- NANOG - lists.nanog.org

Re: Verisign vs. ICANN
by Dickson, Brian 22 Jun '04

22 Jun '04

Stephen J. Wilcox (SJW) wrote: SJW> I do not believe there is any technical spec prohibiting this, SJW> in fact that DNS can use a wildcard at any level is what enables SJW> the facility. It is not always the case that everything a spec defines, is included or enumerated in the spec, particularly when specs refer to other specs and it is the combination(s) of specs which define proper behaviour. (If every protocol which was built on TCP, had to also include the contents of the TCP spec, the whole RFC system would quicly collapse under its own weight.) SJW> I think this is a non-technical argument.. SJW> altho it was demonstrated that owing to the age and status of the com/net SJW> zones a number of systems are now in operation which make SJW> assumptions about the response in the event of the domain not existing... If it were merely an *internal* issue *within* the DNS system, perhaps there would be areas of disagreement which could be settled via either extending, or clarifying, the relevant RFCs. However, the issue is, to some degree, actually outside of the proper scope of the DNS lookup/resolver system. (see below...) On Sat, 19 Jun 2004, Alexei Roudnev (AR) wrote: AR> The technical roots of the problem are: proposed services VIOLATES AR> internet specification (which is 100% clean - if name do not exist, AR> resolver must receive negative response). AR> So, technically, there is not any ground for SiteFinder - vice versa To make Alexei's argument's syntax agree with the intended semantics: He means to say, "Technically, there is no grounds for implementing SiteFinder by means of inserting wildcards to the .com and .net zones. Rather, there are specific grounds for *not* inserting wildcards, regardless of the purpose of those wildcards, in .net and .com zones. (E.g.: in contrast with .museum zone, which is generally special-purpose, and for which assumptions about which services are expected (www only) are reasonable and valid, the .com and .net zone are general-purpose, and pretty much any service, including all assigned values for TCP and UDP ports from the IANA, should and must be presumed to be used across the collection of IPv4 space.) The crux of the problem appears in a particular case, for which *no* workaround exists, and for which no workaround *can* exist, from a straight derivational logic of state-machine origins. The DNS *resolver* system, is only one of the places where the global namespaces is *implemented*. Any assigned DNS name *may* be placed into the DNS. And *only* the owner of that name has authority to register that name, or cause its value to return from any query. An assigned name, however, can *also*, or even *instead* of being placed into the DNS *resolver* system, be put into other systems for resolving and returning name->address mappings. These include: the predecessor to BIND, which is the archaic "/etc/hosts" file(s) on systems; Sun's NIS or NIS+ systems (local to any NIS/NIS+ domain space); LDAP and similar systems; X.500 (if this is by any chance distinct from LDAP - I'm no expert on either); and any other arbitrary system for implementing name->address lookups. And the primary reason for *REQUIRING* NXDOMAIN results in DNS, is that in any host system which queries multiple sources, only a negative response on a lookup will allow the search to continue to the next system in the search order. Implementing root-zone wildcards, places restrictions on both search-order, and content population, of respective name-resolution systems, which violates any combination of RFCs and best-common practices. And, most importantly, *cannot* be worked around, *period*. Until the RFCs are extended to permit population of zones with authoritative *negative* information, and all the servers and resolvers implement support for such, *and* operators of root zone databases automatically populate assigned zones with such negative values, wildcards *will* break, in unreconcileable fashion, existing, deployed systems which refer to multiple implementations of zone information services, and for which *no* workaround is possible. Apologies for a long, semi-on-topic post. Hopefully this will end this thread, and maybe even put a stake through the heart of the VeriSign filing (at least this version of it). While the law generally doesn't recognize mathematically excluded things as a matter of law, when it comes to affirmative testimony, counter-arguments can demonstrably be shown as de-facto purgury (sp?). Brian Dickson (who has had to deploy systems in heterogeneous environments, and is aware of deployed systems that broke because of *.com)

2 1

Being abused by a spammer.. Need help - AOL/swbell/adelphia.net
by Nicole 21 Jun '04

