July 2003 - NANOG - lists.nanog.org

Re: Cisco vulnerability and dangerous filtering techniques
by James Roten 23 Jul '03

23 Jul '03

>P.S. The only sure way of eradicating this Cisco bug from the Internet is >to convert the Internet to IPv6. The bug doesn't affect Cisco's IPv6 code >and older routers whose IOS cannot be upgraded also cannot do IPv6 so >they cannot be used in an IPv6 Internet. Food for thought... Quick solution to this bug, as well as any future bug(s) .... replace all routers with PCs running Zebra. James Roten Ninjas are sooooooooooo sweet that I want to crap my pants. I can't believe it sometimes, but I feel it inside my heart. These guys are totally awesome and that's a fact. Ninjas are fast, smooth, cool, strong, powerful, and sweet. I can't wait to start yoga next year. I love ninjas with all of my body (including my pee pee).

1 0

RE: rfc1918 ignorant
by Ben Buxton 23 Jul '03

23 Jul '03

Uhhh...PMTU-d can break as routers will send back icmp cant-frag packets from those link addresses and rpf, filtering, etc will bring tcp connections to a standstill. Don't filter rfc1918? umm good luck convincing the rest of the net to eliminiate their filters. The basic premise of building public networks is that you have to work around other peoples policies. If it's corporate nets, then sure you can control it all, but not here. Though the PMTU-d point is arguable (what are your internal links doing with crummy MTU, for example). BB > > Is this really an issue? So long as they're not advertising > the space I > see no issue with routing traffic through a 10. network as > transit. If > you have no reason to reach their router directly (and after > Cisco's last > exploit, I'd think no one would want anyone to reach their > router directly > :-) ), what's the harm done? > > RFC1918 merely states that it shouldn't be routed on the > global internet, > not that it can't be used for transit space. > > > > <---------------------------> > > Is there a site to "report" networks/isps that still leak > rfc1918 space? > By leaking I not only mean "don't filter", but actually _use_ in their > network? > > If someone is keeping a list, feel free to add ServerBeach.com. All > traceroutes to servers housed there, pass by 10.10.10.3. > > traceroute to www.serverbeach.com > ... > 20. 64-132-228-70.gen.twtelecom.net > 21. 10.10.10.3 > 22. 66.139.72.12 > > Kind Regards, > Frank Louwers > > -- > Openminds bvba www.openminds.be > Tweebruggenstraat 16 - 9000 Gent - Belgium > -- > David Temkin >

2 1

re: rfc1918 ignorant
by Vinny Abello 23 Jul '03

23 Jul '03

I agree... The only problem is if you filter all inbound RFC 1918 and inadvertently block ICMP messages from their routers on rfc1918 space. That could potentially cause issues with network connectivity related to MTU, etc... At 08:59 AM 7/23/2003, Dave Temkin wrote: >Is this really an issue? So long as they're not advertising the space I >see no issue with routing traffic through a 10. network as transit. If >you have no reason to reach their router directly (and after Cisco's last >exploit, I'd think no one would want anyone to reach their router directly >:-) ), what's the harm done? > >RFC1918 merely states that it shouldn't be routed on the global internet, >not that it can't be used for transit space. > > > ><---------------------------> > >Is there a site to "report" networks/isps that still leak rfc1918 space? >By leaking I not only mean "don't filter", but actually _use_ in their >network? > >If someone is keeping a list, feel free to add ServerBeach.com. All >traceroutes to servers housed there, pass by 10.10.10.3. > >traceroute to www.serverbeach.com >... >20. 64-132-228-70.gen.twtelecom.net >21. 10.10.10.3 >22. 66.139.72.12 > >Kind Regards, >Frank Louwers > >-- >Openminds bvba www.openminds.be >Tweebruggenstraat 16 - 9000 Gent - Belgium > -- >David Temkin Vinny Abello Network Engineer Server Management vinny(a)tellurian.com (973)300-9211 x 125 (973)940-6125 (Direct) PGP Key Fingerprint: 3BC5 9A48 FC78 03D3 82E0 E935 5325 FBCB 0100 977A Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com (888)TELLURIAN There are 10 kinds of people in the world. Those who understand binary and those that don't.

