July 2001 - NANOG - lists.nanog.org

RE: telnet vs ssh on Core equipment , looking for reasons why ?
by Grace, Terry 31 Jul '01

31 Jul '01

Here's an alternative that might work. Authenticate via Radius which in turn proxies the authentication request to a SecurId server. With one time passwords, who cares if they get sniffed? You also get the benefit of having your Radius server being able to do accounting/access control on the sessions as well. -----Original Message----- From: Dave Israel [mailto:davei@biohazard.demon.digex.net] Sent: Tuesday, July 31, 2001 2:43 PM To: alex(a)yuriev.com Cc: nanog(a)merit.edu Subject: RE: telnet vs ssh on Core equipment , looking for reasons why ? [Yeah, I know, we've wandered off topic. But security is fun to talk about.] On 7/31/2001 at 12:41:23 -0400, alex(a)yuriev.com said: > > > > > 2) Your vendor's ssh authentication creates a secure connection, and > > transfers the password securely, only to then send the password, > > unencrypted, to an authentication server for verification, making > > ssh moot. > > Establish reasonable path for trust propagation and you have solved the > problem. Except, of course, if I had a reasonable path for trust propigation, I would have a trusted path for telnet logins. ;-) Any compromise on a clear-text telnet password is going to be viable against any other clear-text password transmission. Even restricting logins to certain host ranges only pushes security to those networks. If you're going to sniff my backbone passwords, the networks that are wrapped in are presumably compromised already. Network security is a beast. There's no sure method. Of course, the compromises get progressively more unlikely as time goes on (including keyboard sniffing and signal analysis.) So the question becomes, what is secure enough? If you're only using telnet, with clear passwords, restricted to a certain range (which, by the way, despite a recent post to nanog, we are doing; I'd like to say we left that router open so folks could read my poetry, but the truth is, we were morons and missed it) you're secure as long as your backbone links and backend aren't being sniffed. Physically tapping fiber isn't terribly easy for the average hacker, and careful routing protocol selection and implementation should keep you from external intrusion. So really, your back-end that's the most likely way in. So... does anybody know how long it takes to hack an ssh key given identity and identity.pub? Because, if I have your machine, I have these... it's just a matter of unlocking your passphrase. (And not even that, if you're running ssh-agent and I can get to that...) -- Dave Israel Senior Manager, IP Backbone Intermedia Business Internet Get to know us http://www.thestar.com - Canada's largest daily newspaper online http://www.toronto.com - All you need to know about T.O. http://www.workopolis.com - Canada's biggest job site http://www.torontostartv.com - Webcasting & Production http://www.newinhomes.com - Ontario's Largest New Home & Condo Website http://www.waymoresports.com - Canada's most comprehensive sports site

2 1

Code Red round two
by Jeff Ogden 31 Jul '01

31 Jul '01

So what, if anything, are people planning to do differently as 8 pm EDT today and the possibility of a new round of Code Red Worm activity approaches? Are there things that we as network operators can and should be doing beyond encouraging end users to patch their vulnerable systems? -Jeff

3 3

RE: telnet vs ssh on Core equipment , looking for reasons why ?
by Roeland Meyer 31 Jul '01

31 Jul '01

> From: Stephen J. Wilcox [mailto:steve@opaltelecom.co.uk] > Sent: Tuesday, July 31, 2001 6:52 AM > so thats my main logic, authentication... i cant understand the big > paranoia on people sniffing tho! If ANY part of the link, between the NetAdm and the CORE system, even accidently, transits ANY part of an untrusted network, then that link is sniffable. Now, if you are accessing said equipment, via in-band means, this is virtually guaranteed to be the case (with a small number of anomalous exceptions). Even out-band networks are vulnerable if someone accidently leaves one host, in router-mode, and one of the NICs is on the Admin LAN. With dynamic routing, this is even less deterministic. Given a Firewall, one contractor/sales-person, with a lap-top and an 802.11b (or even Ricochet) connection to the outside world, on your inner-LAN; Your Firewall becomes a potential Maginot Line ... useless. [side-bar: A Compaq Ipaq can do this, running Linux. As PDAs get more powerful, they also become potential stealth cracker tools] Ergo, all networks are potentially sniffable. Many of them leak like sieves. You also imply another fallacy, that of only encrypting sensitive traffic. Given the above and in a stack full of needles, when you know that only the encrypted ones are interesting, you will only sniff the encrypted ones (this is the essential fallacy of SSL, it's even conveniently segregated by port number). This measurably cuts down the search time. Now if all needles were equally encrypted you add steganographic effects, to the LAN, and it becomes orders of magnitude more difficult to crack. I submit that all packets, on all networks, even SANs, should be strongly encrypted, at all times. I further submit that all hosts, even those behind a Firewall, should be hardened against attack. Never assume that you are safe.

