- NANOG - lists.nanog.org

GLBX De-Peers Intercage [Was: RE: Washington Post: Atrivo/Intercage, w hy are we peering with the American RBN?]
by Paul Ferguson 30 Aug '08

30 Aug '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Marc Sachs" <marc(a)sans.org> wrote: >Unless I'm mis-reading this (or perhaps GBLX read Kreb's story and said >good-bye to Atrivo/Intercage), it looks like they are no longer their >upstream: > >http://cidr-report.org/cgi-bin/as-report?as=AS27595&v=4&view=2.0 > I applaud GLBX's move to disconnect Atrivo/Intercage. What the Armin/McQuaid/Jonkman report [1] documented are activities that many of us in the security community have known for a couple of years. One thing that Krebs _didn't_ mention in his WaPo article are the large number of rogue DNS servers that also reside there. A couple of colleagues, Feike Hacquebord, Chenguai Lu, et al., presented a paper at the Virus Bulletin conference last year [2]. While the paper is almost a year old, that particular situation has gotten progressively worse. My only concern here is that by the publicity this issue continues to receive, these activities will just move else where, like scurrying cockroaches (like what happened with AS40989). One step at a time, I suppose. - - ferg [1] http://www.hostexploit.com/ [2] http://www.virusbtn.com/pdf/conference_slides/2007/HacquebordVB2007.pdf -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIuJelq1pz9mNUZTMRArvXAJ9PHNQygl5Mnrozgu140di34FvuigCcCzFa UWI10pR0jTyDUapX/J3Opa4= =YU/M -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: BGP Attack - Best Defense ?
by Scott Weeks 29 Aug '08

29 Aug '08

----- Original Message ----- Let's say the attacker is announcing one or more /24s of mine and announcing a more specific is not possible. I figure it out somehow and begin announcing the same. The attacker doesn't stop his attack. What happens? The part of the internet closest in topology to me sends their traffic to me and the part of the internet closest to the attacker sends traffic to him? ----------------------------------- --- Guy_Shields(a)Stream.Com wrote:------- Correct, as you would then be contending with the path length portion of the 10 determistic citeria in the bgp protocol. --------------------------------------- And the only one that'd really come into play would be shortest number of AS hops, so topological closeness would be the deciding factor on whether the traffic transits the attacker's network or properly comes directly to me. scott

1 0

Using 32 bit ASN numbers
by Brian Raaen 29 Aug '08

29 Aug '08

I am doing some research for our company regarding 32 bit ASN numbers. I am trying to locate information about vendor and service provider support. In particular I have not been able to find what Cisco IOS image I would need to load on our router to support 32 bit ASN's. I also want to know what experience people have had with service provider support of 32 bit ASN's -- Brian Raaen Network Engineer braaen(a)zcorum.com

7 8

Re: BGP Attack - Best Defense ?
by Scott Weeks 29 Aug '08

29 Aug '08

------ Guy_Shields(a)Stream.Com wrote: --------- You need to contact 1st their directly connected provider, 2nd contact your upstream provider and ask that they contact their peers and negate the announcement. 3rd if this is an ARIN provided block contact them as you do pay for your allocation and they will have the contacts to resolve the issue. You cannot normally announce smaller than a /24 ----------------------------------------------- As someone told me in a private email: ## I would then try to contact the ASs still using the attack ## path to get it stopped. (Yell help on NANOG? ;-) :: What if the relevant ASNs are in a remote part of the world :: that doesn't participate in NANOG, or speak english, or even :: have a 24x7 NOC Which is why I said "Yell help on NANOG? ;-)". Since there're more ASN operators here than on any other *NOG I'm aware of I would have my best hope after exhausting all other avenues of resolution. scott

