March 2005 - NANOG - lists.nanog.org

Re: DNS cache poisoning attacks -- are they real?
by Florian Weimer 30 Mar '05

30 Mar '05

* Brad Knowles: > At 1:08 PM +0200 2005-03-29, Florian Weimer wrote: > >> BIND accepts non-authoritative answers if their additional section >> looks a bit like a referral. I don't tink that this check is >> deliberately lax, but stricter checks are simply harder to do on this >> particular code path. > > BIND explicitly assumes that there might be upstream nameservers > you may talk to that may be answering from cache. Really? I can't get it to work reliably. Can you share an example where delegation to a non-authoritative caching resolver works, without the need for special seeding of the caching resolver? Your posts to nanog(a)merit.edu aren't distributed by the mailing list, BTW.

1 0

Telcordia report on ICANN .net RFP Evaluation
by Eric Brunner-Williams in Portland Maine 30 Mar '05

30 Mar '05

Oki all, A summary of the report and a link to the full report can be found at: http://www.icann.org/announcements/announcement-28mar05.htm So now you know. VGRS, NS+, AF, ranked 1, 2, 3; DE and CORE ranked 4 & 5. Eric

4 3

Re: ICANN on the panix.com theft
by James Galvin 30 Mar '05

30 Mar '05

--On Saturday, March 26, 2005 4:58 PM -0500 David Lesher <wb8foz(a)nrk.com> wrote: > > ICANN Blames Melbourne IT for Panix Domain Hijacking Unfortunately, the agenda for the next ICANN meeting: <http://www.icann.org/meetings/mardelplata/> Still does not yet show that the SSAC <http://www.icann.org/committees/security/> Will be having a public meeting on Tuesday, from 6:30-7:30pm, during which it will present its preliminary results and recommendations from its review of the incident. The meeting was requested to be held in the plenary room. If it is it will be webcast, etc., just as all the main meetings are. It is not my place to speak for the committee but I can tell you that PR information that has been released (although I haven't seen it published anywhere yet) points out that the committee took a broader view of the incident, looking at the interactions throughout the system, and will have some things to say that are somewhat critical of more than just Melbourne IT. Sorry but the presentation will probably not be public until just before the meeting. Anybody who wants an official comment or more detailed information in advance of the presentation should contact the Chair, Steve Crocker. Jim Provider of "staff" support to the SSAC

