- NANOG - lists.nanog.org

Re: Boing Boing: Michael Lynn's controversial Cisco security presentation
by sthaug＠nethelp.no 30 Jul '05

30 Jul '05

> > I guess at this point ISS realizes their reputation is so deep in the > > shitter that nothing they do could make it worse. > > Give it a week. :) > > (It's obvious that the people calling the shots in this circus have either > never heard of "Skylarov", "deCSS", or "@Stake/Dan Geer", or have decided to > out-do those. In either case, I'm willing to bet a large pizza with everything > on it that Monday morning will bring a whole new set of PR miscues into play.. ;) It'll be interesting to see them trying to suppress all the downloads that have been made by people outside the U.S. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

1 0

Boing Boing: Michael Lynn's controversial Cisco security presentation
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

Over on Boing Boing: [snip] Here's a PDF that purports to be Michael Lynn's presentation on Cisco's critical vulnerabilities ("The Holy Grail: Cisco IOS Shellcode And Exploitation Techniques"), delivered at last week's Black Hat conference. Lynn's employer, ISS, wouldn't let him deliver the talk (they'd been leant on by Cisco), so Lynn quit his job, walked onstage and delivered it anyway. (See yesterday's post and Scheneier's take for more). 1.9MB PDF Link [snip] http://www.boingboing.net/2005/07/29/michael_lynns_contro.html I think these guys better prepare for the "slashdot effect"... :-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 30 Jul '05

30 Jul '05

One thing that bugs me, though, is the quote that is credited to Lynn: [snip] "I feel I had to do what's right for the country and the national infrastructure," he said. "It has been confirmed that bad people are working on this (compromising IOS). The right thing to do here is to make sure that everyone knows that it's vulnerable." [snip] http://www.securityfocus.com/news/11259 Lynn's statement would tend to make one believe that this is yet another example of a vulnerability that is awaiting an exploit, not one that has yet to be discovered -- a sort of Sword of Damocles, if you will... - ferg -- Brett Frankenberger <rbf(a)rbfnet.com> wrote: On Thu, Jul 28, 2005 at 07:03:31AM -0700, Eric Rescorla wrote: As nearly as I can tell from reports (I wasn't there), he (1) talked about a general way to exploit a buffer overflow to cause arbitrary code execution (this would apply to buffer overflows generally, but would be completely useless if you didn't know of a buffer overflow to exploit), and (2) demonstrated his technique using a previosuly known buffer overflow vulnerability which Cisco has already patched. So Cisco is correct in saying that he didn't identifiy any new vulnerabilities, and Cisco is also correct in saying that the vulnerability he used in his presentation to demonstrate his technique has been patched. However, the same technique will be useful on the next buffer overflow vulnerability to be discovered. -- Brett

15 17

Re: [Full-disclosure] <Cisco Message> Mike Lynn's controversial Cisco Security Presentation
by Valdis.Kletnieks＠vt.edu 30 Jul '05

30 Jul '05

On Fri, 29 Jul 2005 13:11:57 CDT, Russell Smoak said: > All, > > These recipients received an email from Austin Mckinley as Cisco Systems. > > This messasge was sent in complete error and includes intellectual > property of ISS and Cisco Systems. Please delete and do not distrbute > the information any further. Unfortunately, there has been a temporal discontinuity between the departure of the quadrupeds and the closing of the barn doors. There's only two ways to *effectively* deal with this one: a) Commence massive neural wipes of anybody who *might* have seen it. b) Obtain *and* *enforce* a permanent injunction banning anybody who's already seen it from meeting anybody who hasn't seen it in any establishment that serves Guiness. deCSS, anybody? ;)

1 0

Re: eWeek: Cisco Comes Clean on Extent of IOS Flaw
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

As an aside, I like John Murrell's headline in "Good Morning, Silicon Valley" best of all -- "Cisco patches security researcher vulnerability" http://blogs.siliconvalley.com/gmsv/2005/07/cisco_patches_s.html ;-) - ferg -- Saku Ytti <saku+nanog(a)ytti.fi> wrote: I guess someone has to yell wolf every now and then to interest people in maintaining their systems. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

