- NANOG - lists.nanog.org

monkeys.dom UPL being DDOSed to death
by Raymond Dijkxhoorn 24 Sep '03

24 Sep '03

Hi! After Osirusoft was shut down most likely Infinite-Monkeys are doing down also ?? See: > [Mimedefang] monkeys.dom UPL being DDOSed to death Jon R. Kibler mimedefang(a)lists.roaringpenguin.com Tue Sep 23 14:15:01 2003 Greetings to all: I have some really sad news. I just got off the telephone with Ron Guilmette who runs the monkeys.com Unsecured Proxies List DNSBL. I hate to say it, but monkeys.com has been killed. It has been DDOSed to death. Ron says that every aspect of his network is undergoing a massive DDOS attack from thousands of IPs -- apparently many/all spoofed. He has tried to get law enforcement to investigate, but to no avail. He indicated that this is probably the end of his service. This makes two DNSBLs that have been DDOSed to death recently. Which one is next? NJABL? ORDB? The computer security industry really needs to figure out how to get law enforcement to take these attacks seriously. It would only take a few good prosecutions to put an end to these types of attacks. Any thoughts/suggestions? This is really a dark day for those of us fighting spam. I looks like the spammers have won a BIG battle. The only question now is who will be the causality in this war? Jon R. Kibler A.S.E.T., Inc. Charleston, SC USA > This is pretty sad. bye, Raymond.

