- NANOG - lists.nanog.org

RE: root zone file
by Matt Zito 26 Apr '02

26 Apr '02

I really don't want to start any discussions about the relative merits of the ICANN vs. ORSC vs. New.net vs. anything root zones, but I feel like I need to mention that the main zones on this page are for the ORSC root servers, not the ICANN ones. The ICANN zone file at the bottom is the hints file, not the root zone. Thanks, Matt > -----Original Message----- > From: William Warren [mailto:hescominsoon@faithwalk.org] > Sent: Friday, April 26, 2002 5:20 PM > To: Curtis Maurand; nanog > Subject: Re: root zone file > > > > Hope this helps > http://www.superroot.net/downloads.html > > Curtis Maurand wrote: > > > > >Anyone know where I can obtain the latest and greatest? I just tried > >ftp.icann.org to no avail (host not found.) which is where I > used to get > >them. > >Thanks in advance > >Curtis > > > > > > > >

1 0

RE: [ISN] Hackers exploit Korea to attack global systems
by Rowland, Alan D 26 Apr '02

26 Apr '02

Anybody ever do a study that compares exploited systems percentages to pirated software percentages? -Al Rowland -----Original Message----- From: blitz [mailto:blitz@macronet.net] Sent: Friday, April 26, 2002 2:20 PM To: nanog(a)trapdoor.merit.edu Subject: Fwd: [ISN] Hackers exploit Korea to attack global systems Hmm speaking of the Asian rim: >http://www.koreaherald.co.kr/SITE/data/html_dir/2002/04/26/200204260031.asp > >By Yang Sung-jin Staff reporter >2002.04.26 > >Hackers are increasingly using South Korea as an entry point to attack >computer systems in other countries, a serious situation that could >undermine the country's image ahead of the World Cup finals, experts >and industry sources said yesterday. > >Major international studies show that a large percentage of computer >attacks can be traced to Korea, suggesting that the country's cyber >security system needs an urgent upgrade or overhaul. > >According to New York-based Predictive Systems Inc., Pacific Rim >countries were involved in 91 percent of attacks that weren't traced >to the U.S., which continued to be the leading source of attacks and >target for them. Korea accounted for 34 percent, followed by 29 >percent for China, 10 percent for Japan and 7 percent for Taiwan. > >The National Policy Agency's Cyber Center said the number of hacking >incidents is rising steadily with the World Cup just around the >corner. > >Some foreign servers block access attempts whose origins are traced to >Korea, implying that the country's leadership in the broadband >Internet business may be marred by its negligence in upgrading lame >security protection systems, the center said. > >The center, in charge of cracking down on cyber crime and hacker >attacks, estimated that 22 international hackers broke into 11,222 >server systems around the world between August last year and March >this year. Of 6,287 sites with identifiable origins, 39 percent were >traced to Korea, the center said. > >It said about 4,376 systems in Korea have been the targets of hacking >attempts during the period and the actual damage might have affected >more than 40,000 systems nationwide. > >The police cyber center said Korea was most vulnerable to hacker >attacks, followed by the United States, China, Taiwan, Romania and >India. > >The victims ranged from a major Internet portals to state-run research >agencies to security solutions providers. > >Even a government organization armed with the latest security >solutions was a victim of an attack by sophisticated foreign hackers, >police said. > >According to the center, the average number of hacking incidents in >the year to March was 614, up 20.2 percent from the year-earlier >period. More importantly, a large number of victims did not know their >systems had been attacked. > >Police said its cyber team is chasing 22 suspects whose origins are >outside of Korea in connection with the latest hacking incidents. >Police are tracking hackers' IP (Internet Protocol) addresses and >working with investigators in other countries. > >Police said 18 of the 22 suspects are Romanian and others come from >Australia, Brazil, Germany and Russia. > >"Schools have turned out to be most vulnerable to hackers' attacks >since they care little about their network security and international >hackers are exploiting such school systems," the Cyber Center said. > >Hackers use a variety of techniques to hop from one computer to >another to disguise their location, making it hard for investigators >to trace the criminal activities. > >The reason for the frequent attacks on Korean systems is the country's >fast-growing broadband network. More than half of the nation's >households are now wired to the high-speed Internet network and tens >of thousands of local PC salons are crowded with multi-user network >game users and online stock traders. > >Although the broadband network has advanced by leaps and bounds, Korea >is required to strengthen its security level by adopting advanced >software and solutions to block hacking attempts.