RE: Cisco IOS Exploit Cover Up
by Guru (Gurumurthy) Yeleswarapu 29 Jul '05

29 Jul '05

I just happened to see this : Last month, a company called Internet Security Systems (ISS) issued an alert to warn users that Cisco's VoIP offering had a security flaw that would allow just that. According to the company, this implementation flaw in Cisco's Call Manager, which handles call signaling and routing, could allow a buffer overflow that would grant an intruder access to the system to listen in on all calls routed through it. This is one scenario described by ISS and other vendors focused on selling technology to plug the security holes in VoIP, a method for sending voice traffic over IP that many say was not designed with security in mind. ISS and its competitors, which come to this new field largely from the VoIP management and IP security markets, forecast big risks for companies that don't take VoIP security seriously, and undoubtedly look forward to formidable revenue streams generated by those that do. Guru -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Janet Sullivan Sent: Friday, July 29, 2005 12:44 PM To: swm(a)emanon.com; nanog(a)merit.edu Subject: Re: Cisco IOS Exploit Cover Up Scott Morris wrote: > And quite honestly, we can probably be pretty safe in assuming they > will not be running IPv6 (current exploit) or SNMP (older exploits) or > BGP (other > exploits) or SSH (even other exploits) on that box. :) (the 1601 or > the > 2500's) If a worm writer wanted to cause chaos, they wouldn't target 2500s, but 7200s, 7600s, GSRs, etc. The way I see it, all that's needed is two major exploits, one known by Cisco, one not. Exploit #1 will be made public. Cisco will released fixed code. Good service providers will upgrade. The upgraded code version will be the one targeted by the second, unknown, exploit. A two-part worm can infect Windows boxen via any common method, and then use them to try the exploit against routers. A windows box can find routers to attack easily enough by doing traceroutes to various sites. Then, the windows boxen can try a limited set of exploit variants on each router. Not all routers will be affected, but some will. As for what the worm could do - well, it could report home to the worm creators that "Hey, you 0wn X number of routers", or it could do something fun like erasing configs and locking out console ports. ;-) Honestly, I've been expecting something like that to happen for years now. <shrug>

1 0

RE: Boing Boing: Michael Lynn's controversial Cisco security presentat ion
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

Now the FBI is investigating Lynn for criminal wrongdoing? Kim Zetter writes in Wired News this morning that: [snip] The FBI is investigating a computer security researcher for criminal conduct after he revealed that critical systems supporting the internet and many networks have a serious software flaw that could allow someone to crash or take control of the routers. [and] The FBI declined to discuss the case. [snip] http://www.wired.com/news/politics/0,1283,68356,00.html - ferg > > Over on Boing Boing: > > [snip] > > Here's a PDF that purports to be Michael Lynn's presentation > on Cisco's critical vulnerabilities ("The Holy Grail: Cisco > IOS Shellcode And Exploitation Techniques"), delivered at > last week's Black Hat conference. Lynn's employer, ISS, > wouldn't let him deliver the talk (they'd been leant on by > Cisco), so Lynn quit his job, walked onstage and delivered it > anyway. (See yesterday's post and Scheneier's take for more). > 1.9MB PDF Link > > [snip] > > http://www.boingboing.net/2005/07/29/michael_lynns_contro.html >

4 3

eWeek: Cisco Comes Clean on Extent of IOS Flaw
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

http://www.eweek.com/article2/0,1759,1841669,00.asp - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 3

