July 2003 - NANOG - lists.nanog.org

Re: PSI (UK/Europe) out ??
by neil＠DOMINO.ORG 29 Jul '03

29 Jul '03

Power failure in Telehouse... > > > Thorsten Toenges wrote: > > you're flapping too much :) > > I wish it were me, but we are not doing BGP at that site. Sigh. Thanks for > looking. Still on hold - the uaul recorded platitudes about 'experts' and > 'you are important'. > > Peter > >

1 0

Re: PSI (UK/Europe) out ??
by Peter Galbavy 29 Jul '03

29 Jul '03

Thorsten Toenges wrote: > you're flapping too much :) I wish it were me, but we are not doing BGP at that site. Sigh. Thanks for looking. Still on hold - the uaul recorded platitudes about 'experts' and 'you are important'. Peter

1 0

Re: Learning more about authentication and passwords
by Dave Israel 29 Jul '03

29 Jul '03

On 7/29/2003 at 04:37:01 -0400, Sean Donelan said: > > > If you would like to learn more about the strengths and weaknesses > of various authentication methods, I highly recommend the book > > Authentication: From Passwords to Public Keys > by Richard E. Smith ISBN: 0201615991 > I'll add: Network Security: Private Communication in a Public World by Charlie Kaufman, Radia Perlman, Mike Speciner, Charles Kaufman Prentice Hall PTR ISBN: 0130460192 I have not read the 2nd Edition, but the 1st was excellent. -- Dave Israel Director, Data Engineering Allegiance Telecom

2 1

Re: Remembering history passwords may be bad, but they are getting worse
by Kevin Day 29 Jul '03

29 Jul '03

>The problem is fewer and fewer modern systems implement the other >recommendations. So password lifetime has become the primary protection >factor. > >How many systems notify the user > - the date and time of user's last login > - the location of the user at the last login > - unsuccessfull login attempts since last successful login >How many web systems control the rate of login attempts > - by source > - by userid >How many web systems notify anyone or block the account after N >unsuccessful login attempts either temporarily or permanently Sean: I run one of the larger adult websites, that has a reputation for being very difficult to acquire passwords for. The kind of attacks we see now aren't solved by any of the above. We throttled the number of login attempts per IP, then the attackers switched to using proxy servers. Tens of thousands of them at once. Our database of IP addresses that have had more than 100 bad login attempts is now around 100,000. (Most of which are all now banned completely). We also tried put rate limiting on login attemps by username. This allowed any idiot to lock any of our legit customers out of the system whenever they want, providing an easy denial of service, so this was scrapped pretty quickly. The attacks we see now are... well orchestrated. 10-50,000 proxy servers all making login attempts at once, rather slowly. 10-50 login attempts per second, each from a different proxy. Still slow enough per IP that it doesn't hit our threshold for how many bad logins per IP per hour we allow, but enough attempts that just by trying seemingly random username/password combinations they get a couple of successes a day. We've also seen people trying what appear to be known good username/password combos that were presumably acquired from other sites that were compromised in some way. We keep detailed histories of all the login attempts per IP, and can eventually weed out the exploited proxies from actual users, but this takes an incredible amount of our time, CPU time and database storage just to manage. A few weeks ago, after we tightened our login attempt limits, whoever is doing this decided to point all the proxies to a public URL that was very database intensive, and requested it over and over again(apparently to get revenge/in frustration), killing our database server for several hours until I figured out what was going on. We tried putting up something that was displayed to users showing their last login time and IP, in hopes that some would notice their account being used by others. Many ISP's force users to go through a proxy server, usually without their knowledge. We'd report the IP address that we saw (the proxy server) which would freak out many users because it didn't match their system's IP. The login time is apparently meaningless to most users, who didn't seem to keep track of when their last login in. We do have our tricks to detect when an account has been compromised, but they're not 100% accurate, so it usually comes down to having to wait until our friendly hacker and his 500 closest buddies are all sharing the account. We're taking steps to make brute force attacks like that impossible (forced random passwords, etc) but we've found that many users won't tolerate not being able to choose their own password. If forced into it, they forget their passwords very easily and the support costs from dealing with password recovery are generally higher than passwords leaking out. While the recommendations you listed are probably worthwhile to stop some attacks, they're not going to stop people determined enough to get into SOME account if they're not picky on which one. -- Kevin

4 3

Re: Hollywood plot: Attack critical infrastructure while President is in town
by Stewart, William C (Bill), RTSLS 29 Jul '03

29 Jul '03

As Vadim said, it's about display of power. However, I'm not worried about terrorists attacking infrastructure under the cover of Presidential No-Fly Zones; I'm more worried about backhoe drivers named Bubba who didn't call the "Call Before You Dig" number and weren't noticed by cable route overflights because they were grounded while Bush gets his hair cut. On the other hand, that's what diverse cable routes and rapid restoration systems are for, and even with air patrolling of cable routes, there's the occasional Bubba who's checked with the call-before-you-dig people (so the air patrols don't stop him) and makes a mistake about where to dig...

