- NANOG - lists.nanog.org

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by freedman＠freedman.net 27 Mar '13

27 Mar '13

An important question... I recall a peering panel at an ISPCON in 1996 when the current Peering Badguys, BBN, were represented by John, who listened to a ton of bitching for an hour about the unfairness of it all and said (paraphrasing)... "I understand you all have your opinions and desires but I just want to point out one thing. It is now 1996, 2 years after the widespread adoption of the web, and in every city in the US there are at least two ISPs happily providing unlimited {dialup} access for under $20/mo. What do you think we'd have if it were run or regulated by the government?" Luckily, many bureaucrats and politicians in our government do understand that. And so far The Community has been able to put pressure on international bodies and other governments don't have the clout. Hopefully that remains the case for some time. Avi > In general, governments have avoided regulating various aspects of > the Internet, in part because of lack of understanding and in part > because the community keeps telling them that trying to regulate > won't work because of its decentralized nature. As the Internet > becomes increasingly important to each country's economy and its > citizens, the status quo is not likely to continue. > > The real question is, when governments do decide to try and help > "improve the Internet", who will they be listening to, and will > the operator community have spoken with a clear enough voice in > these matters on what actually would make for an improvement? > > FYI, > /John

1 0

Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Jay Ashworth 27 Mar '13

27 Mar '13

http://blog.cloudflare.com/the-ddos-that-almost-broke-the-internet Yes: 120 gigabits/second, primarily of DNS amplification traffic. Still think it's optional to implement BCP38 pervasively? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

9 9

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Scott Weeks 27 Mar '13

27 Mar '13

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> According to the New York Times it was 300 gbps and Cyberbunker was the bad guy. http://www.nytimes.com/2013/03/27/technology/internet/online-dispute-become… ----------------------------------------- Got a link that we don't have to allow cookies and have to create an account to read? ------------------------------------------------------------ I found it using startpage.com's proxy and pasted it below for others that don't want to create accounts and all: A squabble between a group fighting spam and a Dutch company that hosts Web sites said to be sending spam has escalated into one of the largest computer attacks on the Internet, causing widespread congestion and jamming crucial infrastructure around the world, John Markoff and Nicole Perlroth write on Wednesday in The New York Times. Millions of ordinary Internet users have experienced delays in services like Netflix or could not reach a particular Web site for a short time. However, for the Internet engineers who run the global network, the problem is more worrisome. The attacks are becoming increasingly powerful, and computer security experts worry that if they continue to escalate, people may not be able to reach basic Internet services, like e-mail and online banking. The dispute started when the spam-fighting group, called Spamhaus, added the Dutch company Cyberbunker to its blacklist, which is used by e-mail providers to weed out spam. Cyberbunker, named for its headquarters, a five-story former NATO bunker, offers hosting services to any Web site “except child porn and anything related to terrorism,” according to its Web site. A spokesman for Spamhaus, which is based in Europe, said the attacks began on March 19, but had not stopped the group from distributing its blacklist. Patrick Gilmore, chief architect at Akamai Networks, a digital content provider, said Spamhaus’s role was to generate a list of Internet spammers. Of Cyberbunker, he added: “These guys are just mad. To be frank, they got caught. They think they should be allowed to spam.” Mr. Gilmore said that the attacks, which are generated by swarms of computers called botnets, concentrate data streams that are larger than the Internet connections of entire countries. He likened the technique, which uses a long-known flaw in the Internet’s basic plumbing, to using a machine gun to spray an entire crowd when the intent is to kill one person. The so-called distributed denial of service, or DDoS, attacks have reached previously unknown magnitudes, growing to a data stream of 300 billion bits per second. Questioned about the attacks, Sven Olaf Kamphuis, an Internet activist who said he was a spokesman for the attackers, said in an online message that, “We are aware that this is one of the largest DDoS attacks the world had publicly seen.” Mr. Kamphuis said Cyberbunker was retaliating against Spamhaus for “abusing their influence.” scott

3 2

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Scott Weeks 27 Mar '13

27 Mar '13

"...Sven Olaf Kamphuis, an Internet activist who said he was a spokesman for the attackers..." I wonder is he'll ever post here again as he has in the past. It probably would not go well for him if he did... scott

1 0

Re: Cloudflare, and the 120Gbps DDOS "that almost broke the Internet"
by Scott Weeks 27 Mar '13

27 Mar '13

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> According to the New York Times it was 300 gbps and Cyberbunker was the bad guy. http://www.nytimes.com/2013/03/27/technology/internet/online-dispute-become… ----------------------------------------- Got a link that we don't have to allow cookies and have to create an account to read? scott

4 3

Enforcing Source Integrity: BCP38 and Open Resolver Problems
by Eric M. Carroll 27 Mar '13

