- NANOG - lists.nanog.org

RE: Anyone seen this?
by blitz 15 Jan '03

15 Jan '03

Thanks Arjen, Glad to see that...the most disturbing part here, is the creation of a DDos network. When I read that, I could clearly see conflict with computer intrusion statutes. At 14:36 1/15/03 +1300, you wrote: >Hoax. See www.e-secure-it.us Global security News > >A hoax message posted to two security mailing lists Monday suggests that the >Recording Industry Association of America has hired a group of hackers who >have developed a worm capable of infecting and shutting down peer-to-peer >file-sharing software. The hackers claim to have released the worm, on the >RIAA's orders, and that it now controls almost 95 percent of "all P2P >participating hosts." The RIAA said the message was a total fabrication. >"It's a complete hoax," said an RIAA spokesman in Washington. "Someone >forwarded the message to us and that was the first we heard or read about >it." The outlandish claims are part of a "security advisory" supposedly >written by a group called Gobbles Security. However, the message bears >little resemblance to the group's other advisories and also seems to make >fun of Gobbles' habit of posting vulnerability information and exploits >without notifying affected vendors in advance. > >Cheers, >Arjen >New Zealand > > > >-----Original Message----- >From: blitz [mailto:blitz@macronet.net] >Sent: Wednesday, 15 January 2003 2:17 p.m. >To: nanog(a)merit.edu >Subject: FYI: Anyone seen this? > > > > From ISN: > > > > > >http://www.theregister.co.uk/content/6/28842.html > > > >By Andrew Orlowski in San Francisco > >Posted: 14/01/2003 > > > >The RIAA is preparing to infect MP3 files in order to audit and > >eventually disable file swapping, according to a startling claim by > >hacker group Gobbles. In a posting to the Bugtraq mailing list, > >Gobbles himself claims to have offered his code to the RIAA, creating > >a monitoring "hydra". > > > >"Several months ago, GOBBLES Security was recruited by the RIAA > >(riaa.org) to invent, create, and finally deploy the future of > >antipiracy tools. We focused on creating virii/worm hybrids to infect > >and spread over p2p nets," writes Gobbles. > > > >"Until we became RIAA contracters [sic], the best they could do was to > >passively monitor traffic. Our contributions to the RIAA have given > >them the power to actively control the majority of hosts using these > >networks." > > > >Gobbles claims that when a peer to peer host is infected, it catalogs > >media and sends the information "back to the RIAA headquarters > >(through specifically crafter requests over the p2p networks) where it > >is added to their records", and also propagates the exploit to other > >nodes. > > > >"Our software worked better than even we hoped, and current reports > >indicate that nearly 95% of all p2p-participating hosts are now > >infected with the software that we developed for the RIAA." > > > >The "hydra" is uncorroborated. > > > >Gobbles attached two pieces of code, one of which jinglebellz.c > >details a frame header exploit for the Linux player mpg123. The code > >chastises OpenBSD lead Theo de Raadt for failing to checksum the > >public MP3s (written to celebrate each OpenBSD release). The group has > >singled out OpenBSD in its previous exploits > > > >In their presentation to last year's DefCon, the group described > >itself as "the largest active nonprofit security group in existence > >(that favors full disclosure)," consisting of 17+ members. > > > >"They're real, and they're damn good. They have made what appeared to > >be extremely exaggerated claims in the past, and when mocked, they > >have demonstrated that they are serious," one security expert familiar > >with their work, who declined to be named, told The Register. > > > >"He's a funny guy," De Raadt told us. "This is a buffer overflow > >exploit," he confirmed. De Raadt said he was more concerned by social > >engineering than by external exploits. "We had Fluffy Bunny, now we > >have Gobbles. They come in waves. " > > > >An exploit of this nature is of dubious legality, right now, but > >language in Howard Berman's "P2P Piracy Prevention" bill last year > >legitimizing such exploits was backed by RIAA chief Hilary Rosen:- > > > >The Berman bill, ensured a copyright owner would not be liable for > >"disabling, interfering with, blocking, diverting, or otherwise > >impairing the unauthorized distribution, display, performance, or > >reproduction of his or her copyrighted work on a publicly accessible > >peer-to-peer file trading network, if such impairment does not, > >without authorization, alter, delete, or otherwise impair the > >integrity of any computer file or data residing on the computer of a > >file trader." Berman is expected to re-introduce the bill in this > >Congressional session.

