- NANOG - lists.nanog.org

hat tip to .gov hostmasters
by Scott Francis 24 Sep '08

24 Sep '08

http://it.slashdot.org/article.pl?sid=08/09/22/1253201&from=rss nice to see a wholesale DNSSEC rollout underway (I must confess to being a little surprised at the source, too!). Granted, it's a much more manageable problem set than, say, .com - but if one US-controlled TLD can do it, hope is buoyed for a .com rollout sooner rather than later (although probably not much sooner :)). /sf

18 33

YAY! Re: Atrivo/Intercage: NO Upstream depeer
by Mark Foo 24 Sep '08

24 Sep '08

On Sun, Sep 21, 2008 at 12:46:54PM -0700, Emil Kacperski wrote: > Hey James, > > That's the worst part in all this, so many been with me for years!? I just put my fate into companies I shouldn't have. Emil: Yes, they have been with you for years -- it's quite unfortunate, such great customers. Take those customers who steal identity from the public -- did you get a cut, or just the hosting fees? Next, move to those who host trojans, rogue antivirus, bill people for fake software (and keep billing them), etc. Oh, and the ad-ware, despite being a lower security risk, it was some of the most hated stuff out there. I'd say you have put your fate into companies you shouldn't have -- not just your fate but your business. This is the logical result (actually, this is just the start). I'm surprised it took so long. You can't wash away years of malicious activity by simply claiming innocence and disconnecting some of your worst offenders. Male parta male dilabuntur. For the NANOG folks who apparently don't understand what is going on and are so easily socially engineered by these claims of innocence -- do a little research: http://www.google.com/search?hl=en&q=intercage+malware http://www.google.com/search?hl=en&q=atrivo+malware ======================================================== Here's some research for you: Complaints on Intercage/Atrivo from 2003: Re: The in-your-face hijacking example http://www.irbs.net/internet/nanog/0305/0038.html ======================================================== >From 2006: More super rogue anti-spyware http://updates.zdnet.com/tags/intercage.com.html Be on the lookout for another new supposed anti-spyware program that might be hijacking desktops any day now. This one is called PestTrap and it.s a clone of SpySheriff. SpySheriff was one of the top 10 rogue anti-spyware apps of 2005, coming in at number 2. PestTrap site is hosted at IP address 69.50.167.173 which belongs to an ISP in California, InterCage, Inc., formerly know n as Atrivo. Note the nameservers are mail.atrrivo.com and pavel.atrivo.com . OrgName: InterCage, Inc. OrgID: INTER-359 Address: 1955 Monument Blvd. Address: #236 City: Concord StateProv: CA PostalCode: 94520 Country: US Not surprisingly, SpySheriff.com (link to whois) is hosted at InterCage, and we have SpyTrooper.com on the same IP address, 69.50.170.82. The other domain on the IP is Spy-Sheriff.com. This IP is also currently blacklisted. InterCage, Inc. INTERCAGE-NETWORK-GROUP (NET-69-50-160-0-1) 69.50.160.0 - 69.50.191.255 William Lu STANDARDSHELLS (NET-69-50-170-0-1) 69.50.170.0 - 69.50.170.255 The Intercage.com (link to site) home page is white and blank except for "." in the upper left corner. Now, that seems odd to me. An ISP with a blank homepage? Google searches for Intercage.com and Intercage, Inc. bring up all kinds of interesting links. A Google search for Atrivo produces even more fascinating information like this and this. More on this one later.

3 2

RE: Atrivo/Intercage: Now Only 1 Upstream
by Skywing 23 Sep '08

23 Sep '08

Putting things in the automated bogon feeds (e.g. Team Cymru) that are not strictly bogons (unallocated addresses) is likely to very quickly erode trust in those services, if that is what you are suggesting. - S -----Original Message----- From: Lamar Owen <lowen(a)pari.edu> Sent: Wednesday, September 17, 2008 09:26 To: nanog(a)nanog.org <nanog(a)nanog.org> Subject: Re: Atrivo/Intercage: Now Only 1 Upstream On Tuesday 16 September 2008 23:36:20 *Hobbit* wrote: > you expect them to apply a null route? > > Well, I *have* been talking somewhat idealistically here and > there with this crop of questions, but frankly I thought in the > 2 or 3 years I was ignoring the list that the NETWORK OPERATORS > ostensibly in custody of the intertubes would have pulled things > together a little better and grown enough of a pair to firmly > state "this crap stops here and now" and make it happen. :-) Speaking as an observer only, and not as someone who, other than at my own edge, could make a significant impact on the result. Seems to me getting that IP space on a bogon list could be enough to make a serious dent.

