WINS Monthly Meeting 2/6/2004 WINS Monthly Meeting 2/6/2004

Agenda IntroductionsIntroductions Mydoom VirusMydoom Virus Content Filter Redirect IssueContent Filter Redirect Issue Statscout MonitorStatscout Monitor DCCC ProjectDCCC Project Spring BreakSpring Break Question & AnswersQuestion & Answers

Introductions NameName TitleTitle LocationLocation

Mydoom Virus is a mass-mailing worm that arrives as an attachment with the file extension.bat,.cmd,.exe,.pif,.scr, is a mass-mailing worm that arrives as an attachment with the file extension.bat,.cmd,.exe,.pif,.scr, or.zip. When a computer is infected, the worm sets up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources. In addition, the backdoor can download and execute arbitrary files. There is a 25% chance that a computer infected by the worm will perform a Denial of Service (DoS) on February 1, 2004 starting at 16:09:18 UTC, which is also the same as 08:09:18 PST, based on the machine's local system date/time. If the worm does start the DoS attack, it will not mass mail itself. It also has a trigger date to stop spreading/DoS-attacking on February 12, While the worm will stop on February 12, 2004, the backdoor component will continue to function after this date. When a computer is infected, the worm sets up a backdoor into the system by opening TCP ports 3127 through 3198, which can potentially allow an attacker to connect to the computer and use it as a proxy to gain access to its network resources. In addition, the backdoor can download and execute arbitrary files. There is a 25% chance that a computer infected by the worm will perform a Denial of Service (DoS) on February 1, 2004 starting at 16:09:18 UTC, which is also the same as 08:09:18 PST, based on the machine's local system date/time. If the worm does start the DoS attack, it will not mass mail itself. It also has a trigger date to stop spreading/DoS-attacking on February 12, While the worm will stop on February 12, 2004, the backdoor component will continue to function after this date.

Content Filter Redirect Portal – Google, Yahoo, AOLPortal – Google, Yahoo, AOL Cached ImagesCached Images Porn availablePorn available Solution issuesSolution issues Suggestions?Suggestions?

Statscout Monitor Statscout's vastly scalable network performance monitoring software and optional high performance LAN analyzer software, produce informative, easy-to-read, real-time and historical reports on bandwidth utilization, response time congestion and error conditions. Statscout's approach to network performance management delivers a comprehensive view of how the entire network is performing, and provides the ability to track down and fix network problems.Statscout's vastly scalable network performance monitoring software and optional high performance LAN analyzer software, produce informative, easy-to-read, real-time and historical reports on bandwidth utilization, response time congestion and error conditions. Statscout's approach to network performance management delivers a comprehensive view of how the entire network is performing, and provides the ability to track down and fix network problems. Statscout generally appeals to government departments, corporate enterprises or educational facilities with 500 to 100,000 network nodes and a distributed network infrastructure, seeking a high return on investment from a network monitoring solution.Statscout generally appeals to government departments, corporate enterprises or educational facilities with 500 to 100,000 network nodes and a distributed network infrastructure, seeking a high return on investment from a network monitoring solution.

DCCC Project Academic Network Internet ProblemsAcademic Network Internet Problems Currently T-1 ISP with VoicenetCurrently T-1 ISP with Voicenet Download speeds 2 to 3 KBpsDownload speeds 2 to 3 KBps Widener ISP solutionWidener ISP solution Download speeds 250 to 300 KBps, testedDownload speeds 250 to 300 KBps, tested Voicenet will handle specified URL’sVoicenet will handle specified URL’s Widener will carry rest of trafficWidener will carry rest of traffic Admin Network will continue with VoicenetAdmin Network will continue with Voicenet

Widener Spring Break One week a year of downtimeOne week a year of downtime Starts 9 pm on Feb 27 thStarts 9 pm on Feb 27 th Ends 9 pm on Mar 8 thEnds 9 pm on Mar 8 th Cisco Routers Upgrade Sat Feb 28 th 8 am – 12 amCisco Routers Upgrade Sat Feb 28 th 8 am – 12 am Shasta Upgrade Mon Mar 1 st 5 am – 7 amShasta Upgrade Mon Mar 1 st 5 am – 7 am ACN UPS Upgrade Mon Mar 1 st 11:30 PM – 3:30 amACN UPS Upgrade Mon Mar 1 st 11:30 PM – 3:30 am Only downtime for WINS 5 am on Mon Mar 1 stOnly downtime for WINS 5 am on Mon Mar 1 st

Questions & Answers Next Meeting Friday Mar 5th!Next Meeting Friday Mar 5th!