- NANOG - lists.nanog.org

Provider-based DDoS Protection Services
by John Neiberger 29 Jul '05

29 Jul '05

I've been talking to various providers about their DDoS detection and mitigation services and I'd like to get some opinions about what I'm hearing. One provider prices their product based on how much traffic you will need to mitigate during an attack. The sales engineers say that most DDoS attacks are in the 2-3 Gbps range so, of course, they recommend that you pay for that much protection at great cost. Another provider (using the exact same hardware and software) costs about half as much per month. Yet another provider (again, using exactly the same hardware and software) has much more flexible pricing that is far more attractive, but that's because their engineers state that DDoS attacks are usually sized to match the size of the network they're attacking. For example, according to this sales engineer, attackers usually won't launch a 3 Gbps attack on someone who only has a handful of T1 circuits. So, this provider's pricing looks much more attractive to end-users who have smaller circuit size requirements. If you have a single T1, for example, you could buy 50 Mbps of protection and they say that's enough. What do you think? Is the first vendor closer to telling the truth, or is the third vendor? Or, is there really just no way of knowing ahead of time so you might as well pay for the most protection you can afford? Thanks, John

1 0

Reflecting on Cisco's flaws
by J. Oquendo 29 Jul '05

29 Jul '05

/* The incident highlights the thorny issue of when to go public with a security problem. Security firms and computer vendors generally agree to do so when there's a patch - or fix - available. Cisco said it encourages independent security research but said in a statement that it felt Lynn's presentation "was presented prematurely and did not follow proper industry disclosure rules." [see footnote a] ... Worms - malicious programs that spread automatically - are less likely in today's version of Cisco's operating system because the underlying software is different enough for each device. That will change in the next release, making it possible to attack a wide swath of routers without adjusting the malware for each unique configuration. Such attacks, Lynn said, could modify routers en masse so that they cannot receive updates so they are always infected. Worse, attackers could erase instructions that tell the machine how to turn on. "The purpose of doing this presentation was to prevent a worm from being made," he said. His Las Vegas demonstration was stripped of any information that would lead anyone to figure out how the technique works, Lynn said. He also said he decided to defy his employer because Cisco's operating system source code had been stolen and posted on a hacker Web site. Additionally, Lynn said, he has seen discussions of Cisco vulnerabilities posted on Web sites for Chinese hackers. "Cisco has never told anybody that it was possible to take over one of their routers," Lynn said. "They fought that argument for a long time. You can see how far they're willing to go. I demonstrated it live on stage. That debate is over now." ... That changed when Cisco and ISS hired a team of temporary workers to yank about 20 pages from thousands of conference binders and replace compact discs with presentation materials. [footnote b] http://www.forbes.com/business/feeds/ap/2005/07/28/ap2163964.html */ Footnotes: (a) What are these "industry disclosure rules" and who made them? (b) Cisco Rent A Cops: "You have the right to unset alias echo, any echoing will be used against you in a GPL, OpenSource, XML, RPC, INSERT_LICENSE_HERE court of law." To reflect on earlier incorrect statements from some here, it is now clear that some of the presentation was perhaps based on code that was stolen earlier this year. Secondly for those who think some April fix worked you must have fell for those patches that came out on April 1st. Good old fools day. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

1 0

U.N. Not Seeking to Govern Net
by Fergie (Paul Ferguson) 29 Jul '05

29 Jul '05

...and I've reached my post limit for the day. Via Red Herring. [snip] The United Nations recent examination of Internet governance does not portend a wholesale shift of control to the international body, the chief of the working group parsing the issue said Thursday. "Our mandate was not a proposal for sweeping regime change," said Markus Kummer, executive coordinator of the U.N. Working Group on Internet Governance (WGIG). The group released a report July 14 that called for more international oversight in the operation of the domain-name system (DNS) for Internet addresses. Mr. Kummer made his remarks at a meeting sponsored by the Internet Governance Project at Syracuse University. [snip] http://www.redherring.com/article.aspx?a=12961 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Cisco cover up
by J. Oquendo 29 Jul '05

29 Jul '05

On Wed, 27 Jul 2005, Dan Hollis wrote: > > This is looking like a complete PR disaster for cisco. They would have > been better off allowing the talk to take place, and actually fixing the > holes rather than wasting money on a small army of razorblade-equipped > censors. > > -Dan Complete PR disaster? Maybe they're still working on the fix and didn't want those on the blackhat scene to have a glimpse of how they intended on fixing things. I wonder if this has exploit_foo_bar has anything to do with their code being stolen earlier this year was it, or late last year. Maybe for the geeks in you, it may be a PR disaster, but I doubt their stock price will come down much. Oddly I wonder if those in gov are watching closely to those who are running around shorting Cisco stock. Or should that be: "sh0rt1ng c1sc0 st0ck!@$" =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

11 10

Redux: Cisco/ISS/Black Hat story hits the AP wires
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

...which, of course, means that it is being picked up by ABC, CBS, NBC, and virtually every other news-gathering operatioon on the planet. Here's yet another sample: http://abcnews.go.com/Technology/wireStory?id=987407 I sure hope it works out for everyone involved, but I'm pretty sure there will be enough casualty for all parties involved, especially innocent bystanders. It sure looks like a PR disaster for Cisco and ISS, a win for Michael Lynn in his determination to shed some truth, and a loss for Cisco customers who are currently standing around scratching their heads, unsatisfied with the PR "release" surrounding the entire incident. - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: Well, it appears this story has hit the Associated Press newswires: http://news.yahoo.com/news?tmpl=story&u=/ap/20050728/ap_on_hi_te/cisco_secu… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Cisco/ISS/Black Hat story hits the AP wires
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

