April 2000 - NANOG - lists.nanog.org

How long before NIPC decides we need one of these?
by Roland Dobbins 05 May '00

05 May '00

http://www.the-times.co.uk/news/pages/sti/2000/04/30/stinwenws01034.html -- ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice

8 13

RE: ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 01 May '00

01 May '00

A thought just came to me. My experience with above.net, and exodus.net, leaves me to KNOW that a certain exodus engineer's wife works as an engineer at above.net. Reading the quote at http://www.cnn.com/2000/TECH/computing/04/28/fbi.abovenet.idg/index.html Quoted: "Vixie says the company has speculated widely as to the motive for the attack and concluded that it could have emerged from one of two "completely useless categories." One category includes competitors that the company took a customer away from, disgruntled former employees or customers who had been disconnected because they were spamming. The other category, said Vixie, includes "someone who has something to prove and wants to bring our network down and wants to brag about it." " Ebay WAS at exodus, then half of it went to above. Maybe this is just the "conspirator" in me, but, what if that husband/wife team was 'contracted' for revenge, for the ebay move, and participated in paid corporate espionage? :) __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

8 8

Re: Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Danny McPherson 01 May '00

01 May '00

> Since I value your input, I'm not sure if you are joking, or serious. > > I understand the humorous issues involved here (believe me, I do), > I'm really serious about this, and I need serious feedback. I was obviously joking about the "disinformation experts" comment, at least to some degree. However, I certainly do agree that it's a good idea to discuss this as you propose at the upcoming NANOG, especially in lieu of recent occurrences. I don't believe some folks realize how much people read into topics discussed on this list, or understand the impact that seemingly simple posts (accusations about Vendor A's broken software, Vendor B's broken hardware, ISP A's broken network, ISP B's poor customer service, ISP C's security practices, etc..) have on these businesses, and more so, the individuals involved, especially since those accusations are often [demonstrated] premature or completely unfounded. -danny

4 3

Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Sean Donelan 01 May '00

01 May '00

Folks seem to be concentrating on locking down the front door. You also need to watch all the backdoors. With multi-protocol equipment, there are a lot of backdoors. Is syslog sending plaintext information, when was the last time you changed snmp community strings, do you have read-write snmp or rsh/rcp access enabled, are ancilliary services like ntp, ospf and bgp authenticated? Have you turned off any services you aren't using such as MOP? If you network load your configuration, how do you know you got your configuration? Do you understand how arp works/doesn't work. After securing your network, one security issue I rarely see explicitly addressed is what do you do when your authentication stops working for whatever reason. Have you made plans for breaking into your own network. Vendor backdoors should require physical access to the equipment (e.g. moving a switch) not just knowledge of a "secret" maintenance password or special signal over a remote control line (e.g. break).

3 2

Re: ICQ & AOL
by sthaug＠nethelp.no 01 May '00

01 May '00

> I'd venture to say that this is the result of the following phenomena: > > Block all APNIC and RIPE assigned networks at the border and all of the > sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. And if I block the ARIN assigned networks, most of the spam I receive disappears. It's very effective. In fact, I can limit myself to blocking all email from Hotmail, AOL and a few other large ISPs in the US, and that'll take care of most of the spam too... Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

SSH on Cisco Routers (was RE: ABOVE.NET SECURITY TRUTHS?)
by Ron Buchalski 01 May '00

01 May '00

SSH1 is supported on the following platforms starting in 12.1(1)T: C17x0, C25xx, C26xx, C36xx, C4x00, C7x00 See: http://www.cisco.com/warp/customer/cc/cisco/mkt/ios/rel/121/prodlit/1065_pp… -rb >From: "Mr. James W. Laferriere" <babydr(a)baby-dragons.com> >To: "Greene, Dylan" <DGreene(a)NaviSite.com> >CC: "'Paul Froutan'" <pfroutan(a)rackspace.com>, rmeyer(a)mhsc.com, >nanog(a)merit.edu >Subject: RE: ABOVE.NET SECURITY TRUTHS? >Date: Fri, 28 Apr 2000 14:34:14 -0700 (PDT) > > > > Hello Dylan, Knew this was coming . But I'd hoped that > the supported platforms would have been a little larger . > Just the 7200 & UP . Seems cisco thinks ssh puts a bit > of load on a cpu ? I can't see that for just a terminal > session though . Twyl, JimL ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

