- NANOG - lists.nanog.org

'we should all be uncomfortable with the extent to which luck..'
by k claffy 25 Jul '01

25 Jul '01

david moore's analysis of code red: episode 0/1 is at http://www.caida.org/analysis/security/code-red/ [funded by DARPA's ITO office NGI/NMS programs, NSF ANIR, and CAIDA members, david a caida PI] definitely check out jeff brown's animation at bottom; watch carefully around 15:00 for pretty ominous elbow in infection rate (get an epidemiologist to look at it without telling them what it is...) 360,000 machines (well, IP addresses) infected in under 14 hours. from conclusion: // ..in the final analysis, we should all be uncomfortable with the extent to which luck, rather than proactive diligence, maintains the stability of the Internet infrastructure. // it goes without saying that many hosts are still vulnerable. and will likely remain so (to this or the next poison) until our luck runs out. do we expect the next version to have the two weaknesses christopher pointed out today? do we expect the next version won't clear every 3rd bit on the hard drive? almost makes me wonder if some white hat might (should?) have been behind CodeRed as some 'vaccination' attempt. "The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure," said Rasch. The good news is, there will be a global catastrophic failure." -- http://www.nando.net/technology/story/44887p-694372c.html the worse news is: protecting 'critical infrastructure' is far from enough. again from http://www.caida.org/analysis/security/code-red/ This assault also demonstrates that machines operated by home users or small businesses (hosts less likely to be maintained by a professional sysadmin) are integral to the robustness of the global Internet. As is the case with biologically active pathogens, vulnerable hosts can and do put everyone at risk, regardless of the significance of their role in the population. fwiw, caida trying to do gentle survey of patching speed, see http://worm-security-survey.caida.org/ k ps: john maddog hall (linux int'l) had a great slide a few months ago at UCSD talk; upshot something like INSTALLED BASE (EARTH) + 20 million linux systems + 450 million gates licenses ==> 4.4 - 6.6 % of the population total ... world population: ~6B ==> 5.4 billion people haven't selected an OS yet [k: maybe we can get them on OS-antioxidants before it's too late]

11 11

RE: product liability (was 'we should all be uncomfortable with t he extent to which luck..')
by Roeland Meyer 25 Jul '01

25 Jul '01

> -----Original Message----- > From: William Allen Simpson [mailto:wsimpson@greendragon.com] > Sent: Wednesday, July 25, 2001 7:04 AM > To: nanog(a)nanog.org > Subject: Re: product liability (was 'we should all be > uncomfortable with > the extent to which luck..') > > > > Roeland Meyer wrote: > > > > > From: William Allen Simpson [mailto:wsimpson@greendragon.com] > > > A check in the mail would be a better incentive to > > > administrators than "automatic" updates. > > > > Now *there's* a thought. However, all software companies > carry product > > liability insurance. It's sometimes called a shrink-wrap > license. You might > > actually try reading it the next time you purchase and > install software. > > I'm not a party to the EULA. > > For the sake of argument, ISPs are the party that the SUV hit when it > rolled over after the tires exploded.... > > (actually, because of our proactive action and filtering, we had > exactly zero customers that were still infected by Jul 20th. But we > had to spend the manpower and technical support -- that's worth > something!) > > Also, you may have noticed that shrink-wrap licenses are > valid in only > two places: Washington (state) and Virginia. This would be a Federal > class action. Please, do not confuse "governing law" and "jurisdiction" with applicability. With most commercial software, you don't own it. The actual owners retain full ownership rights. That makes a huge legal difference. BTW, MHSC shrink-wrap, and all other MHSC contracts, are under Delaware law, with alternative jurisdiction in Colorado, and neither of the other two jurisdictions that you mention. It has to do with where the corporate home is. Further, lawyers make big bucks arguing "comparative negligence". None of us gets paid well enough to do so here. FWIW, almost all commercial software developers carry "Errors and Omissions" coverage, as a second-level backup to the lawyers. That said and in most jurisdictions, the driver has primary responsibility. This is due to the fact that the driver has primary responsibility for maintenance and application. This is the primary reason for the "fitness of purpose" clause. > Joe Shaw wrote: > > > > And with this latest threat of code red, Microsoft would > have been covered > > anyway, because a patch for this exploit existed well > before CodeRed hit. > > They released a patch for the indexing server on June 18, > 2001, which as > Actually, although the patch was released, M$ lied, saying it > was only > needed by web servers. We have since learned that *ALL* W2K and XP > systems were vulnerable. Fraud and misrepresentation? Since ALL Win2K and XP packages contain IIS, where did they even mislead? > > human somewhere wrote some bad code. It happens, and > continues to happen > > on a daily basis. > > It's long past time that humans were held accountable. Now, there is something that I can agree with. Let's hunt down the script kiddie and their bunk-daddy (who wrote Code Red) and start hacking off appropriate appendages. I'll be glad to sharpen the knives. > Funny, the engine electronics in my car doesn't seem to be vulnerable > to these failures.... Maybe it's the extensive (years) of > testing and code review? > > Why should I have to pay for the desire of M$ to be "first to > market", or more usually, "last to market but cheaper". > > There is no other industry where such bad practices would be > acceptable. It shouldn't be in ours, either! Have you ever done a function-point analysis, or path permutations analysis on your average GUI program? The simplest GUI is vastly more complex than the engine monitoring computer in your car. Just chasing all first-order paths would take decades. Second-order paths number in the billions. We won't go to third-order. Exhaustive testing is not even dreamable. If you even have a QA department available, ask them. While you're at it, do you QA your web-site? > > Security requires vigilence, and there seems to be too > little of it out in > > the world. > > > Agreed. Yes.