1 0

Re: Cisco vulnerability and dangerous filtering techniques
by Michael.Dillon＠radianz.com 23 Jul '03

23 Jul '03

>> Just a handful of traceroutes would give it enough information to start >> at a major backbone and work back towards itself. >I guess all folks with Ph.D. at Akamai really are paid for nothing if a >virus could calculate that with a few traceroutes. Akamai is a business and has customers paying for its service, therefore they must attempt to get the best answer every time. But a virus can live with sub-optimal results as long as it does well enough to keep propagating and keep wreaking havoc. In fact, the virus writer might prefer that it does not shut down the entire Internet in one grand orgy of destruction because if that happens, there is too much incentive for police to identify the individuals concerned. The fact is that the idea has now been expressed in public. This almost guarantees that there are now multiple teams of virus writers working on incorporating these ideas into their creations. P.S. The only sure way of eradicating this Cisco bug from the Internet is to convert the Internet to IPv6. The bug doesn't affect Cisco's IPv6 code and older routers whose IOS cannot be upgraded also cannot do IPv6 so they cannot be used in an IPv6 Internet. Food for thought... --Michael Dillon

2 1

RE: Cisco vulnerability and dangerous filtering techniques
by Austad, Jay 23 Jul '03

23 Jul '03

It could poll different looking glasses... > -----Original Message----- > From: alex(a)yuriev.com [mailto:alex@yuriev.com] > Sent: Tuesday, July 22, 2003 4:01 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: RE: Cisco vulnerability and dangerous filtering techniques > > > > I was thinking about this the other day. The most > efficient way to make > > this work would be to spread using some vulnerability (like > the Microsoft > > DCOM vulnerability released last week), and then at a > predetermined time, > > start DoS'ing routers in the IP space of major providers, > and then work your > > way towards the "edges." > > Pray tell, the virus will also get BGP feeds to determine > where the edges > are? > > Alex > >

6 7

PRTC (Puerto Rico Telephone Company)'s DNS Mistake
by Mehmet Akcin 23 Jul '03

23 Jul '03

Hello I personally don't know if there is here anyone monitoring from PRTC, but with thinking there is a possibility to have one I am letting you guys know about the mistake you have in your DNS servers, which you should fix immediately. As it has given in the example the ip 65.23.208.101 is resolving as 65-23-208-101.prtc.net , however 65-23-208-101.prtc.net is pointed to 66.23.208.101 which is resolving as 66-23-208-101.clients.speedfactory.net. * Looking up 65.23.208.101 * Resolved 65.23.208.101 to 65-23-208-101.prtc.net * Looking up 65-23-208-101.prtc.net * Resolved 65-23-208-101.prtc.net to 66.23.208.101 * Looking up 66.23.208.101 * Resolved 66.23.208.101 to 66-23-208-101.clients.speedfactory.net hope it gets fixed immediately. regards Mehmet Akcin

1 0

failure notice
by Stephen J. Wilcox 23 Jul '03

23 Jul '03

A bit harsh bearing in mind this address is your legitimate reply address from the email.. ! On Tue, 22 Jul 2003, John Palmer (NANOG Acct) wrote: > Hi. This is the TMDA program at adns.net. > I'm afraid I wasn't able to deliver your message to the following addresses. > This is a permanent error; I've given up. Sorry it didn't work out. > > This is probably because this is an internal account that no one is > supposed to be sending mail to. If you are sending it mail, you are > probably a low-life, bottom feeding scum sucking spammer who will > burn in hell. NO addresses at this domain EVER want to hear from you. > > What part of that don't you understand? > > <nanog(a)adns.net>: > Message rejected by recipient. > > --- Enclosed is a copy of your message. > > >From steve(a)telecomplete.co.uk Tue Jul 22 21:03:02 2003 > Return-path: <steve(a)telecomplete.co.uk> > Received: from mail-0.telecomplete.net ([193.0.249.4] helo=mail.telecomplete.net) > by MAIL.ADNS.NET with esmtp (Exim 3.22 #1) > id 19f822-0001mB-00 > for nanog(a)adns.net; Tue, 22 Jul 2003 21:03:02 -0400 > Received: from steve (helo=localhost) > by mail.telecomplete.net with local-esmtp (Exim 4.20) > id 19f86v-0002RH-Bp; Wed, 23 Jul 2003 02:08:05 +0100 > Date: Wed, 23 Jul 2003 02:08:05 +0100 (BST) > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > X-X-Sender: steve@MrServer > To: John Palmer <nanog(a)adns.net> > cc: nanog(a)merit.edu > Subject: Re: AT&T Canada Problems ??? > In-Reply-To: <01d801c350b3$140ed3f0$8919d797@JPALMERWIN2K> > Message-ID: <Pine.LNX.4.44.0307230207450.6986-100000@MrServer> > MIME-Version: 1.0 > Content-Type: TEXT/PLAIN; charset=US-ASCII > > > On Tue, 22 Jul 2003, John Palmer wrote: > > > Cannot get to sites on AT&T Canada - Any news regarding the problem cause? > > Perhaps the Internet broke? > > > >

