- NANOG - lists.nanog.org

Re: EBAY and AMAZON
by Astro Dog 14 Jun '12

14 Jun '12

(Sorry for the top post. Mail client is being obnoxious.) Why? The prevalence of malware for a given OS is going to, generally, be a matter of most return for least work. If you're writing malware to steal credit card numbers, say, you're much better served writing it for Windows than you are OSX or Linux, even if it were slightly more difficult to do, because that will get you the largest number of card numbers, simply because more people use Windows. It's generally safe to assume that malware writers want to target as many machines as possible, thus they will focus on Windows, reg ardless of the relative ease or difficulty of the other platforms. There is no reason to believe that the platform distribution of malware would have a linear relationship with general usage rates or ease of exploitation, given the motivations and methods involved. --- Harrison ----- Original Message ----- From: Rich Kulawiec Sent: 06/13/12 06:55 AM To: nanog(a)nanog.org Subject: Re: EBAY and AMAZON On Tue, Jun 12, 2012 at 11:44:44AM +0000, Jamie Bowden wrote: > While MS may be a favorite whipping boy, let's not pretend that if the > dominant OS were Apple or some flavor of *nix, things would be any better. I've heard this argument many times, and I reject it this time as I have before. If popularity were the measure of relative OS security, then we would expect to see infection rates proportional to deployment rates: thus if operating systems A, B and C respectively accounted for 85%, 10%, and 5% of deployments, we should see those numbers reflected in infection rates.

4 3

[NANOG-announce] Survey Reminder
by Betty Burke <betty＠nanog.org> 14 Jun '12

14 Jun '12

NANOGers; Thank you to those recently participating in NANOG 55, Vancouver. Either as an on-site or remote attendee, speaker, sponsor, or member, your opinions are valued. If you have not yet completed the NANOG 55 survey(s), we would greatly appreciate you taking the time to complete them by visiting the NANOG 55 Survey http://www.nanog.org/meetings/nanog55/surveys.html The surveys will close at end of day Friday, June 15, 2012. Remember, your feedback will help us take action to continuously improve the NANG meeting experience! Sincerely, Betty -- Betty Burke NANOG Executive Director _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

WLC vlan size and management
by Andrey Khomyakov 14 Jun '12

14 Jun '12

Hi list, If I may ask for your advice, I have a Cisco 5508 WLC. Need to use it to manage APs at multiple buildings which I plan on doing using AP Groups. I understand that if I have one SSID mapped to one VLAN I can do it within the AP group and all is well. In my case, I have to provide a single SSID, but be able to assign clients into vlans based on their credentials. ACS 5.2 takes care of that with Tunnel-Private-Group-ID. Currently, I only have it managing one building, so the problem is only looming, but need to start converting my fat APs to LWAPs in other places. That means "way more clients than I can fit into a /24 or even a /23". The way I have it configured right now is as follows: 1. I have interfaces created in the WLC with names corresponding to the value that gets sent in Tunnel-Private-Group-ID (this is done because there are multiple controllers, but I can adjust to a tag instead. Though I don't think this will help in my case) 2. I have these interfaces grouped into an interface group. 3. I have the WLAN created and mapped to the interface group (which I'm pretty sure is not important, since AP group overrides this) 4. I have an AP Group with my APs in just this one building and that has that very same WLAN mapped to the same interface group mentioned above 5. ACS sends back the interface name in Tunnel-Private-Group-ID and the client gets placed into an appropriate vlan based on client's credentials Now the issue 1. I need to add other buildings full of APs, so I'm guessing more AP groups (one per building) 2. If I map the next new AP group to the same interface group it will work and the clients will get placed into the same vlans as the clients above 3. The issue is that at some point I will exhaust the DHCP scopes. I'm thinking that somehow I need to be able to place clients into an appropriate vlan based no only on credentials but also on location (that is building). What I can't find is how to match clients based on AP location in my WLC 7.0 + ACS 5.2 setup. The best I could come up with is tracking all AP's mac addresses and match Called-Station-ID based on those address, but that's a nightmare in my opinion. How do others do it? I would imaging there are some kind of "spill over" features that have to exist out there or some other technique Thanks, --Andrey

1 0

HE IPv6 tunnel inbound
by Grant Ridder 14 Jun '12

14 Jun '12

Hi, I have a Hurricane Electric v6 tunnel setup on an AWS (amazon web services) instance so that i can have ipv6 connectivity. I can ping and traceroute out of the tunnel fine, but am unable to access the tunnel from outside. For example, i am unable to traceroute to the tunnel address outside the tunnel address, even with the AWS instance firewall completely open. I would like to host a website accessible via IPv6, hence the tunnel setup. Is this possible? if so, what could i be doing wrong? Or is there a better was to go about this? Thanks, Grant

