Slashdot Mirror
Noticed Welchie/Nachi in Your Bandwidth Bill, Yet?
Pinkboard Panther asks: "I have recently received my bill for Internet usage for last month and discovered it is 4 times higher than expected. Since there had been no increase in usage of the sites I run I had to search elsewhere for the exorbitant increase. Eventually I tracked it down to my firewall being bombarded with 20,000 ICMP Echo requests a minute from many different IP addresses. This adds up to $A10 per hour or $A240 a day. I still need to battle with my ISP over whether I should be paying for this. It seems that the Welchie/Nachi worm sends out pings to find what machines are out there before it moves onto deeper probes. I can't believe that I am the only site out there which is being attacked in this way. There must be lots of other sites out there who are affected this way. Maybe they just haven't received their bills, yet?"
It's their fault for not stopping the ping requests at their firewall !! Talk like a pirate #gh !!
well here in Toronto, both the major ISPs, Rogers and Sympatico have a nice habit of overcharging these days. Bills of $100 per month and over are not un heard of. There are over 50 broadband providers but many are small-name untested services I wouldnt wanna risk trying. But since the Rogers and Sympatico both have started bandwidth caps, it is time to give the ones without such caps a chance. Let capitalism take its course.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
See these links for more info.
My ISP is having almost continual problems being flooded with random worm noise.
Your friend and well-wisher
m0smithslash
http://www.ferociousflirting.com
I've been asking around about this, and it's amazing how many people are just brushing it off as nothing. It is a serious issue for IP addresses that are being hit.
m l
i ty/2003-08/0002.html
.htaccess, not my own httpd.conf.
Here are some more posts on the topic, elsewhere. Note how some people just say "Oh, you are getting hits! Hits are good, no?".
http://www.webmasterworld.com/forum39/1435.htm
http://lists.jammed.com/incidents/2003/08/0369.ht
http://www.derkeiler.com/Mailing-Lists/linuxsecur
The blocking rules people suggest (see page five of the first link) don't work at my site, for some reason. Maybe it's because I only have access to
However they probably just see the ping using up your bandwidth and that is what they are looking at. I'd probably start loging all IP addresses that are pinging your server and then go after all these users. After all they are infected with this worm and until people who get on the internet start being responsible for keeping their machines firewalled, updates and locked down as much as possible from hackers these things will continue. Most of the MS worms could be prevented if people used zone alarm or black ice or another firewall product. Also most of the Linux and bsd exploits could be avoided if they setup firewalls and update their systems and kept on top of security.
No it is not your fault, so go after those who are using up YOUR bandwidth and sue them and make them pay. It is their irresponsibility and stupidity that are causing these problems.
Only 'flamers' flame!
Does slashdot hate my posts?
Yep, that's what full-rate ADSL customers pay for traffic in New Zealand, once they get past their pitiful 500M monthly allowance.
"I run linux.. I'm not affected by Windows worms and viruses" - Yeah, you wish..!
455fe10422ca29c4933f95052b792ab2
I get random pings on my 56k dial-up, on an adsl connection, on another 56k dial-up, on a cable connection, I had someone on another dial-up isp run tcpdump and they get it too.
It's extremely annoying, and has caused me to block the response.
The difference is that a real firewall (Like Zone Alarm or Sygate (free is down at the bottom)) will block the traffic, prompt you to allow/disallow it, and then follow instructions.
Black Ice, on the other hand, will simply watch ports, log traffic, and when someone tries to access your RPC port or whatnot, it simply sets a flag "Serious Error - Someone Hacking" and starts blinking in the system tray. No real response, no ability to block it in the future, just simple monitoring.
In other words, it's a complete waste of CPU cycles from a security standpoint, and if you're using it for traffic monitoring you'd be better served with Ethereal.
(Linux/netfilter example:
Would not really help, but lower the impact.My router WAN activity light and modem activity light and are continuously flickering, even when no computers on my LAN are turned on. I tried replacing my Linksys BEFSR41 router with a Belkin F5D5231-4 router, and switching from a DSL modem to a cable modem but the new lights flicker just as much as the old ones. Since my computer is powered off, the continuous activity must be coming from the internet. I guess either hackers or worms.
This is going to sound harsh, but maybe they actually *look* at their logs and traffic graphs with a little more frequency than you imply that you do, noticed something was amiss and put the onus on the ISP to block it? You quadrupled your bandwidth for the month - that's one *serious* anomaly whether it's steady noise or intermittant spikes, and as such should have been red-flagged no later than day two, and that's assuming you only get a daily email from a cron. With this data you could have requested your ISP filter the traffic upstream, and made a fair claim against paying the already incurred traffic and an insistance against future traffic.
I'd think long and hard about going to court with this, because there is a pretty good chance that the ISP's lawyers are going to bring this up. If they do, then your companies' technical competence is likely to be brought into question in a big way, and in a public forum too. You might be better off writing this off as experience, setting up some better monitoring tools and moving on.
Of course, you might have some mitigating circumstances, such as... Well, actually, I can't think of any technical reasons why you couldn't spot this kind of traffic, is there one?
UNIX? They're not even circumcised! Savages!
I would ask my ISP to stop charging me in hex.
abuse@cox.net IGNORES Nachi/Welchia reports. Just fucking ignores them. I keep geting hit by about 200 different machines DAILY from other customers on the Cox network, and guess what they do about these IDIOTS... NOTHING. I guess that they're just planning on waiting around for the worm to kill itself off on Dec. 30th.
Morons...