21 Jun '04

Below are several examples of spam apperantly being sent out forging both my from address domain and Received from server information. Obviously this could become problematic. Fortunatly it's inaccurate. Any help on how I can do something about this or find ouy who and how they are doing it would be greatly appreciated. Also I would share that this started after i started notifying upstream ISP's of spam violations. Who apparently shared my information to earn myself retaliation. The ISP's were most likely Media Dreamland and UUNET/MCI but I cannot be certain of course. Nicole ---------------- Return-Path: <catcall(a)unixgirl.com> Received: (qmail 18818 invoked from network); 21 Jun 2004 14:20:10 -0000 Received: from exprod6mx50.postini.com (HELO psmtp.com) (12.158.35.194) by adams.net with SMTP; 21 Jun 2004 14:20:10 -0000 Received: from source ([67.23.190.129]) by exprod6mx50.postini.com ([12.158.35.251]) with SMTP; Mon, 21 Jun 2004 07:20:08 PDT Received: from unixgirl.com (mx20.webweaver.net [64.124.90.17]) by 67-23-190-129.bflony.adelphia.net (Postfix) with ESMTP id 8F0CC0C0CB for <sgrigsby(a)adams.net>; Mon, 21 Jun 2004 10:19:38 -0500 Message-ID: <100101c457a3$8c0bf833$a4cff4cf(a)unixgirl.com> From: "Denier I. Hobbs" <catcall(a)unixgirl.com> To: Sgrigsby <sgrigsby(a)adams.net> Subject: See the Cutset Chcks Chick Gaping asloeshs filled with Date: Mon, 21 Jun 2004 10:19:38 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0016_C8B1DB09.BE7DF58C" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.10; AVE: 6.20.0.1; VDF: 6.20.0.46; host: 67-23-190-129.bflony.adelphia.net) Hlelo, chief :) Young Cum Wrohe creampie vidoes ready to dlownoad http://hO7paPqK.u.shoppostfalls.org/acfe22eeddf82266e32f/47XHt4LTK/FQUcOgkU… woyAxRJDAMW.htm ----------------------------- Return-Path: <nodding(a)unixgirl.com> Received: from 61-27-138-9.home.ne.jp (61-27-138-9.home.ne.jp [61.27.138.9]) by theta.nas.net (8.11.6/8.10.1) with SMTP id i5L4VbK20918 for <awilbur(a)netaccess.on.ca>; Mon, 21 Jun 2004 00:31:38 -0400 (EDT) Received: from unixgirl.com (mx20.webweaver.net [64.124.90.17]) by 61-27-138-9.home.ne.jp (Postfix) with ESMTP id A5F4DC0886 for <awilbur(a)netaccess.on.ca>; Mon, 21 Jun 2004 00:31:11 -0500 Message-ID: <110101c45750$2fe5a1a8$ccbc5795(a)unixgirl.com> From: "Selfsame R. Routinizing" <nodding(a)unixgirl.com> To: Awilbur <awilbur(a)netaccess.on.ca> Subject: Hot Chick Gteting Jizezd Inetrnally in her Ass Date: Mon, 21 Jun 2004 00:31:11 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_1BC6E4BE.73348A74" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Virus-Scanned: by amavisd-milter (http://amavis.org/) Hlelo teerh! Hot Chick Fileld with Cum http://oitjl.pMkOx1kQ.0kzP5jE.shoppostfalls.org/acfe22eeddf82266e32f/2wFjk/… wwSFSIIBxoyDQQCERVMAT1ABAY=.htm ---------------------------------- Received: from bm9.sec.tds.net ([216.170.230.79]) by mta02.mail.tds.net with ESMTP id <20040621021413.JVNC3320.mta02.mail.tds.net(a)bm9.sec.tds.net> for <becky(a)tctc.com>; Sun, 20 Jun 2004 21:14:13 -0500 Received: from adsl-209-30-158-163.dsl.rcsntx.swbell.net (adsl-209-30-158-163.dsl.rcsntx.swbell.net [209.30.158.163]) by bm9.sec.tds.net (8.12.10/8.12.2) with SMTP id i5L2E8qt001719 for <becky(a)tctc.com>; Sun, 20 Jun 2004 21:14:10 -0500 (CDT) Received: from unixgirl.com (mx20.webweaver.net [64.124.90.17]) by adsl-209-30-158-163.dsl.rcsntx.swbell.net (Postfix) with ESMTP id 3F39723BDF for <becky(a)tctc.com>; Sun, 20 Jun 2004 22:13:44 -0500 Message-ID: <010001c4573d$5e9cbbbd$6867fa4a(a)unixgirl.com> From: "Frazzled F. Restrains" <Cornelia(a)unixgirl.com> To: Becky <becky(a)tctc.com> Subject: The Httseot Chick gteting their asses fileld with cum Date: Sun, 20 Jun 2004 22:13:44 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0035_D46F3F18.B5679917" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-AntiVirus: checked by AntiVir MailGate (version: 2.0.1.5; AVE: 6.17.0.2; VDF: 6.17.0.5; host: adsl-209-30-158-163.dsl.rcsntx.swbell.net) Good day. Spam explicatives deleted. http://tvLvT.shoppostfalls.org/acfe22eeddf82266e32f/PAmrZy9Yi/o1DBZY/6Cyo18… NOBcnEwESAUAwAQo=.htm ------------------------- Received: from smtp-dtc01.proxy.aol.com (smtp-dtc01.proxy.aol.com [205.188.118.17]) by rly-ip04.mx.aol.com (v98.19) with ESMTP id RELAYIN10-b40d62f2867; Sun, 20 Jun 2004 20:43:20 -0400 Received: from AC9935A8.ipt.aol.com (AC9935A8.ipt.aol.com [172.153.53.168]) by smtp-dtc01.proxy.aol.com (8.12.11/8.12.11) with SMTP id i5L0hCtZ013596 for <vpr87(a)militaryop.com>; Mon, 21 Jun 2004 00:43:15 GMT Received: from unixgirl.com (mail.webweaver.net [64.124.90.12]) by AC9935A8.ipt.aol.com (Postfix) with ESMTP id C98E8D4C19 for <vpr87(a)militaryop.com>; Sun, 20 Jun 2004 20:42:49 -0500 Message-ID: <000101c45731$462f4644$46a3ec11(a)unixgirl.com> From: "Bolero J. Amalgam" <captivation(a)unixgirl.com> To: Vpr <vpr87(a)militaryop.com> Subject: Nice Amateur Tenes on webcam Date: Sun, 20 Jun 2004 20:42:49 -0500 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0018_CC18E230.C1D2B726" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1409 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409 X-Virus-Scanned: Norton X-Scanned-By: MIMEDefang 2.40 X-Apparently-From: HeyJudebag(a)aol.com X-AOL-IP: 205.188.118.17 -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com *** Spam Sucks and I get tons of it. So I have some tight spam filters. If any email to me bounces, please use your secret decoder ring and please send to blabgoo at yahoo dot com :)

