- NANOG - lists.nanog.org

Announcing xtractr (on pcapr)
by kowsik 22 Feb '10

22 Feb '10

We just released xtractr, a collaborative cloud app for indexing, searching, extracting and reporting on large pcaps. This thread on NANOG is one of the many use cases that xtractr attempts to solve: http://mailman.nanog.org/pipermail/nanog/2009-December/015661.html You can learn more about xtractr on our blog: http://bit.ly/d7yrKl or watch a demo: http://www.pcapr.net/xtractr Thanks, K. --- http://www.pcapr.net/ http://www.mudynamics.com http://twitter.com/pcapr

1 0

Spamhaus and Barracuda Networks BRBL
by Dean Drako 22 Feb '10

22 Feb '10

With respect to Barracuda Networks and Spamhaus. I expect, but I do not know, that Spamhaus probes on port 25 in order to identify Barracuda Spam and Virus Firewalls and then block their access to their RBL. Many Barracuda customers have been cut off without warning causing them trouble and pain. Barracuda attempted to find a deal that would work for licensing Spamhaus for our products, however, spamhaus's desire for money could not be met without significantly increasing the price to each of our customers. They wanted us to charge the spamhaus feed price to each of our customers. We tried to find an arrangement for a long time. I personally love the work that spamhaus has done. I was disappointed that we could not find an arrangement once they changed into a commercial entity and started charging customers. When they were providing a free service we promoted them strongly, but when they started charging the customers that really used it, we had to part ways. It is a pity. We recommend customers use only Barracuda's Free RBL: "BRBL" and this is now built into the Barracuda Spam and Virus Firewall. http://www.barracudacentral.org/rbl The BRBL is provided at no charge to anyone who wants to use it (even non barracuda customers). The BRBL has a full time staff that answers phone and email to correct any false positives and handle removal requests -- unlike competing services that charge money and who do not provide a staff. We will consider providing data feeds if anyone has interest. We currently provide the BRBL as a free service. We make no claims about it being better or worse than any other RBL. It does use a massive amount of data in order to determine which IP's should be on the list. Others have made claims about its accuracy and say great things about it. Others complain that we unjustly block them, however, 99.9% of the people who are blocked and who contact us find a BOT in their network. Sincerely, Dean Drako CEO Barracuda Networks

7 6

Assistance Required for Masters Program
by Erik Jacobsen 22 Feb '10

22 Feb '10

I am in the process of enrolling in a Masters of Information Assurance (MSIA) program and need some assistance. The program requires that we complete a case study at the end of each three month term. I have chosen to do my case studies on the Internet Service Provider industry. I worked in the industry for 5+ years, so I am pretty comfortable with the technology. I am looking for a couple of CISSP level engineers or even Information Security officers who work for an Internet service provider to act as industry contacts. The purpose of the case studies is to baseline course content against current industry practices. So, I will be producing a case study that will identify current industry practices and makes recommendations on how the industry as a whole can improve security. My work may even be published in those ubiquitous industry rags. Because security is a sensitive subject, you have the option of remaining anonymous in my reports. Thanks Erik Jacobsen

1 0

In wall switches
by Andrey Khomyakov 22 Feb '10

22 Feb '10

Hi folks, Does anyone know of anything like a small, but managed in wall switch? I have an area where the business needs to deploy more thin client kiosks than I have data drops and it's impossible to add more due to how the walls on that floor (basement) where finished. I found this little device from HP http://www.procurve.com/products/wireless/HP_ProCurve_MultiService_Access_D… under $250 a pop. Even though it's a WiFi AP, I don't care for wifi functionality of that. I just want to avoid throwing 5 port linksys's all over the floor there. Has anyone seen anything like that HP or worked with that HP at all? Can I manage it without buying the controller? Thanks, Andrey PS. You probably have seen posts from me before as Andrey Gordon. I recently changed my name to Andrey Khomyakov. Just making the connection if anyone cares. --