Weekly Routing Table Report
by Routing Table Analysis 29 Jul '05

29 Jul '05

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. Daily listings are sent to bgp-stats(a)lists.apnic.net If you have any comments please contact Philip Smith <pfs(a)cisco.com>. Routing Table Report 04:00 +10GMT Sat 30 Jul, 2005 Analysis Summary ---------------- BGP routing table entries examined: 167568 Prefixes after maximum aggregation: 96522 Unique aggregates announced to Internet: 81002 Total ASes present in the Internet Routing Table: 20174 Origin-only ASes present in the Internet Routing Table: 17598 Origin ASes announcing only one prefix: 8279 Transit ASes present in the Internet Routing Table: 2576 Transit-only ASes present in the Internet Routing Table: 71 Average AS path length visible in the Internet Routing Table: 4.5 Max AS path length visible: 26 Prefixes from unregistered ASNs in the Routing Table: 9 Special use prefixes present in the Routing Table: 0 Prefixes being announced from unallocated address space: 15 Number of addresses announced to Internet: 1399249941 Equivalent to 83 /8s, 102 /16s and 220 /24s Percentage of available address space announced: 37.8 Percentage of allocated address space announced: 56.8 Percentage of available address space allocated: 66.4 Total number of prefixes smaller than registry allocations: 79457 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 34690 Total APNIC prefixes after maximum aggregation: 15868 Prefixes being announced from the APNIC address blocks: 32540 Unique aggregates announced from the APNIC address blocks: 16299 APNIC Region origin ASes present in the Internet Routing Table: 2317 APNIC Region origin ASes announcing only one prefix: 679 APNIC Region transit ASes present in the Internet Routing Table: 346 Average APNIC Region AS path length visible: 4.5 Max APNIC Region AS path length visible: 18 Number of APNIC addresses announced to Internet: 192265344 Equivalent to 11 /8s, 117 /16s and 188 /24s Percentage of available APNIC address space announced: 71.3 APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911 APNIC Address Blocks 58/7, 60/7, 124/7, 126/8, 202/7, 210/7, 218/7, 220/7 and 222/8 ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 89792 Total ARIN prefixes after maximum aggregation: 54675 Prefixes being announced from the ARIN address blocks: 70232 Unique aggregates announced from the ARIN address blocks: 25888 ARIN Region origin ASes present in the Internet Routing Table: 10109 ARIN Region origin ASes announcing only one prefix: 3720 ARIN Region transit ASes present in the Internet Routing Table: 940 Average ARIN Region AS path length visible: 4.3 Max ARIN Region AS path length visible: 20 Number of ARIN addresses announced to Internet: 254978581 Equivalent to 15 /8s, 50 /16s and 170 /24s Percentage of available ARIN address space announced: 63.3 ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863 ARIN Address Blocks 24/8, 63/8, 64/6, 68/7, 70/6, 74/7, 76/8, 198/7, 204/6, 208/7 and 216/8 RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 32277 Total RIPE prefixes after maximum aggregation: 22045 Prefixes being announced from the RIPE address blocks: 29251 Unique aggregates announced from the RIPE address blocks: 19668 RIPE Region origin ASes present in the Internet Routing Table: 6925 RIPE Region origin ASes announcing only one prefix: 3652 RIPE Region transit ASes present in the Internet Routing Table: 1128 Average RIPE Region AS path length visible: 5.2 Max RIPE Region AS path length visible: 26 Number of RIPE addresses announced to Internet: 212855424 Equivalent to 12 /8s, 175 /16s and 234 /24s Percentage of available RIPE address space announced: 63.4 RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839 RIPE Address Blocks 62/8, 80/5, 88/6, 188/8, 193/8, 194/7, 212/7 and 217/8 LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 9153 Total LACNIC prefixes after maximum aggregation: 3150 Prefixes being announced from the LACNIC address blocks: 7531 Unique aggregates announced from the LACNIC address blocks: 4392 LACNIC Region origin ASes present in the Internet Routing Table: 626 LACNIC Region origin ASes announcing only one prefix: 192 LACNIC Region transit ASes present in the Internet Routing Table: 115 Average LACNIC Region AS path length visible: 5.2 Max LACNIC Region AS path length visible: 23 Number of LACNIC addresses announced to Internet: 20630016 Equivalent to 1 /8s, 58 /16s and 202 /24s Percentage of available LACNIC address