2 1

AT&T Canada Problems ???
by John Palmer 23 Jul '03

23 Jul '03

Cannot get to sites on AT&T Canada - Any news regarding the problem cause?

3 2

RE: Cisco vulnerability and dangerous filtering techniques
by Austad, Jay 22 Jul '03

22 Jul '03

I was thinking about this the other day. The most efficient way to make this work would be to spread using some vulnerability (like the Microsoft DCOM vulnerability released last week), and then at a predetermined time, start DoS'ing routers in the IP space of major providers, and then work your way towards the "edges." You can pretty much safely assume that most of your infected machines are going to basically be on the edges of the internet, so if you start with major providers, you won't kill all of your connectivity. Even more destructive would be p2p built into it, so all of the infected hosts could coordinate before the attack on what networks each one would handle. Someone is likely going to attempt something similar, it's just a matter of time before it happens. Luckily this Cisco problem didn't come out around the same time as the slammer worm. Jay > -----Original Message----- > From: jgraun(a)comcast.net [mailto:jgraun@comcast.net] > Sent: Tuesday, July 22, 2003 9:58 AM > To: Adam Maloney > Cc: nanog(a)merit.edu > Subject: Re: Cisco vulnerability and dangerous filtering techniques > > > > That is a bit paranoid, but it could happen. I have not seen > anybody do > anything that intelligent in the past couple of years. Not > to say that there > arent people out there that couldn't do that but I think many > have thought of > using one exploit to expose another, DDoS is the closest I > have seen on any of > my honeypots. I have learned many things about what most > people will try to > get into a box from the honeypots, but that is a good point. > Filtering or > patching should take place on the edge and on the most > critical spots on your > network. > > Good Luck > > > > I had a passing thought over the weekend regarding Thursday's cisco > > vulnerability and the recent Microsoft holes. > > > > The next worm taking advantage of the latest Windows' > vulnerabilities is > > more or less inevitable. Someone somewhere has to be > writing it. So why > > not include the cisco exploit in the worm payload? > > > > Based on past history, there will be plenty of vulnerable > Windows hosts to > > infect with the worm. I would also guess that there are lots of > > organizations and end-users that have cisco devices that > haven't patched > > their IOS. Furthermore, I wonder how many people have > applied filtering > > only at their border? But packets from an infected host inside the > > network wouldn't be stopped by filtering applied only to > the external > > side. > > > > Basically, if you're filtering access to your interface > IP's rather than > > upgrading IOS, remember that the internet isn't the only > source of danger > > to your network. > > > > Adam Maloney > > Systems Administrator > > Sihope Communications > > > >

3 2

RE: RADb ?
by Ejay Hire 22 Jul '03

22 Jul '03

One other option that is worth mentioning.. If you are an Arin member (i.e. you have an ASN) then you can use Arin's Route registry services. These services are currently free to members. -Ejay -----Original Message----- From: Kevin Oberman [mailto:oberman@es.net] Sent: Tuesday, July 22, 2003 1:16 PM To: mike harrison Cc: nanog(a)merit.edu Subject: Re: RADb ? > Date: Tue, 22 Jul 2003 14:25:18 -0400 (EDT) > From: mike harrison <meuon(a)highertech.net> > Sender: owner-nanog(a)merit.edu > > > > Does anyone really use the RADb ? Worth the $250 per year? > > Just wondering if it worth renewing.. Registry is worth it, but you might want to think about a free DB (if you are small) or setting up your own with the free irrd software. There is nothing more magical about the RADB than any other member of the IRR. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

5 4