMBER TO SCREENSHOT YOUR RESULT IF YOU GET A NEW HIGHSCORE. Or at least write down what date/time/node you came from if SET HOST, so I can verify the score..
sampsa <sampsa at mac.com>
mobile +358 40 7208932
On Fri, 29 Nov 2013, Pontus Pihlgren wrote:
On Thu, Nov 28, 2013 at 11:27:42PM +0000, Sampsa Laine wrote:
I think we'll need some kind of driving license system for running servers at some point, this botnet stuff is just ridiculous :)
I don't believe in that. But I've always wondered why
ISPs aren't more proactive. You'd think it is in their
interest and they should have the expertise.
It's not in their best interest when the spammers and skiddies pay
$$$...even if the money is stolen.
/P
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
sampsa <sampsa at mac.com>
mobile +44 7961 149465
On 29 Nov 2013, at 08:26, Pontus Pihlgren <pontus at Update.UU.SE> wrote:
On Thu, Nov 28, 2013 at 11:27:42PM +0000, Sampsa Laine wrote:
I think we'll need some kind of driving license system for running servers at some point, this botnet stuff is just ridiculous :)
I don't believe in that. But I've always wondered why
ISPs aren't more proactive. You'd think it is in their
interest and they should have the expertise.
I wasn't entirely serious but the level of Stupid seems to be growing daily..
On Thu, Nov 28, 2013 at 11:27:42PM +0000, Sampsa Laine wrote:
I think we'll need some kind of driving license system for running servers at some point, this botnet stuff is just ridiculous :)
I don't believe in that. But I've always wondered why
ISPs aren't more proactive. You'd think it is in their
interest and they should have the expertise.
/P
Find their outgoing mail server, nmap -P0 -p1-65535 -T5 on a loop for a few days...
Should slow the fuckers down.... :)
sampsa <sampsa at mac.com>
mobile +44 7961 149465
On 29 Nov 2013, at 04:59, Gregg Levine <gregg.drwho8 at gmail.com> wrote:
Hello!
Last month I was getting spammed by an idiot who refused to honor the
removal requests sent back from his own clients. I contacted the
services that were foolish enough to allow him to operate. Further
along one chap did in fact realize that I was indeed right regarding
that bozo, he then did the magic needed to close that account.
Eventually it stopped.
Now regarding VersaWeb, here's an idea, each time that idiot spams
you, explain to them that they owe you a fixed amount of currency, US
of course.
Do they have an abuse@ e-mail address? Send that note to them there
that the bozo is indeed spamming you, and further the more he
continues to do it, the more they will owe you a fixed amount over 50
dollars US.
Regarding for example those annoying people over in a country that has
other problems........ Never mind.
Let's move this back on topic.
-----
Gregg C Levine gregg.drwho8 at gmail.com
"This signature fought the Time Wars, time and again."
On Thu, Nov 28, 2013 at 11:38 PM, Cory Smelosky <b4 at gewt.net> wrote:
On Fri, 29 Nov 2013, Sampsa Laine wrote:
On 29 Nov 2013, at 03:48, Gregg Levine <gregg.drwho8 at gmail.com> wrote:
Hello!
Interesting problem that one, Sampsa as applied to the Asterisk PBX.
Now the important question, who is or was hosting them? I might know
of them?
It's hosted in a colo facility operated by NETRIPLEX LLC - I actually
sent them the message as an act of goodwill, the PBX operator probably
DOESN'T want to be compromised like this :)
Now if only VersaWeb would shitcan this spammer that keeps spamming me...I
wish companies were more like the one you contacted that cared.
A compromised NAS, interesting. It might have been deliberately spun
up that way.....
That was in China - I don't even bother contacting their abuse points,
useless...
I got annoyed with those not working so I contemplated contacting ARIN or
the CEO directly. The CEO never emailed me back.
And I agree with you regarding the drivers license and the server issues.
It is getting ludicrous. Soon we'll all be behind NAT "for our own
safety". Ugh.
Yup...
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
Hello!
Last month I was getting spammed by an idiot who refused to honor the
removal requests sent back from his own clients. I contacted the
services that were foolish enough to allow him to operate. Further
along one chap did in fact realize that I was indeed right regarding
that bozo, he then did the magic needed to close that account.
Eventually it stopped.
Now regarding VersaWeb, here's an idea, each time that idiot spams
you, explain to them that they owe you a fixed amount of currency, US
of course.
Do they have an abuse@ e-mail address? Send that note to them there
that the bozo is indeed spamming you, and further the more he
continues to do it, the more they will owe you a fixed amount over 50
dollars US.
Regarding for example those annoying people over in a country that has
other problems........ Never mind.
Let's move this back on topic.
-----
Gregg C Levine gregg.drwho8 at gmail.com
"This signature fought the Time Wars, time and again."
