- NANOG - lists.nanog.org

Re: Every incident is an opportunity (was Re: Hackers hit key Internet traffic computers)
by Brandon Butterworth 12 Feb '07

12 Feb '07

> > During the cold war American kids > > were trained to hide beneath their desktops in caseof a nuclear > > attack. Much good that would have done. It could have kept them from running around the streets screaming we're all going to die. It may well save people if they are on the edge of the survival zone, that may not be a good idea but at least they know what to expect I don't pretend to know the real reason but keeping control is usually better even if you can't change the outcome. brandon

2 1

Fwd: death of the net predicted by deloitte -- film at 11
by Alexander Harrowell 12 Feb '07

12 Feb '07

---------- Forwarded message ---------- From: Alexander Harrowell <a.harrowell(a)gmail.com> Date: Feb 12, 2007 4:13 PM Subject: Re: death of the net predicted by deloitte -- film at 11 To: Paul Vixie <vixie(a)vix.com> Paul, that's very interesting. A query: "AMT Site: A multicast-enabled network not connected to the multicast backbone served by an AMT Gateway. It could also be a stand-alone AMT Gateway." Should that read: a multicast-enabled network, not connected to the multicast backbone, served by an AMT Gateway? It looks like it from the meat of the RFC. On 12 Feb 2007 06:14:00 +0000, Paul Vixie <vixie(a)vix.com> wrote: > http://tools.ietf.org/html/draft-ietf-mboned-auto-multicast-00 is what i > expect. note: i've drunk that koolaid & am helping on the distribution > side. > -- > Paul Vixie >

2 1

Re: Every incident is an opportunity (was Re: Hackers hit key Internet traffic computers)
by Gregory Hicks 12 Feb '07

12 Feb '07

> Date: Mon, 12 Feb 2007 11:38:10 -0500 > From: "D'Arcy J.M. Cain" <darcy(a)druid.net> > > On Mon, 12 Feb 2007 09:51:38 -0600 > Dave Pooser <dave.nanog(a)alfordmedia.com> wrote: > > Marshall beat me to it. I have a T-shirt that says "Mac: So > > simple my parents can use it." It's funny because it's true. > > Why do I keep hearing "My parents are stupid" in these sorts of > comments? Just wait. They get smarter as you get older. My father was NOT stupid. He could use several of the more popular "word processors" (Wang being the last one he had used) but he could NOT, for the life of him, get used to using MS Word. Or anything else associated with Windoze. The command sequences just "didn't make sense to him ("Why do I have to go push "start" when I want to shut the system down?") --------------------------------------------------------------------- I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

1 0

RE: death of the net predicted by deloitte -- film at 11
by michael.dillon＠bt.com 12 Feb '07

12 Feb '07

> [Perhaps my viewpoint is skewed because channel-delivered TV content > in Canada is horrible; it's almost as bad as American TV. I seem to > think that broadcast TV in the UK more tolerable, although I haven't > really seen it since I left the UK in the mid 90s so perhaps > I'm just > deluded.] We've gone digital in the UK (DVB-T) which includes an electronic program guide. So the average consumer CAN buy a PVR with digital receivers (yes plural) which they simply plug in, scan for channels, and use. Pause and rewind live TV, record programs according to the EPG. And it is all free, i.e. funded by TV commercials just like analog TV was. Of course, the cable companies, Sky satellite TV and the telephone company (ADSL provider) are offering some sort of PVR-like box with a selection of broadcast and pre-recorded content. Note: I happen to work for said telephone company (BT) but I have nothing to do with either our DSL or TV offerings. > Cursory consideration of your examples above provide clues as to > which way the scale is tipping; radio has for a long time been a way > to promote record sales, and the video stores here are now half-full > with boxed sets of TV series on DVD. Here too. Especially at Christmas time. I've noticed the same thing in Russia where homegrown TV series are in every video shop. > It looks to me like people increasingly want their content > on-demand, > and that there's a growing industry supplying that demand. And I don't think it depends on culture. People are people all over the world. Everyone wants to control their own time. Everyone wants predictability of their outgoings, i.e. trend towards flat rates. So shifting TV from a flat-fee all-you-can-eat broadcast model to a pay-per-use network model is a non-starter. It will never be more than a drop in the bucket. --Michael Dillon

1 0

Re: motivating security, was Re: Every incident...
by Alexander Harrowell 12 Feb '07

12 Feb '07

d Lewis <Ed.Lewis(a)neustar.biz> wrote: > > > I don't mean to say that the car owners or computer users are free > from blame. But holding a sentiment of just blaming users is not > helpful. OTOH, if there was something the operators could clearly do > to stop this, someone would have suggested it by now. (There are all > them laws about snooping traffic, etc.) > > I thought I had a conclusion ... but I don't. Sure. Demonising sufferers didn't stop the spread of AIDS, probably made it worse (Saudi Arabia has one of the fastest growing HIV problems, they say). But shouting at people to wear condoms/use a firewall has diminishing returns. It's complicated.