1 0

Justice Dept: Wiretaps should apply to Net calls
by Fergie (Paul Ferguson) 21 Jun '04

21 Jun '04

The battle rages on, apparently. The more things change, the more things stay the same, it would seem. ;-) This is from this past Wednesday --I'm surprised that I somehow overlooked it and only just now saw this. http://www.cnn.com/2004/TECH/internet/06/16/telecoms.voip.reut/index.html FYI, - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net

9 18

Level(3)->AT&T problems
by Jerry B. Altzman 21 Jun '04

21 Jun '04

Hi all, We're situated firmly on AT&T, and clients of ours who are behind Level(3) are having connectivity issues reaching us. Are there any known problems? AT&T has reported some to me, I am just curious if it is just the T/L3 link or if it is a bigger L3 problem. Thanks! //jbaltz -- jerry b. altzman jbaltz(a)omnipod.com +1 646 230 8750 Thank you for contributing to the heat death of the universe.

1 0

RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]
by Hannigan, Martin 21 Jun '04

21 Jun '04

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Sean Donelan > Sent: Saturday, June 19, 2004 10:25 PM > To: Cade,Marilyn S - LGCRP > Cc: Steven M. Bellovin; Jim Dempsey (E-mail); North American Noise and > Off-topic Gripes > Subject: RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists] > > > > On Sat, 19 Jun 2004, Cade,Marilyn S - LGCRP wrote: [SNIP] > > A SPAN port could satisfy an ISP's obligations under > TitleIII/ECPA, but > not satisfy CALEA. What is required is TCAP information and bearer traffic. Typically delivered off the switch back to the LEA collector via a DS0. The TCAP information can be delivered in a multitude of ways.