2 1

RE: product liability (was 'we should all be uncomfortable with t he extent to which luck..')
by Roeland Meyer 25 Jul '01

25 Jul '01

> From: William Allen Simpson [mailto:wsimpson@greendragon.com] > Sent: Tuesday, July 24, 2001 11:43 PM > Perhaps a different approach is in order -- product liability. > Network operators have been injured by the distribution of > buggy software from M$. We need to be compensated for our > time and expenses. > > End users need to be compensated for their costs to upgrade. > > A check in the mail would be a better incentive to > administrators than "automatic" updates. Now *there's* a thought. However, all software companies carry product liability insurance. It's sometimes called a shrink-wrap license. You might actually try reading it the next time you purchase and install software.

5 6

RWHOISD help needed - please contct off-list
by Rich Sena 25 Jul '01

25 Jul '01

-- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

RE: 'we should all be uncomfortable with the extent to which luck ..'
by Roeland Meyer 25 Jul '01

25 Jul '01

> From: Mitch Halmu [mailto:mitch@netside.net] > Sent: Wednesday, July 25, 2001 8:30 AM > > On Tue, 24 Jul 2001, Roeland Meyer wrote: > > > How many of us here run anything less than SSH and even > allow telnetd to > > live on any of our hosts?> > > Those (few) providers offering shell accounts still do. Someone once proved to me, definitvely, how easy it is to crack root from a shell account. Especially one that is allowed to execute their own code. That night, I killed all shell accounts of users that I didn't personally know and trust. Those that were left were introduced to SSH. This was five-years ago.

1 0

Call For Papers: Peer To Peer in Higher Education Conference
by Chris Rapier 25 Jul '01

25 Jul '01

NANOG Members, I'm on the program committe for the Collaberative Computing in Higher Education conference on peer to peer technologies. This conference will immediately follow the Internet 2 Meeting this October in Austin Texas and is open to the public. At this point we are looking for paper and/or presentations on research and development be it in academia or corporate environments. The deadline for submission of an *abstract* is Friday, August 10. If your abstract is accepted you'll have plenty of time to prepare a final paper or presentation for the meeting. If you have any questions please contact me or the two committee chairs listed below. Chris Rapier Pittsburgh Supercomputing Center National Center for Network Engineering --------------------------------------------------------------------- Collaborative Computing in Higher Education: Peer-to-Peer and Beyond http://www.internet2.edu/activities/html/p2pworkshop.html Renaissance Austin Hotel, Austin, Texas. October 4, 11:30 am-5:00 pm October 5, 8:00 am-3:00 pm CALL FOR PRESENTATIONS/PAPERS The Workshop Program Committee is now accepting proposals for presentations and papers. The deadline for submission is August 10, 2001. Areas of focus for presentations/papers: - advantages of Peer-to-Peer (P2P) and distributed computing models for applications in: * teaching and learning * research and science * collaboration and business models - architectural/infrastructure issues - technnical issues and challenges in p2p applications: security, network performance, NATS and firewalls, standards, etc. - ipv6, end-to-end performance and p2p applications - exploration of potential collaborations between universities and P2P application developers: how can universities integrate and perhaps even innovate? - Policy and implications when P2P applications are used in real case scenarios. - Bandwidth issues and maximizing both commodity and Internet2 bandwidth How to Present We ask that the following be sent to both of the program chairs: Ana Preston <apreston(a)utk.edu> and Linda Roos <lroos(a)oar.net> - speaker/presenter name and affiliation, - email address and phone number, - the desired area of focus, - an abstract of no more than 200 words, and - permission to reproduce your presentation, including permission to netcast your session if it's selected for the program and for netcasting. Deadlines Submission deadline August 10, 2001 Notification by August 31, 2001. The Program Committee also welcomes suggestions/recommendations for panels, tutorials, speakers, and other presentation topics. Registration http://www.internet2.edu/activities/html/p2pworkshop-reg.html Please note that this workshop requires separate registration from the Internet2 Member Meeting. Please send your suggestions and direct your questions to Ana Preston <apreston(a)utk.edu> and Linda Roos <lroos(a)oar.net> .