7 10

Digest from questions about IPTelephony
by Christopher Bird 24 Sep '03

24 Sep '03

Many thanks to all who responded. I have been asked by a few people to post a digest, so here it is. I have chosen not to attribute the quotes because some of the people who responded directly to me. If they had wanted their statements made public and attributable, then they would have posted publicly. Please remember that I am a conduit here. These are opinions of others that I have assembled. So if you feel like flaming me, go ahead, you won't get much back from me though! I hope that I have represented the views of the responders accurately. If not, please publish corrections. The general consensus seemed to break down into the following areas: Call Quality ------------ There were several comments related to call jitter and how different equipment has different jitter/quality characteristics. Reference was made to the following report.... http://www.iwl.com/Products/maxwell/VoIPReport.html The report speaks for itself, but I don't know when it was created and whether the products have been updated since. "Yes, there are issues. Packet jitter is the biggest annoyance, but the H.323 VoIP protocol is reasonably robust about such things by providing some degree of jitter correction at both ends. The clincher is usually finding network providers that do a reasonably good job of keeping the network in a stable state. With reliable connectivity, H.323 can keep nearly circuit-quality calls in at least 95% of cases, and still audible but sometimes "cell phone quality" calls every once in a while. If you're connecting primarily to a nearby (in Net terms) landline gateway for most of your IP-to-PSTN calls, you'll probably never notice the difference." General conclusion is that most of the time call quality in IPT solutions is at worst adequate (cell phone quality) and at best as good as PSTN/PBX Robustness/Reliability ---------------------- 2 users report 100% availability using private corporate networks. But the caution is that the network design is critical. There is a considerable amount of configuration activity. One user reported that the most common source of problems was keying errors. Many configuration activities were templated using perl scripts to reduce configuration errors. One question posed is "When was the last time you had to update the firmware on your phone?" A reference to the need for software/firmware in the phone giving another possible point of failure when an update fails. Observation that a PBX approach is highly centralized, so can present single point of failure behaviors, whereas the IPT approach leads to a more distributed and potentially better self healing approach. At a time of national crisis (9/11 in NYC), the phone system wasn't any more reliable than the data systems. "Now, *faxing* is a big problem in the VoIP world. If your landline gateway provider doesn't give you a decent method to do fax calls, you may have an issue. V.22 and V.23 fax calls (not to mention modem calls) do not work well over a VoIP-modulated line, but some landline gateway services overcome this by placing a POTS-emulating device at the fax machine, translating back to a digital data stream, then back to POTS fax on the other side. There's also net<->fax gateway services out there." "We have been running approximately 3.5 MILLION minutes per month across our xxx VoIP solution for approximately 12-14 months: Do we have problems, yeah occasionally, but they are actually in line with the frequency of problems when running on a real pbx.........." (Vendor name removed by me) "Reliability-wise, 100% uptime requires redundant IP PBXes, backbones, switches and backup UPSes for all. This is no different to what a telco does in their Central Office for their class 5 switches, but any reasonable sized corporate network already has the UPS and backbone infrastructure in place. Why - because they have learned the hard way that people can live without phones for a while, but go ballistic if they don't get their email on time." "Things like intelligent routing and a good telecom engineer should help alleviate concerns with network outages. i.e. you're still gonna have a tie trunk to the local telco to offload non-corporate phone calls anyway...in the event of network outages, you can just seamlessly re-route the traffic over the PSTN. I wouldn't buy any of that ip-phones-on-the-desktop-crap that xxx keeps pushing. Yes, there may be some applications for the ip handsets, but the last thing you wanna hear is that someone can't get their vmail because the dhcp server barfed." Note product name removed by Chris Corporate usage vs. usage over the internet vs. POTS -------------------------------------------------- There were many cautions expressed about using VOIP over the internet. QOS control must be implemented for consistent quality, but of course that isn't possible if you don't know how calls are routed. One user reported how nice it is to have "extension portability" take the phone all over the campus and his phone number follows him. One user reported (home user) that he can take his ATA device overseas and essentially get local phone number support while traveling. "Note that you need to make the distinction between IP-only calls and calls that originate/terminate on the public POTS network. For the former, you should be able to reach reliability levels that are no worse than good old PABX equipment as long as you don't use the public internet as part of your IP path. For the latter you are not going to improve upon a PABX......." "I am about to deploy an IP telephone network in a corporate environment and I have studied others who have done it. Sure, the Internet at large is less than reliable but how often does the actual network within your company go down? I'm not talking about the file server or mail server or firewall but the actual network? That is all IP telephony depends on unless you are planning to make calls out through the Internet. A properly managed ethernet network these days is highly reliable. I would have no problems putting the internal phone system on it. I would be more hesitant to do voice over IP over the general Internet although I wouldn't be too worried about running voice and data over dedicated lines connecting offices etc." Security -------- In a corporate environment (all of the IPT gear behind corporate firewalls) the security issues do not appear to be great. Caveat given without explanation was "depending on what you are using for your PBX). Outside the firewall is something that few seem to have come to grips with. Not much discussion of security in this thread. Implementation and support complexity ------------------------------------- "Maintenance-wise I'd say the IP PBX is vastly superior to the telco. Think of it like this - you are paying a telco (and your internal telco techs) a premium to maintain and update your phone numbers and troubleshoot your internal analog wiring infrastructure. On a (sic) IP PBX, you can remove them from the equation entirely and put this under the IT infrastructure group using the same wiring you use for your pCS. No more punchdowns every time an employee moves from cubicle A to cubicle B -- just move the IP phone and power it up." "Most problems with IP telephony come from the 'router people' not talking to the 'firewall people' and both of them not talking to the 'telephone people'. If you can get these lines of communication working, you'll likely succeed. If you don't, go with the traditional way, because then you don't have to make the people communicate." Cost (compared with traditional PBX approaches) ------------------------------------------------ There was not much data presented here on cost. Certainly little hard evidence that IPT is any more or less expensive directly than PABX approaches. The costs were alluded to by the comments on punch-downs, single infrastructure etc. but no hard numbers presented. Editorial comment: I am sure the vendors will be delighted to supply that information :-). The two strongest opinions voiced suggest that the lower TCO touted by the vendors are unsubstantiated (they used stronger language as you see in the comments.) Unclassified quotations taken as a whole --------------------------------------- "When using shared infrastructure, there are so many ways for one user of the infrastructure to disrupt the work of another. You must have SLAs with pay-back on all services that you use (dark fiber, dwdm, layer 2 service, layer 2 over layer 3 service like MPLS, layer 3 service..... any service at all). If you are building a network which will support both your data and your voice traffic you must make the network as robust as possible. Make sure you rate limit the traffic sources before they reach the bottleneck .... Make sure you have 2 paths between critical points. For example it may not be justified to have a redundant GigE on each access switch, but it is in most cases justified to have redundant links between higher level aggregation devices and between sites. With a proper redundancy and security design you can reach very long up-times. However there is always the risk of human error (which seems to be only corrected through external auditing, and proper change management procedures) and the risk of co-related failures (for example in case of an attack against a bug in the software of two redundant devices)" Karsten W. Rohrbach said.... "Just a few thoughts: - several manufacturers of VoIP equipment happened to have shipped bad firmware with security problems (mainly DoS, cf. http://www.securityfocus.com/archive/1/273673, for example) - when exactly did you upgrade the firmware of your telephone set last time? - VoIP phone sets are not very widespread yet, so most of the hard-/software was not audited thoroughly yet. - you /will/ need bandwith management/QoS when deploying a larger scale VoIP network - you'll need the folks to understand the technology and its implications (to successfully operate all that stuff) - desktop integration of VoIP phones, anyone? IMVHO, VoIP stuff will reach a level of usability, when it's properly integrated with desktop/laptop address books and available as plug-in USB or serial device, giving a certain benefit to the user. I dial folks from the directory in my mobile phone, why shouldn't I do that from my desktop workstation? I have not seen a really usable solution yet. Most TCO calculations are - in terms of obviously increased maintenance, compared to regular phones - simply bogus. And, yes, it /is/ possible to wire analog, ISDN and ethernet over the same wire infrastructure. ;-) Repost this mail to NANOG if you think it's of interest to the other NANOG folks. Regards, /k" Again thanks to all who responded. I hope this digest is of use to the communuity at large. I also hope that I have been fair to all parties. Regards Chris