space announced: 30.7 LACNIC AS Blocks 26592-26623, 27648-28671, plus ERX transfers LACNIC Address Blocks 189/8, 190/8, 200/7 AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 1641 Total AfriNIC prefixes after maximum aggregation: 784 Prefixes being announced from the AfriNIC address blocks: 1011 Unique aggregates announced from the AfriNIC address blocks: 779 AfriNIC Region origin ASes present in the Internet Routing Table: 131 AfriNIC Region origin ASes announcing only one prefix: 36 AfriNIC Region transit ASes present in the Internet Routing Table: 16 Average AfriNIC Region AS path length visible: 4.6 Max AfriNIC Region AS path length visible: 12 Number of AfriNIC addresses announced to Internet: 2340096 Equivalent to 0 /8s, 35 /16s and 181 /24s Percentage of available AfriNIC address space announced: 7.0 AfriNIC AS Blocks 36864-37887 & ERX transfers AfriNIC Address Blocks 41/8, 196/8 APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 4134 954 5523 193 CHINANET-BACKBONE 1221 769 1457 534 Telstra Pty Ltd 9583 769 77 14 Sify Limited 4755 662 248 144 Videsh Sanchar Nigam Ltd. Aut 4766 590 3412 278 Korea Telecom (KIX) 7545 513 108 73 TPG Internet Pty Ltd 17676 463 6707 98 Softbank BB Corp. 9443 382 82 77 Primus Telecommunications 9929 343 224 46 China Netcom Corp. 2907 337 1789 314 SINET Japan 9498 333 83 61 BHARTI BT INTERNET LTD. 7474 317 273 219 SingTel Optus Pty Ltd 4802 297 53 164 Wantree Development 17557 296 23 153 Pakistan Telecom 18302 292 109 158 SK Global co., Ltd 4808 290 245 168 CNCGROUP IP network: China169 9837 278 79 181 Powertel Ltd 17974 270 65 14 PT TELEKOMUNIKASI INDONESIA 17488 267 16 8 Hathway IP Over Cable Interne 703 250 262 206 UUNET - Commercial IP service ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7018 1492 6417 964 AT&T WorldNet Services 4323 1138 688 222 Time Warner Telecom 174 1125 5823 1042 Cogent Communications 721 1085 21779 311 DLA Systems Automation Center 701 1021 8172 864 UUNET Technologies, Inc. 6197 939 522 433 BellSouth Network Solutions, 2386 895 529 658 AT&T Data Communications Serv 1239 872 2879 630 Sprint 18566 833 224 7 Covad Communications 20115 651 499 321 Charter Communications 209 623 3471 492 Qwest 3356 563 10765 431 Level 3 Communications, LLC 27364 554 44 18 Armstrong Cable Services 3602 538 123 104 Sprint Canada, Inc. 3561 535 2384 421 Savvis 7725 510 64 16 MediaOne 22773 502 1188 23 Cox Communications, Inc. 5668 499 115 23 CenturyTel Internet Holdings, 6198 468 396 225 BellSouth Network Solutions, 852 466 1093 385 Telus Advanced Communications RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 702 592 1995 483 UUNET - Commercial IP service 3301 300 1081 286 TeliaNet Sweden 3320 292 3232 241 Deutsche Telekom AG 8220 266 473 262 COLT Telecommunications 680 245 2041 241 DFN-IP service G-WiN 3246 230 469 223 Song Networks 8708 225 253 211 Romania Data Systems S.A. 1257 196 712 174 SWIPnet Swedish IP Network 5515 181 778 127 Sonera Solution Autonomous Sy 786 175 1794 175 The JANET IP Service 6746 175 49 153 Dynamic Network Technologies, 5400 174 287 147 BT Ignite European Backbone 3269 169 1520 72 TELECOM ITALIA 719 168 340 100 LANLINK autonomous system 8866 167 21 11 Bulgarian Telecommunication C 3300 156 184 89 AUCS Communications Services 9121 154 273 34 TTnet Autonomous System 6830 148 537 31 UPC Distribution Services 25186 142 145 99 France Telecom Transpac's Tra 1273 136 174 96 Cable & Wireless Deutschland LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 380 599 160 UniNet S.A. de C.V. 16814 265 16 7 NSS, S.A. 11172 236 99 60 Servicios Alestra S.A de C.V 6147 192 110 21 Telefonica Del Peru 11664 181 20 23 Keytech SA 14117 152 9 5 Telefonica del Sur S.A. 7303 144 69 18 Telecom Argentina Stet-France 22047 143 112 7 VTR PUNTO NET S.A. 19632 142 14 5 Metropolis Intercom S.A. 11556 131 64 3 Cable-Wireless Panama 6505 130 90 87 Global One Communicaoes Ltda 19169 116 7 22 Telconet 6503 114 148 75 AVANTEL, S.A. 13999 110 52 9 Mega Cable S.A. de C.V. 18822 110 7 14 TELEFONICA MANQUEHUE 10481 101 40 7 Prima S.A. 21826 101 13 18 INTERCABLE 5639 96 12 9 Telecommunications Services o 22927 96 73 25 TELEFONICA DE ARGENTINA 23216 89 24 16 RAMtelecom Telecomunicaciones AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 3741 264 621 221 The Internet Solution 5536 120 15 17 Internet Egypt Network 2018 98 295 89 Tertiary Education Network 8452 96 28 6 TEDATA 2905 76 266 68 The Internetworking Company o 24835 57 34 6 RAYA Telecom - Egypt 20928 56 16 2 