2 1

Re: Interesting Occurrence
by Mike Tancsa 21 Jun '04

21 Jun '04

Not the best place to ask (full-discloure or the incidents list perhaps), but there are numerous phishing scams going of late (I get 3 or 4 a day) that exploit an unpatched IE bug.... e.g. the spam reads You Have a VoiceMessage Waiting Priority :Urgent From:xxx xxx http://www.ONEvoicemailbox.net/voicemail/ (replace ONE with "1" in the host)-- I strongly suggest NOT going to this site with IE This particular site crams in a keylogger into your PC by use of http://221.4.203.78/bestadult/shellscript_loader.js http://221.4.203.78/bestadult/shellscript.js ---Mike At 01:44 PM 21/06/2004, Brent_OKeeffe(a)asc.aon.com wrote: >Okay... Here is a new one for me. Got a call from my dad saying he left >his PC on last night connected to his broadband. He went to log in this >morning and noticed a new ID in his user list - IWAP_WWW. He immediately >deleted is and called me. I had him ensure his critical updates we all >applied - they were. I had him ensure his antivirus was up to date - it >was (Norton Antivirus 2004). He is running XP Home. > >I searched the antivirus sites and elsewhere for references. Any idea if >there is a new vulnerability that has not been publicly released? Any clues? > >Regards, >Brent

1 0

Re: Interesting Occurrence
by Brent_OKeeffe＠asc.aon.com 21 Jun '04

21 Jun '04

Mon, Jun 21, 2004 at 13:58, ras(a)e-gerbil.net wrote: >Dare I ask, what part of "North American Network Operators Group" made you >think that this could POSSIBLY be on-topic or of interest to anyone here? #1 - Without sounding like a suck up, some of the greatest security minds are subscribed to this list and I, being totally self centered, thought that I would try and monopolize they're time for a small portion of the day. #2 - I have seen in the past that the locomotives of security vulnerabilities are predominately discovered and discussed on this forum... likely related to others' similar feelings on #1 above. #3 - the list has been quiet today and thought I would spark up a few threads ;-) Brent

1 0

Interesting Occurrence
by Brent_OKeeffe＠asc.aon.com 21 Jun '04

21 Jun '04

Okay... Here is a new one for me. Got a call from my dad saying he left his PC on last night connected to his broadband. He went to log in this morning and noticed a new ID in his user list - IWAP_WWW. He immediately deleted is and called me. I had him ensure his critical updates we all applied - they were. I had him ensure his antivirus was up to date - it was (Norton Antivirus 2004). He is running XP Home. I searched the antivirus sites and elsewhere for references. Any idea if there is a new vulnerability that has not been publicly released? Any clues? Regards, Brent

7 6

Re: Interesting Occurrence
by Brent_OKeeffe＠asc.aon.com 21 Jun '04

21 Jun '04

Yes, the XP version. I already chastised him for that faux pax. He replied that the guy who sold him the satellite system said it would be adequate. I offered to go find the guy and.... Ummm... rectify the situation. ;-) Brent "Jeff Shultz" <jeffshultz(a)wvi.com> Sent by: owner-nanog(a)merit.edu 06/21/2004 01:55 PM Please respond to "Jeff Shultz" To: nanog(a)merit.edu cc: Subject: Re: Interesting Occurrence ** Reply to message from Brent_OKeeffe(a)asc.aon.com on Mon, 21 Jun 2004 12:44:50 -0500 > Okay... Here is a new one for me. Got a call from my dad saying he left > his PC on last night connected to his broadband. He went to log in this > morning and noticed a new ID in his user list - IWAP_WWW. He immediately > deleted is and called me. I had him ensure his critical updates we all > applied - they were. I had him ensure his antivirus was up to date - it > was (Norton Antivirus 2004). He is running XP Home. > > I searched the antivirus sites and elsewhere for references. Any idea if > there is a new vulnerability that has not been publicly released? Any > clues? > > Regards, > Brent Out of curiosity, was he running any sort of (including the XP one) of firewall software? -- Jeff Shultz A railfan pulls up to a RR crossing hoping that there will be a train.

1 0

Re: what's going on with yahoo and gmail lately?
by Joe Shen 21 Jun '04

21 Jun '04

8 8