On Thu, Nov 28, 2013 at 11:38 PM, Cory Smelosky <b4 at gewt.net> wrote:
On Fri, 29 Nov 2013, Sampsa Laine wrote:
On 29 Nov 2013, at 03:48, Gregg Levine <gregg.drwho8 at gmail.com> wrote:
Hello!
Interesting problem that one, Sampsa as applied to the Asterisk PBX.
Now the important question, who is or was hosting them? I might know
of them?
It's hosted in a colo facility operated by NETRIPLEX LLC - I actually
sent them the message as an act of goodwill, the PBX operator probably
DOESN'T want to be compromised like this :)
Now if only VersaWeb would shitcan this spammer that keeps spamming me...I
wish companies were more like the one you contacted that cared.
A compromised NAS, interesting. It might have been deliberately spun
up that way.....
That was in China - I don't even bother contacting their abuse points,
useless...
I got annoyed with those not working so I contemplated contacting ARIN or
the CEO directly. The CEO never emailed me back.
And I agree with you regarding the drivers license and the server issues.
It is getting ludicrous. Soon we'll all be behind NAT "for our own
safety". Ugh.
Yup...
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
On Fri, 29 Nov 2013, Sampsa Laine wrote:
On 29 Nov 2013, at 03:48, Gregg Levine <gregg.drwho8 at gmail.com> wrote:
Hello!
Interesting problem that one, Sampsa as applied to the Asterisk PBX.
Now the important question, who is or was hosting them? I might know
of them?
It's hosted in a colo facility operated by NETRIPLEX LLC - I actually
sent them the message as an act of goodwill, the PBX operator probably
DOESN'T want to be compromised like this :)
Now if only VersaWeb would shitcan this spammer that keeps spamming me...I wish companies were more like the one you contacted that cared.
A compromised NAS, interesting. It might have been deliberately spun
up that way.....
That was in China - I don't even bother contacting their abuse points, useless...
I got annoyed with those not working so I contemplated contacting ARIN or the CEO directly. The CEO never emailed me back.
And I agree with you regarding the drivers license and the server issues.
It is getting ludicrous. Soon we'll all be behind NAT "for our own safety". Ugh.
Yup...
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
On 29 Nov 2013, at 04:03, "Brian Schenkenberger, VAXman-" <system at TMESIS.COM> wrote:
Sampsa Laine <sampsa at mac.com> writes:
{...snip...}
It is getting ludicrous. Soon we'll all be behind NAT "for our own =
safety". Ugh.
NAT doesn't necessarily provide you or buy you any better security.
Well not necessarily but if you're the type to leave 20 services open on your box and you doing it on a NAT'd network with no port forwards, those 20 service won't be internet visible. I was being a bit sarcastic there because soon ISPs will start charging extra for non-NAT'd service I think, as the free IP pool gets shallower and shallower.
So NAT for n00bs = good. It doesn't expose their machine directly to the internet. Especially if you get the box from ISP like most people in the UK, they could lock down UPNP and any internet facing management ports, and the "crazy amount of open services" problem is gone.
Of course a less than brilliant user can go and download something that compromises his system on the INSIDE of the NAT and makes an outgoing connection, and you're right, you'd need a firewall (or competence) to stop that.
Sampsa
Sampsa Laine <sampsa at mac.com> writes:
{...snip...}
It is getting ludicrous. Soon we'll all be behind NAT "for our own =
safety". Ugh.
NAT doesn't necessarily provide you or buy you any better security.
--
VAXman- A Bored Certified VMS Kernel Mode Hacker VAXman(at)TMESIS(dot)ORG
Well I speak to machines with the voice of humanity.
On 29 Nov 2013, at 03:48, Gregg Levine <gregg.drwho8 at gmail.com> wrote:
Hello!
Interesting problem that one, Sampsa as applied to the Asterisk PBX.
Now the important question, who is or was hosting them? I might know
of them?
It's hosted in a colo facility operated by NETRIPLEX LLC - I actually
sent them the message as an act of goodwill, the PBX operator probably
DOESN'T want to be compromised like this :)
A compromised NAS, interesting. It might have been deliberately spun
up that way.....
That was in China - I don't even bother contacting their abuse points, useless...
And I agree with you regarding the drivers license and the server issues.
It is getting ludicrous. Soon we'll all be behind NAT "for our own safety". Ugh.
Hello!
Interesting problem that one, Sampsa as applied to the Asterisk PBX.
Now the important question, who is or was hosting them? I might know
of them?
A compromised NAS, interesting. It might have been deliberately spun
up that way.....
And I agree with you regarding the drivers license and the server issues.
-----
Gregg C Levine gregg.drwho8 at gmail.com
"This signature fought the Time Wars, time and again."