3 2

a new labor intensive layer 1 solution (humor?)
by Eric Kuhnke 29 Jul '03

29 Jul '03

Backhoes, natch... All you need is a camo uniform, M-16, and spool for rapid network deployment: http://www.army-technology.com/contractors/navigation/brugg/brugg5.html Repairing cables places your life at risk: http://colofinder.net/gallery/view_photo.php?set_albumName=album17&id=izd_0…

6 7

In answer to a Nanog request - How to get Free Cook Report Back Issues
by Gordon Cook 28 Jul '03

28 Jul '03

Well over a year ago someone on Nanog asked me why I didn't give away back issues. I said I planned to give them away at the Creative Commons web site. I sent a bunch to them on a CD rom but as far as I know nothing happened. OK - The wait is over and more than 10 years of back issues are now available at no cost. Two from just over a year ago instantaneously. The rest by registration. At http://cookreport.com/ you will find pointers to the following changes. 1. COOK Report Back issues available three different ways. (a) You can down load past issues from April 1992 through June July 2002 by registering and having me assign a username and password. (b) The issues of April - May and June July 2002 are instantly down loadable without registration via 2 links at the top of the home page. (c) In about 2 weeks they likely will also be available for a small charge on a CD rom through cafe.press 2. There are also some very nice endorsements. 3. There are two small forums.... one where you can make comments and a second one way mail list from me that you can sign up for. In the next 30 days I may install an actual blog - namely Greymatter http://noahgrey.com/greysoft/ I would welcome comments on what folk find. BTW I will publish an issue on license exempt wireless by about Labor Day. Between now and the end of the year one of my interests is to explore what IBM is calling pervasive computing. This, by 2010, could involve many hundreds of millions of small embedded processors using open source software and license exempt spectrum. I would appreciate pointers to people doing work in the area of pervasive computing. It is allied with grids certainly. But grids would be, I think, more of a back end. -- ============================================================= The COOK Report on Internet, 431 Greenway Ave, Ewing, NJ 08618 USA 609 882-2572 (PSTN) 703 738-6031 (Vonage) 17318 (FWD) cook(a)cookreport.com Subscription info & prices at http://cookreport.com/subscriptions.shtml Fiber & Wireless as First Mile Technology - Fiber Business Models & Architecture, July- September 2003, 130 pages available at http://cookreport.com/12.04-06.shtml =============================================================

1 0

RE: a new labor intensive layer 1 solution (humor?)
by Temkin, David 28 Jul '03

28 Jul '03

Which, ironically coincided with the time WorldCom bought UUNet. <duck> -----Original Message----- From: Christopher L. Morrow [mailto:chris@UU.NET] Sent: Monday, July 28, 2003 1:05 PM To: Robert E. Seastrom Cc: Eric Kuhnke; nanog(a)merit.edu Subject: Re: a new labor intensive layer 1 solution (humor?) On Mon, 28 Jul 2003, Robert E. Seastrom wrote: > > "Christopher L. Morrow" <chris(a)UU.NET> writes: > > > I believe thats an FN-FAL rifle, not a M-16... I wonder if telcom's > > could employ these folks to watch over their fiber lines to keep the > > backhoes away? > > It's a SIG SG550, not an FAL or an M16. well there ya go! :) I just knew it wasn't a m16 and was guessing toward the FAL due to language and stock appearances... been a few years since I spent time looking at guns.

