November 2008 - Core-students - mailman3.cels.anl.gov

Returned mail: see transcript for details
by Mail Delivery Subsystem 13 Nov '08

13 Nov '08

The original message was received at Thu, 13 Nov 2008 15:32:22 -0600 from foxtrot.mcs.anl.gov [140.221.9.122] ----- The following addresses had permanent fatal errors ----- <kjprice(a)ncsa.uiuc.edu> (reason: 550 5.7.1 <kjprice(a)ncsa.uiuc.edu>... server pop.ncsa.uiuc.edu for <kjprice(a)ncsa.uiuc.edu> rejected address saying "<kjprice(a)ncsa.uiuc.edu>... User unknown") ----- Transcript of session follows ----- ... while talking to rimantadine.ncsa.uiuc.edu.: >>> RCPT To:<kjprice(a)ncsa.uiuc.edu> <<< 550 5.7.1 <kjprice(a)ncsa.uiuc.edu>... server pop.ncsa.uiuc.edu for <kjprice(a)ncsa.uiuc.edu> rejected address saying "<kjprice(a)ncsa.uiuc.edu>... User unknown" 550 5.1.1 <kjprice(a)ncsa.uiuc.edu>... User unknown

1 0

Where's Rick tomorrow friday 13th
by Rick Bradshaw 13 Nov '08

13 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have to wait or a package tomorrow morning, so I will be working from home. I will be on the mudd, and IM. I will also be watching email and so on. I am hoping to be in by Noon at the latest. Rick -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJHJgzdavihOKkCCERAsyzAJsEOBP/vc1Ds/t0VkQa6/axXygtzgCglPxQ zEoYQqGImihH2erUTdSs6Qo= =4cZg -----END PGP SIGNATURE-----

1 1

ANL Domain account changes were detected in the MCS organization!
by ANLDomainAdministrator＠anl.gov 13 Nov '08

13 Nov '08

This is an automated email message from CIS account administration. Please do not reply to it. The following changes to the ANL Domain accounts of the MCS organization were detected today. These changes are since 12-November-2008 7-55-00 AM. The following accounts were removed (disabled): tpmatthews 00058742 Matthews, Thomas P., Jr. The following accounts were added: hunter 00058742 Matthews, Thomas P., Jr. Note that if an account was renamed, then the old name will appear as a deletion and the new name will appear as an addition. A full list of active MCS accounts is attached.

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 13 Nov '08

13 Nov '08

This is the Postfix program at host breeze.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <dyrkacz(a)mcs.anl.gov>: host mailgw.mcs.anl.gov[140.221.9.4] said: 550 <dyrkacz(a)mcs.anl.gov>: Recipient address rejected: User unknown in relay recipient table (in reply to RCPT TO command)

1 0

Security buzz on Friday
by Craig Stacey 12 Nov '08

12 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For those who aren't out of town, we're going to have a quick security sync on Friday to make sure all our ducks are in a row in preparation for the red team attack we're going to face. I've got 221-A261 booked Friday from 1:30-2:30. If you manage an externally exposed machine, you'll want to attend. We'll go over what machines are exposed, what steps we need to take to make sure we're covered. ORNL and PNNL were both owned by these guys, and they're paying for it. ANL might get owned, we only have control over a small amount of it. But I still want to keep us off the radar, especially in light of the recent hacks we had in September. == Craig -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkkbZYkACgkQbVNGA3HOzQs9kgCeKp59+L37DTYjE7Ga8Uap3IJu jggAnRdAwCtT/4EXzHld3VbLN62BQkWP =bHAh -----END PGP SIGNATURE-----

2 1

Where's John?
by John Valdes 12 Nov '08

12 Nov '08

Sorry, I forgot to send this out earlier. I need to take care of some family-related things tomorrow, so I'll be taking the day off. I'll be offline but checking email every so often, and I'll be reachable by cell should anything come up. Please put me down for 1 day vacation. John

1 0

Resolve tickets via e-mail
by Craig Stacey 12 Nov '08

12 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 For those who want to resolve a ticket via e-mail, I've put in a Scrip that does this (for mcs-systems). All you need to do is forward to mcs-systems-comment(a)rt.mcs.anl.gov where the top of your message contains, on a line by itself: resolveticket It'll resolve, and not bug the user. This is only on the mcs-systems queue at the moment. If anyone else wants it on their queue, feel free to steal or I can set it up. == Craig -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkkbDocACgkQbVNGA3HOzQsOOwCgiX0zDK1nZEavF0khtsUBg+Zi V1IAn0srIHyUCw5e1+MK1Z6KSUx9j+wZ =kQ16 -----END PGP SIGNATURE-----