1 0

Re: BGP Attack - Best Defense ?
by Guy_Shields＠Stream.Com 29 Aug '08

29 Aug '08

Goto www.traceroute.org for a very comprehensive looking glass and routeview servers list. You can then determine how succesful your attempts to quell an attack are. ----- Original Message ----- From: "Scott Weeks" [surfer(a)mauigateway.com] Sent: 08/29/2008 04:06 PM MST To: <nanog(a)merit.edu> Subject: Re: BGP Attack - Best Defense ? ----------- scg(a)gibbard.org wrote: -------------- From: Steve Gibbard <scg(a)gibbard.org> On Fri, 29 Aug 2008, Scott Weeks wrote: > I am signed up for the Prefix Hijack Alert System > (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or > less?) about a prefix announcement change. > > I then would deaggregate (as little as possible) to be able to announce > the same more specific as the attacker. Announcing the same prefix length as the attacker would get you back some portion of your traffic, rather than all of it. You'd really want to announce something more specific than what the attacker is announcing. ---------------------------------------------------- Let's say the attacker is announcing one or more /24s of mine and announcing a more specific is not possible. I figure it out somehow and begin announcing the same. The attacker doesn't stop his attack. What happens? The part of the internet closest in topology to me sends their traffic to me and the part of the internet closest to the attacker sends traffic to him? ------------------------------------------------------ Of course, then you'd need to get your upstreams to accept the more specific, which might mean modifying filters. How quickly can you get your upstreams to do that? ------------------------------------------------------ I have them do orlonger when I set up the BGP sessions, so I'm good to go. I have a /15 and two /16s fully aggregated, so I can announce anything smaller than that for TE. The worst I have done so far is use /17s to groom ingress traffic, but that was temporary. I now have enough BW to run BGP without turning any knobs ------------------------------------------------------ Also, please don't be like Covad. If you deaggregate to deal with a highjacking, make your deaggregation temporary, and clean it up when it's not needed anymore. ------------------------------------------------------ I won't. Learning from many here about netizenship I make sure I am a good boy. ;-) scott ------------------------------------------------------------ > I would then try to contact the ASs still using the attack path to get > it stopped. (Yell help on NANOG? ;-) If you try to contact networks that are innocently hearing the announcement, rather than those involved in propagating it, you'll have a lot of networks to contact. A better move would be to contact those originating the announcement (unless you think they're involved in something malicious), and then their upstreams, and if that doesn't work, their upstreams' upstreams. Calling an upstream provider's NOC to ask them to modify a customer's filters generally gets met with lots of skepticism. You'll almost certainly be told that you have to be the customer whose filter it is to ask to have it modified. You'll need to be quite firm, and will probably need to ask to speak to somebody higher up than the front-line tech who answers the phone. The very few times I've had to do this, I've also found it quite useful to deemphasize their receiving of the prefix from a customer, and emphasize that they were announcing it to the rest of the world. "You are announcing our prefix, and you are not authorized to do so," is a useful line. -Steve -------------------------------------------------------------- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