7 9

Chuck Norris Botnet and Broadband Routers
by Gadi Evron 22 Feb '10

22 Feb '10

Last week Czech researchers released information on a new worm which exploits CPE devices (broadband routers) by means such as default passwords, constructing a large DDoS botnet. Today this story hit international news. Original Czech: http://praguemonitor.com/2010/02/16/czech-experts-uncover-global-virus-netw… English: http://www.pcworld.com/businesscenter/article/189868/chuck_norris_botnet_ka… When I raised this issue before in 2007 on NANOG, some other vetted mailing lists and on CircleID, the consensus was that the vendors will not change their position on default settings unless "something happens", I guess this is it, but I am not optimistic on seeing activity from vendors on this now, either. CircleID story 1: http://www.circleid.com/posts/broadband_routers_botnets/ CircleID story 2: http://www.circleid.com/posts/broadband_router_insecurity/ The spread of insecure broadband modems (DSL and Cable) is extremely wide-spread, with numerous ISPs, large and small, whose entire (read significant portions of) broadband population is vulnerable. In tests Prof. Randy Vaughn and I conducted with some ISPs in 2007-8 the results have not been promising. Further, many of these devices world wide serve as infection mechanisms for the computers behind them, with hijacked DNS that points end-users to malicious web sites. On the ISPs end, much like in the early days of botnets, many service providers did not see these devices as their responsibility -- even though in many cases they are the providers of the systems, and these posed a potential DDoS threat to their networks. As a mind-set, operationally taking responsibility for devices located at the homes of end users made no sense, and therefore the stance ISPs took on this issue was understandable, if irresponsible. As we can't rely on the vendors, ISPs should step up, and at the very least ensure that devices they provide to their end users are properly set up (a significant number of iSPs already pre-configure them for support purposes). The Czech researchers have done a good job and I'd like to thank them for sharing their research with us. In this article by Robert McMillan, some details are shared in English: ---------- Discovered by Czech researchers, the botnet has been spreading by taking advantage of poorly configured routers and DSL modems, according to Jan Vykopal, the head of the network security department with Masaryk University's Institute of Computer Science in Brno, Czech Republic. The malware got the Chuck Norris moniker from a programmer's Italian comment in its source code: "in nome di Chuck Norris," which means "in the name of Chuck Norris." Norris is a U.S. actor best known for his martial arts films such as "The Way of the Dragon" and "Missing in Action." Security experts say that various types of botnets have infected millions of computers worldwide to date, but Chuck Norris is unusual in that it infects DSL modems and routers rather than PCs. It installs itself on routers and modems by guessing default administrative passwords and taking advantage of the fact that many devices are configured to allow remote access. It also exploits a known vulnerability in D-Link Systems devices, Vykopal said in an e-mail interview. A D-Link spokesman said he was not aware of the botnet, and the company did not immediately have any comment on the issue. Like an earlier router-infecting botnet called Psyb0t, Chuck Norris can infect an MIPS-based device running the Linux operating system if its administration interface has a weak username and password, he said. This MIPS/Linux combination is widely used in routers and DSL modems, but the botnet also attacks satellite TV receivers. ---------- Read more here: http://www.pcworld.com/businesscenter/article/189868/chuck_norris_botnet_ka… I will post updates on this as I discover them on my blog, under this same post, here: http://gadievron.blogspot.com/2010/02/chuck-norris-botnet-and-broadband.html Gadi.

4 4

Messages in junk/spam box
by Tarig Y. Adam 22 Feb '10

22 Feb '10

Hi Messages we send from our mail sever always received at SPAM box in many Public Mail servers like hotmail, yahoo, and gmail. We made a revers dns lookup, and there is no spamming from our server, still messages go to junk. how to solve this. thanx This message may contain confidential information from Sudanese Universities Information Network (SUIN). If you have received this message by mistake, please inform the sender by sending an e-mail reply. At the same time please delete the message and any attachments from your system without making, distributing or retaining any copies Although all our e-mails messages and any attachments upon sending are automatically virus scanned we assume no responsibility for any loss or damage arising from the receipt. Sudanese Universities Information Network (SUIN), P.O.Box 321/22, University of Khartoum, 11115, Khartoum, Sudan. www.suin.edu.sd

3 2

RE: Spamhaus
by Joel M Snyder 22 Feb '10

22 Feb '10

On Sat, Feb 20, 2010 at 7:25 PM, Jon Lewis <jlewis(a)lewis.org> wrote: > > IMO, the original question in this thread was on-topic, but unfortunately it > > got very little discussion >I like spamhaus, they run a quality list, but they want between $1900 >and $19000 per year for their rsync service and you have to tell them >how many email customers you're supporting in order to pay less than >the max. That would be an acceptable price to pay for antispam efforts >overall, but I couldn't afford to pay that for *each* of the dozens of >services spamassassin consults while analyzing a message. I wonder if the pricing you've got is old. I just did a test of a product and got pricing of $420/year for 600 users when I queried them. Essentially, less than $1/user/user. I understand that you are querying dozens of services with SpamAssassin, but I can guarantee you're not getting value for all that traffic you're generating. In our research, we've found very little value to stacking reputation services. And even stacking content filters can cause more problems than it solves if you don't pick them VERY carefully. Just as an example, last month one of the content filters (think of it as an anti-spam product like SpamAssassin, but NOT including any reputation component) I tested ran with approximately an 81% catch rate. Add in a single reputation filter, and that jumps up to 92.36%. Add in three reputation filters, and the new rate is 92.99%. Add in every single reputation filter I'm testing (that was 32 of them last month) and the rate barely jumped to 93.02%---but the false positive count jumped by 112 messages per 10,000 (because APEWS was somehow having a lousy month). In general, the more reputation services you include, the more likely it is you're going to have false positives. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

