- NANOG - lists.nanog.org

Re: Hijacked IP space.
by Jamie Reid 04 Nov '03

04 Nov '03

I must have missed the thread on this, but is there a good summary available of exactly _how_ these netblocks are getting hijacked? Are they taking advantage of sloppy redistribution configurations, 0wning routers, spoofing OSPF updates, taking advantage of default static routes, or is there something more complicated at work? Are these attacks actually generating bogons, or are they isolated to ASN's they have at one point been legitimately announced by, and forgotten? I can think up many more interesting applications for these kind of ghost-nets than spamming, all of which are quite, if you'll pardon the pun, haunting. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "chuck goolsbee" <chucklist(a)forest.net> 11/03/03 03:56pm >>> All, Sorry, to interrupt any off-topic rambles, but I had a client call last week who had just had some telephone abuse heaped on them, by somebody accusing them of spamming. It turns out our client had a netblock assigned to them back in the mid-90's. They used to put on networking trade shows, and used the space for making show networks. They haven't put on a networking trade show (with a public network) since about 1997. Of course to complicate the matter, the sole contact listed in whois no longer works there. I informed our client how to remove their name from the whois record and relinquish the netblock back to ARIN, which I hope they are doing now. I also have (at the suggestion of some research through the nanog archives) submitted the netblock to the completewhois site. [I have no interest in commenting on the current inane OT nanog thread about that subject, so don't even try me.] Mr. Thomas' cymru.com service was offline when I tried to contact it last week (he replied via email about an outage... sorry to hear... coffee will get there eventually. Order put to the roaster today. - hang in there.) Of course I have no hard data, other than my client's phone call about another phone call, so I can't query based on a timestamp to see where this was being announced from. It appears to vanished, and has remained so according to my casual glances here and there. The netblock in question is: 204.89.0.0/21 So, my question is: Other than the above, and mentioning it here, is there anything else *I* can do to assist my client? Especially since I am not at all directly related to this netblock in any way. Additionally, it would not hurt to know if anyone here *does* know when or where the announcement came from. The client in question are good folks, and I hate to see their reputation tainted by the actions of others. Thanks, --chuck goolsbee, digital.forest

2 1

OT: Need FSO link in Santa Clara & Sunnyvale
by Brennan_Murphy＠NAI.com 04 Nov '03

04 Nov '03

What are the top vendors these days for wireless FSO links? I need at least 100Mb link over a distance of about 1-2 miles. Seems like last time I looked at this though, the speeds were up to a Gig at pretty low cost. Any insights? Would also accept emails from sales persons if they can briefly (1paragraph) summarize what they've got and at what price. I'll contact the top 3 or 5 offers directly. Thanks, BM

2 1

Re: Sabotage investigation of fiber cuts in Northwest
by JC Dill 04 Nov '03

04 Nov '03

At 07:32 PM 11/3/2003, John Fraizer wrote: >On Mon, 3 Nov 2003, Owen DeLong wrote: > > > Maybe I'm missing something, but, if you have the bolt cutters, I don't > > see why you need the key to an adjacent lock or any of the locks. > >Um, cutting a lock out gets it out of the mix but, you still have to have >the key to one of the other locks to complete the chain again. Think >about it. A cut lock can be replaced with a similar replacement lock and usually no one will be the wiser. Look at the locks here: <http://www.qsl.net/kf4lhp/telweb/microwave/kiv70/padlocks.jpg> The lock marked ATC is between 2 other locks (that's a hasp to its left, with rusty chain further to the left). It could be cut and replaced with a similar lock linking the other two locks, without opening either of the other two locks. On gates with many locks (I've seen chains of 6 or more), there is rarely any interest given to the locks that are not one's own responsibility. jc p.s. please do not cc me on replies - post to me only or to the list only, as you prefer

2 1

Verizon Postmaster contact?
by Charles Sprickman 04 Nov '03

04 Nov '03

Hi, I see VZ was not kind enough to put any contact info in Jared's NOC list. They are currently blocking all mail from an ISP customer of mine (based on the envelope From, not IP), and I need to get someone on the phone to clear this up. Sorry for the OT. Charles -- Charles Sprickman spork(a)inch.com