19 28

prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

I am hoping to confirm a short-duration prefix hijack of 72.234.0.0/15 (and another of our prefixes) by ASN 8997 ("OJSC North-West Telecom" in Russia) in using ASN 3267 (Russian Federal University Network) to advertise our space to ASN 3277 (Regional University and Scientific Network (RUSNet) of North-Western and Saint-Petersburg Area of Russia). Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", put in prefix 72.234.0.0/15 and select the dates: 22/9/2008 9:00:00 and 22/9/2008 15:00:00 If so, am I understanding it correctly if I say ASN 3267 saw a shorter path from ASN 8997, so refused the proper announcement from ASN 36149 (me) it normally hears from ASN 174 (Cogent). If the above two are correct, would it be correct to say only the downstream customers of ASN 3267 were affected? scott

9 16

Re: eigrp and managed ethernet
by Joseph Doran 23 Sep '08

23 Sep '08

EIGRP timers over WAN media default to 60 seconds. Neighborship will not expire for up to 180 seconds. To verify your EIGRP neighborship do a "show ip eigrp neighbor" Message: 6 Date: Tue, 23 Sep 2008 09:25:34 -0700 (PDT) From: Philip Lavine <source_route(a)yahoo.com> Subject: Re: eigrp and managed ethernet To: nanog <nanog(a)merit.edu> Message-ID: <542140.85408.qm(a)web30802.mail.mud.yahoo.com> Content-Type: text/plain; charset=us-ascii What is really bizarre is that I am down for minutes not seconds and the timers never fire. If I don't manually passive the connection eigrp will for some reason think there is a neighbor even though I am unable to source ping across the WAN.

2 1

Re: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

------ tme(a)multicasttech.com wrote: ---------- From: Marshall Eubanks <tme(a)multicasttech.com> So, do you think this was lots of little tests / hijacks / mistakes ? Or did it just not propagate very far ? --------------------------------------------- According to Andree Toonk (and someone confirmed privately) ASN 8997 leaked a full table to ASN 3267 (who didn't filter!). The only upstream of ASN 3267 I saw in bgplay was ASN 174 (Cogent) who seems to have filtered, but I can't confirm. So I guess that the impact would've only been to the peers downstream of ASN 3267. scott --------------------------------------------- Andree Toonk <andree+nanog(a)toonk.nl> Not a false positive, It actually was detected by the RIS box in Moscow (rrc13). Strange that it's not visible in RIS search website, but it's definitely in the raw data files. Looking at that raw data from both routeviews and Ripe, it looks like they (AS8997) 'leaked' a full table, i.e. : ----------------------------------------------

3 2

Re: eigrp and managed ethernet
by Philip Lavine 23 Sep '08

23 Sep '08

What is really bizarre is that I am down for minutes not seconds and the timers never fire. If I don't manually passive the connection eigrp will for some reason think there is a neighbor even though I am unable to source ping across the WAN. ----- Original Message ---- From: Matthew Huff <mhuff(a)ox.com> To: Philip Lavine <source_route(a)yahoo.com>; nanog <nanog(a)merit.edu> Sent: Tuesday, September 23, 2008 8:59:14 AM Subject: RE: eigrp and managed ethernet Correct. Eigrp neighbor connectivity has a short-cut when L2 connectivity goes down, otherwise it will use the eigrp neighbor hold-down timer. You can decrease that timer: interface fa0/0 ip hello-interval eigrp p x ip hold-time eigrp p y where p is your eigrp as-number, and x is how often you want the hello (in seconds) and y is the max hold-down timer. Generally y is = x * 3 http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfeigrp… ---- Matthew Huff | One Manhattanville Rd OTA Management LLC | Purchase, NY 10577 www.ox.com | Phone: 914-460-4039 aim: matthewbhuff | Fax: 914-460-4139 -----Original Message----- From: Philip Lavine [mailto:source_route@yahoo.com] Sent: Tuesday, September 23, 2008 11:43 AM To: nanog Subject: eigrp and managed ethernet For some reason when I lose layer 3 connectivity between two managed Ethernet sites EIGRP does not bounce.Is this because the physical interface does not bounce?