2 1

Call for papers: ISP-10, Orlando, USA, July 2010
by James Heralds 21 Feb '10

21 Feb '10

It would be highly appreciated if you could share this announcement with your colleagues, students and individuals whose research is in information security, cryptography, privacy, and related areas. Call for papers: ISP-10, Orlando, USA, July 2010 The 2010 International Conference on Information Security and Privacy (ISP-10) (website: http://www.PromoteResearch.org<http://www.promoteresearch.org/>) will be held during 12-14 of July 2010 in Orlando, FL, USA. ISP is an important event in the areas of information security, privacy, cryptography and related topics. The conference will be held at the same time and location where several other major international conferences will be taking place. The conference will be held as part of 2010 multi-conference (MULTICONF-10). MULTICONF-10 will be held during July 12-14, 2010 in Orlando, Florida, USA. The primary goal of MULTICONF is to promote research and developmental activities in computer science, information technology, control engineering, and related fields. Another goal is to promote the dissemination of research to a multidisciplinary audience and to facilitate communication among researchers, developers, practitioners in different fields. The following conferences are planned to be organized as part of MULTICONF-10. • International Conference on Artificial Intelligence and Pattern Recognition (AIPR-10) • International Conference on Automation, Robotics and Control Systems (ARCS-10) • International Conference on Bioinformatics, Computational Biology, Genomics and Chemoinformatics (BCBGC-10) • International Conference on Computer Communications and Networks (CCN-10) • International Conference on Enterprise Information Systems and Web Technologies (EISWT-10) • International Conference on High Performance Computing Systems (HPCS-10) • International Conference on Information Security and Privacy (ISP-10) • International Conference on Image and Video Processing and Computer Vision (IVPCV-10) • International Conference on Software Engineering Theory and Practice (SETP-10) • International Conference on Theoretical and Mathematical Foundations of Computer Science (TMFCS-10) MULTICONF-10 will be held at Imperial Swan Hotel and Suites. It is a full-service resort that puts you in the middle of the fun! Located 1/2 block south of the famed International Drive, the hotel is just minutes from great entertainment like Walt Disney World® Resort, Universal Studios and Sea World Orlando. Guests can enjoy free scheduled transportation to these theme parks, as well as spacious accommodations, outdoor pools and on-site dining — all situated on 10 tropically landscaped acres. Here, guests can experience a full-service resort with discount hotel pricing in Orlando. We invite draft paper submissions. Please see the website http://www.PromoteResearch.org <http://www.promoteresearch.org/> for more details. Sincerely James Heralds

2 1

Re: Spamhaus...
by Robert Bonomi 21 Feb '10

21 Feb '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Fri Feb 19 22:32:48 2010 > From: William Herrin <bill(a)herrin.us> > Date: Fri, 19 Feb 2010 23:32:10 -0500 > Subject: Re: Spamhaus... > To: Larry Sheldon <LarrySheldon(a)cox.net> > Cc: nanog(a)nanog.org > > On Fri, Feb 19, 2010 at 8:35 PM, Larry Sheldon <LarrySheldon(a)cox.net> wrote: > > On 2/19/2010 7:20 PM, William Herrin wrote: > >> "If an SMTP server has accepted the task of relaying the mail and > >> later finds that the destination is incorrect or that the mail cannot > >> be delivered for some other reason, then it MUST construct an > >> "undeliverable mail" notification message and send it to the > >> originator of the undeliverable mail (as indicated by the > >> reverse-path)." > > > > Does the RFC say what to do if the reverse-path has been > > damaged and now points to somebody who had nothing > > what ever to do with the email? > > Hi Larry, > > Re-reading the paragraph I quoted and you repeated, I'm going to say > that the answer is "yes." > I'll bite. *HOW* do you send to the _originator_ (as *required* by the RFC you quoted) of the undeliverable mail, when the reverse path points to 'someone else'? Note well the exact lanugage used -- it does not say 'the party named in the reverse path', the 'claimed sender', 'putative sender' or any other similar equivocation that justifies sending to a forged address. It says "the originator". To me, that can be only iterpreted in _one_ way. To wit: as the party that _actually_ created and transmitted the message, _regardless_ of what the declared return path is. Since such a message is 'defective' (not RFC-compliant -- because the true point -of-origin is *NOT* in the reverse path, as it MUST be for an RFC-compliant message) on it's face, I will argue that there is no need to apply the 'required' handling for a 'proper' message to it.

9 15

Re: Messages in junk/spam box
by chaim.rieger＠gmail.com 21 Feb '10

21 Feb '10

You should head over to the mail groups and ask this, more on topic there. Sent via BlackBerry from T-Mobile

1 0