<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:PMingLiU;
panose-1:2 2 5 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.hoenzb
{mso-style-name:hoenzb;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Is this actually what caused the outage in full?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Which would mean, seriously, default passwords are still the highest priority risk? *<b>sigh</b>* How are manufacturers still allowed to ship things with ‘admin admin’ as the password?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">*<b>grumbles</b>*<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black">Outages-discussion <outages-discussion-bounces@outages.org> on behalf of Damian Menscher <damian@google.com><br>
<b>Date: </b>Monday, October 24, 2016 at 1:39 PM<br>
<b>To: </b>Charles Sprickman <spork@bway.net><br>
<b>Cc: </b>"outages-discussion@outages.org" <outages-discussion@outages.org><br>
<b>Subject: </b>Re: [Outages-discussion] What Dyn IPs to look for in netflow?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You can identify your infected users by looking for outbound scanning on port 23/tcp. (The Dyn attack was from an IoT botnet which spreads via telnet default passwords.)
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Damian<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Sat, Oct 22, 2016 at 6:48 PM, Charles Sprickman <<a href="mailto:spork@bway.net" target="_blank">spork@bway.net</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">I wanted to poke through our netflow data from Friday to see if any customers were involved. Do we have any idea which Dyn IPs were being hit in the east coast attack?<br>
<br>
I’ve been poking around with sorting by packet count to UDP 53, but I’m not even sure this was an application level or volumetric attack. Nothing is standing out (yet)…<span style="font-family:PMingLiU"><br>
<br>
</span>Thanks,<span style="font-family:PMingLiU"><br>
<br>
</span>Charles<br>
<span class="hoenzb"><span style="color:#888888">--</span></span><span style="color:#888888"><br>
<span class="hoenzb">Charles Sprickman</span><br>
<span class="hoenzb">NetEng/SysAdmin</span><br>
<span class="hoenzb">Bway.net - New York's Best Internet <a href="http://www.bway.net" target="_blank">
www.bway.net</a></span><br>
<span class="hoenzb"><a href="mailto:spork@bway.net">spork@bway.net</a> - <a href="tel:212.982.9800">
212.982.9800</a></span><br>
<br>
<br>
<br>
<span class="hoenzb">_______________________________________________</span><br>
<span class="hoenzb">Outages-discussion mailing list</span><br>
<span class="hoenzb"><a href="mailto:Outages-discussion@outages.org">Outages-discussion@outages.org</a></span><br>
<span class="hoenzb"><a href="https://puck.nether.net/mailman/listinfo/outages-discussion" target="_blank">https://puck.nether.net/mailman/listinfo/outages-discussion</a></span></span><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>