2 1

Re: Sorbs.net
by Dean Anderson 30 Mar '05

30 Mar '05

Hi folks. A few points about Sorbs (I've also started a web site www.iadl.org to track abuse of the internet for defamation purposes. The web site isn't finished, yet.) 1) Someone said Sorbs is just Matthew Sullivan. Well, _Sullivan_ said it isn't just him. Yeah, sure, that has credibilty... However, my own experience with Sorbs has revealed that it is also Alan Brown (formerly of ORBS) and Kai Schlicting. We all remember Alan from the ORBS shutdown, I hope. Alan was found by three courts in separate cases to be defaming people (two by using a blacklist). Well, Alan claimed our address space was hijacked and that the OSF didn't exist anymore. This was picked up verbatim by Sorbs. When I contacted Sullivan to tell him this was false, Schlichting send an "anonymous" message from abuse(a)conti.nu to The Open Group. (www.osf.org goes to www.theopengroup.org) After that, they dropped the part of OSF not existing anymore. [You all know the The Open Group (TOG): They do Motif, X Window System, DCE, CDE (used on sun, hp, compaq, ibm, etc). They own the Unix trademark, XPG4 suite, they do standards compliance testing, etc. They do lots of things.] The general counsel for TOG forwarded me the defamatory email from Schlicting demanding that TOG explain why we provide them services and why we are allowed to use 130.105/16 and other nonsense. Here's just a sample, indentation his: however ARIN regulations and their predecessor's (the Internic: operations funded by ARPANET) regulations make it quite clear that the resources allocated by these registries are for the public benefit, and are nothing short of a government grant for use of a public, shared resource. Government grants are not transferable without explicit and advance permission, and their beneficial details and use are open to the public for inspection, and likely covered by the FOIA. Yeah, right. The message was anonymous, from abuse(a)conti.nu, which I tracked back to Schlichting. After a complaint to their hosting provider, (at the time, XO), Sorbs was apparently booted from XO for its defamatory statements in violation of XO's AUP. Another Sullivan site that was threatening mailbombing was also booted. Interestingly, Sullivan tried to convince XO that Sorbs.net and dnsbl.sorbs.net were different and that he wasn't responsible for dnsbl.sorbs.net, and so XO shouldn't boot www.sorbs.net. XO didn't buy it, I guess. SORBS was then given hosting by ISC.ORG, which doesn't have an AUP (interesting by itself), and apparently doesn't mind being associated with court-proven liars and mailbombers. Also interestingly, the Sorbs web site contains (or used to contain) a lot of logos for vendors. At first glance, these seem to be endorsements or support. But if you read the text, it just says not to complain to these other companies about Sorbs. Sorbs did claim that Sun donated equipment. I contacted Sun in Australia, and they had no record of donating anything to Sorbs. The most I have been able to find out about Sullivan is that he is/was a student at the University of Queensland in Australia. In his email to me, he claimed that I should sue him because he has no assets. Well, indeed, we can sue him for defamation and expect the similar results as in the 3 similar ORBS lawsuits. Brown/ORBS tried to say his false claims were just opinion. As did MAPS in Exactis V. MAPS. Interestingly, in his messages to me, Sullivan claimed that the (US) First Amendment protects him. This has been refuted in US courts and is a frivolous claim even in the US, but certainly it doesn't protect Australians in Australia. The court, in addressing ORBS's false claims, noted they were basically a personal attack. But, indeed, I have not so far located any substantial assets other than Sorbs itself, which doesn't seem very substantial. I'm still looking. Australian law gives us 5 years from the last false claim to file suit. So we have (at least) until March 2010. If anyone has any more information about Sullivan or his personal assets, please let me know. I note that Brown lost his ISP to pay for damages in his ORBS court cases. This was followed by a strategy posted by Ron Guillmette for preventing assets from being put at risk by abusive blacklists. Sullivan seems to be following that strategy. When Sullivan says "sue me I have no assets", he's telling me that it is of little point to lay out $50K to sue someone who's economic substance amounts to being barely above homeless and who almost certainly can't pay the damages when they lose. Rich Kulawiec mused: >On Tue, Mar 15, 2005 at 05:44:41PM -0500, Paul G wrote: >> unfortunately, that *still* didn't stop people from using it, which >> translated into an unresolvable headache for me as a sp. > >Then gripe at the people who chose to use it: it was *their* >decision, and if it was a poor one, then they are the people >who need to be held accountable for it. I haven't found it to be too much of a headache, so far. After almost 2 years of listing by SORBS, its little more than annoying. I suppose that could change if someone really starts promoting SORBS and ignoring its history. When we come across someone using Sorbs (a couple times a month, though I had three in the last week--though they were all university student run servers), I just call them up and point them to information about Sorbs, and our listing. That's usually enough for them to quit using SORBS. A good link is http://www.pathname.com/~corpus/NET.age It shows that SORBS isn't blocking anything. To get into double digits, you have to use the SORBS DUL list, which is copied from elsewhere. Nearly all of the rest is under half a percent. But I usually compare the SORBS ZOMBIE(hijacked) list with more reputable hijacked lists: OVERALL% SPAM% HAM% S/O RANK SCORE NAME:0-1 OVERALL% SPAM% HAM% S/O RANK SCORE NAME:1-3 OVERALL% SPAM% HAM% S/O RANK SCORE NAME:3-6 0.089 0.1046 0.0054 0.951 0.42 0.82 RCVD_IN_SORBS_ZOMBIE:0-1 0.035 0.0365 0.0312 0.539 0.43 0.82 RCVD_IN_SORBS_ZOMBIE:1-3 0.094 0.1095 0.0000 1.000 0.46 0.82 RCVD_IN_SORBS_ZOMBIE:3-6 0.015 0.0179 0.0000 1.000 0.36 1.00 RCVD_IN_WHOIS_HIJACKED:0-1 0.007 0.0088 0.0000 1.000 0.43 1.00 RCVD_IN_WHOIS_HIJACKED:1-3 0.081 0.0946 0.0000 1.000 0.45 1.00 RCVD_IN_WHOIS_HIJACKED:3-6 I note that SORBS blocks _ham_ as hijacked, while more reputable lists block no ham as hijacked. Apparently it isn't just Av8 they are lying about. And in the very few cases where we've run into SORBS supporters, our lawyers have noted that such blacklisting is itself defamation, unlawful participation in a group boycott, tortious interference in a contract and other things. That takes care of that. But that's been pretty rare. Nearly all users of SORBS are of the misled variety. And even the supporters seem to have trouble with it. I noted recently that even ISC no longer uses SORBS for mail filtering. >Look, if I want to publish a blocklist of all domains with the >string "er" in them and all IP addresses ending in .7, that would be >a silly thing to do: but after all, it's just a list. There are consequences, of course, to doing irresponsible things, and to misleading your subscribers, and to blocking email that your subscribers didn't authorized you to block. And even if legal consequences aren't pursued, there are still consequences to being a liar, and consequences to associating with liars and disreputable people. The first consequence is that people will point out one's associations/false statements/etc. These things indicate the character of a person. Sometimes there are requirements of good character necessary to, say, hold public offices, hold certain licenses, etc. For example, this is why former New York mayor Rudi Guiliani found it necessary to dissolve his business partnership with Bernie Kerik after Kerik was found associated with the Mafia. In other cases, its just embarrasing to be found associated with such people. But there are always consquences of some sort or other. No bad deed goes unpunished. Its just a matter of time. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