3 2

Re: Its not just Spam and DDOS anymore (was Re: OT: Re: User negligence?)
by Peter Gray 28 Jul '03

28 Jul '03

On the subject of host security issues and spam, try doing a search of the Usenet archive for '"Net Access Corporation" spam'. You get 328 results. And those are just the spams which people have traced to NAC, never mind the millions of untraced ones.... >From: Sean Donelan <sean(a)donelan.com> >To: Alex Rubenstein <alex(a)nac.net> >CC: nanog(a)merit.edu >Subject: Its not just Spam and DDOS anymore (was Re: OT: Re: User >negligence?) >Date: Sun, 27 Jul 2003 02:39:31 -0400 (EDT) >MIME-Version: 1.0 >Received: from mc4-f40.law16.hotmail.com ([65.54.237.175]) by >mc4-s7.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Sat, 26 Jul >2003 23:41:26 -0700 >Received: from trapdoor.merit.edu ([198.108.1.26]) by >mc4-f40.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Sat, 26 >Jul 2003 23:40:45 -0700 >Received: by trapdoor.merit.edu (Postfix)id 997F191229; Sun, 27 Jul 2003 >02:39:35 -0400 (EDT) >Received: by trapdoor.merit.edu (Postfix, from userid 56)id 6B69C9122B; >Sun, 27 Jul 2003 02:39:35 -0400 (EDT) >Received: from segue.merit.edu (segue.merit.edu [198.108.1.41])by >trapdoor.merit.edu (Postfix) with ESMTP id 90F4B91229for ><nanog(a)trapdoor.merit.edu>; Sun, 27 Jul 2003 02:39:32 -0400 (EDT) >Received: by segue.merit.edu (Postfix)id 6BA575DF03; Sun, 27 Jul 2003 >02:39:32 -0400 (EDT) >Received: from clifden.donelan.com (clifden.donelan.com [199.34.53.180])by >segue.merit.edu (Postfix) with ESMTP id 4DCDC5DEE1for <nanog(a)merit.edu>; >Sun, 27 Jul 2003 02:39:32 -0400 (EDT) >Received: from sean (helo=localhost)by clifden.donelan.com with local-esmtp >(Exim 3.34 #3)id 19gfBr-00044I-00; Sun, 27 Jul 2003 02:39:31 -0400 >X-Message-Info: MxAodtZPLiQ6HPHOc8rBiXjgUFkT69DC >Delivered-To: nanog-outgoing(a)trapdoor.merit.edu >Delivered-To: nanog(a)trapdoor.merit.edu >Delivered-To: nanog(a)merit.edu >In-Reply-To: <Pine.WNT.4.43.0307270146050.200-100000(a)TEMPEST.hq.nac.net> >Message-ID: <Pine.GSO.4.44.0307270218570.15622-100000(a)clifden.donelan.com> >Sender: owner-nanog(a)merit.edu >Precedence: bulk >Errors-To: owner-nanog-outgoing(a)merit.edu >X-Loop: nanog >Return-Path: owner-nanog(a)merit.edu >X-OriginalArrivalTime: 27 Jul 2003 06:40:45.0882 (UTC) >FILETIME=[0223E9A0:01C3540A] > > >On Sun, 27 Jul 2003, Alex Rubenstein wrote: > > I think there is confusion here. >Yep. No problem, I think we've cleared it up. > > > The banks are making the claim, that, if you the user, has an infected >PC, > > that is compromised by an 3lit3 h4x0r, and your password to your bank > > account is compromised, then the bank is not responsible. > > > > That is what you are saying, Sean? > >I posted the dots, but failed to explicitly connect them. > >People have been talking about DDOS, spammers and the underground economy. > >Folks, its not underground any more. The criminals are using trojans >to steal real money from real people now. > >Firewalls can't stop it, ISPs can't stop it. Its a *HOST* security issue. > >For most home users the choices are get Microsoft to fix its software, or >buy a Macintosh (hide Unix under the hood). For an extra $20 Dell will >pre-configure the system security settings for business purchasers; but >home users are still on their own. > > _________________________________________________________________ Sign-up for a FREE BT Broadband connection today! http://www.msn.co.uk/specials/btbroadband

2 1

User negligence?
by Sean Donelan 28 Jul '03

28 Jul '03

Unfortunately there are a lot, and growing number, of self-infected PCs on the net. As the banks point out, this is not a breach of the bank's security. Nor is it a breach of the ISP's security. The user infects his PC with a trojan and then the criminal uses the PC to transfer money from the user's account, with the user's own password. http://www.iol.co.za/index.php?click_id=13&art_id=qw1059039360281B215&set_i… "The fact that hackers got access to bank customer's accounts was not due to inadequate security at the bank, but due to "user negligence", an e-commerce company said on Thursday. [...] "Consumers should be vigilant when opening emails. If they receive strange emails, or emails from people or companies they do not know, it is better not to open the mail - especially attachments. These intrusions were clearly not a result of any vulnerability in Absa's Internet security."

20 27