1 0

Independent Technical Review Panel
by Michael.Dillon＠radianz.com 24 Sep '03

24 Sep '03

In this letter: http://www.icann.org/correspondence/lewis-to-twomey-21sep03.htm Verisign CEO, Paul Twomey, makes the following claim: We have also formed an independent technical review panel to gather and analyze data for the purpose of assessing any operational impact of our wildcard implementation. The technical review panel will consist of leading experts in the field. Is he lying about this? If not, where is this panel and who is on it? --Michael Dillon

2 1

Re: Verisign Responds
by Michael.Dillon＠radianz.com 24 Sep '03

24 Sep '03

>And the usual US-centric view... >Which congress person does Demon Netherlands, T-dialin, Wanadoo >France, Tiscali etc. go to? In the Netherlands, Germany, France, Italy and other countries people generally know who to go to to raise an issue with their governments. In some cases there is a direct equivalent of "your" elected representative unless the country uses proportional voting. In all cases, the ISP can contact their favorite political party and ask for advice and support in raising a complaint to the U.S. government who indirectly regulate Verisign through the Department of Commerce involvement in ICANN and IANA. It is especially important for ISPs outside the U.S.A. to also issue press releases to go along with their petition for government action because the publicity from the press release will often accomplish more than the petition itself. The goal should be to get your country's government to officially protest the U.S. government's support for Verisign's action in destabilising the Internet. When the number of protests reaches critical mass and are widespread enough, then the Department of Commerce will be forced to act. The failure of the DOC to act before this point forms an indirect support of Verisign's action by the U.S. government. --Michael Dillon

1 0

Re: monkeys.dom UPL being DDOSed to death
by Dr. Jeffrey Race 24 Sep '03

24 Sep '03

On Tue, 23 Sep 2003 16:32:55 -0500, Jack Bates wrote: >Question: Why is it not illegal for an ISP to allow a known vulnerable >host to stay connected and not even bother contacting the owner? There >are civil remedies that can be sought but no criminal. Various theories of criminal liability could certainly be applied e.g. attractive nuisance (like leaving an unfenced swimming pool for children to drown in). However this kind of very plausible action would take an aggressive public prosecutor with a good computer forensic staff and a seriously injured victim. Since the public prosecutors can hardly handle the criminals at MCI, Enron, the leading finance firms, we may have to wait a while. Jeffrey Race

1 0

Re: Verisign Responds
by Paul Vixie 24 Sep '03

24 Sep '03

> ... > We recommend that any and all TLDs which use wildcards in a manner > inconsistent with this guideline remove such wildcards at the earliest > opportunity." > > What else does the IETF need to do here? issue an rfc. iab is not a representative body, and their opinions are not "refereed."

