- NANOG - lists.nanog.org

Re: Nato warns of strike against cyber attackers
by Tim Franklin 10 Jun '10

10 Jun '10

> Checklists come in handy in fact if many were followed (BCP > checklists, appropriate industry standard fw, system rules) > the net would be a cleaner place. Sensible checklists that actually improve matters, yes. The audit checklists I've often been subjected to, full of security theatre and things that are "accepted auditor wisdom" rather than contributing to the security of the network in any meaningful way, not so much. Regards, Tim.

1 0

ISP Responsibilities [WAS: Re: Nato warns of strike against cyber attackers]
by Paul Ferguson 10 Jun '10

10 Jun '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 To cut through the noise and non-relevant discussion, let's see if we can boil this down to a couple of issues: 1. Should ISPs be responsible for abuse from within their customer base? 1a. If so, how? 2. Should hosting providers also be held responsible for customers who abuse their services in a criminal manner? 2.a If so, how? I think anyone in their right mind would agree that if a provider see criminal activity, they should take action, no? If that also holds true, then why doesn't it happen? Providers in the U.S. are the worst offenders of hosting/accommodating criminal activities by Eastern European criminals. Period. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.3 (Build 5003) wj8DBQFMDzEsq1pz9mNUZTMRAofEAKDsKxNL+5GT0ztuuqq4LpK/i3TFmACeJ4mc wfZppwxJYkvW1vS6cacuuX0= =Xs0E -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawgster(at)gmail.com ferg's tech blog: http://fergdawg.blogspot.com/

9 11

Re: ISP Responsibilities [WAS: Re: Nato warns of strike against cyber attackers]
by Larry Sheldon 09 Jun '10

09 Jun '10

On 6/9/2010 10:58, Owen DeLong wrote: >> What happened to the acronyms "AUP" and "TOS"? >> > I'm not sure what you mean by that. I'm talking about an ISPs liability to > third party victims, not to their customers. "Acceptable Use Policy" and "Terms of Service" > > AUP/TOS are between the ISP and their customer. Very good. Does that provide an answer to the earlier question about "what is a provider to do?" when a customer misbehaves? Does that provide a method for assigning liability? I am not a lawyer, but it doesn't seem a stretch to me to include, in this context, traffic from peers and transit providers. -- Somebody should have said: A democracy is two wolves and a lamb voting on what to have for dinner. Freedom under a constitutional republic is a well armed lamb contesting the vote. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

4 5

Re: Nato warns of strike against cyber attackers
by andrew.wallace 09 Jun '10

09 Jun '10

The original article is FUD. The Times newspaper is historically known as MI5, MI6's newspaper of choice. Andrew http://sites.google.com/site/n3td3v/

1 0

Re: Nato warns of strike against cyber attackers
by Michiel Klaver 09 Jun '10

09 Jun '10

-------- Original message -------- > Generally speaking, nobody wants to be the cop that makes that call. > Theoretically an ISP *might* be able to do that, but most are unwilling, > and those of us that do actually play BOFH run the risk of losing > customers to a sewerISP that doesn't. Our experiences from the Dutch ISP market indicate otherwise, customers are more than happy to be informed they might have been infected by a virus/worm. Most customers are too afraid of loosing valuable documents due to a file-eating virus for example, or afraid of loosing connection to the internet entirely and appreciate it to get an opportunity to do some clean-up when placed in quarantaine vlan. They even will recommend you, and your reputation as ISP-with-clue will increase. To stay on-topic, this is one of the first steps to prevent hosts in your network attacking NATO and decrease the risk of being disconnected by them. Commercial products that might assist you: http://www.quarantainenet.nl/?language=en;page=product-qnet Michiel Klaver IT Professional

2 1

Root Zone DNSSEC Deployment Technical Status Update
by Joe Abley 09 Jun '10

09 Jun '10

Root Zone DNSSEC Deployment Technical Status Update 2010-06-09 This is the eighth of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. RESOURCES Details of the project, including documentation published to date, can be found at <http://www.root-dnssec.org/>. We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org. PUBLIC NOTICE The US Department of Commerce National Telecommunications and Information Administration (NTIA) has issued a Public Notice regarding the deployment of DNSSEC in the root zone. http://www.ntia.doc.gov/frnotices/2010/FR_DNSSEC_Notice_06092010.pdf The Public Notice makes reference to the final report submitted to NTIA by ICANN and VeriSign which contains a summary of the project work to date together with a recommendation that full deployment should proceed. http://www.ntia.doc.gov/reports/2010/DNSSEC_05282010.pdf The Public Notice includes a public review period. Comments may be submitted by postal mail, fax or e-mail before 2010-06-21. Instructions for the submission of comments are included in the Public Notice. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ 2010-05-05: J starts to serve DURZ To come: 2010-06-16: First Key Signing Key (KSK) Ceremony 2010-07-15: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.)