Something would need to be done further upstream, at say the ISP. A web frontend to iptables would not be too hard to create, however it would be difficult/repetitive for dialup users who get disconnected after a handful of hours.
Using Windows 98 on a 4 hour dialup modem connection, the number of times I ran netstat and discovered foreign machines connected to port 135 was astounding - even when there were no file shares available. Whenever I had SQL Server 2000 SP3 running, within 30 minutes my modem lights would blink like crazy, until I temporarily stopped the DB service.
Now I run Linux with iptables blocking all ports except 80 (Apache) and 81 (IIS-4). No attacks can get to my Win98 VMWare Workstation.
You can test what ports are open/closed/stealth at this URL: https://grc.com/x/ne.dll?bh0bkyd2
But this wouldn't solve Pinkboard Panther's problem - some blocks would need to be implmented further up-stream.
Mike
Even if I block it at my firewall, it still gets TO my firewall, hence it's using my pipe and therefore my bandwidth, so I'll still be charged. So, again assuming I'm not missing the point, what needs to happen is my ISP needs to filter that stuff BEFORE it gets to my pipe. Even better, the ISP of the offender should be doing egress filtering of Nachi, etc. so it never gets to me in the first place.
I doubt that my site will have a problem with that (since it missed the blaster thing), but I'm awaiting to see my bandwidth bill for my normal internet usage this month from my ISP (for my home usage). I've already been quite busy on the internet and I've clocked over 400 of the Swen worm being downloaded from my many email accounts in less than two days.
If this keeps up, I'm looking at ~800MB of additional traffic.
I guess this shows a fundamental problem with the internet as a commercial entity. It's kind of like being charged every time your phone rings. Imagine your bill going up because a bunch of autodialers were set up to call random numbers.
Seems to me that either billing practices need to be reworked, or the net needs to be modified with considerations like this in mind.
For actually having a clue. Congrats!
Killerwall Kicks @$$
... its mandatory !
Your system has achieved a perfect "TruStealth" rating. Not a single packet ? solicited or otherwise ? was received from your system as a result of our security probing tests. Your system ignored and refused to reply to repeated Pings (ICMP Echo Requests). From the standpoint of the passing probes of any hacker, this machine does not exist on the Internet. Some questionable personal security systems expose their users by attempting to "counter-probe the prober", thus revealing themselves. But your system wisely remained silent in every way. Very nice.
Gotta love Linux
DONT TREAD ON ME MOÎΩN ÎABÃ
I don't know how things work in your neck of the woods, but here all I had to do was threaten to take my business to another provider because the ISP in question had not bothered to even attempt to filter the 92 byte ICMP echo requests coming from the Internet into their own network.
Most pings are not 92 bytes exactly. The pings this virus sends out are 92 bytes with a payload of 'AA' repeated to pad it out to 92 bytes.
You mileage may vary, though, as I have several thousands of dollars monthly worth of leverage.
Sig??? I don't need no stinkin Sig!
not setting up filters when you are ISP or even have a big physical network (pass-thru) is plain stupid. if they have the bandwidth they can not care, but imagine traffic leaving the country, say from usa to japan. this physical line is very precious and if zombies in either country can saturat the bandwidth with use-less traffic users in both countries get f#ck. ;)
...
of course maybe the ISP purposely don't filter the junk data so the internet feels "slow" and some decide to "upgrade" their ADSL or something only to find out that sites hosted in a foreign country are still slow
i wonder why i times of war bridges become so valuable
try :
http://ww.domain.com
http:/wwww.domain.com
http://uuuuuu.domain.com
http://wuuw.domain.com
http://vwv.domain.com
http://w.w.w.domain.com
http://http.domain.com
http://ftp.domain.com
http://domain.domain.com
http://web.domain.com
http://www.domain.domain.com
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
etc.
...
Apologies for my recently germanified english
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
The company I work for hosts 20ish web sites, and have 2 class C address ranges. If your server responds to the icmp packet, you then get hit with a 4k web request. _This_ is what pushed our usage way up.
Once we blocked the icmp probes, the web requests stopped, and our usage went down to something resembling sensible. The icmp probles are all 92 bytes in length, so they're easy enough to block if you have a decent router (ours is a linux pc). Before I knew about the icmp probes, I was blocking the worms' http requests - obviously couldn't block the first packet but it still reduced the incoming data by about a third.
Our isp waived the changes based on what we agreed was a reasonable estimate of traffic volume caused by the worm(s).
I came across this article as I was searching for answers to my connection. Within the last three weeks I have been having problems connecting and I have talked to my ISP about the problem. They have sent someone twice to check my network and they always says it fine. Now the funny thing is it works for a few minutes or hours and then its gone for a long time. When I talk to the ISP am told that am giving them funny talk as the traffic on my network seems very busy. While they say its very busy, i cant even open a page on my side. Could this have something to do with those viruses? I have scanned for the viruses and even patched the software on win 2000 computers. Funny though very early mornings and evenings my connection is okay. Any help????? Anybody???
we've got about 64 IP addresses (it was 2x class C's, but we've unrouted most addresses to reduce the cost). This worm is generating on average 13-14 MB per day. Again since I live in Australia, any excess usage is charged at .15c per MB, $2 a day or $60 per month.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
His FIREWALL is being bombarded with the traffic. Monitoring has nothing to do with this. He's blocking ICMP requests and throwing them away. His ISP on the other hand is charging for all bandwidth used even though this is unwanted traffic. If it is the isp's policy to charge no matter what he is screwed otherwise, if they dont't, he might have a chance to get them to disregaurd that used bandwith.