5 5

Re: New CA Law
by Joe St Sauver 24 Sep '03

24 Sep '03

Hi Leo, #Word is Gray Davis signed this law, #http://info.sen.ca.gov/pub/bill/sen/sb_0151-0200/ #sb_186_bill_20030911_enrolled.html today. It seems to be a pretty #strong anti-spam bill. Given all the talk of black lists and DDOS's #and the like does anyone think this will make a difference? Is #anyone planning on using the law to recover damages? Likewise, Oregon passed (and our Governor signed) SB910 http://www.leg.state.or.us/03reg/measures/sb0900.dir/sb0910.en.html which includes a right of private action with $500 per spam penalties [in the case of spam which "Misrepresents or hinders a person from determining the point of origin or transmission path of the electronic mail message"] among other nice provisions. "Electronic mail service providers" also acquire new rights of action, and some interesting immunities. All that's needed now is litigation support software that can ingest spam submissions, aggregate and summarize appropriately, do automated whois lookups and deobfuscation, and produce digestified ready-to-litigate spam packages for interested attorneys. Regards, Joe

1 0

[Fwd: monkeys.dom UPL DNSBL being DDOSed to death]
by Matthew Sullivan 23 Sep '03

23 Sep '03

Forwarded for your information. That leave 2 proxy DNSbls left - SORBS and DSBL... Looking at the stats for SORBS over at SDSC looks like SORBS is pretty ineffective thanks to the DDoS: (see: http://www.sdsc.edu/~jeff/spam/cbc.html) -------- Original Message -------- From: Jon R. Kibler <Jon.Kibler.multi(a)ng.aset.com> Newsgroups: news.admin.net-abuse.email Subject: monkeys.dom UPL DNSBL being DDOSed to death Date: Tue, 23 Sep 2003 14:26:47 -0400 Greetings to all: I have some really sad news. I just got off the telephone with Ron Guilmette who runs the monkeys.com Unsecured Proxies List DNSBL. I hate to say it, but monkeys.com has been killed. It has been DDOSed to death. Ron says that every aspect of his network is undergoing a massive DDOS attack from thousands of IPs -- apparently many/all spoofed. He has tried to get law enforcement to investigate, but to no avail. He indicated that this is probably the end of his service. This makes two DNSBLs that have been DDOSed to death recently. Which one is next? NJABL? ORDB? The computer security industry really needs to figure out how to get law enforcement to take these attacks seriously. It would only take a few good prosecutions to put an end to these types of attacks. Any thoughts/suggestions? This is really a dark day for those of us fighting spam. It looks like the spammers have won a BIG battle. The only question now is who will be the causality in this war? Jon R. Kibler A.S.E.T., Inc. Charleston, SC USA

3 3

Foundry BigIron series
by william+nanog＠hq.dreamhost.com 23 Sep '03

23 Sep '03

We're considering switching to Foundry BigIrons (probably the 4000, as opposed to Cisco 6500 series switches. We're currently using 7206VXRs). Anyone have opinions (on or off list) on this product? Looking through the archives, I don't notice any discussions of this since about 2001 [1]. (http://www.foundrynet.com/products/l3backbone/bigiron/BigIronx00Datasheet.h…) I'm mostly interested in its BGP implementation, as the boxes would be handling our core routing via BGP. (I haven't noticed anyone complaining about BGP problems in the past year or so); also opinions on the CLI would be helpful (I'm told it's 95% identical to IOS's CLI). The CLI was another complaint in the thread cited below, so I'm curious if it has improved since 2001. I'd be interested in hearing about the comparable Riverstone boxes as well. [1] thread starting at http://www.merit.edu/mail.archives/nanog/2002-09/msg00050.html -- "Since when is skepticism un-American? Dissent's not treason but they talk like it's the same..." (Sleater-Kinney - "Combat Rock")

1 2

Follow up to: [Fwd: monkeys.dom UPL DNSBL being DDOSed to death]
by Matthew Sullivan 23 Sep '03

23 Sep '03

Hi all, Sorry people I had forgotten about EasyNet.nl's proxy list (Wirehub).... and for the record for a proxy spam blocker I don't rate the opm. Yours Matthew

1 0