1 0

Undelivered Mail Returned to Sender
by MAILER-DAEMON＠mcs.anl.gov 12 Nov '08

12 Nov '08

This is the Postfix program at host owney.mcs.anl.gov. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <michealjohnson207(a)gmail.com>: host gmail-smtp-in.l.google.com[72.14.205.114] said: 550-5.1.1 The email account that you tried to reach does not exist. Please 550-5.1.1 try double-checking the recipient's email address for typos 550-5.1.1 or unnecessary spaces. Learn more at 550 5.1.1 http://mail.google.com/support/bin/answer.py?answer=6596 s35si15845513qbs.13 (in reply to RCPT TO command)

1 0

[Fwd: Heads Up: Cyber Security Red Team Assessments]
by Rick Bradshaw 12 Nov '08

12 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am fairly certain everyone already got this message, but I just wanted to through it out there again incase anyone isn't on the cyber911 list. Rick - -------- Original Message -------- Subject: Heads Up: Cyber Security Red Team Assessments Date: Tue, 11 Nov 2008 23:16:57 -0600 From: Skwarek, Michael A. <MSkwarek(a)anl.gov> To: <cyber911(a)anl.gov> Everyone, Earlier today, I received information from the Office of Science (SC) that each of the SC labs will be under going a full technical cyber security assessment in the coming weeks. These assessments have been requested by Dr. Orbach (Undersecretary for Science) as a result of the outcomes reached by the recent OA/HSS assessments at PNL and ORNL. In the OA assessments at PNL and ORNL, the assessment teams leveraged social engineering (email and Cds), administrative rights on the desktop, poor configuration management and weak internal IDS to gain full administrative permissions across the Laboratory and lay undetected for months. Complete details on the upcoming assessments are sketchy, but the following items are solid at this point. * The assessment will be conducted by a team of highly qualified professional penetration testers. This group is known as the "A-Team" (not the 1980s TV show cast) within DOE circles for their capabilities and success in breaking into systems. Some have said that this team is far better than what we have seen in the past with the HSS/OA teams. Each of the members are DOE employees and carry a Q-clearance. Note: This is not the team that had success at PNL/ORNL. * Vulnerability testing will include both external and internal assessments. External scanning is to begin in the coming days. We do not know any information as to where they will be coming from (IP address-wise) during their external scanning. Information is unclear at this time regarding internal scanning. If systems are found to be vulnerable, they will be exploited and that system will act as a jumping point. * Social Engineering testing will happen - no doubt. In the past, this team has used every social engineering method possible: email, thumb drives, cds, phone calls AND physical on-site assessments. * We will not lower our defenses in anyway, nor have we been asked to. If we detect a level of scanning and or social engineering, we will play through the normal actions as we would with any other real hack attempt. * Each site will be allowed a "White Cell" who will be aware of the actions of the assessment team and will be able to stop the assessment at anytime they feel that actions may harm the operational stability of the Laboratory. At this time, I will be the White Cell for Argonne until told otherwise. As further details become available, I promise to pass them along to everyone. At this time, we should begin to position ourselves for the assessment in the following ways: * Harden External Exposure: Ensure that conduit enabled systems are patched and up to date. Ensure that new vulnerabilities identified by Scavenger for conduit enabled systems are addressed as soon as possible. We will take a quick pass at conduits with low to zero hits, and will be pinging divisions on their need to remain open. * Harden Internal Exposure: Ensure that vulnerabilities identified by the Scavenger Monthly and Low Hanging Fruit scans are addressed in a timely manner. Timing is on our side that we just kicked off the new monthly scans, and we should be in a good position for when they decide to perform internal scans. * Heightened Awareness: We need to reiterate with our employees the need to be vigilant with respect to social engineering. Thinking past the strange email will be important in this assessment as this team will use the full toolbox (including coming on site -> They do have badges). We will run the Argonne today articles, and it will be important that we communicate this numerous times with our users in the coming weeks. * Communication: If you witness abnormal behavior in your logs or if a user reports a strange email or phone call, please contact the cyber office immediately at cyber(a)anl.gov or 2-3456. We promise to communicate any information that we gather via this distro. More information will follow, and if you have any questions, please do not hesitate to give me a call. Mike _______________________________________________ ihw_itadmins mailing list ihw_itadmins(a)lists.anl.gov https://lists.anl.gov/mailman/listinfo/ihw_itadmins _______________________________________________ ihw_users mailing list ihw_users(a)lists.anl.gov https://lists.anl.gov/mailman/listinfo/ihw_users -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFJGu8LdavihOKkCCERApPxAKCDBithFqeRNUoUbHA8JUc+5CyTIwCfY2dX q5GQTBeerMMSg4yOeHqIBug= =emtY -----END PGP SIGNATURE-----

1 0

ANL Domain account changes were detected in the MCS organization!
by ANLDomainAdministrator＠anl.gov 12 Nov '08

12 Nov '08

This is an automated email message from CIS account administration. Please do not reply to it. The following changes to the ANL Domain accounts of the MCS organization were detected today. These changes are since 11-November-2008 7-55-00 AM. The following accounts were added: hnaik 00057865 Naik, Harish G. Note that if an account was renamed, then the old name will appear as a deletion and the new name will appear as an addition. A full list of active MCS accounts is attached.

1 0