August 2008 - NANOG - lists.nanog.org

RE: Revealed: The Internet's well known BGP behavior
by Bogdanov, Oleg (IT) 28 Aug '08

28 Aug '08

First, thank you all for the usually intelligent/enlightening discussion. My first post to this list and apologies in advance if discussion of end point (customer) networks is off-topic: I haven't seen the presentation that some of you have referred to. If someone can provide a link that would be helpful. What is the as-prepend piece of the puzzle? Insert AS numbers of ISPs in the path from hijacker to intended recipient so snooped data doesn't boomerang back to the hijacker (exploit BGP loop detection mechanism)? Theoretically, can one hijack both sender and receiver space to get inline on the whole conversation? And maybe the more relevant question: Can the customer do anything? What would my ISPs tell me if I asked them to take measures (magic ones?) to mitigate my exposure? Thanks, Oleg Bogdanov Morgan Stanley | Technology 1 Pierrepont Plaza, 12th Floor | Brooklyn, NY 11201 oleg.bogdanov(a)morganstanley.com -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.

1 0

Service Outage in Indiana
by Elijah Savage 28 Aug '08

28 Aug '08

Anyone know what is going on there. Sprint Verizon data and voice circuits affected in the Fort Wayne area.

1 1

interger to I P address
by kcc 28 Aug '08

28 Aug '08

Hi all ls it possible t convert the interger to ip Thank you

27 33

reviving the botnets@ mailing list: a new statregy in fighting cyber crime
by Gadi Evron 28 Aug '08

28 Aug '08

The public botnets@ mailing list, where malicious activity on the Internet can be openly shared, has been revived, and boy is it active. Warning: live samples and malicious URLs are openly shared there. NANOG relevance: These can be operationally used by ISP security operators not of those "in the know" to block new attacks and to identify abusers in their own networks. Reminder: this mailing list was started to take off-topic traffic from NANOG. Mailing list URL: http://www.whitestar.linuxbox.org/mailman/listinfo/botnets Reasons, thinking and explanations: http://gadievron.blogspot.com/2008/08/public-sharing-and-new-statregy-in.ht… Excerpt: ------ A couple of years ago I started a mailing list where folks not necessarily involved with the vetted, trusted, closed and snobbish circles of cyber crime fighting (some founded by me) could share information and be informed of threats. In this post I explore some of the history behind information sharing online, and explain the concept behind the botnets mailing list. Feel free to skip ahead if you find the history boring. Also, do note the history in this post is mixed with my own opinions. As I am one of the only people who where there in the beginning though and lived through all of it, I feel free to do so (in my own blog post). As I conclude, we may not be able to always share our resources, but it is time to change the tide of the cyber crime war, and strategize. One of the strategies we need to use, or at least try, is public information sharing of "lesser evils" already in the public domain. .. .. To fight a war, you have to be involved and engaged. On the Internet that is very difficult, but the Russians found a way. It is a fact that while we made much progress in our efforts fighting cyber crime, we had nearly no effect what-so-ever on the criminals and the attackers. Non. They maintain their business and we play at writing analysis and whack-a-mole. Using the botnets mailing list, I am burrowing a page from the apparent Russian cyber war doctrine, getting people involved, engaged. Personally aware and a part of what's going on. It can't hurt us, and perhaps now, four years over-due and two years after the previous attempt, we may be ready to give it a go and test the concept. ------- Gadi Evron. -- "You don't need your firewalls! Gadi is Israel's firewall." -- Itzik (Isaac) Cohen, "Computers czar", Senior Deputy to the Accountant General, Israel's Ministry of Finance, at the government's CIO conference, 2005. (after two very funny self-deprication quotes, time to even things up!) My profile and resume: http://www.linkedin.com/in/gadievron

1 0

RE: Revealed: The Internet's well known BGP behavior
by Hank Nussbacher 28 Aug '08

28 Aug '08

At 11:32 PM 27-08-08 -0500, John Lee wrote: >Thanks guys, going back to my Comer one more time. My issue, question was >whether the organization doing the hijacking controlled all of the routers >in the new modified path or only some of them? > >John (ISDN) Lee They didn't have control of any routers other than their own. What they had to find is a single clueless upstream ISP that would allow them to announce prefixes that didn't belong to them. -Hank

4 3

RE: Revealed: The Internet's well known BGP behavior
by Paul Ferguson 28 Aug '08

28 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Hank Nussbacher <hank(a)efes.iucc.ac.il> wrote: >At 11:32 PM 27-08-08 -0500, John Lee wrote: >>Thanks guys, going back to my Comer one more time. My issue, question was >> whether the organization doing the hijacking controlled all of the >>routers in the new modified path or only some of them? >> >>John (ISDN) Lee > >They didn't have control of any routers other than their own. What they had to find is a single clueless upstream ISP that would allow them to announce prefixes that didn't belong to them. > *bing* Trust is the major exploit here. That has never been "new". - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFItkFQq1pz9mNUZTMRAgqHAJ4ogryvjftxw5CQTWhf0c7VyBBXyQCfUo9w qdK2kEWHY/B1AU/rGNikOlg= =d/L7 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

ATT.net
by tbeecher＠localnet.com 28 Aug '08

28 Aug '08

Any known issues across AT&T's network? Got a couple calls for some access issues, I'm seeing roughly 15% loss at a couple of paths at the AT&T network edge.

