- NANOG - lists.nanog.org

Re: If you have nothing to hide
by bdragon＠gweep.net 06 Aug '02

06 Aug '02

> Thus spake <bdragon(a)gweep.net> > > <snip> > > > our packets. While I'm certainly in favor of anything edge providers can > > > do to eliminate denial of service attacks based on source-routing, > > > I certainly don't want anything further. > > <snip> > > > > denial of service based upon source routing? I hadn't heard of any denial > > of service attacks of that sort. > > > > Disabling source-routing is like filtering icmp, sure you might block > > a few abuses, but more often than not, you are throwing out legitimate > > traffic. > > I can't come up with any legitimate reason to use source-routed packets today. > If your routers even support them, they probably consume orders of magnitude > more processing power than normal packets; that is enough reason to disable > source-routing, not to mention the security implications. > > S Validation of routing policy to ensure others aren't abusing you (pointing default, for example). As for orders of magnitude, once an IP option is in a packet, the damage is essentially done, otherwise looking up the path to an address in the options is no more impactive than looking up the address in the original destination field. source-routing only has security implications to those with defenses which permit traffic through some type of backdoor. The backdoor has more security implications than the source-routing, since it may be compromised in other manners.

2 3

Re[4]: If you have nothing to hide
by Richard Welty 05 Aug '02

05 Aug '02

On Mon, 5 Aug 2002 17:10:50 -0400 (EDT) John Fraizer <nanog(a)Overkill.EnterZone.Net> wrote: > On Mon, 5 Aug 2002, Richard Welty wrote: > haven't you ever heard of smurf? > I wasn't aware the SMURF used source-routing. It generally simply > spoofed > the source address of the packet. If more ISPs properly filtered on the > customer edge back then, SMURF wouldn't have been as deadly as it > was/(is). my mistake. when smurf was first explained to me lo those many years ago, the person who explained it (and it's been so long i don't even remember who that was) claimed it used source routing. i never really questioned that, but everyone who has corrected me is right -- it doesn't need source routing to work. oops, richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Unix, Linux, IP Network Engineering, Security

1 0

Re: If you have nothing to hide
by bdragon＠gweep.net 05 Aug '02

05 Aug '02

> > > "You know, there's quite a difference between source routing and > IP spoofing .." > > > > As true as this statement is, the two walk hand in hand (especially during > certain attacks). > > If I send an attack from a spoofed address to a victim, I can turn blue in > the face waiting for a response that will never come. > If I spoof an address and use loose source routing I can force the response > to return right through my network. I was not aware that responses to source-routed packets were themselves source-routed. I also don't believe it is the case, but am open to being contradicted. If the responses aren't source-routed, then the packets would only return through your network if your network was the path back to the spoofed source. > Also loose source routing can be used for Man-in-the-middle attacks by using > a loose source route you can force all traffic to pass through the attackers > network. You could make the outbound traffic pass through a secondary target, but with software-processing of ip options, your goodput of dos payload may go way down. You are more likely to take down something closer to yourself and self-limit the attack. > Strict source routing does not benefit an attacker, but as I said loose > source routing does.

1 0

Re: If you have nothing to hide
by Dave Crocker 05 Aug '02

05 Aug '02

At 06:31 AM 8/4/2002 -0400, Sean Donelan wrote: >I encourage network operators (or IX operators, DNS operators, etc) to let >the government know what you think. Mr. Clarke's crew is writing the >plan, and taking input from many sources. If you think RPF (or some other >source address validation) is a solution let them know. If you think >S-BGP is a solution, let them know. If you think network operator managed >firewalls on every DSL/Cable modem is a solution, let them know. On the >other hand, if to think some of those things are not a solution (or a >really bad idea), tell them that. These are technical operations matters. Seems like there might be some benefit in formulating consensus views within the technical operations community. Any chance that an IETF BCP would be possible and helpful? Diverse input to a government process can be good for learning about choices, but consensus views should be helpful for making them. d ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

3 2

Re: Re[2]: If you have nothing to hide
by Miquel van Smoorenburg 05 Aug '02

05 Aug '02

In article <cistron.E17bkHu-0005Mi-00(a)skipper.averillpark.net>, Richard Welty <rwelty(a)averillpark.net> wrote: >On Mon, 5 Aug 2002 12:00:20 -0400 (EDT) bdragon(a)gweep.net wrote: >> I understood what you were saying, I just was not aware of any attacks >> which used source routing. > >umm, haven't you ever heard of smurf? You know, there's quite a difference between source routing and IP spoofing .. Mike.