4 4

OT: Chasing spam.
by Bill Nash 29 Mar '05

29 Mar '05

I'm chasing after some spam that appears to have been built from a nanog post culling, and am looking for anyone else who may have recieved some mail a few weeks back, relevent info looks like: Date: Tue, 8 Mar 2005 12:01:59 -0800 From: Steve Gladstone <xms(a)empirix.com> Subject: Register for the VoIP Deployment, Diagnostics & Monitoring Webinar Sniffing about the opt-out functions gave me: You have already been opted-in to the system Email Address: billn(a)billn.net Email Type: not specified, defaulted to MIME Date and time signed up: March 03, 2005 at 07:16:16 PST A description of how your email address was obtained: Internal Sources >From Empirix A discussion with the VP running the division responsible for the mailing has met with.. a door in the face, basically. Anyone with time (and a log trail), would you mind checking to see if you recieved it as well, and contact me offlist? Thanks! - billn

1 1

phishing sites report - March/2005
by Gadi Evron 29 Mar '05

29 Mar '05

Below is a periodic public report from the Malicious Websites and Phishing research and mitigation mailing list (a sub-group of the drone armies / botnets research and mitigation mailing list). For this report it should be noted that we base our analysis on the data we have accumulated from various sources. According to our incomplete analysis of information we have thus far, we now publish the following report. Notes on the report: * The report is in descending order. * In the listing are also included suspected child pornography sites, however, their numbers are not large enough to effect the statistics. Number of phishing sites found: 276. The ISP's that are most often plagued with phishing sites: ---------------------------------------------------------- ASN Responsible Party 14780 INKTOMI-LAWSON - Inktomi Corpo 14779 13768 PEER1 - Peer 1 Network Inc. 21844 THEPLANET-AS - THE PLANET 1668 AOL-ATDN - AOL Transit Data Ne 4134 CHINANET-BACKBONE No.31 Jin-ro 29761 OC3-NETWORKS-AS-NUMBER - OC3 N 27699 TELECOMUNICACOES DE SAO PAULO 15201 Universo Online Ltda. * We would gladly like to establish a trusted relationship with these and any organizations to help them in the future (especially the attacked eCommerce sites and the hosting service providers). * By previous requests here is an explanation of what "ASN" is, by Joe St Sauver: http://darkwing.uoregon.edu/~joe/one-pager-asn.pdf -- Gadi Evron, Information Security Manager, Project Tehila - Israeli Government Internet Security. Ministry of Finance, Israel. gadi(a)tehila.gov.il gadi(a)CERT.gov.il Office: +972-2-5317890 Fax: +972-2-5317801 http://www.tehila.gov.il The opinions, views, facts or anything else expressed in this email message are not necessarily those of the Israeli Government.

3 6

The U.N. thinks about tomorrow's cyberspace
by Fergie (Paul Ferguson) 29 Mar '05

29 Mar '05

An interesting article & interview with Houlin Zhao, director of the ITU's Telecommunication Standardization Bureau (who would like very much for the UN to become more involved in "Internet Governance"). http://news.com.com/The+U.N.+thinks+about+tomorrows+cyberspace/2008-1028_3-… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

4 3

Re: T1 vs. T2 [WAS: Apology: [Tier-2 reachability and multihoming]]
by Tom Vest 29 Mar '05

29 Mar '05

On Mar 29, 2005, at 12:24 PM, Tom Vest wrote: > On Mar 29, 2005, at 12:08 PM, Stephen J. Wilcox wrote: > >> Maybe I'm wrong, i checked with renesys and their data has 701 with >> 5200 >> adjacencies followed by 1239 with 3500 anyway i care enough to have >> snipped the >> data. > > Does anyone know how many of these adjacencies are with single-homed > ASNs, i.e., ASNs that are out-of-spec and likely artifacts of previous > M&A transactions? > > Tom

1 0

Apology: [Re: Tier-2 reachability and multihoming]
by G Pavan Kumar 29 Mar '05

29 Mar '05

This is with my deepest regrets that I apologize from the bottom of my heart to Mr.Gilmore, Mr.Woodcock, Mr.Bush and also the rest of the honourable members of the list for being ignorant of how high-profile a list this is. I couldn't be more sorry. Please, please forgive me. ps: I sure meant no harm, was just trying to be humorous,(I hope the exclamation marks might have given some hint) anyway it is too late. They say there is no natural punishment than remorse. Also, I was too embarrassed to post a quick apology. Thanking you, pavan.

8 11

Re: T1 vs. T2 [WAS: Apology: [Tier-2 reachability and multihoming]]
by John Dupuy 29 Mar '05

29 Mar '05

6 10