- NANOG - lists.nanog.org

RE: mitigating botnet C&Cs has become useless
by Fergie 02 Aug '06

02 Aug '06

-- "Barry Greene (bgreene)" <bgreene(a)cisco.com> wrote: >> >> What? That's what I'm trying to find out, but I'm not as >> smart as most, so I can only point out the things that I >> believe definitely won't work and why I think that. >> Hopefully by the application of flame to my butt by smart >> people for saying what I do will spark some thought toward the goal. > > >Start with: > >http://www.nanog.org/mtg-0602/greene.html > Also, I hope to be gving a presentation at the next NANOG (it might just turn out to be a "lightning talk" depending on the number of slides) which segues into this particular topic. :-) Now, I need to get to work on those slides.... :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: mitigating botnet C&Cs has become useless
by Barry Greene (bgreene) 02 Aug '06

02 Aug '06

> > What? That's what I'm trying to find out, but I'm not as > smart as most, so I can only point out the things that I > believe definitely won't work and why I think that. > Hopefully by the application of flame to my butt by smart > people for saying what I do will spark some thought toward the goal. Start with: http://www.nanog.org/mtg-0602/greene.html

1 0

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 02 Aug '06

02 Aug '06

----- Original Message Follows ----- From: Barry Shein <bzs(a)world.std.com> > On August 1, 2006 at 11:50 surfer(a)mauigateway.com (Scott > Weeks) wrote: > >... > > there has to be a technical way to do this, rather > > than a diplomatic way as the diplomatic ways > > historically have not worked in the other areas > > mentioned, so they probably won't work here, either. > > Or we have to keep going until one can be contrived. > > Many good attempts have been made and there will be > > more to come until we hopefully rid ourselves of the > > sickness others of lower values force on us daily... > > I have nothing against technical solutions tho after over > ten years of a lot of smart people trying, and a grand > prize of probably a billion dollars increase in personal > wealth, it doesn't seem forthcoming. > > However, I do take exception to the assertion that > "diplomatic ways historically have not worked in other > areas mentioned". > > I think what you mean is that they haven't worked > perfectly, but slipped the semantics a little. Surely you > didn't mean to say that all efforts to oppose, e.g., the > human slave trade have been in vain? > > The effectiveness has a lot to do with the profitability > making the risk worthwhile (e.g., drug trade), and who the > crime appeals to; some poor, desparate people will take > risks others won't (e.g., high-seas piracy.) > > Unfortunately all this reasoning might be edifying but it > leads nowhere. Yes, you're correct. I didn't mean to say the things you mentioned haven't worked at all. I'm just saying that there has to be a better way than police-type actions on a global scale. Also, I'm sure many more smart people will work on it for many more years and others will make billions more before it's solved. But it needs to be solved on the same playing field that the ugliness is occurring on. You don't solve San Diego's slave trade by kicking ass on Indonesia's pirates. Last, you're also correct that this is leading nowhere. I made my point and have now beat it to death. Thanks for listening... scott

5 5

RE: mitigating botnet C&Cs has become useless
by Fergie 02 Aug '06

02 Aug '06

"Jamie Bowden" <jamie(a)photon.com> wrote: [snip] >I'd just like to point out Paul, that while we may rely on police to >handle crimes in the real world, we still lock our doors. > >Jamie Bowden Indeed. And good neighbors usually alert the police when someone is breaking into their neighbor's house -- it's called "community watch." Alternatively, some people also call the cops when someone is firing a sniper rifle from a neighboring house into the surrounding neighborhood, as well. :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Odd named messages...
by Dominic J. Eidson 02 Aug '06

02 Aug '06

Has anyone else seen an increase of the following named errors? Aug 1 01:00:09 morannon /usr/sbin/named[21279]: dispatch 0x4035bd70: shutting down due to TCP receive error: unexpected error Aug 1 01:00:09 morannon /usr/sbin/named[21279]: dispatch 0x4035bd70: shutting down due to TCP receive error: unexpected error .. someone trying some new anti-bind trickery? - d. -- Dominic J. Eidson "Baruk Khazad! Khazad ai-menu!" - Gimli ------------------------------------------------------------------------------- http://www.the-infinite.org/

2 1

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 02 Aug '06

02 Aug '06

"cyberspace is just a meatspace overlay" I'm just sitting here with my mouth open and nothing to say. I'm going to have to chew and digest that mouthful of meat (and all it implies) for a while. (pun intended... :-) "the only technical solution is "gated communities"" That's definitely what's done now in meatspace for protection against the vile dweebs. Lotsa protection where the money is and badlands where it isn't. scott ----- Original Message Follows ----- From: Paul Vixie <vixie(a)vix.com> To: nanog(a)merit.edu Subject: Re: mitigating botnet C&Cs has become useless Date: 02 Aug 2006 06:29:55 +0000 > surfer(a)mauigateway.com ("Scott Weeks") writes: > > > ... I'm just saying that there has to be a better way > > than police-type actions on a global scale. ... > > no, there doesn't have to be such a way. where the stakes > are in meatspace (pun unintended), the remediation has to > be in meatspace. cyberspace is just a meatspace overlay, > it can only pretend to have different laws when nothing > outside of cyberspace is at stake. i think that the days > when botnets were mostly used for kiddie-on-kiddie > violence or even gangster-on- gangster violence are > permanently behind us. it's up to the real LEOs now, > because it's on their turf now, which is to say, it's in > the real world now. > > as was true of spam when i said this about spam ten years > ago, it is true now of botnets that the only technical > solution is "gated communities". but the internet's > culture, which merely mirrors the biases of those who use > it, requires the ability for children to go door to door > selling girl scout cookies, without necessarily having the > key code to every one of the doors. > > so the internet community has no appetite for the > trappings of any technical solution to botnets. the > meatspace community and their LEOs absolutely *do*. -- > Paul Vixie

