- NANOG - lists.nanog.org

IOS worm clarification
by J. Oquendo 20 Sep '05

20 Sep '05

///////////////////////////////// From: Andrei Mikhailovsky <mlists(a)arhont.com> Reply-To: andrei(a)arhont.com To: ciscoioshehehe(a)yandex.ru Subject: Re: [Full-disclosure] Cisco IOS hacked? Hello, Being a co-author of the "Hacking Exposed Cisco Networks" book and one of the co-founders of Arhont Ltd an Information Security Company that is doing the research for the book on Cisco Devices I have to make the following comments about the article in SecurityLab.ru: The russian article (http://www.securitylab.ru/news/240415.php) has been badly paraphrased from the livejournal of one of the authors/researchers of the book. As a result of this outrageously inaccurate paraphrasing of the article many confusions and misunderstandings have been circling on the security related sources and mailing lists. Some of the issues addressed in the article are true and Arhont is currently preparing a formal advisory that will be sent to PSIRT. Among the discovered issues are multiple vulnerabilities in EIGRP implementation. Also, authors have addressed the _theoretical_ aspects of an algorithm for cross-platform worm that could spread in IOS based devices. The existence of the practical implementation of such warm is a complete lie. Let me assure that there has been no development nor the desire to develop such code by the authors of the book. The theoretical methodology and algorithms will be also discussed with PSIRT at the appropriate time. In addition, there has been some minor inconsistencies of the livejournal postings that will be soon addressed and edited. If you have any comments on this topic we would be glad to address them. -- Andrei Mikhailovsky Arhont Ltd - Information Security ///////////////////////////////// =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 "Just one more time for the sake of sanity tell me why explain the gravity that drove you to this..." Assemblage

2 1

[Fwd: Cisco IOS hacked?]
by Gadi Evron 19 Sep '05

19 Sep '05

Here's something from bugtraq on it. Gadi.

1 0

Article - "skype killer" carrier grade app filter
by Suresh Ramasubramanian 19 Sep '05

19 Sep '05

Cites nanog posts and presentations to prove that skype is a bandwidth hog The ceo of this company is apparently ex founder-CTO of NAP of the Americas. --srs -- Suresh Ramasubramanian (ops.lists(a)gmail.com) [IP] The Inquirer: Anti-Skype software kills IM, P2P too From: David Farber <dave(a)farber.net> To: Ip Ip <ip(a)v2.listbox.com> Date: Mon Sep 19 19:53:14 2005 Begin forwarded message: From: Bob Drzyzgula <bob(a)drzyzgula.org> Date: September 19, 2005 9:47:43 AM EDT To: David Farber <dave(a)farber.net> Cc: Ip Ip <ip(a)v2.listbox.com> Subject: The Inquirer: Anti-Skype software kills IM, P2P too <http://www.theinquirer.net/?article=26255> | Anti-Skype software kills IM, P2P too | Bandwidth bandsaw released | By: Doug Mohney | | Monday 19 September 2005, 07:14 | | LAST WEEK, Verso Technologies (www.verso.com) | announced the rollout of a "carrier-grade applications | filter" that can block so-called bandwidth drains | such as Skype, P2P messaging, streaming media, and | instant messaging. | | Skype is singled out in the headline of the press | release. It's not a P2P blocker, it's a "Skype | Filtering Technology." | | Verso CEO Monty Bannerman, founding CTO of the NAP of | Americas, says service providers are gung-ho about | his new product offering. As a "free" service, | Skype is raiding the business model of service | providers that want to roll out VoIP services for | their customers. "They're all telling me they hate | Skype and they're telling me that they want to do | something about Skype," said Bannerman in a telephone | interview. "If you have something in your network that | is costing you money and raiding your business model, | I assure you you're going to do something about it." | | Bannerman claims that Skype and other P2P applications | were generating up to 30 per cent of existing | network traffic load as of last year according to | presentations at the North American Network Operators | Group (NANOG). Since a revenue-based service provider | isn't making any money off that traffic load, it's | not a good thing, especially if they plan to offer | their own flavor of VoIP to their customer base. Since | making the announcement, Verso has received a number | of phone calls from existing customers as well as | intrigued service providers. | | Could this technology be used to block Vonage | service? "Sure," said Bannerman. "But we wouldn't do | that." Bannerman drew a distinction between the more | heavily US-regulated Vonage and Skype, saying that | they were "different," with Vonage required to provide | E-911 service and abide by other FCC regulations, | while Skype had no such state-side regulation. He | believed he had a shot at selling some of his boxes | to Vonage in order for that company to monitor | traffic flow. | | Figuring how to measure and block Skype has been a | significant challenge, since the application has been | difficult to measure. Verso has spent over a year | and four engineering attempts to develop a platform | capable of detecting, managing, and controlling | Skype. "We are better than anyone else at this moment | in time in detecting Skype and doing something with | it, including turning it off." | | When asked if current FCC rulings and upcoming | American federal legislation to prevent application | blocking of any type would affect selling the | Skype-blocker in the States, Bannerman didn't seem | to be worried. "The World Wide Web isn't just about | America, plunk yourself anywhere else," he said. "This | is a product for the world market," and he pointed | out that there's a patchwork of regulatory schemes | around the globe. µ

2 2

IPv6 BGP Peering
by Mark Radabaugh 19 Sep '05

19 Sep '05

What is the state of IPv6 BGP peering with US transit providers? Questions to sales / tech reps are generally met with "I heard we were working on something" and that's as far as I have made it so far. The routing table shows UUNet, Verio, Sprint and a few other transit providers but I am not having much luck finding contact or setup information for those providers specific to IPv6. -- Mark Radabaugh Amplex mark(a)amplex.net 419.837.5015