1 0

clueful verizon.net email contact?
by Joshua A. Fiske - jfiske 09 Jun '10

09 Jun '10

It appears that verizon.net has one email server[1] (out of a sizeable pool) that is not able to perform a proper MX lookup for our domain. Does anyone have contact information for a clue-ful individual that would have responsibility for email server maintenance at verizon.net? Josh [1] Reporting-MTA: dns;vms173001.mailsrvcs.net (tcp-daemon) - - - - Joshua Fiske '03, '04 Manager of User Services Clarkson University, Office of Information Technology (315) 268-6722 -- Fax: (315) 268-6570

1 0

Nato warns of strike against cyber attackers
by J. Oquendo 09 Jun '10

09 Jun '10

>From the NetSec mailing list... > At http://www.timesonline.co.uk/tol/news/world/article7144856.ece > > June 6, 2010 > Nato warns of strike against cyber attackers > Michael Smith and Peter Warren > > NATO is considering the use of military force against enemies who launch > cyber attacks on its member states. > > The move follows a series of Russian-linked hacking against Nato members and > warnings from intelligence services of the growing threat from China. > > A team of Nato experts led by Madeleine Albright, the former US secretary of > state, has warned that the next attack on a Nato country ³may well come down > a fibre-optic cable². > > A report by Albright¹s group said that a cyber attack on the critical > infrastructure of a Nato country could equate to an armed attack, justifying > retaliation. > > Article 5 is the cornerstone of the 1949 Nato charter, laying down that ³an > armed attack² against one or more Nato countries ³shall be considered an > attack against them all². > > It was the clause in the charter that was invoked following the September 11 > attacks to justify the removal of the Taliban regime in Afghanistan. > > Nato is now considering how severe the attack would have to be to justify > retaliation, what military force could be used and what targets would be > attacked. > > The organisation¹s lawyers say that because the effect of a cyber attack can > be similar to an armed assault, there is no need to redraft existing > treaties. > > Eneken Tikk, a lawyer at Nato¹s cyber defence centre in Estonia, said it > would be enough to invoke the mutual defence clause ³if, for example, a > cyber attack on a country¹s power networks or critical infrastructure > resulted in casualties and destruction comparable to a military attack². > > Nato heads of government are expected to discuss the potential use of > military force in response to cyber attacks at a summit in Lisbon in > November that will debate the alliance¹s future. General Keith Alexander, > head of the newly created US cyber command, said last week there was a need > for ³clear rules of engagement that say what we can stop². > > The concerns follow warnings from intelligence services across Europe that > computer-launched attacks from Russia and China are a mounting threat. > Russian hackers have been blamed for an attack against Estonia in April and > May of 2007 which crippled government, media and banking communications and > internet sites. > > They also attacked Georgian computer systems during the August 2008 invasion > of the country, bringing down air defence networks and telecommunications > systems belonging to the president, the government and banks. > > Alexander disclosed last week that a 2008 attack on the Pentagon¹s systems, > believed to have been mounted by the Chinese, successfully broke through > into classified areas. > > Britain¹s Joint Intelligence Committee cautioned last year that Chinese-made > parts in the BT phone network could be used to bring down systems running > the country¹s power and food supplies. > > Some experts have warned that it is often hard to establish government > involvement. Many Russian attacks, for example, have been blamed on the > Russian mafia. The Kremlin has consistently refused to sign an international > treaty banning internet crime. > > Obviously NATO is not concerned with proving the culprit of an attack an albeit close to impossibility. Considering that many attackers compromise so many machines, what's to stop someone from instigating. I can see it coming now: hping -S 62.128.58.180 -a 62.220.119.62 -p ++21 -w 6000 hping -S 62.220.119.62 -a 62.128.58.180 -p ++21 -w 6000 So NANOGer's, what will be the game plan when something like this happens, will you be joining NATO and pulling fiber. I wonder when all types of warm-fuzzy filtering will be drafted into networking: "Thou shall re-read RFC4953 lest you want Predator strikes on your NAP locations... -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

15 18

Re: Nato warns of strike against cyber attackers
by Michiel Klaver 09 Jun '10

09 Jun '10

> ----- Original message ----- > All that said, the biggest problem is users. Social Engineering is a far bigger threat than anything in software. And I don't know how we stop that. Anyone have an idea? Users will click anything they find 'interesting', can't change that part up front. However, after those users get infected with whatever virii/worm/botnet client came along, you could detect it [1] and place them into a quarantaine vlan routing all traffic to an information page stating they have done something stupid and educate them how to clean-up and avoiding it from happening in the future again. This will stop the abuse almost instantly (if the detection and vlan move is done automatically), and it will educate users afterwards by learning from their msitakes. Most users appreciate such kind of warnings from their own ISP (afraid of loosing documents by a virus) and are willing to clean-up. You could charge fees when users need clean-up assistance. [1] Projects like ShadowServer.org scan all kinds of botnets and (after a sign-up) send out notifications to your abuse-desk when they find infected hosts at your IP subnets. You could also setup your own Snort IDS with the detection rules from EmergingThreats.net. With kind regards, Michiel Klaver IT Professional

1 0

Strange practices?
by Dale Cornman 09 Jun '10

09 Jun '10

Has anyone ever heard of a multi-homed enterprise not running bgp with either of 2 providers, but instead, each provider statically routes a block to their common customer and also each originates this block in BGP? One of the ISP's in this case owns the block and has even provided a letter of authorization to the other, allowing them to announce it in BGP as well. I had personally never heard of this and am curious if this is a common practice as well as if this would potentially create any problems by 2 Autonomous Systems both originating the same prefix. Thanks -Bill

10 12