- NANOG - lists.nanog.org

Re: Tiscali switches to Public-Root?? What do you think?
by Brandon Butterworth 01 Aug '05

01 Aug '05

> "www.really-cool.alt. Now fix your systems so I can access it" > > The poor guy/gal at the other end of the line will need a really good > answer. "Looks like your friend has been duped by some domain hijackers/phishers exploiting a DNS security hole. We've kept you safe from that perhaps your friend would like to move to us rather than the insecure ISP" > Not to mention the answers we need for the market droids... > > "Hey, I heard that Tiscali is offering more Internet than us at no > extra cost, and they make a lot of money on it too. How soon can we > start doing the same?" "I hear you can buy .tiscali for $1M so all our users plus some others will get our site instead of theirs. Unfortunately the same scam means a bunch of other people have .telenor" > This puts a lot of pressure on other European ISPs, and eventually > also North American ISPs (to make this on-topic :-) I hope the rest of > us can stand together against it. The rot started when icann hijacked . and started selling pointless gtlds, it's not surprising others want to do the same. brandon

1 0

Re: More info on the Exploit from Black Hat conference
by Piotr KUCHARSKI 01 Aug '05

01 Aug '05

On Sat, Jul 30, 2005 at 09:18:12PM -0400, Robert Guess wrote: > > Piotr KUCHARSKI <chopin(a)sgh.waw.pl> 7/30/2005 8:40:21 PM >>> > > On Sat, Jul 30, 2005 at 07:03:47AM -0400, Scott Morris wrote: > > > Based on some pictures from > > > http://tomsnetworking.com/Sections-article131.php I would agree with > > > you that they were edited. > > Contents seem the same, just the pics are missing. > > Anyone from conference to judge the completeness of circulating > > presentation? > I took pictures of the slides but may have missed one or two. Grab them > here: http://164.106.251.250/docs/netsec/defcon13/7-27-05.zip Thank you. I compared one by one; your photos show few additional slides: about why he was doing it, two green font views of cisco console and one slide about him looking for job. Other than that (and lack of jpgs on each slide in pdf), the circulating presentation seems to be the exactly same. p. PS I took the liberty of mirroring it at 42.pl/lynn/ -- Beware of he who would deny you access to information, for in his heart he dreams himself your master. -- Commissioner Pravin Lal

2 1

Re: More info on the Exploit from Black Hat conference
by Brad Knowles 31 Jul '05

31 Jul '05

At 9:18 PM -0400 2005-07-30, Robert Guess wrote: > I took pictures of the slides but may have missed one or two. Grab them > here: > > http://164.106.251.250/docs/netsec/defcon13/7-27-05.zip Not there anymore. Got another URL? -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

1 0

Cisco and the tobacco industry
by J. Oquendo 31 Jul '05

31 Jul '05

Subject : RE: Cisco IOS Exploit Cover Up On Thu, 28 Jul 2005, Geo. wrote: > I think there is also a LOT concern about all the unpatched routers that > remain unpatched simply because the admins don't feel like spending a week > running the cisco gauntlet to get patches when you don't have a support > contract with cisco. Its like cisco doesn't want you to patch or they would > make it easy. > > Geo. This is oh so true - contracts in order to patch your equipment. Normally I would never mention the need for an authority to intervene on things related to the Internet but how long will it be before the term "Digital Pearl Harbor" is a reality. Maybe it is time an authority figure steps in and makes some form of rules for vendors to distribute fixes under some form of law. If this flaw of Cisco's could lead to the kind of severe damage as Mr. Lynn claims, shouldn't it fall on the shoulders of Cisco to get their act together and provide a fix as opposed to sending in the hounds (legal shmoes via lawsuit) to quash their problems. I'm sort of taking a look at it from the tobacco company lawsuit stance where the tobacco bigwigs would bury the truth in legal trash as opposed to making things right. It's rather irresponsible behaviour on the part of Cisco to avoid coming clean on this issue. On matters of a public exploit and or the skill level necessary to create an attack via whatever flaw Mr. Lynn spoke of: It is only a matter of time before something is out there, so for some to criticize Mr. Lynn for being a whistleblower, shame on you. I think he did a courageous thing. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo sil @ infiltrated . net | http://www.infiltrated.net GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

16 28

RE: Cisco and the tobacco industry
by Jim McBurnett 31 Jul '05

31 Jul '05

QUOTE From: Ivan Groenewald [mailto:ivang@xtrahost.co.uk] IMHO IOS should be completely modular. ie SNMP/QOS/BGP etc should be a loadable module etc. In the event of you patching a service specific bug, you'd only upload the new modules and insmod them. I'd be very happy if the Cisco router fairy would write and backport such an IOS. That should end this idiotic router rebooting nonsense that the internet is plagued with, for the most part. /QUOTE If I remember correctly, This Exactly where Cisco has said they are going... With the IOS XR Just as the beginning.. Does anyone else remember this? Jim