1 0

Re: Hard data on network impact of the "Code Red" worm? (fwd)
by Larry Sheldon 31 Jul '01

31 Jul '01

> : >NTBUGTRAQ is carrying informatiion that says that is not right. > : > > : >They say that currently extant copies of the thing will sleep forever, > : >or until the host is re-booted--at which time the thing ceases to exist. > : > : There seems to be some disagreement about this point. CERT, in fact, > : notes that explicitly (http://www.cert.org/advisories/CA-2001-23.html) > : They also claim that enough infected machines have their clocks set > : wrong that there may be a new outbreak tonight (EDT) -- that one > : strikes me as less plausible. > > Less plausible in the (statistical) abstract... however as CERT also > points out (emphasis mine): > > "Our analysis estimates that starting with a *SINGLE* infected > host, the time required to infect *ALL* vulnerable IIS servers > with this worm could be less than 18 hours. " > > It only takes one. Well, some of us think it take vulnerable IIS servers too. Some of us think we listened to the wake-up call and have plugged some of the holes, learned how to detect the occurrence of un-plugged holes and so on. Some of us are wrong. > : >The hazard tomorrow is the introduction of new copies of the thing. > : > > : > : That hazard isn't specific to August 1. > > Well... maybe... but suppose July was just practice? Another worm with > the same time-pattern encoded, but with different targeting and/or > capabilities. Clever malice trumps predictability any day... Well... maybe... but suppose the sky really is falling, or that some completely unrealted vermin has been released, or that my "atheletes foot" really isn't cured. Can't deal with most of the 'sposes--not able to handle all of the "is"'s. If ordinary diligence, prudence, care, craftsmanship and skill don't do it, then the bad guys have won, and we will (probably) rethink how we use wires.

1 0

A call to sanity/action on responding to Code Red.
by Erik Antelman 31 Jul '01

31 Jul '01

according to a "pundit" (http://www.pbs.org/cringely/pulpit/pulpit20010730.html) "officials" determined that sending E-Mails to sysadmins of infected domains would be unacceptable. WHAT!? - This is crazy, I learned of our server being infected by a admin in Oregon and I was grateful, who wouldn't be? Those that would be upset can live with the abuse as long as they don't fix there machines. A central authority notifying infected hosts would be far more beneficial than wasting bandwidth on redundant notifications, until such an authority stands up keep those notifications going out to people with infected machines. for(;;); /* eantelman(a)acm.org */

1 0

Code Red round two
by Larry Sheldon 31 Jul '01

31 Jul '01

> So what, if anything, are people planning to do differently as 8 pm > EDT today and the possibility of a new round of Code Red Worm > activity approaches? Are there things that we as network operators > can and should be doing beyond encouraging end users to patch their > vulnerable systems? I'll do what I have done for most of the over-hyped hysterical panics that I have taken the time to think through (yes, that says I have dozed and gotten caught up in frenzies--Y2K was not one of them [1]): I'll go to the dentist to get a tooth filled after lunch. That will annoy me enough that I will go home. I'll feed the cats, and make myself something interesting (last day to play, my wife returns tomorrow) to eat. I'll either eat what I made, or head 7 miles to the nearest pizza store for a replacement (they won't deliver that far out <*snif*>. To earn the big bucks I get, at the magic hour or as soon as I finish eating, which ever occurs last), I'll start paying closer attention to our network indicators, the logs, email, and the office voice mail. If the evening goes the way I think it will, I'll get tired of it and go to bed. If it goes the way some say it will, in between telephone calls to the support troops (they are all on "speed dial" anyway), I'll be looking up recipes for things like, crow, my hat and so on. [1] Does anybody else think that W2K actually is doing what Y2K only dreamed of?