Re: BGP Attack - Best Defense ?
by Guy_Shields＠Stream.Com 29 Aug '08

29 Aug '08

Correct, as you would then be contending with the path length portion of the 10 determistic citeria in the bgp protocol. ----- Original Message ----- From: "Scott Weeks" [surfer(a)mauigateway.com] Sent: 08/29/2008 04:06 PM MST To: <nanog(a)merit.edu> Subject: Re: BGP Attack - Best Defense ? ----------- scg(a)gibbard.org wrote: -------------- From: Steve Gibbard <scg(a)gibbard.org> On Fri, 29 Aug 2008, Scott Weeks wrote: > I am signed up for the Prefix Hijack Alert System > (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or > less?) about a prefix announcement change. > > I then would deaggregate (as little as possible) to be able to announce > the same more specific as the attacker. Announcing the same prefix length as the attacker would get you back some portion of your traffic, rather than all of it. You'd really want to announce something more specific than what the attacker is announcing. ---------------------------------------------------- Let's say the attacker is announcing one or more /24s of mine and announcing a more specific is not possible. I figure it out somehow and begin announcing the same. The attacker doesn't stop his attack. What happens? The part of the internet closest in topology to me sends their traffic to me and the part of the internet closest to the attacker sends traffic to him? ------------------------------------------------------ Of course, then you'd need to get your upstreams to accept the more specific, which might mean modifying filters. How quickly can you get your upstreams to do that? ------------------------------------------------------ I have them do orlonger when I set up the BGP sessions, so I'm good to go. I have a /15 and two /16s fully aggregated, so I can announce anything smaller than that for TE. The worst I have done so far is use /17s to groom ingress traffic, but that was temporary. I now have enough BW to run BGP without turning any knobs ------------------------------------------------------ Also, please don't be like Covad. If you deaggregate to deal with a highjacking, make your deaggregation temporary, and clean it up when it's not needed anymore. ------------------------------------------------------ I won't. Learning from many here about netizenship I make sure I am a good boy. ;-) scott ------------------------------------------------------------ > I would then try to contact the ASs still using the attack path to get > it stopped. (Yell help on NANOG? ;-) If you try to contact networks that are innocently hearing the announcement, rather than those involved in propagating it, you'll have a lot of networks to contact. A better move would be to contact those originating the announcement (unless you think they're involved in something malicious), and then their upstreams, and if that doesn't work, their upstreams' upstreams. Calling an upstream provider's NOC to ask them to modify a customer's filters generally gets met with lots of skepticism. You'll almost certainly be told that you have to be the customer whose filter it is to ask to have it modified. You'll need to be quite firm, and will probably need to ask to speak to somebody higher up than the front-line tech who answers the phone. The very few times I've had to do this, I've also found it quite useful to deemphasize their receiving of the prefix from a customer, and emphasize that they were announcing it to the rest of the world. "You are announcing our prefix, and you are not authorized to do so," is a useful line. -Steve -------------------------------------------------------------- This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

Re: BGP Attack - Best Defense ?
by Scott Weeks 29 Aug '08

29 Aug '08

----------- scg(a)gibbard.org wrote: -------------- From: Steve Gibbard <scg(a)gibbard.org> On Fri, 29 Aug 2008, Scott Weeks wrote: > I am signed up for the Prefix Hijack Alert System > (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or > less?) about a prefix announcement change. > > I then would deaggregate (as little as possible) to be able to announce > the same more specific as the attacker. Announcing the same prefix length as the attacker would get you back some portion of your traffic, rather than all of it. You'd really want to announce something more specific than what the attacker is announcing. ---------------------------------------------------- Let's say the attacker is announcing one or more /24s of mine and announcing a more specific is not possible. I figure it out somehow and begin announcing the same. The attacker doesn't stop his attack. What happens? The part of the internet closest in topology to me sends their traffic to me and the part of the internet closest to the attacker sends traffic to him? ------------------------------------------------------ Of course, then you'd need to get your upstreams to accept the more specific, which might mean modifying filters. How quickly can you get your upstreams to do that? ------------------------------------------------------ I have them do orlonger when I set up the BGP sessions, so I'm good to go. I have a /15 and two /16s fully aggregated, so I can announce anything smaller than that for TE. The worst I have done so far is use /17s to groom ingress traffic, but that was temporary. I now have enough BW to run BGP without turning any knobs ------------------------------------------------------ Also, please don't be like Covad. If you deaggregate to deal with a highjacking, make your deaggregation temporary, and clean it up when it's not needed anymore. ------------------------------------------------------ I won't. Learning from many here about netizenship I make sure I am a good boy. ;-) scott ------------------------------------------------------------ > I would then try to contact the ASs still using the attack path to get > it stopped. (Yell help on NANOG? ;-) If you try to contact networks that are innocently hearing the announcement, rather than those involved in propagating it, you'll have a lot of networks to contact. A better move would be to contact those originating the announcement (unless you think they're involved in something malicious), and then their upstreams, and if that doesn't work, their upstreams' upstreams. Calling an upstream provider's NOC to ask them to modify a customer's filters generally gets met with lots of skepticism. You'll almost certainly be told that you have to be the customer whose filter it is to ask to have it modified. You'll need to be quite firm, and will probably need to ask to speak to somebody higher up than the front-line tech who answers the phone. The very few times I've had to do this, I've also found it quite useful to deemphasize their receiving of the prefix from a customer, and emphasize that they were announcing it to the rest of the world. "You are announcing our prefix, and you are not authorized to do so," is a useful line. -Steve --------------------------------------------------------------