1 0

RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S.
by Rowland, Alan D 26 Apr '02

26 Apr '02

No. What's hard to believe is that anyone would find that surprising/newsworthy. My last post on this OT subject. Really. I promise... -Al -----Original Message----- From: Deepak Jain [mailto:deepak@ai.net] Sent: Thursday, April 25, 2002 3:02 PM To: Steve Goldstein; Rowland, Alan D Cc: nanog(a)merit.edu Subject: RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S. Is it really hard to believe that the Chinese government would actively fund cyberterrorism? Deepak Jain AiNET -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Steve Goldstein Sent: Thursday, April 25, 2002 5:55 PM To: Rowland, Alan D Cc: nanog(a)merit.edu Subject: RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S. Gosh, oh golly-gee, do you really think that they would do something like that (planting a story)? ;-) --Steve At 7:16 AM -0700 4/25/02, Rowland, Alan D wrote: > >Someone in the CIA is looking for funding... > >Just my 2¢. > >-Al --

2 1

Further UUNet problems
by mscramer＠armstrong.com 26 Apr '02

26 Apr '02

UUNet is reporting a problematic OC12 in New York affecting multiple clients, with no ETR. Matt -- Matthew S. Cramer <mscramer(a)armstrong.com> Office: 717-396-5032 Lead Security Analyst Fax: 717-396-5590 Armstrong Information Technology Services Pager: 717-305-3915 Armstrong World Industries, Inc. Cell: 717-917-7099

1 0

RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S.
by Eric Germann 26 Apr '02

26 Apr '02

So you are suggesting going to http://ftp.apnic.net/stats/apnic/apnic-2002-04-01 (for example) and pulling out all ASN's from CN|HK|KR|MO and then going after them? > -----Original Message----- > From: Rouland, Chris (ISSAtlanta) [mailto:CRouland@iss.net] > Sent: Friday, April 26, 2002 3:14 PM > To: 'Chad Oleary'; Eric Germann > Cc: deepak(a)ai.net; nanog(a)merit.edu > Subject: RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S. > > > That isn't very concise - I think you need to look at ASNs and BGP to make > sure netblocks aren't licensed cross-nation-state. IE New > Zealand uses some > KR netblocks, and if you go by an APNIC query you may cut-off some Kiwi's. > > -----Original Message----- > From: Chad Oleary [mailto:col@pobox.com] > Sent: Friday, April 26, 2002 3:15 PM > To: Eric Germann > Cc: deepak(a)ai.net; nanog(a)merit.edu > Subject: RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S. > > > This message uses a character set that is not supported by the Internet > Service. To view the original message content, open the > attached message. > If the text doesn't display correctly, save the attachment to > disk, and then > open it using a viewer that can display the original character set. >

1 0

KR assignments
by Peter Salus 26 Apr '02

26 Apr '02

If you go to //ftp.arin.net/pub/stats, you can pick up all three RIRs. Then grep for KR in APNIC. Voila! Peter

1 0

RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S.
by Deepak Jain 26 Apr '02

26 Apr '02

I'm happy to take the blame for the real problem. Exactly what am I taking the blame for? Deepak Jain AiNET -----Original Message----- From: todd glassey [mailto:todd.glassey@worldnet.att.net] Sent: Friday, April 26, 2002 9:43 AM To: Joel Jaeggli; Deepak Jain Cc: blitz; nanog(a)trapdoor.merit.edu Subject: Re: CIA Warns of Chinese Plans for Cyber-Attacks on U.S. SNIP- > > > We're off-topic, but I'd say that cyberterrorismis far less expensive to > > create than invasion or nuclear weapons. And they are much easier to stop. Just turn off the routers such that China is its own sealed-in infrastructure. But if its China's money you are after then you will have to build something akin to a "demarcation gateway" between China and the rest of the world and then who cares what is done inside China. Or you will ultimately be held liable for your custiomer's attacks against the rest of the world... You operators still dont seem to get that YOU are the real problem here. Todd Glassey > > > > Deepak Jain > > AiNET > > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > > blitz > > Sent: Thursday, April 25, 2002 6:33 PM > > To: nanog(a)trapdoor.merit.edu > > Subject: RE: CIA Warns of Chinese Plans for Cyber-Attacks on U.S. > > > > > > > > I put nothing past them, of course theyre not alone, as we all must assume > > by now. > > Theyve threatened to nuke LA if we interfere with their plans to take > > Tiawan by force, and smile and say, kill 300 million of us, do us a favor. > > Kinda hard to deal with an enemy like that. > > > > At 18:01 4/25/02 -0400, you wrote: > > > > > > >Is it really hard to believe that the Chinese government would actively > > fund > > >cyberterrorism? > > > > > >Deepak Jain > > >AiNET > > > > > > > > -- > -------------------------------------------------------------------------- > Joel Jaeggli Academic User Services joelja(a)darkwing.uoregon.edu > -- PGP Key Fingerprint: 1DE9 8FCA 51FB 4195 B42A 9C32 A30D 121E -- > In Dr. Johnson's famous dictionary patriotism is defined as the last > resort of the scoundrel. With all due respect to an enlightened but > inferior lexicographer I beg to submit that it is the first. > -- Ambrose Bierce, "The Devil's Dictionary" > > >