On Thu, Nov 28, 2013 at 6:27 PM, Sampsa Laine <sampsa at mac.com> wrote:
Took out another 5 or so attackers today, actually reported one Asterisk PBX (weird, right) to their hosting company in the US, figured they are compromised.
All of the hosts I've scanned are basically compromised systems, some poor guys server or the latest one, a NAS unit with all its management ports accessible through the Internet.
I think we'll need some kind of driving license system for running servers at some point, this botnet stuff is just ridiculous :)
sampsa <sampsa at mac.com>
mobile +44 7961 149465
Took out another 5 or so attackers today, actually reported one Asterisk PBX (weird, right) to their hosting company in the US, figured they are compromised.
All of the hosts I've scanned are basically compromised systems, some poor guys server or the latest one, a NAS unit with all its management ports accessible through the Internet.
I think we'll need some kind of driving license system for running servers at some point, this botnet stuff is just ridiculous :)
sampsa <sampsa at mac.com>
mobile +44 7961 149465
Guys, I'm running a VT100 Tetris competition on CHIMPY::.
There's actual prizes and everything! You get a Tetris
Ninja certificate along with the stuff listed below.
If you DO get a high score (1st or 2nd place) PLEASE
screenshot the name entry screen and email it to
tetris at sampsa.com
Access: telnet to chimpy.sampsa.com, log in as tetris
Prizes / General Blurb
======================
CHIMPY:: VT100 (well VT220 if you have it) Tetris challenge relaunched!
Last year's winner never claimed his price, my suspicions being that he didn't
trust banker's drafts from obscure countries like the United Kingdom of Great
Britain and Northern Ireland.
So this year the price has not only been increased in total monetary value,
but it is issued in CASH. That's right, the winner will get LL 25,000
(TWENTY FIVE THOUSAND LEBANESE POUNDS), a reliable currency issued
by a known entity*, unlike the RBS Group.
The runner up will get EGP 35 (THIRTY FIVE EGYPTIAN POUNDS).
So get your VT220 client out, telnet to CHIMPY.SAMPSA.COM, and log in as
TETRIS.
We will be posting more or less frequent updates about the state of play.
* No seriously, the Lebanese Pound is dollar-pegged and hasn't been devalued
for like ever. Even during the July War it didn't drop.
sampsa <sampsa at mac.com>
mobile +44 7961 149465
Dave McGuire <mcguire at neurotica.com> writes:
On 11/27/2013 12:13 PM, Brian Schenkenberger, VAXman- wrote:
The Telnet protocol itself makes no promises about the presence OR
absence of encryption, and it has a very flexible do/don't/will/won't
option negotiation protocol. Kerberos-enabled telnet, in particular,
allows for automatic authentication and/or stream encryption, with
either enabled or disabled on an invocation-by-invocation basis.
Kerberos-enabled telnet doesn't work unless the target is setup to and
willing to provide for it. I have no knowledge of how Sampsa has his
configured but from the initial discussion, I'd doubt that Kerberos is
involved.
As do I. I was merely nit-picking that "telnet" does not exclusively
mean "cleartext". Given that it was an open and outward-facing service,
I'd certainly HOPE it was Kerberized telnet! ;)
Sampsa already explain that it is not.
I do have telnet enabled but only for specific captive accounts. These
accounts -- such as the VTTEST account -- run an application that can't
be escaped from to tinker with anything on the system. For the general
cases, though, I only permit 'ssh' for external access and that runs on
an alternate port too. Port scanning ssh on a VMS system can consume a
over-generous amount of CPU resources. I also limit, becasue of this,
how many 'ssh' session can be created at any one time. For me, this is
a pretty low number as I should be the only party accessing my systems.
--
VAXman- A Bored Certified VMS Kernel Mode Hacker VAXman(at)TMESIS(dot)ORG
Well I speak to machines with the voice of humanity.
On 11/27/2013 12:13 PM, Brian Schenkenberger, VAXman- wrote:
The Telnet protocol itself makes no promises about the presence OR
absence of encryption, and it has a very flexible do/don't/will/won't
option negotiation protocol. Kerberos-enabled telnet, in particular,
allows for automatic authentication and/or stream encryption, with
either enabled or disabled on an invocation-by-invocation basis.
Kerberos-enabled telnet doesn't work unless the target is setup to and
willing to provide for it. I have no knowledge of how Sampsa has his
configured but from the initial discussion, I'd doubt that Kerberos is
involved.
As do I. I was merely nit-picking that "telnet" does not exclusively
mean "cleartext". Given that it was an open and outward-facing service,
I'd certainly HOPE it was Kerberized telnet! ;)
-Dave
--
Dave McGuire, AK4HZ
New Kensington, PA
Dave McGuire <mcguire at neurotica.com> writes:
On 11/27/2013 11:26 AM, Ian McLaughlin wrote:
Encrypted telent? I am intrigued...