6 9

ISPs' willingness to take action
by kenw＠kmsi.net 04 Nov '03

04 Nov '03

I'm a little puzzled, and I hope people won't object to my asking about this. As I see it, we're experiencing an ever-increasing flood of garbage network traffic. While not all of it is easy or appropriate to target, it seems to me there's some "low hanging fruit" that could generate serious gains with relatively little investment. A few things that make sense to me (as a non-ISP network consultant) include: 1) Summarily fencing/sandboxing/disconnecting clients sending high volumes of spam, virii, etc. You might politely contact your commercial/static clients first, but anyone connecting a "bare" PC on a broadband circuit is too stupid to deserve coddling. The great majority of your clients would thank you profusely. So far as I can see, detection of serious abusers should pretty straightforward. It wouldn't require any pretense at spam or virus filtering, per se; just pick off the clients that are flagrant sources of the plague of the month. 2) Notwithstanding the above, would it really be so hard to trap network packets bearing clear signatures of the "plague of the month"? Sure, it would create an extra load on routers or require special filtering hardware, but wouldn't it be worth it? Again, no need to be comprehensive; just blast the ones that are easy pickings. 3) There was a thread a little while ago that talked about a way to cut down spam by simply restricting who you would accept SMTP traffic from. Unfortunately, I don't recall the details, but at the time it struck me as eminently sensible, and just required cooperation between ISPs to implement effectively. One problem for the average ISP would be the monitoring and updating of plague control infrastructure. It would probably be a lot easier with a bit of cooperation and sharing -- either that, or someone could get rich offering services to ISPs for a fee. By the way, can anybody explain to me a legitimate use for port 135/137 traffic across the Internet, like it's somebody's private LAN? Seems to me anybody who still thinks that's legitimate is living in the past. So, the big question: why don't ISPs do more of this? Are they afraid of client reaction? Doesn't wash, for me: most clients would be highly grateful, and all it really takes for the remainder is fair warning. Cost? Again, you can judge for yourselves how low the fruit you choose to pick; the biggest gains have the best ROI. Happy clients, liberated bandwidth, faster servers -- what's to loose? /kenw Ken Wallewein CDP,CNE,MCSE,CCA,CCNA K&M Systems Integration Phone (403)274-7848 Fax (403)275-4535 kenw(a)kmsi.net www.kmsi.net

15 18

Re: Sabotage investigation of fiber cuts in Northwest
by JC Dill 03 Nov '03

03 Nov '03

At 08:53 PM 11/2/2003, you wrote: >I'm fairly certain that the telco huts or CO's have to accomodate multiple >groups having access, so I'd bet that a padlock probably is a tough sell There are special latches that accommodate multiple padlocks, where unlocking any one padlock opens the latch. They are routinely used on private gates in remote areas where each property owner (and the local fire department) have individual locks on the gate and opening any one lock allows access. One such device is shown on here: <http://www.tayhope.com/mlus.htm> jc

7 8

Hijacked IP space.
by chuck goolsbee 03 Nov '03

03 Nov '03

All, Sorry, to interrupt any off-topic rambles, but I had a client call last week who had just had some telephone abuse heaped on them, by somebody accusing them of spamming. It turns out our client had a netblock assigned to them back in the mid-90's. They used to put on networking trade shows, and used the space for making show networks. They haven't put on a networking trade show (with a public network) since about 1997. Of course to complicate the matter, the sole contact listed in whois no longer works there. I informed our client how to remove their name from the whois record and relinquish the netblock back to ARIN, which I hope they are doing now. I also have (at the suggestion of some research through the nanog archives) submitted the netblock to the completewhois site. [I have no interest in commenting on the current inane OT nanog thread about that subject, so don't even try me.] Mr. Thomas' cymru.com service was offline when I tried to contact it last week (he replied via email about an outage... sorry to hear... coffee will get there eventually. Order put to the roaster today. - hang in there.) Of course I have no hard data, other than my client's phone call about another phone call, so I can't query based on a timestamp to see where this was being announced from. It appears to vanished, and has remained so according to my casual glances here and there. The netblock in question is: 204.89.0.0/21 So, my question is: Other than the above, and mentioning it here, is there anything else *I* can do to assist my client? Especially since I am not at all directly related to this netblock in any way. Additionally, it would not hurt to know if anyone here *does* know when or where the announcement came from. The client in question are good folks, and I hate to see their reputation tainted by the actions of others. Thanks, --chuck goolsbee, digital.forest