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Steven M. Bellovin 31 Jul '01

31 Jul '01

In message <200107310341.WAA01723(a)bluejay.creighton.edu>, Larry Sheldon writes: > >> On Mon, 30 July 2001, k claffy wrote: >> > so, 1 aug midnite GMT (tomorrow 17:00 in california), >> > codered goes back into 'spread' mode. >> > within a few hours, we'll have 100,000-300,000 >> > globally infected machines again. > >NTBUGTRAQ is carrying informatiion that says that is not right. > >They say that currently extant copies of the thing will sleep forever, >or until the host is re-booted--at which time the thing ceases to exist. There seems to be some disagreement about this point. CERT, in fact, notes that explicitly (http://www.cert.org/advisories/CA-2001-23.html) They also claim that enough infected machines have their clocks set wrong that there may be a new outbreak tonight (EDT) -- that one strikes me as less plausible. > >The hazard tomorrow is the introduction of new copies of the thing. > That hazard isn't specific to August 1. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 31 Jul '01

31 Jul '01

On Mon, 30 July 2001, Christian Kuhtz wrote: > Your logic is flawed. If this was true, zombie networks would be largely > ineffective. The current mutation is nothing more than an automated zombie > distribution network, with all fun options of current zombie networks such as > remote control, remote upgrades etc... > > You may want to read up on the details of this one, like the presentation at > the bottom of http://www.digitalisland.net/codered/ If "code red" is nothing more than what we've been seeing for years, why the special CNN reports every half-hour, and the joint press conference with our fearless leaders today? What makes "code red" so extrodinary it merits this special response, when previous "zombie" networks didn't? I have a hard time seeing how "Code Red" will ever live up to the advance hype on August 1. Is Don King managing the pay-per-view for this event? Michelangelo Vs. Code Red. Why don't we just have an annual, lets update your Microsoft software patches day. Every year the press can get on the bandwagon and remind us about changing the batteries in our smoke detectors and downloading the latest patches. There are a lot of flawed systems out there. Downloading a couple of patches for "Code Red" isn't enough to protect your system from all the other things. I'm worried the joint press release is doing a disservice if people have a false sense of security because they protected themselves from "code red." On the other hand, will wednesday really be that much different from any other wednesday with the normal thousdand DDOS attacks happening, and normal spam, and normal e-mail/macro viruses, and normal zombies? I think its a bit premature to predict the end of the Internet on August 1.

6 5

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 31 Jul '01

31 Jul '01

On Mon, 30 July 2001, k claffy wrote: > so, 1 aug midnite GMT (tomorrow 17:00 in california), > codered goes back into 'spread' mode. > within a few hours, we'll have 100,000-300,000 > globally infected machines again. > and presumably they won't stop at the > end of the day to start phase two this time. > (remember CRv2 only had a day before it > went into phase two the first time) I agree, we were lucky on some things. But predictions are always hard because we never completely understand the problem. What natural limits (or predators) exist controlling the spread of the worm. If the worm destroys the very infrastructure it needs to survive, it tends to be self- limiting. If the worm keeps re-infecting the same machines, they tend to die and stop spreading. Custodians (i.e. system and network administrators) have shown the ability to adapt, and respond if the worm is too slow. I suspect, but have no evidence, the worm can quickly spread through hundreds of thousands of machines, but then the worm's behavior tends to interfere with its ability to propagate. If it attacts attention to itself, the system administrator may take action. I know, later variants no longer change the web site. If the worm takes out DSL modems and other network infrastructure, machines behind DSL modem are isolated until a network operator can intervene. If the site is on auto-pilot, this also limits the worm. Several folks have sent me mail saying we should be worrying about the quiet zombie machines. They feel there are far more of them on the net than the "code red" worm. But the question is what are they waiting for? Argh, this is why I got out of security. Too many twisty passages. It is dark. You have been eaten by a Grue.

3 2

Hard data on network impact of the "Code Red" worm?
by Sean Donelan 30 Jul '01

30 Jul '01

As several government agencies gear up today to get additional funding, what hard data about the impact of the code read worm on the Internet exists? CAIDA posted some data about the speed of infection. But I was looking at overall Internet performance during the time period. The worm tended to revisit the same systems over, and over again, so I would agree those people may have been severely affected. But 350,000 hosts isn't that big of a number any more. The Morris Internet Worm infected an estimated 10% of the internet hosts of the day. What do you think had more world-wide impact on the Internet? 1. The train accident in Baltimore 2. The "code red" worm

7 7