Well, it appears this story has hit the Associated Press newswires: http://news.yahoo.com/news?tmpl=story&u=/ap/20050728/ap_on_hi_te/cisco_secu… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Mozilla Implements TLD Whitelist for Firefox in Response to IDN Homogr aphs Spoofing
by Jason Sloderbeck 28 Jul '05

28 Jul '05

Phil said: > Does anyone else think that it's not the job of a web browser to do this? Yes, it's recognized by Mozilla and others as the job of the Internet Architecture Board (in particular, the IAB-IDN group) to make a final decision on how to deal with homographs. However, for early adopters like Mozilla with a released software package that supports IDNs, they are taking an intermediate action until the committee comes up with a guideline. I think you're both right -- most applications can't feasibly manage their own Unicode Philosophy, but Mozilla needs to do something for the short term. -Jason -- Jason Sloderbeck Positive Networks jason @ positivenetworks . net

5 8

RE: identical-glyph homographs
by Jason Sloderbeck 28 Jul '05

28 Jul '05

> Let me repeat my other argument: Users don't use domain names > in trust assessments. I strongly disagree with this and other arguments that it's just "bad PR". I think we're off in theory-land. There are 2 critical requirements on the end-user side that make SSL work. Whether we like it or not, both require some level of intelligence: 1) Users can't ignore browser certificate warnings (i.e. look for the padlock) 2) Users have to eyeball the URL to ensure they're at the official web company site. 2a) Users have to know what the official company URL is in the first place. You may not like the existence of the above 2 rules, and we can argue about how often people pay attention to them, how feasible they are, but they are nonetheless a reality. Even the savviest of IT people can only click on the padlock, verify the cert is signed by a root authority (which it would be), check that the domain matches (it would), and hope it's secure -- this isn't just a "dumb user" issue. None of "us" could tell the difference if homographs were in place (unless you expect every application/developer to be as smart as Mozilla is). So, if you allow homographs, you have to add another rule to the chain: 3) All URLs for trusted sites must be hand-typed in the browser. All links to SSL sites are never to be trusted. You can make the case that this should be done, is acceptable, you don't mind it, etc., but it's clearly an additional link in the security architecture that wasn't previously necessary and, therefore, not just a bunch of random PR. Users are already the weak link; counting on them for yet another thing just doesn't ring true as a good idea. Bottom line: This is a real issue that reduces the *practical* security of SSL, which is why there's an IAB group dedicated to it. Counterpoints: - "But users might think 'ebay.com' and 'ebay-security.com' are the same thing." That's unrelated; it's a given that you have to know what the company URL is in the first place. There's no avoiding that existing requirement (see 2a above). - "There are lots of other browser hacks out there." So what? That doesn't justify approving a new global DNS standard that permits yet another security hole in SSL/PKI. We should be working to avoid security risks, not approving them in RFCs. - "Only the TLDs are protected." That's already the case with the way cert's are issued (e.g. you can go register "ebay.stealyourcreditcard.cx" and get a cert) ... old news. Todd Vierling's page is a great example: http://www.duh.org/homographs.cgi ... and I'm going to go join the IAB-IDN mailing list: http://lists.paf.se/cgi/listinfo/iab-idn -Jason -- Jason Sloderbeck Positive Networks jason(a)positivenetworks.net

1 0

Re: Cisco and the tobacco industry
by J. Oquendo 28 Jul '05

28 Jul '05

Re: Cisco and the tobacco industry On Thu, 28 Jul 2005, Florian Weimer wrote: > But it looks as if Cisco actually did this, and you (and Geo) just > weren't part of the elite circle of operators whose networks are > considered U.S. national critical infrastructure. Did they already do this? Highly doubtful hence Mr. Lyns resignation and decision to go public with his disclosure which brought forth Cisco's move to quash what he had to say via legal threats. When you state "Cisco already did this" what have they done other than tell someone to "shut up we're Cisco and we'll bury you with legal bills". They've done nothing but obscure the fact that they have issues with their IOS they don't want disclosed. http://quotes.nasdaq.com/asp/summaryquote.asp?symbol=CSCO%60&selected=CSCO%… Company News 07/28/2005 9:30AM Cisco Systems gets pwned at Blackhat Briefings file lawsuit to cover up swiss cheese-like holes =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

1 0

RE: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

..and of course: "Cisco Denies Router Vulnerability Claims" [snip] Cisco Systems is downplaying a news story that suggests new security flaws may have been discovered in some of its routers. [snip] http://www.varbusiness.com/components/weblogs/article.jhtml?articleId=16640… So, until the _facts_ come out, this appears to be spin vs. spin (a play on spy v. spy, for all you Alfred E. Newman fans)... - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: ...and Wired News is running this story: "Cisco Security Hole a Whopper" Excerpt: [snip] A bug discovered in an operating system that runs the majority of the world's computer networks would, if exploited, allow an attacker to bring down the nation's critical infrastructure, a computer security researcher said Wednesday against threat of a lawsuit. Michael Lynn, a former research analyst with Internet Security Solutions, quit his job at ISS Tuesday morning before disclosing the flaw at Black Hat Briefings, a conference for computer security professionals held annually here. [snip] http://www.wired.com/news/privacy/0,1848,68328,00.html - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: For what ot's worth, this story is running in the popular trade press: "Cisco nixes conference session on hacking IOS router code" http://www.networkworld.com/news/2005/072705-cisco-ios.html - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5