27 Mar '13

The root cause of high scale directed amplification attacks is the failure to assure the integrity of the source IP address. This failure leads to a large set of directed amplification attack vectors. BCP38 was written in 2000, coming up on its 13th anniversary. This root cause, and various methodologies & technologies to resolve it, have been an ongoing discussion since back to the 90s. The failure to enforce this BCP or the related technological mechanisms to force implementation is the root cause of why the Internet cannot always trust source addresses and why these attack vectors persist. Until the ISP community gets serious about forcing the integrity of source addresses throughout its topology, various flavours of attack whose root cause is the spoofed source addresses will continue. Yes, it is not easy to do because it is a transitive trust issue, linked to topology and address management policy. Yes it would be easier if there was a magic bullet to validate source addresses built into the architecture. But there is not, the architecture is what it is. If every step of the chain enforced the integrity of source addresses, this risk would be resolved. There are multiple different steps that could be taken, including law enforcement, statute, contractual, policy, process and technological mechanisms. Every ISP and content providers' business model is threatened by this vulnerability. Every attack drives up operational expenses for everyone. Opportunity costs of missed sales and impacted business are everywhere. It is a pure tragedy of the commons - for lack of enforcement, the whole system is threatened in scale. This problem cannot be allowed to rest at the edges simply by pointing at the current amplification vector. Yesterday it was something different. Tomorrow it will different again. The constant is the rising scale of the Internet and resulting increase in scale of the attack and its corresponding economic impact. The root cause is not today's Google issue. The ISP community has the power to enforce this through policy and technological means. Whether it has the will and ability to self-organize and enforce is a different issue (and also, a long standing one). The discussion needs to be not just about the edge issue of the day. It needs to be about what forum, and what means can be used to enforce this integrity. Post-9/11 the ISP community has significantly more hammers in its arsenal now that it did in May 2000. Perhaps NANOG is not the right forum to discuss, but if not, what is? This is truly an operational threat to the whole community. Leadership needs to come from the largest providers, not just from the smallest. Today the threat is rogue data centres hosting spammers trying to game the system, tolerated by their up stream providers. Does this really need to be a hostile state or quasi-state actor deliberately threatening the infrastructure before serious coordinated action is taken? We really do know better. Eric Carroll

1 0

Cisco Security Advisory: Cisco IOS Software IP Service Level Agreement Vulnerability
by Cisco Systems Product Security Incident Response Team 27 Mar '13

27 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software IP Service Level Agreement Vulnerability Advisory ID: cisco-sa-20130327-ipsla Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +--------------------------------------------------------------------- Summary ======= The Cisco IOS Software implementation of the IP Service Level Agreement (IP SLA) feature contains a vulnerability in the validation of IP SLA packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Mitigations for this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd0ACgkQUddfH3/BbTp8QwD+IPK7Dzz7B0uga/FtZKjYU9XC ik2D1EIVMDWcFNYovn8A/i2M+COtgQr9j/7CuMRdNfnAoA65JOxRHu4NTW7cdZoo =w51Y -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Protocol Translation Vulnerability
by Cisco Systems Product Security Incident Response Team 27 Mar '13

27 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Protocol Translation Vulnerability Advisory ID: cisco-sa-20130327-pt Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +--------------------------------------------------------------------- Summary ======= The Cisco IOS Software Protocol Translation (PT) feature contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd4ACgkQUddfH3/BbTr/hQEAhB32OjahAaNFUbeYsZloNqCX C9JHEqRP4k4Y27LcWZUA+wTwW0yKpKzQ9+ZDvaWYiXtL1iSvOhlSjS178A3kMIhb =JlLG -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Smart Install Denial of Service Vulnerability
by Cisco Systems Product Security Incident Response Team 27 Mar '13

27 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Smart Install Denial of Service Vulnerability Advisory ID: cisco-sa-20130327-smartinstall Revision 1.0 For Public Release 2013 March 27 16:00 UTC (GMT) +--------------------------------------------------------------------- Summary ======= The Smart Install client feature in Cisco IOS Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. Affected devices that are configured as Smart Install clients are vulnerable. Cisco has released free software updates that address this vulnerability. There are no workarounds for devices that have the Smart Install client feature enabled. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd4ACgkQUddfH3/BbToUsAD+NSDtaCAvOzfjmsqhxVZN6Uy+ ceAxXTPCp6M0n8yGk0sA/1uJk8CWE1yjCtTu1IDGX8K/SUvWFEUi0pqFyKfKVFEa =eRMY -----END PGP SIGNATURE-----

1 0

Cisco Security Advisory: Cisco IOS Software Network Address Translation Vulnerability
by Cisco Systems Product Security Incident Response Team 27 Mar '13

27 Mar '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Cisco IOS Software Network Address Translation Vulnerability Advisory ID: cisco-sa-20130327-nat Revision 1.0 For Public Release 2013 March 27 10:00 UTC (GMT) +--------------------------------------------------------------------- Summary ======= The Cisco IOS Software implementation of the virtual routing and forwarding (VRF) aware network address translation (NAT) feature contains a vulnerability when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-… Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication. Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link: http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.18 (Darwin) Comment: GPGTools - http://gpgtools.org iF4EAREIAAYFAlFQcd0ACgkQUddfH3/BbTrndAD/Qxm/suF3S/US+6bDND+/OKB3 9KpBW/wUPVC2+87IFRQBAIXFrAjFqnbmmBAKFEVZztVhRN1TlOW9JL7mKd6SXwZw =jAQM -----END PGP SIGNATURE-----

1 0