1 0

fast ethernet limits
by Steve Rude 15 Jan '03

15 Jan '03

Hi NANOG, Could someone please help me with a fast ethernet problem I am having. We have a POP in a 27 floor building, and have a rj45 run from the the bottom of the building (in the telco room) to the top of the building. We have cisco switches on either end and we are seeing about 5-20% packet loss on the trunk. Are we running into a distance limitation of fast ethernet, or are we suffering from another problem? I read that 328 feet is the limitation of fast ethernet. Is there anything short of getting a repeater for the cable run that I can do to boost the signal? TIA for your help. Ciao. Steve Rude

23 30

Scaled Back Cybersecuruty
by sgorman1＠gmu.edu 14 Jan '03

14 Jan '03

This may be of interst: AP: Bush Expected to Sign Scaled Back Internet Security Plan Washington, DC -- A new Bush administration plan aimed at improving the security of key U.S. computer networks will not be as ambitious as previously indicated, the Associated Press reported on Tuesday. The plan is being closely watched by network security firms in the DC area. A draft of the proposal, called the National Strategy to Secure Cyberspace, obtained by the AP contains only 49 of the 86 initiatives of an earlier version, eliminating such mandates as regular consultations with privacy experts about civil liberties and a call for corporations to improve cybersecurity. Instead, it focuses on the security of federal agencies; it also makes clear that the Defense Department can engage in "cyber warfare" should the U.S. be attacked. The job of improving Internet security, however, would be handled by the new Homeland Security Department, which would launch test attacks against various agencies and seek to improve automated systems that operate water, chemical and electrical networks. Bush is expected to sign the plan in the coming weeks. http://www.washingtonpost.com/wp-dyn/articles/A18662-2003Jan6.html

4 3

Re: Scaled Back Cybersecuruty
by sgorman1＠gmu.edu 14 Jan '03

14 Jan '03

That is the rub. Kind of like targeting treatment for AIDS to those with the most sexual partners - it helps solves the problem but is it worth rewarding irresponsible behaviour. Although not the best analogy, especially since in this case the worst offenders are fortuantely not the best connected. Still think that at some point you need to deal with raising the lowest common denominator. That said it would be good to see something concrete being done like the RFP inclusions. The incentive though should be greater than what is gained by ignoring security currently. Is the government willing to provide enough incentive to change the market place? If RFP's alone can't do it what else could be tried? ----- Original Message ----- From: Avi Freedman <freedman(a)freedman.net> Date: Tuesday, January 14, 2003 9:06 pm Subject: Re: Scaled Back Cybersecuruty > > In article <103014.1607.23062(a)avi.netaxs.com> you wrote: > > : Seems to be a case of prisoners dilema. The security of any one > network: is to some extent at the mercy of all other connected > networks. The > : overall security of the network is only as strong as it's > weakest link. > : In a highly competitive market place there is going to be little > : incentive to invest in security if it will just be compromised > by your > : cost cutting competitors. > > Yes, but: > > - Shouldn't we encourage our tax $ go with preference towards good > network citizens? > > - If only a few of the larger networks started implementing better > practices that engineering groups can't get funded today, we're > still getting better off. > > - Starting at the core, which is who the Feds buy the most IP from, > still makes life a lot simpler if and when we get the "big one" > in terms of cyber-attack. > > I think this is probably better for a BOF (maybe even the security > BOF) discussion, though... > > Avi > > >

2 1

Re: Scaled Back Cybersecuruty
by Avi Freedman 14 Jan '03

14 Jan '03

In article <103014.152131.21746(a)avi.netaxs.com> Pete wrote: : I'm trying to envision an RFP that awards business to one or : a few network operators, but requires that they interoperate : effectively with other operators who don't win any of the : business. I've only got a state-level purchasing : perspective, but I don't see it happening at any level. Let me be more clear :) If the next FTS or if all large Federal IP purchases mandated one of: - Routers must be configured by end of 2003 so that all packets to the control plane must be logically separated from user packets (or demonstrate the ability to take 200mb of attack traffic to the router CPU without having an effect) OR - All single-homed customers must be source-address filtered at ingress or egress. (Becoming multi-homed at ingress as a requirement over time) OR ... You get the idea. Something that IS possible, that matters MOST at the large end of the scale. And if we go a long way towards solving one beasty per year we'll at least be making MORE progress than we've been making to date, which is roughly zero. : Pete. Thanks, Avi