1 0

Re: BGP Attack - Best Defense ?
by Guy_Shields＠Stream.Com 29 Aug '08

29 Aug '08

You need to contact 1st their directly connected provider, 2nd contact your upstream provider and ask that they contact their peers and negate the announcement. 3rd if this is an ARIN provided block contact them as you do pay for your allocation and they will have the contacts to resolve the issue. You cannot normally announce smaller than a /24 ----- Original Message ----- From: "Scott Weeks" [surfer(a)mauigateway.com] Sent: 08/29/2008 03:50 PM MST To: <nanog(a)merit.edu> Subject: Re: BGP Attack - Best Defense ? ------- jfesler(a)gigo.com wrote: ------- From: Jason Fesler <jfesler(a)gigo.com> > I am signed up for the Prefix Hijack Alert System > (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or > less?) about a prefix announcement change. Would the alerts go to a mail server behind said BGP prefixes? --------------------------------------- They would go to me. They have been coming to me since I heard about this service on NANOG. Thanks folks at Colorado State University! :-) -------------------------------------- Also, if you're gonna bother at all.. I'd humbly suggest that 6 hours is too long to wait. Without naming names, consider if this response time is adequate, and if not, look at some of the commercial options. -------------------------------------- I'm currently on an eyeball network and no one is physically close to me, since I'm in Hawaii (the most isolated land mass in the world). Even though the TTL changes in this attack, the physics don't. The gamers would probably be the first alert folks as they would see the delay regardless of what their traceroutes say... ;-) In this attack the traffic makes it to both end-points. The middle is what changes. Restating my question differently: If the attacker is announcing a /24 of mine, I figure it out some how and I start announcing the same. What happens if the attacker doesn't stop? This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

1 0

Re: BGP Attack - Best Defense ?
by Scott Weeks 29 Aug '08

29 Aug '08

------- jfesler(a)gigo.com wrote: ------- From: Jason Fesler <jfesler(a)gigo.com> > I am signed up for the Prefix Hijack Alert System > (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or > less?) about a prefix announcement change. Would the alerts go to a mail server behind said BGP prefixes? --------------------------------------- They would go to me. They have been coming to me since I heard about this service on NANOG. Thanks folks at Colorado State University! :-) -------------------------------------- Also, if you're gonna bother at all.. I'd humbly suggest that 6 hours is too long to wait. Without naming names, consider if this response time is adequate, and if not, look at some of the commercial options. -------------------------------------- I'm currently on an eyeball network and no one is physically close to me, since I'm in Hawaii (the most isolated land mass in the world). Even though the TTL changes in this attack, the physics don't. The gamers would probably be the first alert folks as they would see the delay regardless of what their traceroutes say... ;-) In this attack the traffic makes it to both end-points. The middle is what changes. Restating my question differently: If the attacker is announcing a /24 of mine, I figure it out some how and I start announcing the same. What happens if the attacker doesn't stop?

2 1

BGP Attack - Best Defense ?
by Scott Weeks 29 Aug '08

29 Aug '08

My question revolves around the best recovery from an attack of the type we've been discussing. I only figured out the attack methodology yesterday evening Hawaiian Standard Time. Be gentle please... :-) I am signed up for the Prefix Hijack Alert System (phas.netsec.colostate.edu) and would be alerted in about 6 hours (or less?) about a prefix announcement change. I then would deaggregate (as little as possible) to be able to announce the same more specific as the attacker. The topologically closer ASs would then start sending the traffic to me properly. Those topologically closest to the attacker would still send to the attack path. I would then try to contact the ASs still using the attack path to get it stopped. (Yell help on NANOG? ;-) Is this the best recovery plan at this time? scott

3 2