Noor Advanced Technologies AS 6713 51 54 8 Itissalat Al-MAGHRIB 15475 49 84 4 Nile Online 9129 42 3 3 UUNET Kenya 5713 36 142 29 Telkom SA Ltd 12455 36 6 3 Jambonet Autonomous system 15706 31 8 3 Sudatel Internet Exchange Aut 8524 23 1 4 AUCEGYPT Autonomous System 16637 22 10 19 Johnnic e-Ventures 23889 20 5 9 MAURITIUS TELECOM 10798 19 1 11 Standard Bank of South Africa 12258 17 3 11 Vodacom Internet Company 15808 17 2 2 Communication Solutions Ltd i 21491 17 1 1 UTL On-line is RF broadband I Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 4323 1138 916 Time Warner Telecom 18566 833 826 Covad Communications 721 1085 774 DLA Systems Automation Center 4134 954 761 CHINANET-BACKBONE 9583 769 755 Sify Limited 27364 554 536 Armstrong Cable Services 4755 662 518 Videsh Sanchar Nigam Ltd. Aut 6197 939 506 BellSouth Network Solutions, 7725 510 494 MediaOne 22773 502 479 Cox Communications, Inc. 5668 499 476 CenturyTel Internet Holdings, 7545 513 440 TPG Internet Pty Ltd 3602 538 434 Sprint Canada, Inc. 17676 463 365 Softbank BB Corp. 6467 431 358 E.Spire Communications, Inc. 20115 651 330 Charter Communications 19262 433 319 Verizon Global Networks 4766 590 312 Korea Telecom (KIX) 9443 382 305 Primus Telecommunications 6140 401 299 ImpSat List of Unregistered ASNs (Global) ---------------------------------- Bad AS Designation Network Transit AS Description 64826 PRIVATE 64.200.250.0/23 7911 Williams Communicati 65050 PRIVATE 168.96.148.0/24 6140 ImpSat 65507 PRIVATE 200.0.64.0/24 27750 Cooperación Latino A 65142 PRIVATE 200.32.76.0/24 6140 ImpSat 65142 PRIVATE 200.32.77.0/24 6140 ImpSat 64512 PRIVATE 200.61.48.0/20 11664 Keytech SA 64512 PRIVATE 200.61.58.0/23 11664 Keytech SA 64512 PRIVATE 200.80.148.0/23 11664 Keytech SA 65005 PRIVATE 203.200.197.0/24 4755 Videsh Sanchar Nigam Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 50.160.0.0/13 1221 Telstra Pty Ltd 132.0.0.0/10 721 DLA Systems Automation Center 137.0.0.0/13 721 DLA Systems Automation Center 158.0.0.0/13 721 DLA Systems Automation Center 172.32.0.0/24 7011 Citizens Utilities 192.43.230.0/24 7575 Australian Academic and Rease 192.44.0.0/24 5501 Fraunhofer Gesellschaft 192.44.0.0/19 702 UUNET - Commercial IP service 192.70.164.0/24 25689 National Research Council of 192.84.205.0/24 719 LANLINK autonomous system 192.119.135.0/24 270 NASA 192.135.50.0/24 7018 AT&T WorldNet Services 192.169.0.0/23 3970 RGnet, Inc. 192.172.0.0/19 721 DLA Systems Automation Center 192.200.100.0/24 7018 AT&T WorldNet Services Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:3 /10:8 /11:15 /12:75 /13:167 /14:317 /15:607 /16:8474 /17:2665 /18:4538 /19:10539 /20:11515 /21:9531 /22:13041 /23:13913 /24:91131 /25:351 /26:297 /27:178 /28:50 /29:26 /30:75 /31:0 /32:35 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 18566 817 833 Covad Communications 6197 765 939 BellSouth Network Solutions, 7018 703 1492 AT&T WorldNet Services 2386 606 895 AT&T Data Communications Serv 9583 586 769 Sify Limited 27364 545 554 Armstrong Cable Services 4323 539 1138 Time Warner Telecom 7725 480 510 MediaOne 4766 408 590 Korea Telecom (KIX) 5668 403 499 CenturyTel Internet Holdings, 702 365 592 UUNET - Commercial IP service 1239 360 872 Sprint 19916 354 361 OLM LLC 6198 343 468 BellSouth Network Solutions, 7011 327 378 Citizens Utilities 6517 295 317 Yipes Communications, Inc. 15270 292 316 PaeTec.net -a division of Pae 6467 287 431 E.Spire Communications, Inc. 20115 283 651 Charter Communications 18302 277 292 SK Global co., Ltd Number of /24s announced per /8 block (Global) ---------------------------------------------- 4:6 8:22 9:1 12:1560 13:1 15:9 16:2 17:3 18:3 20:4 24:1178 30:2 32:70 33:2 38:140 40:55 44:4 47:2 52:4 55:2 56:3 57:23 58:140 59:59 60:67 61:746 62:634 63:1882 64:2802 65:2066 66:2929 67:645 68:557 69:1115 70:151 71:10 72:276 80:579 81:572 82:437 83:299 84:225 85:304 86:67 87:18 128:161 129:168 130:88 131:293 132:38 133:1 134:146 135:42 136:138 137:73 138:163 139:61 140:306 141:105 142:147 143:141 144:203 145:34 146:291 147:109 148:288 149:175 150:107 151:65 152:108 153:88 154:5 155:140 156:79 157:99 158:165 159:167 160:81 161:70 162:218 163:94 164:192 165:189 166:156 167:241 168:438 169:143 170:324 171:8 172:1 190:1 192:5736 193:3231 194:2429 195:1606 196:660 198:3883 199:3295 200:4106 201:226 202:5934 203:6372 204:3802 205:2026 206:2452 207:2811 208:2046 209:3344 210:1628 211:742 212:1243 213:1330 214:275 215:31 216:3619 217:1126 218:213 219:160 220:403 221:252 222:124 End of report