4 3

RE: ABOVE.NET SECURITY TRUTHS?
by Greene, Dylan 01 May '00

01 May '00

Maybe I should read the entire message before responding.. hehe.. =) A switched private management lan resolves the cleartext problem. SSH version 1 is apparently supported in 12.0 as well (never played w/ it, so dunno how well it works); http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120 limit/120s/120s5/sshv1.htm ..Dylan | -----Original Message----- | From: Paul Froutan [mailto:pfroutan@rackspace.com] | Sent: Friday, April 28, 2000 4:46 PM | To: rmeyer(a)mhsc.com | Cc: nanog(a)merit.edu | Subject: RE: ABOVE.NET SECURITY TRUTHS? | | | | I don't think you can. However, I use TACACS on all my switches and | routers. From what I know, TACACS passwords are encrypted | using the key on | your network devices and the TACACS server. So, that, in | combination with | a private management LAN not accessible by your customers | should lock down | your network pretty effectively. Any comments? | | At 4/28/00 -0700, you wrote: | | > > Exiled Dave | > > Sent: Friday, April 28, 2000 1:10 PM | > | > > Lets think about this, cisco in no way has such a flaw | > > that would allow someone to 'root' and erase all the | > > info on switches. The password was sniffed. | > | >Can one setup SSH on a Cisco 6509? | | Paul Froutan Email: | pfroutan(a)rackspace.com | Rackspace, Ltd <http://www.rackspace.com> | |

7 8

Re: ABOVE.NET SECURITY TRUTHS?
by Danny McPherson 01 May '00

01 May '00

IMO, it requires more than this. Ideally, one-time, token-based (i.e. SecurID) passwords, coupled with SSH, is the best solution, especially with the turnover rates at providers these days. Of course, this also requires that all the backend (RADIUS, configuration management, etc..) and out-of-band systems are secure, which is another rathole altogether. As for this incident, well, I think if the intial intent of the "divulging message" was simply to remind folks to change their passwords, the points been made. -danny > > I don't think you can. However, I use TACACS on all my switches and > routers. From what I know, TACACS passwords are encrypted using the key on > your network devices and the TACACS server. So, that, in combination with > a private management LAN not accessible by your customers should lock down > your network pretty effectively. Any comments?

2 1

Re: ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 30 Apr '00

30 Apr '00

Ive had some private messages asking if i was involved in this. I wasnt. I was asked to write this initial email by someone who KNOWS the real truth of what happened at above, and why they are being so tight-lipped. Lets think about this, cisco in no way has such a flaw that would allow someone to 'root' and erase all the info on switches. The password was sniffed. Unless above has some employee who felt the need to do do this. But, my Above rep laughling CONFIRMED that this was the problem. COMMON PASSWORDS. Cant we make it a LITTLE tougher on the script kiddies? And not make EVERY MAJOR switch the same password? This is safe to post, because my above sales rep told me what the old password was. God. THATS SECURITY. Sales reps telling Clients OLD PASSWORDS. So, if we wanna verify my authenticity, Here's what she told me: whY2Ghay/1Pee-Fr331y Sound framiliar Above? Im suprised by lack of comment from you. Im out to HELP. Not to hurt. __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

10 10

Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Shawn McMahon 30 Apr '00

30 Apr '00

On Sun, 30 Apr 2000, Bennett Todd wrote: > > GNU Keyring <URL:http://gnukeyring.sourceforge.net/> is your friend. > Store passwords in your Palm, with no fears for the security of the > backups or the loss of the Palm. And it can generate nice passwords, > too. However, it marks the database file as "no backup" by default, and you have to use third-party tools to change that. Oh, and that stuff about having a week to change the battery before you lose your data after the screen goes blank; rubbish. :-) Since it's entirely likely that you'll pick a weak passphrase to protect the Palm keyring, if you *DO* change the backup bit on that database, don't sync it at work. Or, leave the backup bit alone, so it doesn't back up on hotsync, but use a third-party backup tool to grab the whole shebang frequently. Yes, I learned this the hard way.

1 0