7 7

Re: HE IPv6 tunnel inbound
by Grant Ridder 14 Jun '12

14 Jun '12

Hi, Thanks for all the replies. I will look at Chris's solution to see if that will work. I had found similar instructions, but none as extensive. Also, I am using the AWS free tier right now, hence the choice, but i am open to other suggestions. Thanks, Grant On Thu, Jun 14, 2012 at 7:54 AM, seth <seth(a)untethered.org> wrote: > > > > > On Jun 13, 2012, at 11:10 PM, Cameron Byrne <cb.list6(a)gmail.com> wrote: > > > On Jun 13, 2012 8:29 PM, "Grant Ridder" <shortdudey123(a)gmail.com> wrote: > >> > >> Hi, > >> > >> I have a Hurricane Electric v6 tunnel setup on an AWS (amazon web > > services) > >> instance so that i can have ipv6 connectivity. I can ping and > traceroute > >> out of the tunnel fine, but am unable to access the tunnel from outside. > >> For example, i am unable to traceroute to the tunnel address outside the > >> tunnel address, even with the AWS instance firewall completely open. I > >> would like to host a website accessible via IPv6, hence the tunnel > setup. > >> Is this possible? if so, what could i be doing wrong? Or is there a > >> better was to go about this? > >> > >> Thanks, > >> Grant > > > > Sigh. > > > > Or you could take your business to the dozen or so cloud / vps providers > > that support ipv6. ... Softlayer and Arpnetworks come to mind. I have > used > > both with a high level of sucess > > > > CB > > But everybody knows that "amazon" and "cloud" are synonyms.

1 0

Re: very confusing.
by Randy Bush 14 Jun '12

14 Jun '12

NANOG, i strongly desire to restrain this slimeball idiot's trade. please tell me if you have any ideas on how to do so. --- > Be advised that Im following your posts and have your threating > messages to me. If there is an ddos or restraint of trade due to my > ACCIDENTAL email I'll escalate to commerce and FBI. LOL. you are not only a slimeball (who the ietf and nanog admins are scraping out), but an idiot. but do please tell me how i can restrain your trade. would love to discuss your spam with the DoC and FBI. randy

12 11

RE: EBAY and AMAZON
by Hal Murray 14 Jun '12

14 Jun '12

[Snip good collection of security setting suggestions. Does anybody have others or a URL?] > I could never quite understand how anyone could get "phished" by e-mail > since I have never ever seen a "phishing" or other malicious message that > was not obviously so, even when I don't have me spectacles on! Your imagination needs serious recalibration. You are a geek, not a naive, dumb, or unfortunately, typical user. Windows security sucks. Most users will pick convenience over security. What fraction of users (customers) would be happy with your suggested settings? Phishers are smart. They are willing to work for high value targets. Google for >spear phishing<. After you have read a few of those, google for > spear phishing RSA<. >From the comments section of an Arstechnica article on the RSA event: >> So why do any workplace computers in sensitive environments >> have Flash in the first place? > Because the training materials are no doubt flash based. :) If you are interested in security, the whole comments section may be worth scanning. My probably naive view is that this type of problem could easily be solved by having the serious work done on a special class of well locked down machines and making a pool of more open systems available for checking mail or facebook or whatever. I've heard stories of people filling USB slots with epoxy so idiots can't insert thumb drives found in the parking lot or brought from home. I forget the context. -- These are my opinions. I hate spam.

13 15

Patch Management - Windows & RHEL/CentOS based on Date
by Wade Peacock 14 Jun '12

14 Jun '12

Hi All, Does anyone know of a patch management system that will allow us to control the roll out of patches, specifically for Windows but Linux would be nice too, that can use a date to limit whether a patch is rolled out. Ie. Patch to date set to 2012-06-10 So all patches released up to 2012-06-10 will be offer to requesting client. Any patches released after 2012-06-10 will be hidden/not offered until the "Patch to Date" is moved forward. Wade Peacock Production IT | Vision Critical direct 604.629.9358 mobile 604.363.8137 www.visioncritical.com<http://www.visioncritical.com/> New York | London | Vancouver | Paris | Sydney | Chicago | San Francisco | Toronto | Montreal | Calgary

5 4

Re: Article: IPv6 host scanning attacks
by Fernando Gont 13 Jun '12

13 Jun '12

On 06/13/2012 03:37 PM, Dave Hart wrote: >>> "published" and "available" are misleading at best. >> >> It is not. Just scroll down the page, and you'll find the whole article. >> -- it was easy to talk crap than to do that, right? > > Yes, I'm an idiot for believing what I read on that site: > > "Requires Free Membership to View" > > Of course I should have expected that means "scroll past me and the > page of whitespace to view." I wouldn't "announce" the publication of an article that implies the hassle of a registration in order to read it. While it's certainly not "as good as it can get" to have a banner saying "require free membership to view" inserted in the middle of the article body, it's still "acceptable" for me. (Since you're not the first one to think that the article was not free, next time I'll probably make this explicit such that possible trouble is avoided]). >> I find it amazing the number of people that will talk crap when one >> publishes something when compared to the number of people that provides >> technical comments or criticism (even if it's "you're completely wrong >> because of this and that). > > The draft and the article raise valid points about the predictability > of widely-used MAC-derived IIDs, but it does not in any way justify > the headline "Analysis: Vast IPv6 address space actually enables IPv6 > attacks." Whomever wrote that should share their stash. FWIW, the headline was replaced prior to publication. Put another way: I agree with your comment regarding the headline. Cheers, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Flame virus
by Grant Ridder 13 Jun '12

13 Jun '12

Hi Everyone, I realize this is not directly network related, but i thought i would pass the article along anyways. The authors of the Flame virus have started to destroy its existence. http://spectrum.ieee.org/riskfactor/telecom/security/flame-ordered-to-flame… -Grant

1 0