3 3

Re: Revealed: The Internet's Biggest Security Hole
by marcus.sachs＠verizon.com 28 Aug '08

28 Aug '08

I'll have to admit that the TTL manipulation was something I had not thought about. But why not? If you are going to purloin EVERY packet then why not re-write byte 8 in every IP header to a value of your choosing? Very cool. Marc ------Original Message------ From: Jason Ross To: Sachs, Marcus H. (Marc) Cc: Gadi Evron Cc: nanog(a)merit.edu Sent: Aug 27, 2008 22:21 Subject: Re: Revealed: The Internet's Biggest Security Hole On Wed, Aug 27, 2008 at 9:52 PM, <marcus.sachs(a)verizon.com> wrote: > Yes, wonderful preso! My biggest take-away was the fact that the > vast majority of the attendees did not understand the gravity of the > demo. Agreed on both counts: the presentation was great, and largely not understood it seemed. >> >> hehe >> "new". hehe >> >> Maybe something will change now' though, it was a great and >> impressive presentation, hijacking the defcon network and tweaking >> TTL to hide it. >> Notably, Alex and Tony both mentioned that the BGP tricks were not new during the presentation, and commented that it would essentially not be surprising to anyone that groks routing at the level that most of the folks on this list does. What was new though according to their presentation (and it was new to me certainly, but I'm still fairly green) was the AS Path prepending to complete the circuit, and as you mentioned, the TTL magicks to hide the hops. I was suitably impressed at that. -- Jason -------------------------- Marcus H. Sachs Verizon 202 515 2463 Sent from my BlackBerry

2 1

Re: Revealed: The Internet's Biggest Security Hole
by marcus.sachs＠verizon.com 28 Aug '08

28 Aug '08

Yes, wonderful preso! My biggest take-away was the fact that the vast majority of the attendees did not understand the gravity of the demo. The same thing could be said about Dan's talk. It was over the heads of most attendees. Marc ------Original Message------ From: Gadi Evron To: Sachs, Marcus H. (Marc) Cc: fsmendoza(a)gmail.com Cc: nanog(a)merit.edu Sent: Aug 27, 2008 21:42 Subject: Re: Revealed: The Internet's Biggest Security Hole On Wed, 27 Aug 2008 marcus.sachs(a)verizon.com wrote: > Nothing will change. You think DNSSEC is hard? Try getting support for the deployment of S-BGP or soBGP. Without a trust anchor and lots of community support it will remain largely an academic interest area. I guess it will just remain a "cool" presentation than, and boy was it cool. You were there, any special impressions? Gadi. > Marc > > ------Original Message------ > From: Gadi Evron > To: Frank > Cc: NANOG list > Sent: Aug 27, 2008 20:54 > Subject: Re: Revealed: The Internet's Biggest Security Hole > > hehe > "new". hehe > > Maybe something will change now' though, it was a great and impressive > presentation, hijacking the defcon network and tweaking TTL to hide it. > > > > > > On Thu, 28 Aug 2008, Frank wrote: > >> http://blog.wired.com/27bstroke6/2008/08/revealed-the-in.html >> >> Two security researchers have demonstrated a new technique to stealthily >> intercept internet traffic on a scale previously presumed to be unavailable >> to anyone outside of intelligence agencies like the National Security >> Agency. >> >> The tactic exploits the internet routing protocol BGP (Border Gateway >> Protocol) to let an attacker surreptitiously monitor unencrypted internet >> traffic anywhere in the world, and even modify it before it reaches its >> destination. >> >> The demonstration is only the latest attack to highlight fundamental >> security weaknesses in some of the internet's ------Original Message Truncated------ -------------------------- Marcus H. Sachs Verizon 202 515 2463 Sent from my BlackBerry

2 1

Re: Revealed: The Internet's Biggest Security Hole
by marcus.sachs＠verizon.com 28 Aug '08

28 Aug '08

Nothing will change. You think DNSSEC is hard? Try getting support for the deployment of S-BGP or soBGP. Without a trust anchor and lots of community support it will remain largely an academic interest area. Marc ------Original Message------ From: Gadi Evron To: Frank Cc: NANOG list Sent: Aug 27, 2008 20:54 Subject: Re: Revealed: The Internet's Biggest Security Hole hehe "new". hehe Maybe something will change now' though, it was a great and impressive presentation, hijacking the defcon network and tweaking TTL to hide it. On Thu, 28 Aug 2008, Frank wrote: > http://blog.wired.com/27bstroke6/2008/08/revealed-the-in.html > > Two security researchers have demonstrated a new technique to stealthily > intercept internet traffic on a scale previously presumed to be unavailable > to anyone outside of intelligence agencies like the National Security > Agency. > > The tactic exploits the internet routing protocol BGP (Border Gateway > Protocol) to let an attacker surreptitiously monitor unencrypted internet > traffic anywhere in the world, and even modify it before it reaches its > destination. > > The demonstration is only the latest attack to highlight fundamental > security weaknesses in some of the internet's core protocols. Those > protocols were largely developed in the 1970s with the assumption that every > node on the then-nascent network would be trustworthy. The world was > reminded of the quaintness of that assumption in July, when researcher Dan > Kaminsky disclosed<http://blog.wired.com/27bstroke6/2008/07/details-of-dns.html>a > serious vulnerability in the DNS system. Experts say the new > demonstration > targets a potentially larger weakness. > > "It's a huge issue. It's at least as big an issue as the DNS issue, if not > bigger," said Peiter "Mudge" Zatko, noted computer security expert and ------Original Message Truncated------ -------------------------- Marcus H. Sachs Verizon 202 515 2463 Sent from my BlackBerry

2 1