1 0

Re: Sabotage investigation of fiber cuts in Northwest
by Eric Kuhnke 03 Nov '03

03 Nov '03

The Qwest CO in downtown Bellingham WA has a large microwave drum aimed at Orcas Island in the San Juans. The Qwest tower on Orcas has line of site, and what appears to be microwave DS3 rigs aimed at both Anacortes and Friday Harbor. Friday Harbor has a spur of the fiber line (SOUTH of the cut) connecting it to Everett and Seattle. Now I'm no wireless wizard, or Qwest engineer, but it wouldn't be terribly difficult to route 911-destined calls via microwave to the 911 call center. Whatcom County, which had its 911 service knocked out due to the fiber cut does not have a local 911 emergency operations center. 911 calls are routed to somewhere in Snohomish county, approximately 55 miles south on I-5. >If a single fiber cut takes them out, it's not _just_ Qwest's fault.

1 0

Re: Sabotage investigation of fiber cuts in Northwest
by Eric Kuhnke 03 Nov '03

03 Nov '03

As a resident of this area, I can say that the place where this regen hut is located is *very* rural. Burlington Northern/Santa Fe railroad tracks pass through a lot of sparsely populated farm land on the route between Mt. Vernon and Bellingham, WA. Even if the hut is locked with a high quality padlock, it's likely nothing that 5 minutes with leverage-action bolt cutters can't handle. Police/Fire/Ambulance response time to the area of Edison and Samish Island can be 20 minutes or more on a *good* day. There are very few diverse fiber routes between Vancouver BC and Seattle WA. Roughly in the area of highway 237 and the Samish River: http://www.mapquest.com/maps/map.adp?pan=s&mapdata=xU4YXdELrnBtd4g5hI1PGRNl… smlnk version: http://www.smlnk.com/BtkA At 08:38 PM 11/2/2003 -0500, you wrote: >KIRO TV has a report concerning the fiber cuts targeting a particular >fiber route in the Northwest US. It has been been disrupted four times >in the last two years, not by backhoes, but by someone entering a >fiber hut. > > >North Sound 911 Service Repeatedly Targeted >by Chris Halsne KIRO 7 Eyewitness News Investigative Reporter >[...] >This person hasn't been randomly chopping entire bundles of cables, but >rather he or she is using surgical precision to black out one particular >911 emergency call center. > >Early in the morning of Sept. 3, some criminal strolled into a Qwest >Telecommunications server station with tools in hand and carefully sliced >one strand of wire. >[...] >Operators couldn't help but feel a sense of dj vu. KIRO Team 7 >Investigators have learned that someone intentionally rerouted, cut or >altered 911 service to Whatcom County on three occasions in two years. >Each time the criminal entered the same Qwest fiber optics "hut" to create >the chaos. >[...] > >http://www.kirotv.com/news/2601577/detail.html

1 0

RE: Harassment (was Re: ELAN.NET ...)
by Michel Py 03 Nov '03

03 Nov '03

> Eric Brunner-Williams wrote: > [nanog.us] > This one is my fault. I put in-addr.arpa on the protected list, > and didn't think about operational non-dns infrastructure. You can't possibly think of everything (if you could, that would be scary). Although the .us reserve list is quite extensive, some misses are unavoidable; besides nanog.us, ieee.us has been registered too. Michel.

1 0