3 2

Re: Scaled Back Cybersecuruty
by sgorman1＠gmu.edu 14 Jan '03

14 Jan '03

Seems to be a case of prisoners dilema. The security of any one network is to some extent at the mercy of all other connected networks. The overall security of the network is only as strong as it's weakest link. In a highly competitive market place there is going to be little incentive to invest in security if it will just be compromised by your cost cutting competitors. If this is the case then the question is what kind of intervention is necessary to prevent a prisoners dilema and allow something like a Nash Equilibrium - the bar scene in A Beautiful Mind where they fight over the hottie blonde... Basically where a set of strategies for security are arranged so that each player believes that it is doing the best it can (most personal gain) given the strategies of the other players. The current state appears to be that many providers do little to nothing to provide for security, so each player adjust their strategy accordingly resulting in the prisoners dilema. It seems to get beyond this you have to bring up the lowest common denominator so that strategy is not based on networks doing nothing. How do you get the worst offenders to improve the lowest common denominator. Purchasing requirements, subsidies, taxes, regulation??? Maybe a bunch of economic voodoo, but might be a different way of looking at the issue. ----- Original Message ----- From: Pete Kruckenberg <pete(a)kruckenberg.com> Date: Tuesday, January 14, 2003 8:16 pm Subject: Re: Scaled Back Cybersecuruty > > On 14 Jan 2003, Vijay Gill wrote: > > > Avi Freedman <freedman(a)freedman.net> writes: > > > >> Perhaps the Feds (and maybe states) could use their purchasing > power>> to effect change. Short of that, or regulation, the I > don't see how > >> the serious issues we have with the 'net will get resolved. > > > > People do. I've been beating this particular horse for a > > while now, and we are starting to deploy the capex > > hammer. I suggest others start to do the same. See my > > presentation at the eugene nanog. > > I can see how purchasing power may motivate a vendor (and > maybe lots of individual vendors) to fix their own problems, > develop better products, or be more responsive. > > I'm trying to envision an RFP that awards business to one or > a few network operators, but requires that they interoperate > effectively with other operators who don't win any of the > business. I've only got a state-level purchasing > perspective, but I don't see it happening at any level. > > Is spending really an effective hammer (or gun) to make > people work together if they aren't otherwise motivated to? > Behavior related to the '96 Telecom Act doesn't inspire > confidence. > > Can technical solutions be an effective band-aid for a > complex poli-socio-economic problem like this? > > Pete. > > >

1 0

Re: Scaled Back Cybersecuruty
by Avi Freedman 14 Jan '03

14 Jan '03

In article <103014.14855.19429(a)avi.netaxs.com> Vijay the Budget Master wrote: : Avi Freedman <freedman(a)freedman.net> writes: :> Perhaps the Feds (and maybe states) could use their purchasing power :> to effect change. Short of that, or regulation, the I don't see how :> the serious issues we have with the 'net will get resolved. :> :> I suppose that the "problem" is likely that people don't understand :> what a nice actually well-written worm could/would do if it were :> targeted at the infrastructure. : People do. I've been beating this particular horse for a while now, : and we are starting to deploy the capex hammer. I suggest others start : to do the same. See my presentation at the eugene nanog. : /vijay Many networks of sizable import have no capex budget, though - or sometimes very little if no engineering resources. They all pay attention to sales - and especially to RFIs and RFQs from the Feds, though. Avi

2 1

Re: Operating on a "war footing" (was Re: Violation of Acceptable Use Policies)
by Steven M. Bellovin 14 Jan '03

14 Jan '03

See Mapping and Visualizing the Internet. Bill Cheswick, Hal Burch, and Steve Branigan, Usenix 2000 general conference (San Diego), http://www.cheswick.com/ches/papers/mapping.ps.gz which includes some measurements of Yugoslavia's Internet sites. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Verizon QOS??
by Gerald 14 Jan '03

14 Jan '03

Does there exist a Verizon QOS group for chronic network issues? I was told there used to be a chronic issues group that would review long term problems and facilitate long term solutions. I am seeing new lows in quality of service from Verizon for one of our customers, and the few people I have been able to talk to claim ignorance/inability to permanently resolve the problem. Any help or suggestions is appreciated. I'd prefer not to go into this particular network issue on the list in the interest of our customer. Gerald

1 0

CWDM Optical Mux
by Alex Rubenstein 14 Jan '03

14 Jan '03

Hi. It's me again, on my eternally quest for information. This time, it's about CWDM Muxes. Assume that I have a Cisco CMUX system (dark out the back, handing off CWDM waves in the front). Who knows of a small, easy, cheap system that can take a CWDM wavelength in, and mux a few oc12's onto it? Perhaps oc48-cwdm out the back? -- Alex Rubenstein, AR97, K2AHR, alex(a)nac.net, latency, Al Reuben -- -- Net Access Corporation, 800-NET-ME-36, http://www.nac.net --

1 0