2 1

Marketing ideas for ISPs
by Kim Onnel 19 Sep '05

19 Sep '05

Hello, I would like to collect some ideas from you experinced folks on new ideas to push for an ISP that wants to add revenues by adding new service offering or attracting customers with VAS 1) MPLS VPNs: we only provide connectivity, what else could we do, on the top of my head is: a) QoS 2) Internet: we basicly provide ADSL for residential and SDSL for corporate 3) Security: we offer nothing, just configuring firewalls for customers on their premises a) Customers blackhole their traffic b) Analyze customers traffic using sinkholes c) Managed firewalls/ids d) RADIUS based filters(ACL) for dialup/adsl 4) DataCenter: we do normal datacenter, emails, hosting. a) Hosting a mirror of freshmeat and sourceforge, tucowns, download.com<http://download.com> b) Netflow analyzers: selling reports to customers or the Arbor Model The points i have under each is things we dont have, i would like you to share with me your experiences with services from the above, feasability, and if there are supporting documents to be able to pullout a presentation, All your private feedback is welcomed. Thanks

1 0

Katrina Aid Request
by John Souvestre 19 Sep '05

19 Sep '05

Hello. I don't often post to this list, but some here know me. They can verify what I have to tell you. I'm an ISP in Metairie, Jefferson Parish. The Co-Lo where my equipment is located is about 5 miles west of the center of New Orleans. To be precise, it is at 106 Metairie Lawn Dr #300, Metairie LA 70001. It is run by CommTech ESP. The ISPs housed there are CommTech (who is also an ISP, commtechesp.com) Digicomm Systems (webdsi.com) and Southern Star (sstar.com) along with parts of Bayou Tech (teche.net) Skycom1 (skycom1.com) and TriParish (triparish.net) The building and the equipment made it through the storm OK. Like everyone else in the area, we lost commercial power during the storm. We ran on the generator for 11 days. Because of the extended run time, some of the ISPs agreed to kick in and help pay the fuel bill since it was more than the Co-Lo could afford by itself. It cost about $2500 per day for those 11 days. We are all small ISPs, ranging from 1 to 10 employees. This additional cost, on top of everything else, is a heavy burden. If you would like to help us with this expense, we would certainly appreciate it. If you are so inclined, you can send mail to CommTech ESP's temporary office which is set up at Bayou Tech's location. The address is: CommTech ESP c/o Bayou Tech Attn: Jimmy Roussel 314 Chennault St Morgan City LA 70380 Thank you. John John Souvestre - Southern Star - (504) 888-3348 - www.sstar.com

1 0

Belarus ISP contact
by James Spenceley 19 Sep '05

19 Sep '05

Hi, Excuse the strange post, but I'd like to contact anyone working for a Ukrainian and more importantly Belarussian ISP's, alternatively if you know of someone please email me. <begin russian> я хочу связываться человек работа в интернет-поставщике в Белоруссии или Украине, извините моего плохого русского ;-) Thanks, James

2 1

RE: Calling all NANOG'ers - idea for national hardware price quote registry
by Matt Bazan 19 Sep '05

19 Sep '05

> -----Original Message----- > From: bmanning(a)vacation.karoshi.com > [mailto:bmanning@vacation.karoshi.com] > you've had lots (some) folks point out the perceived dangers > of participating in such a venture. ... yet you continue to > insist that such a "service" will be of profound value to the > community as a whole and is not replicated anywhere else. > > if you are so persuaded, then it seems that instead of > espousing the idea, trying to drum up public support, that > you should, to borrow a phrase, "just do it" ... and let > people know where the site is and how to use it. as usual, > YMMV. and you might want to get legal advice. > > --bill Well, I didn't think that I was 'insisting' on the idea, at least that's not how I meant my posts to come across. Frankly, I've been rather surprised at the level of the negativity that has come across towards this idea in several of the posts and I'm not sure why that is. In either case, your last paragraph, Bill, was the direction I was headed. I'll mull it over for a time then decide if I want to put something in place and see what kind of response there is out there. Matt

2 1

PBR needing to hit the cpu?
by David Hubbard 19 Sep '05

19 Sep '05

Just curious, do most vendors' hardware need to hit the cpu when doing policy-based routing? I found one of my border routers' cpu's on the bad end of a DDoS but once I turned off a not necessarily required setup to force some outbound traffic to take a specific outbound link via PBR, the DDoS traffic was no longer an issue. It was only about 200 Mbit so I hadn't expected it to be an issue but apparently it was; I was surprised when support told me the PBR was making traffic hit the cpu. TIA, David

9 9

Re: PBR needing to hit the cpu?
by Fergie (Paul Ferguson) 18 Sep '05

18 Sep '05

What I think we're talking about here is not really "policy- based routing" but "policy-based forwarding", right? If so, then any nin-FIFO scheme would have to to be kicked up to the CPU, right? - ferg ps. I heard you left Cisco again. ;-) -- Tony Li <tony.li(a)tony.li> wrote: On Sep 17, 2005, at 8:57 PM, David Hubbard wrote: > Just curious, do most vendors' hardware need to hit the > cpu when doing policy-based routing? I found one of my > border routers' cpu's on the bad end of a DDoS but once > I turned off a not necessarily required setup to force > some outbound traffic to take a specific outbound link > via PBR, the DDoS traffic was no longer an issue. It was > only about 200 Mbit so I hadn't expected it to be an issue > but apparently it was; I was surprised when support told > me the PBR was making traffic hit the cpu. That's not at all surprising. PBR would be pretty hard to push into a hardware forwarding path. Not impossible, but certainly challenging. Tony

1 0