1 0

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 02 Aug '06

02 Aug '06

----- Original Message Follows ----- From: Barry Shein <bzs(a)world.std.com> > > That's all fine and dandy until you consider the > > international base of these things. I'd like to see > a meeting at the Massachussets state house probably around > 1998 and being shouted down by this reasoning for a few > minutes. > > Believe it or not spam is not the only internationalized > problem on this planet. There's drug trade, actual > high-seas piracy, slave trade, phone fraud, investment > fraud, and on and on. > > So the usual snappy response is: And look how well we do > with all that! > > Well, yes, you can make the best the enemy of the good. > But there's a logical fallacy involved in trying to > extrapolate that to "so therefore we should do nothing". I did not mean to shout anyone down by saying what I did and trying to extrapolate to 'therefore we should do nothing'. I also did not mean to imply sloppy writing. For sure, it's more my misunderstanding than either of those. Also, it was an interesting article. I only meant that meatspace asskicking probably won't get us very far, especially in light of current intercountry cooperation. Also, wouldn't it just teach them what countries to focus their efforts on similar to the context of the article? I just hope to inject that there has to be a technical way to do this, rather than a diplomatic way as the diplomatic ways historically have not worked in the other areas mentioned, so they probably won't work here, either. Or we have to keep going until one can be contrived. Many good attempts have been made and there will be more to come until we hopefully rid ourselves of the sickness others of lower values force on us daily. scott (quickly putting on flameproof underware... ;)

3 2

Re: mitigating botnet C&Cs has become useless
by Scott Weeks 02 Aug '06

02 Aug '06

----- Original Message Follows ----- From: "Fergie" <fergdawg(a)netzero.net> > >mentioned haven't worked at all. I'm just saying that > there >has to be a better way than police-type actions on > a global >scale. Also, I'm sure many more smart people > Personally, I think there is wiggle-room between what Gadi > surmises (persoanlly, I think he is playing Devil's > advocate), what everyone else may surmise as an effort > into nothingness, and what Vixie professes (if anyone > bothered to read what he forwarded -- I did, and very much > agree). I read it all carefully. Twice. I'm not taking sides here. Please don't put me in that position. I'm only beating a point to death. Common NANOG futility. You know the deal... :-) > I actually think there is _a_lot_ which can be, and should > be, done. What? That's what I'm trying to find out, but I'm not as smart as most, so I can only point out the things that I believe definitely won't work and why I think that. Hopefully by the application of flame to my butt by smart people for saying what I do will spark some thought toward the goal. > I actually think there is _a_lot_ which can be, and should > be, done. > > Turning a blind eye is unnacceptable, and right now, ISP's > are in the spotlight w.r.t. doing just that: > There is _major_ room for improvement, so I guess the > relevant question becomes: Are people part of the problem > or part of the solution? > > What's the measuring stick? I get a 1984-like mgmtspeak feeling here. I don't know how to respond except with this attempt (in order): what are some suggestions for the major improvement, people are both the problem and the solution (as in everything) and the measuring stick is a noticable decline in the nefarious deeds on the public internet. scott

1 0

Re: mitigating botnet C&Cs has become useless
by Fergie 02 Aug '06

02 Aug '06

-- "Scott Weeks" <surfer(a)mauigateway.com> wrote: [snip] >Yes, you're correct. I didn't mean to say the things you >mentioned haven't worked at all. I'm just saying that there >has to be a better way than police-type actions on a global >scale. Also, I'm sure many more smart people will work on >it for many more years and others will make billions more >before it's solved. But it needs to be solved on the same >playing field that the ugliness is occurring on. You don't >solve San Diego's slave trade by kicking ass on Indonesia's >pirates. > >Last, you're also correct that this is leading nowhere. I >made my point and have now beat it to death. Thanks for >listening... > >scott > Personally, I think there is wiggle-room between what Gadi surmises (persoanlly, I think he is playing Devil's advocate), what everyone else may surmise as an effort into nothingness, and what Vixie professes (if anyone bothered to read what he forwarded -- I did, and very much agree). I actually think there is _a_lot_ which can be, and should be, done. Turning a blind eye is unnacceptable, and right now, ISP's are in the spotlight w.r.t. doing just that: http://www.zdnet.com.au/news/security/soa/ISPs_accused_of_ignoring_botnet_i… There is _major_ room for improvement, so I guess the relevant question becomes: Are people part of the problem or part of the solution? What's the measuring stick? - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: BGP and GLB.
by Barry Greene (bgreene) 02 Aug '06

02 Aug '06

Anycast - it is a widget - not a solution. Go here http://www.nanog.org/subjects.html, look for Anycast, and watch the VODs. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Robert Sherrard > Sent: Tuesday, August 01, 2006 5:54 PM > To: nanog(a)merit.edu > Subject: BGP and GLB. > > Does anyone know of some good writeup that details using BGP > as a form of global load balancing, between multiple sites. > > Rob > >

1 0