5 4

More info on the Exploit from Black Hat conference
by Church, Chuck 31 Jul '05

31 Jul '05

http://www.tomsnetworking.com/Sections-article131.php Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 864-266-3978 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D

5 4

Boing Boing: Mike Lynn presentation mirrors and legal fund
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

Over on Boing Boing: [snip] You-all have come through with many, many mirrors for Mike Lynn's controversial Black Hat presentation in which he quit his job, described critical vulnerabilities in Cisco equipment and got sued by his employer, the candyasses at ISS. See the end of the post for lots of links -- the paranoid among you can verify mirrors via this MD-5 hash: 559942447c88086fa1304c38f9d0242c. There's a legal-defense fund for Lynn that's gearing up now. Paypal your donations to Abaddon(a)IO.com. Money that is collected and not used will be donated to EFF. [snip] http://www.boingboing.net/2005/07/30/mike_lynn_presentati.html - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Boing Boing: Michael Lynn's controversial Cisco security presentation
by Todd Vierling 30 Jul '05

30 Jul '05

On Sat, 30 Jul 2005, Brad Knowles wrote: > BTW, the original slides are supposed to be at > <http://www.infowarrior.org/users/rforno/lynn-cisco.pdf>. However, what's > there now is currently a place-holder, although it does tell you that if > you're looking for the original PDF file that you can still access that at > <http://www.infowarrior.org/users/rforno/lynn-cisco1.pdf>. Which is now gone, but as we all know, the Internet equivalent of the barn door is made of tissue paper. Cursory glancing around different specialty networks reveals: freenet:CHK@gozyp6dB0-tdpU7nzL~tnh6MsZYLAwI,PcB5BAp7sdwSi1cycrbCfw/lynn-cisco.pdf ed2k://|file|lynn-cisco.pdf|1994295|8f9123fe1690ced5d71e8c61eff3557e|/ magnet:?xt=urn:bitprint:UEYAAJ42EZHDD5SDIJ7O37DVLCO6C45K.PIMEBPJG3G4ON4OWUPZYXRRKPNLTH55473DZLMQ&dn=lynn-cisco.pdf And there's probably a BT to it somewhere, and perhaps Entropy and Tor links, but I don't have easy access to those at the moment. Edited or not, it's still out there. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

1 0

Cisco IPv6 Exploit, was Re: 6to4 routes disappeared from most of North America
by John Neiberger 30 Jul '05

30 Jul '05

Someone on another list was wondering if this IPv6 exploit might have something to do with the NANOG thread from a few days ago titled "6to4 routes disappeared from most of North America". http://www.merit.edu/mail.archives/nanog/msg09747.html Is there any reason to think that these might be related, or do we already know for certain that they're completely unrelated? Regards, John

3 3

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 30 Jul '05

30 Jul '05

The *best* exploit is the one alluded to in the presentation. Overwrite the nvram/firmware to prevent booting (or, perhaps, adjust the voltages to damaging levels and do a "smoke test"). If you could do it to all GSR linecards, think of the RMA costs to Cisco (not to mention the fact that Cisco could not possible replace all the cards in all the GSRs across the internet in an anywhere reasonable timeframe). *THAT* is what I suspect worries Cisco. But of course I am just conjecturing... Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Janet Sullivan > Sent: Friday, July 29, 2005 12:44 PM > To: swm(a)emanon.com; nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > Scott Morris wrote: > > And quite honestly, we can probably be pretty safe in > assuming they will not > > be running IPv6 (current exploit) or SNMP (older exploits) > or BGP (other > > exploits) or SSH (even other exploits) on that box. :) > (the 1601 or the > > 2500's) > > If a worm writer wanted to cause chaos, they wouldn't target > 2500s, but > 7200s, 7600s, GSRs, etc. > > The way I see it, all that's needed is two major exploits, > one known by > Cisco, one not. > > Exploit #1 will be made public. Cisco will released fixed > code. Good > service providers will upgrade. > > The upgraded code version will be the one targeted by the second, > unknown, exploit. > > A two-part worm can infect Windows boxen via any common > method, and then > use them to try the exploit against routers. A windows box can find > routers to attack easily enough by doing traceroutes to > various sites. > Then, the windows boxen can try a limited set of exploit variants on > each router. Not all routers will be affected, but some will. > > As for what the worm could do - well, it could report home to > the worm > creators that "Hey, you 0wn X number of routers", or it could do > something fun like erasing configs and locking out console ports. ;-) > > Honestly, I've been expecting something like that to happen for years > now. <shrug> > >

4 4