[nsp-sec] CANTV poc?

[Chris Morrow]

On Wed, 16 Sep 2009, Rodolfo Baader wrote:

> Hi Chris,
>
> You can contact the VenCERT team (Computer Incident Management National System)
>
> Team Contact Information:
> - Regular telephone number: +58 212 5785672 (GMT -4:30)
> - Emergency telephone number: +58 0800 VENCERT
>                                 +58 416 2033387 (GMT -4:30)
>
> - E-mail address: incidentes at vencert.gob.ve

cool, thanks... It seems that this is probably spoofed, since I'm seeing 
this distribution of packets (though mostly inbound on sprint links, 
oddly):

count icmp-type/code
  3480 0    - 0/0  echo-response
  1674 2048 - 8/0 echo-request
     9 771  - 3/3 port-unreachable
     8 769  - 3/1 host-unreachable

So... I'll email ven-cert and see if they can point me to a cantv POC, but 
if Sprint could have a look that'd sure help :)

-Chris

>
> Regards,
> R.
>
> Chris Morrow wrote:
>> ----------- nsp-security Confidential --------
>>
>> Does someone have a CANTV (AS8048) POC around? apparently a few of
>> their customer ips are ping flooding some google ips (to the tune of
>> ~50mbps). This is not causing actual pain, just people complaining
>> about 'i cant ping the googlez!!'
>>
>> -Chris
>
> _______________________________________________
> nsp-security mailing list
> nsp-security at puck.nether.net
> https://puck.nether.net/mailman/listinfo/nsp-security
>
> Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
> community. Confidentiality is essential for effective Internet security
> counter-measures.
> _______________________________________________
>