The Telnet protocol itself isn't encrypted - passwords are in
cleartext. Running telnet inside an SSH tunnel is different...
Why would you when you've already got a secure communications channel
established?
I routinely use port forwarding through an ssh tunnel and, in most of
the cases, this is essentially telnet on an alternate port (eg. SMTP,
POP) but there are other protocols (eg. SQL) which are not so telnet
like in their implementation which can benefit from ssh tunneling.
The Telnet protocol itself makes no promises about the presence OR
absence of encryption, and it has a very flexible do/don't/will/won't
option negotiation protocol. Kerberos-enabled telnet, in particular,
allows for automatic authentication and/or stream encryption, with
either enabled or disabled on an invocation-by-invocation basis.
Kerberos-enabled telnet doesn't work unless the target is setup to and
willing to provide for it. I have no knowledge of how Sampsa has his
configured but from the initial discussion, I'd doubt that Kerberos is
involved.
This is far from new. I have been using it for over twenty years.
It's certainly not new. ;)
--
VAXman- A Bored Certified VMS Kernel Mode Hacker VAXman(at)TMESIS(dot)ORG
Well I speak to machines with the voice of humanity.
Roughly, what would be the power consumption of a 4000-500?
On Wed, Nov 27, 2013 at 7:32 AM, Cory Smelosky <b4 at gewt.net> wrote:
On Wed, 27 Nov 2013, Mark Wickens wrote:
DS10L with 1 HDD is 176 watts.
That's less than my ES40...quad-proc with 2 HDD and it hits 800W. ;)
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
On 11/27/2013 11:26 AM, Ian McLaughlin wrote:
Encrypted telent? I am intrigued...
The Telnet protocol itself isn't encrypted - passwords are in
cleartext. Running telnet inside an SSH tunnel is different...
The Telnet protocol itself makes no promises about the presence OR
absence of encryption, and it has a very flexible do/don't/will/won't
option negotiation protocol. Kerberos-enabled telnet, in particular,
allows for automatic authentication and/or stream encryption, with
either enabled or disabled on an invocation-by-invocation basis.
This is far from new. I have been using it for over twenty years.
-Dave
--
Dave McGuire, AK4HZ
New Kensington, PA
Encrypted telent? I am intrigued...
The Telnet protocol itself isn't encrypted - passwords are in cleartext. Running telnet inside an SSH tunnel is different...
Ian
On Nov 27, 2013, at 8:22 AM, Dave McGuire <mcguire at neurotica.com> wrote:
On 11/26/2013 05:56 PM, Brian Schenkenberger, VAXman- wrote:
Stupid! Disable TELNET for anything but your local net. You do NOT want
plain text sent over the internet!
Telnet does not imply a lack of encryption. I regularly use encrypted
telnet, as do many others.
-Dave
--
Dave McGuire, AK4HZ
New Kensington, PA
---
Filter service subscribers can train this email as spam or not-spam here: http://my.email-as.net/spamham/cgi-bin/learn.pl?messageid=2BD711B6578011E38…
On 11/26/2013 05:56 PM, Brian Schenkenberger, VAXman- wrote:
Stupid! Disable TELNET for anything but your local net. You do NOT want
plain text sent over the internet!
Telnet does not imply a lack of encryption. I regularly use encrypted
telnet, as do many others.
-Dave
--
Dave McGuire, AK4HZ
New Kensington, PA
On Wed, 27 Nov 2013, Mark Wickens wrote:
DS10L with 1 HDD is 176 watts.
That's less than my ES40...quad-proc with 2 HDD and it hits 800W. ;)
--
Cory Smelosky
http://gewt.net Personal stuff
http://gimme-sympathy.org Projects
On Wed, Nov 27, 2013 at 3:13 AM, Mark Wickens <mark at wickensonline.co.uk> wrote:
DS10L with 1 HDD is 176 watts.
IIRC - the supply was rated at 450W peak.
On 27 Nov 2013, at 02:01, Sampsa Laine <sampsa at mac.com> wrote:
On 26 Nov 2013, at 23:08, Hans Vlems <hvlems at zonnet.nl> wrote:
No, I get telnet attempts from it, es and nl domains lately. I put a text in sys$announce that tells the, error, user that the system is privately owned, alle access attempts are logged and monitored and that unauthorized access is not allowed. The attempts are now down to a couple every 24 hours and no longer every 5 minutes.
Just got an SSH bruteforce attempt from Korea, decided to have a look at the chap's machine:
nmap -p1-65535 -T5 -sV -oAhax0r -P0 14.63.222.153
The "attack" stopped pretty quickly after that lol.
Mainland China based IP attacked me this morning, stopped after 27 seconds of my nmap scan.
The scanners don't like to be scanned it seems :)
Might write an automatic ArcSight rule to trigger these..
sampsa