1 0

Re: motivating security, was Re: Every incident...
by Alexander Harrowell 12 Feb '07

12 Feb '07

On 2/12/07, Edward Lewis <Ed.Lewis(a)neustar.biz> wrote: > > Security is never something I should want, it is always > something I have to have. No-one wants "security", they want not-trouble. Similar to the point that no-one wants energy, they want warm rooms and cold beers. Perhaps we need a concept of "security efficiency"? Security has to resign itself to being > second-class in the hearts and minds of society. Security has to be > provided in response to it's environment and not complain about it's > lot in life. > > (I realize that this post doesn't say anything about people "dying" - > I've heard that in other contexts.) Yup >Society holds individuals accountable for many forms of irresponsible > >behaviour. > > This is true, but individuals are not held entirely accountable. A > reckless driver can cause a multi-car accident on an exit ramps and > cause a tie up for the entire morning rush. Are the "victims" of > this compensated? What about the person who loses a job offer > because of a missed interview and suffers fallout from that? > > And maybe it isn't recklessness. A failed water pump may cause a > breakdown, followed by an accident, etc. Mentioned just to spread > the analogy out. The whole logic of modern computing is that everything migrates towards users. Why shouldn't security? After all, if people didn't let the nasties in, 'twould be very hard to start a botnet.. >There's no need to make exceptions for > >computer users. Make computer-owners/users pay in full for damages > >caused by their equipment with no discount for incompetence. > > If that happened, then computer users would be the exception. I > can't think of any situation in which an accident might occur and the > one causing the accident pays in full to everyone. > [snip] True, but there are plenty of examples of either market (insurance) or government (regulation) solutions to problems where the individual's misfortune also falls on society. Arguably the bulk of the costs of malware proliferation is an externality - the benefits go to the enemy, but costs aren't restricted to the hacked. Not even close. I used to work for a gov't facility whose mission was science. They > had a serious telecommunications problem on their hands. Although it > was important to solve, they funded science first - up until all the > telecom problems became "too annoying" and money was allocated to > solve the problem. > The appropriate analogy is the Great Stink of 1858. London had been suffering from not having sewerage for years, and poor people had been dying in droves from cholera, but nobody with the power to do anything about it cared enough until the Thames got so bad the committee rooms on the river side of Whitehall stank so much nobody would go in them. Then, wham, out came the chequebook, the compulsory purchase powers, and in came Joseph Bazalgette, with the result of an infrastructure used to this day.

2 1

Re: death of the net predicted by deloitte -- film at 11
by Brandon Butterworth 12 Feb '07

12 Feb '07

> I think you're presupposing that the concept of "channels" is > something that will persist. For some time. There's quite an industry with an interest in maintaining that. It probably won't vanish until the current generations die. Channel based and discrete delivery of content (radio vs records, tv/cinema vs vhs/dvd) have coexisted for some time. If one loses ground it's not a problem unless you take sides. brandon