1 0

RE: Boing Boing: Michael Lynn's controversial Cisco security presentation
by Buhrmaster, Gary 29 Jul '05

29 Jul '05

Would this not be a great way to infect thousands of network operations systems due to a PDF exploit? It is like "free beer" to many network operators, they just *have* to consume it. One could take control of the "network" by taking control of the systems of the people operating it and silently watch for the passwords, names, ip addresses that will enable one to take control later. I know, I am just being paranoid. There has never been an exploitable PDF exploit. Oh, wait, there has been :-) One has to admit it would be one hell of a combined social engineering and technical exploit if it could be pulled off. Gary > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Fergie (Paul Ferguson) > Sent: Friday, July 29, 2005 7:19 AM > To: nanog(a)merit.edu > Subject: Boing Boing: Michael Lynn's controversial Cisco > security presentation > > > > Over on Boing Boing: > > [snip] > > Here's a PDF that purports to be Michael Lynn's presentation > on Cisco's critical vulnerabilities ("The Holy Grail: Cisco > IOS Shellcode And Exploitation Techniques"), delivered at > last week's Black Hat conference. Lynn's employer, ISS, > wouldn't let him deliver the talk (they'd been leant on by > Cisco), so Lynn quit his job, walked onstage and delivered it > anyway. (See yesterday's post and Scheneier's take for more). > 1.9MB PDF Link > > [snip] > > http://www.boingboing.net/2005/07/29/michael_lynns_contro.html > > I think these guys better prepare for the "slashdot effect"... > > :-) > > - ferg > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net > ferg's tech blog: http://fergdawg.blogspot.com/ >

2 1