3 2

Google doing regional preferencing on results?
by Avleen Vig 26 Apr '02

26 Apr '02

Slightly off topic, maybe. It could certainly have an impact on Admins/Engs trying to gather data to fix a problem. Google is probably (imo) the most popular search engine (including things like being used by yahoo). Today I noticed it doing something rather strange.. it gives you different results depending on where in the world you search from. I've not seen this documented anywhere or heard of it before. If this was a known fact please feel free to shoot me out of the waters :) Example: Search for "Michael Coppins" (a friend of mine). If you search from a box in the UK, you get 'Michael Coppin's CV' (his resume). If you search from a box in any other country, you don't get it at all! Hmmm what's going on here? I certainly didn't go to www.google.co.uk to search. Even going to www.google.co.uk and searching for it doesn't bring up that link! Ok, so this isn't the North American Google Operator's Group, but still.. couldn't this potentially cause problems for everyone, especially us poor SA's trying to find the answers to problems. Has nayone else seen this 'google effect' ? -- Avleen Vig Work Time: Unix Systems Administrator Play Time: Network Security Officer Smurf Amplifier Finding Executive: http://www.ircnetops.org/smurf

2 1

Cable & Wireless outage NYC 11:00 AM EDT
by Christopher X. Candreva 26 Apr '02

26 Apr '02

This was going to be a question, but now it's a statement. C&W had an outage in NYC around 11:00 AM this morning. 11:40 EDT and things seem to be comming back. C&W NOC was returning busy for about 10 minutes, then I was on hold for 1/2 hour, and they picked up just as traffic started flowing again. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 0

Odd UUNET BGP announcements for interior netblocks
by David G. Andersen 26 Apr '02

26 Apr '02

We periodically see UUNET suddenly leak large numbers of what I can only assume are interior routes, to quite a few peers, and then rapidly withdraw them: +---------------------+------+-------------------+------+--------+ | time | type | prefix | mask | aspath | +---------------------+------+-------------------+------+--------+ | 2002-04-24 03:20:50 | A | 208.254.255.0 | 24 | 1 701 | | 2002-04-24 03:22:14 | A | 208.254.255.0 | 24 | 1 701 | | 2002-04-24 03:22:36 | W | 208.254.255.0 | 24 | NULL | +---------------------+------+-------------------+------+--------+ ... now you see it, now you don't. A check with routeviews shows that we're not the only one seeing such things. For instance, from AT&T's perspective: +---------------------+--------+------+---------------+------+----------+ | time | src_as | type | prefix | mask | aspath | +---------------------+--------+------+---------------+------+----------+ | 2002-04-24 03:20:39 | 7018 | A | 208.254.255.0 | 24 | 7018 701 | | 2002-04-24 03:21:06 | 7018 | A | 208.254.255.0 | 24 | 7018 701 | | 2002-04-24 03:22:05 | 7018 | A | 208.254.255.0 | 24 | 7018 701 | | 2002-04-24 03:22:35 | 7018 | W | 208.254.255.0 | 24 | NULL | +---------------------+--------+------+---------------+------+----------+ These seem to happen about once a month or so, typically at odd hours. Is this a goof up, or some strange leakage during filter reconfiguration? Anyone from UUNET care to clue me in? Thanks, -Dave -- work: dga(a)lcs.mit.edu me: dga(a)pobox.com MIT Laboratory for Computer Science http://www.angio.net/

2 1