1 0

Re: How many ISPs are out there?
by Marshall Eubanks 24 Jul '01

24 Jul '01

FI! The curse of cut and paste on insufficient coffee ! That link should be http://www.multicasttech.com/status/bgp.sum There is http://www.multicasttech.com/status/mbgp.sum for ASN with multicast MBGP reachability, as well. Regards Marshall Eubanks Marshall Eubanks wrote: > > > > >Is there a site that can give me that info? > > > > I must say that I do not think that this is entirely a well posed > question. What is an ISP ? Do you have to have an ASN ? Run BGP? > Support dial ups ? Have your own address blocks ? > I can think of clear ISP's that do not do have an ASN, or run BGP, or... > > At any rate, there is a list of ASN reachable from us by BGP at > /home/httpd/html/MCAST/status/bgp.sum > > There are 11313 as of this morning. > > Also, of course, Boardwatch maintains a list of US ISP's. > > Regards > Marshall Eubanks > >-- > >R O E L A N D M J M E Y E R > >Managing Director > >Morgan Hill Software Company > >t:01 925 373 3954 > >c:01 925 352 3615 > >f:01 925 373 9781 > > > > Marshall Eubanks > > tme(a)21rst-century.com -- Marshall Eubanks tme(a)21rst-century.com

1 0

RE: How many ISPs are out there?
by Roeland Meyer 24 Jul '01

24 Jul '01

That wouldn't constitute a complete answer because there are MANY local ISPs that aggregate under a regional. Also, not all regionals (yes, I've found some exceptions <Qwest?>) use BGP either. Then there is the old route pre-fixing problem. Not many ISPs, smaller than /19, are going to be doing effective ASN's either. > From: bmanning(a)vacation.karoshi.com > [mailto:bmanning@vacation.karoshi.com] > Sent: Tuesday, July 24, 2001 2:21 AM > > how many active ASN's are there? > > > > > > > > I was actually thinking along IAP (Internet Access > Provider) lines. But, > > most folks lump ISPs and IAPs in the same breath. > > > > > -----Original Message----- > > > From: Adam Rothschild [mailto:asr@latency.net] > > > Sent: Monday, July 23, 2001 11:09 PM > > > To: Roeland Meyer > > > Cc: nanog(a)merit.edu > > > Subject: Re: How many ISPs are out there? > > > > > > > > > On Mon, Jul 23, 2001 at 10:37:01PM -0700, Roeland Meyer wrote: > > > > Is there a site that can give me that info? > > > > > > When in doubt, ask Jeeves: > > > > > > <http://www.ask.com/main/askjeeves.asp?ask=How+many+ISPs+are+o > > > ut+there%3F> > > > > > > What exactly is an ISP anyways? > > > > > > -a > > > > > >

5 6

Re: How many ISPs are out there?
by Marshall Eubanks 24 Jul '01

24 Jul '01

> >Is there a site that can give me that info? > I must say that I do not think that this is entirely a well posed question. What is an ISP ? Do you have to have an ASN ? Run BGP? Support dial ups ? Have your own address blocks ? I can think of clear ISP's that do not do have an ASN, or run BGP, or... At any rate, there is a list of ASN reachable from us by BGP at /home/httpd/html/MCAST/status/bgp.sum There are 11313 as of this morning. Also, of course, Boardwatch maintains a list of US ISP's. Regards Marshall Eubanks >-- >R O E L A N D M J M E Y E R >Managing Director >Morgan Hill Software Company >t:01 925 373 3954 >c:01 925 352 3615 >f:01 925 373 9781 > Marshall Eubanks tme(a)21rst-century.com

1 0

Re: List of AS names by ASN?
by Marshall Eubanks 24 Jul '01

24 Jul '01

> >Hi, all. > >I'm trying to find a list/table of AS names by ASN, preferably >tab-delimited, that I can use in spreadsheets and scripts. (Like, e.g., the >Cidr Report) > >Can anyone give me an idea where I might find this sort of thing? ftp://rs.arin.net/netinfo/asn.txt has all of the Arin, and some of the others. I would be glad for similar lists from RIPE and APNIC. Note that this list includes some ASN blocks, and needs to be "expanded" before use in a spread sheet. I have a awk routine to do this... Regards Marshall Eubanks > >Thanks, >Jeb Linton > Marshall Eubanks tme(a)21rst-century.com

4 3