Re: Template Admin Notification

["Irwin R. Naumann" <irwin () THINKAGE CA>]

> From owner-incidents () SECURITYFOCUS COM  Wed Jan 24 11:19:54 2001
> Approved-By: ah () SECURITYFOCUS COM
> Delivered-To: incidents () lists securityfocus com
> Delivered-To: incidents () securityfocus com
> X-Sender:  <ah@mail>
> MIME-Version: 1.0
> Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII>
> Date:         Wed, 24 Jan 2001 08:09:38 -0800
> Reply-To: Alfred Huger <ah () SECURITYFOCUS COM>
> Sender: Incidents Mailing List <INCIDENTS () SECURITYFOCUS COM>
> From: Alfred Huger <ah () SECURITYFOCUS COM>
> Subject:      Template Admin Notification
> To: INCIDENTS () SECURITYFOCUS COM
> Content-Length: 262
>
> Does anyone on the list have a default template email they use to notify
> admins of attacks from their networks?
>
> I would be interested in seeing them posted to the list (or to myself
> directly if that's not possible).
>
> Cheers,
> -al
>
> "Vae Victis"
> SecurityFocus.com

Al, this is the template I use. I haven't gotten around to making a Perl
script to generate it yet.

-----------------
Addressed to <>

Dear coordinator,

There was suspicious activity directed to
hosts on Thinkage's
the DNS servers on Thinkage's
10.235.67.0  network
172.16.234.0 network
10.235.67 and 172.16.234 networks
originating from the IP address xx.yy.xx.yy
which is allocated to kkk.

Perhaps xx.yy.xx.yy has been spoofed, has a curious/malicious user, or
itself has been compromised.

The attempts occurred on month day,2001 between start-time end-time  EDT.
(Eastern Daylight Time is Greenwich Mean Time minus 4 hours  GMT-0400.)
(Eastern Standard Time is Greenwich Mean Time minus 5 hours  GMT-0500.)

I have enclosed TCPDUMP logs of all the activity directed to/from
xx.yy.xx.yy. As you can see there is no legitimate IP traffic other
than the attempts to exploit weaknesses on port .

A followup to this message would be appreciated.

Irwin Naumann, System Administrator, Thinkage Ltd., Kitchener,Ontario
Canada  N2R  1H6     (519)895-1860 Ext. 203        irwin () thinkage com

-----------
I replace <> with the e-mail address of contact person in the "Addressed to"
field.

I choose one of the "hosts on Thinkage's" ... "10.235.67 and 172.16.234
networks".

ww.xx.yy.zz is the source IP address.

kkk is the data form a whois query.

month, day, year.

I choose one of the explanations of EDT or EST for !North American contacts.

------------

Contrived example:

Addressed to contact () example com

Dear coordinator,

There was suspicious activity directed to hosts on Thinkage's 172.16.234 network
originating from the IP address 192.0.2.219 which is allocated to
example.com

Example Ltd. (NET-EXAMPLE)
   1234 Main Street
   Nowhereville
   Ontario, Q2Q 3Z1
   CANADA

   Netname: EXAMPLE
   Netblock: 192.0.2.0 - 192.0.2.255

   Coordinator:
      Ontact, C (XXXX-ARIN)  contact () EXAMPLE COM
      +1 555 555 5555 x555

   Domain System inverse mapping provided by:

   NS1.EXAMPLE.COM              192.0.2.35
   NS.SOMEISP.NET               10.235.2.77

   Record last updated on 01-Nov-1993.
   Database last updated on 24-Jan-2001 07:54:28 EDT.

The ARIN Registration Services Host contains ONLY Internet
Network Information: Networks, ASN's, and related POC's.
Please use the whois server at rs.internic.net for DOMAIN related
Information and whois.nic.mil for NIPRNET Information.

Perhaps 192.0.2.219 has been spoofed, has a curious/malicious user, or
itself has been compromised.

The attempts occurred on January 23,2001 between 14:07:00 and 14:07:09 EST.
(Eastern Standard Time is Greenwich Mean Time minus 5 hours  GMT-0500.)

I have enclosed TCPDUMP logs of all the activity directed to/from
192.0.2.219. As you can see there is no legitimate IP traffic other
than the attempts to exploit weaknesses on port 110.

A followup to this message would be appreciated.

Irwin Naumann, System Administrator, Thinkage Ltd., Kitchener,Ontario
Canada  N2R  1H6     (519)895-1860 Ext. 203        irwin () thinkage com

14:07:00.147015 64.4.14.76.3382 > 172.16.234.9.110: S 3002159064:3002159064(0) win 16384 <mss 1460,nop,nop,sackOK>
14:07:03.324522 64.4.14.76.3382 > 172.16.234.9.110: S 3002159064:3002159064(0) win 16384 <mss 1460,nop,nop,sackOK>
14:07:09.886300 64.4.14.76.3382 > 172.16.234.9.110: S 3002159064:3002159064(0) win 16384 <mss 1460,nop,nop,sackOK>