1 0

Verizon experiencing routing issues?
by Darrell Carley 05 Aug '02

05 Aug '02

Is anyone aware of Verizon having any routing issues at this time? 13 20 ms 20 ms 20 ms A9-0-632.G-GSR1.MAD.verizon-gni.net [130.81.5.94] 14 20 ms 20 ms 20 ms P3-1-0.G-RTR1.MAD.verizon-gni.net [141.150.0.102] 15 24 ms 24 ms 24 ms 141.150.8.210 16 28 ms 23 ms 23 ms S9-0-0-17.G-RTR1.MAD.verizon-gni.net [141.150.8.209] 17 34 ms 27 ms 27 ms 141.150.8.210 18 26 ms 27 ms 26 ms S9-0-0-17.G-RTR1.MAD.verizon-gni.net [141.150.8.209] 19 30 ms 30 ms 30 ms 141.150.8.210 20 30 ms 30 ms 30 ms S9-0-0-17.G-RTR1.MAD.verizon-gni.net [141.150.8.209] 21 34 ms 33 ms 34 ms 141.150.8.210 22 33 ms 33 ms 33 ms S9-0-0-17.G-RTR1.MAD.verizon-gni.net [141.150.8.209] -- Darrell Carley National Data Centers Network Engineer

5 5

C&W Direction
by James Ferris 05 Aug '02

05 Aug '02

Has anyone heard what is going to happen with Cable and Wireless' services? I have service both IP and dedicated voice through C&W and it was my understanding that they were going to divest the voice portion and maintain/grow their IP related business. I cannot get a definitive answer from anyone over at C&W as to when I need to move my dedicated voice traffic to another carrier. I still have six months left on my contract but I'd like to do it as soon as possible just to make sure I'm covered - as well as my job. Is anyone going through this same scenario?

1 0

Re: NSPs filter?
by sal_sabella＠hushmail.com 05 Aug '02

05 Aug '02

Stephen Stuart wrote: > Let's say the customer operates some big enterprise network, runs > their infrastructure in RFC1918 space ("for security," hah) Like Abovenet's OOB right? Communicate in total privacy. Get your free encrypted email at https://www.hushmail.com/?l=2 Looking for a good deal on a domain name? http://www.hush.com/partners/offers.cgi?id=domainpeople

2 1

Contacting Richard Clarke, Special Advisor to the President for Cyberspace Security
by Sean Donelan 05 Aug '02

05 Aug '02

Mr. Richard Clarke Special Advisor to the President for Cyberspace Security The White House 1600 Pennsylvania Ave Washington DC 20500 202-456-1414 http://www.mccullagh.org/image/d30-18/richard-clarke-office-of-cyberspace-s…

1 0

If you have nothing to hide
by Sean Donelan 04 Aug '02

04 Aug '02

Mr. Clarke has been floating several trail ballons this week. http://news.com.com/2100-1001-947409.html "Software makers and Internet service providers must share the blame for the nation's vulnerable networks, President Bush's special adviser on cyberspace security said Wednesday." http://www.computerworld.com/mobiletopics/mobile/story/0,10801,73150,00.html "Why is it that companies have sold products that they know are insecure?" asked Richard Clarke, President Bush's chief cybersecurity adviser. "And why is it that people have bought them? We should all shut [wireless LANs] off until the technology gets better." While Mr. Clarke was identifying groups to blame for the current state of affairs, he seems to have left out the group which has historically blocked many security improvements. Gee, it seems like just last year the US Government had a policy of futzing with international standards development to block strong security (GSM), engaging in expensive legal investigations of people who wrote things like Pretty Good Privacy, prohibiting companies from exporting products with strong encryption, and generally making it a PITA for companies who wanted to make products which were more secure (forcing security research offshore or to Canada). Even attempts to include default encryption in IPv6 hit government policy roadblocks. Anyone who tried to make it more difficult to intercept communications was accused of helping child pornographers, criminals, terrorists and hackers. The refrain was if you have nothing to hide, ... It took decades of government policy to reach this point. Does Mr. Clarke's statement signal the end of the government's policy of maintaining the status quo? If we secure wireless communications, that means it will be possible for people to communicate without worrying (excesively) about evesdroppers. But that security improvement also means the government may not be able to listen in on those communications either. Has the FBI and NSA signed off on this apparent new policy of securing our networks? Finally, what role should network operators play in determining what content subscribers can have access, including "unsafe" content? "ISPs to step up Internet service providers also have to be more security conscious, Clarke said. By selling broadband connectivity to home users without making security a priority, telecommunications companies, cable providers and ISPs have not only opened the nation's homes to attack, but also created a host of computers with fast connections that have hardly any security." Public network operators are very security conscious, about the public network operators network. Should public network operators do things, common in private corporate networks, such as block access to Hotmail, Instant Messenger, Peer-to-peer file sharing, and other potentially risky activities? Should it be official government policy for public network operators to prohibit customers from running their own servers by blocking access with firewalls?

2 2