5 4

eigrp and managed ethernet
by Philip Lavine 23 Sep '08

23 Sep '08

For some reason when I lose layer 3 connectivity between two managed Ethernet sites EIGRP does not bounce.Is this because the physical interface does not bounce?

4 3

Re: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

--- tme(a)multicasttech.com wrote: From: Marshall Eubanks <tme(a)multicasttech.com> : You didn't specify the time zone you are in, : so I looked at +- 1 day around it. If the : hijack lasted 6 hours, we should have seen it. My apologies, I just used the time zone the tool (bgplay.routeviews.org/bgplay) was using when I said: 22/9/2008 9:00:00 and 22/9/2008 15:00:00 I'm sure it was in GMT. Seeing the many responses, we now know something happened and it was only about 15 minutes in duration. bgplay shows the problem with the above data and I was just wondering if I was understanding the impact correctly: > If the above two are correct, would it be > correct to say only the downstream customers > of ASN 3267 were affected? I was not following the rules properly: never attribute to malice that which can be explained by human error. I thought there might be some testing-of-the-water in preparation for future 'events' and I guess I was starting to be trigger happy after all the talk about the new BGP attack. scott --- tme(a)multicasttech.com wrote: From: Marshall Eubanks <tme(a)multicasttech.com> To: surfer(a)mauigateway.com Cc: <nanog(a)merit.edu> Subject: Re: prefix hijack by ASN 8997 Date: Tue, 23 Sep 2008 07:51:36 -0400 On Sep 22, 2008, at 9:06 PM, Scott Weeks wrote: > > > > I am hoping to confirm a short-duration prefix hijack of > 72.234.0.0/15 (and another of our prefixes) by ASN 8997 ("OJSC North- > West Telecom" in Russia) in using ASN 3267 (Russian Federal > University Network) to advertise our space to ASN 3277 (Regional > University and Scientific Network (RUSNet) of North-Western and > Saint-Petersburg Area of Russia). > > Is that what I'm seeing when I go to "bgplay.routeviews.org/bgplay", > put in prefix 72.234.0.0/15 and select the dates: > > 22/9/2008 9:00:00 and 22/9/2008 15:00:00 > > If so, am I understanding it correctly if I say ASN 3267 saw a > shorter path from ASN 8997, so refused the proper announcement from > ASN 36149 (me) it normally hears from ASN 174 (Cogent). I cannot confirm that from the monitoring program at AS 16517 : [tme@lennon mcast]$ grep 72.234.0.0 bgp.full.Sep_2*2008 bgp.full.Sep_21_00:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_21_06:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_21_12:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_21_18:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_00:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_06:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_12:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_22_18:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_23_00:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? bgp.full.Sep_23_06:07:00_EDT_2008:*> 72.234.0.0/15 38.101.161.116 3990 0 174 209 36149 ? You didn't specify the time zone you are in, so I looked at +- 1 day around it. If the hijack lasted 6 hours, we should have seen it. Regards Marshall > > > If the above two are correct, would it be correct to say only the > downstream customers of ASN 3267 were affected? > > scott >

2 1

Re: InterCage, Inc. (NOT Atrivo)
by Scott Weeks 23 Sep '08

23 Sep '08

--- jpleger(a)gmail.com wrote: I am sure if I looked into it more I could find some exploits related to the sites. ------------------------------------- "Why software piracy might actually be good for companies." Folks should clean their own house before pointing fingers at others... scott

16 28