2 1

Web Server Botnets and Server Farms as Attack Platforms
by Gadi Evron 12 Feb '07

12 Feb '07

Are file inclusion vulnerabilitiess equivalent to remote code execution? Are servers (both Linux and Windows) now the lower hanging fruit rather than desktop systems? In the February edition of the Virus Bulletin magazine, we (Kfir Damari, Noam Rathaus and Gadi Evron (me) of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we describe how these are taken to the next level with live attacks and operational problems service providers deal with daily. We discuss how these attacks work using (mainly) file inclusion vulnerabilities (RFI) and (mainly) PHP shells. Further, we discuss how ISPs and hosting farms suffer tremendously from this, and what can be done to combat the threat. I'd like to write more on this here, and ask for the community's feedback on what others see in this field and how you deal with similar issues. Malware is often built to operate within a certain OS environment. Web server malware is completely cross-platform (as long as a web daemon which supports scripting can be found such as IIS, Apache, etc.). These malware attack the web application first, and only then further compromise takes place platform by platform, using the web server's privileges. Most web servers are being compromised by these attacks as a result of an insecure web application written in PHP, although attacks for other scripting languages such as Perl and ASP are also in-the-wild. The main reason for this is that many different PHP applications are available online, and often freely as open source, which makes them a popular selection for use on many web sites. Another reason for the popularity of attacks against PHP applications is that writing securely in PHP is very difficult, which makes most of these PHP applications vulnerable to multiple attacks, with hundreds of new vulnerabilities released publicly every month. While in the past botnets used to be composed of mainly broadband end users running Windows, today we can see more and more server botnets we can refer to as "IIS botnets" or "Linux botnets" as a direct result of these attacks. One of the conclusions we reached was that although the technologies used are not new (RFI, PHP shells, etc.) the sheer scale of the problem is what's interesting. In our research as detailed in the Virus Bulletin article we recognize that vulnerabilities such as file inclusion, as simple as they may be, are equivalent to remote code execution in effect. Although escalation wars, which are reactive in nature, are a solution we hate and are stuck with on botnets, spam, fraud and many other fronts, this front of web server attacks stands completely unopposed and controlled by the bad guys. In our research we detail how over-time, when aggregated, most attacks come from the same IP addresses without these ever getting blocked. ISPs and hosting farms selling low-cost hosting services can not cope with this threat, especially where an attack against one user running such an application can compromise a server running 3000 other sites. Another issue discussed was the formation of the Web Honeynet Task Force ( http://www.webhoneynet.net/ renamed from the Web Honeynet Project to avoid confusion with the honeynet project). I write more about this and host the paper on my blog at SecuriTeam ( http://blogs.securiteam.com/index.php/archives/815 ). All rights for the article itself belong to the Virus Bulletin magazine. Gadi Evron.

1 0

Re: death of the net predicted by deloitte -- film at 11
by Brandon Butterworth 12 Feb '07

12 Feb '07

> Multicast isn't going to help the phoneco atm network. Indeed, people keep quoting that but it's a bogus argument as nothing will help the phoneco atm network running out of bandwidth other than upgrading it That is happening, unicast/p2p/multicast/whatever, as all this content is raising average user bandwidth > But if you accept that the average user only watches 3-6 hours of HDTV per > day, you can spread the load out over 24 hours, the effects on available > bandwidth can be reduced. The TIVO model appears to have an advantage for > the viewer (a large archive to select from) and for the phoneco's and ISP's > at the customer end. When people have their akamai@home box that'll help for some cases. To say it's a universal fix is a bogus as saying multicast will fix all problems. brandon

1 0

Re: death of the net predicted by deloitte -- film at 11
by Frank Coluccio 12 Feb '07

12 Feb '07

I believe that the element that has been missing in this discussion thus far has been the source (content) players, and where they are hiding. CDNs, a la Akamai, Limelight, etc., will take up some of the slack and mitigate much of the backbone burden where legitimate ISPs are concerned, as will hierarchical caching for the newbie carriers-that-came-to-be-called "ISPs" -i.e., the MSOs and Telcos. Playing the Pareto, the higher the demand (95/5) for a title, the closer it will be stored to the user community, and the longer the tail (5/95) of a title, the farther its storage from the user community. My point is, CDNs and hierarchical cache must be inserted into the calculus, because one, they are already being used, and two, their use will only increase with time, fwiw. Frank ps - I've had some issues with my email editor of late. If anyone notices any artifacts or extraneous characters in the delivery of this message, kindly email me off list and I shall be indebted to you, tia. On Sun Feb 11 19:22 , "Geo." sent: > > >> do what google is presumably doing (lots of fiber), or would they put >> some capital and preorder into IDMR? > >IDMR is great if you're a broadcaster or a backbone, but how does it help >the last 2 miles, the phoneco ATM network or the ISP network where you have >10k different users watching 10k different channels? I'm not sure if it >would help with a multinode replication network like what google is probably >up to either (which explains why they want dedicated bandwidth, internode >replication solves the backup problems as well). > >Also forgetting that bandwidth issue for a moment, where is the draw that >makes IPTV better than cable or satellite? I mean come on guys, if the >world had started out with IPTV live broadcasts over the internet and then >someone developed cable, satellite, or over the air broadcasting, any of >those would have been considered an improvement. IPTV needs something the >others don't have and a simple advantage is that of an archive instead of >broadcast medium. The model has to be different from the broadcast model or >it's never going to fly. > >TIVO type setup with a massive archive of every show so you can not only >watch this weeks episode but you can tivo download any show from the last 6 >years worth of your favorite series is one heck of a draw over cable or >satellite and might be enough to motivate the public to move to a different >service. A better tivo than tivo. As for making money, just stick a >commercial on the front of every download. How many movies are claimed >downloaded on the fileshare networks every week? > >Geo. >

2 1