- NANOG - lists.nanog.org

Re: DoS attacks, NSPs unresponsiveness
by Hank Nussbacher 03 Nov '00

03 Nov '00

At 04:32 03/11/00 +0200, Ariel Biener wrote: >On Thu, 2 Nov 2000, dies wrote: > > > > Actually, I was thinking of taking a slightly different path. > > >1). ISPs (downstreams) responsibilities: > >1a). Active and clueful NOC. >1b). Proper implementation of Internet RFCs (private networks and > spoofing). >1c). Proper BGP filtering towards upstream. >1d). Running routing software adequate to today's challenges (for example, > something that can deal properly with small fragments...). > >2). NSPs (upstreams, tier1/2) responsibilities: > >2a). Active and clueful abuse department. >2b). Monitoring tools that will allow tracking down a stream throghout > their own backbone, and cooperation with their peers to get to the > source. With a handful of cluefull people, and a set of autmatic > tools, this IMHO is something at hand. >2c). Proper BGP filtering of their customers, to not allow their customers > to fuck-up Internet routing (Sprintlink incidents...). > > >The main idea is that downstreams make sure they are not very susceptable >to abuse. Then, if attacked, the upstream provider should cooperate in >detecting the source, by monitoring their own network, and cooperating >with it's peers. If for any reason, it takes more than X hours, the >upstream provider should try to protect it's customers. Usually, it wont, >and the attacker will be indentified, and shut down at it's source. > >There is no requirement that tier1/2 NSPs tie up their equipment into an >ACL monster. What is needed is cooperation. With proper cooperation, >identifying a stream's source is much easier that you may think. My experience trying to get tier1 ISPs in the USA to act on specific IP addresses that are attacking, has been terrible. In general it always takes a few private emails to people one may know, who work or have worked in the tier1 ISP to get any response. I have had one incident take 2 weeks recently and am now at day 4 of waiting for a technical reply from another Tier1. This one did not even provide an auto-reply from all their listed abuse and noc email addresses and only private email helped getting some sort of response. Based on solely my personal experience inside many ISPs (tier1-4), I do not find things encouraging. Most ISPs lose money. When you are losing money you can't invest in a top notch team of Internet security pros to handle the kind of problems we are all seeing. That team does not create revenue. As a matter of fact, it creates negative-revenue since the conclusion by the ISP is usually to disconnect the attacker from their service. We can write as many RFCs and BCPs as we want and discuss this item again and again - the truth is - nothing we say or do will make a difference until the government creates regulation on the matter. The same way every phone company has to run a 911 number in event of emergencies, so too must ISPs provide an abuse(a)xxxxx.net email address that not only gives an auto-reply but actually has people behind it to handle the problem. -Hank >Do you find the above so hard to do ? All it requires is some >professional attitude, and a bit more cooperation and consideration from >NSPs and ISPs as one, what happens to someone you don't know today may >happen to you tomorrow ! > > >Thoughts ? > >--Ariel > > > Well since everyone else is stating their opinions, I'll join in > > as well.First off I think pulling the plug is a great idea ( =] ). > > Anyways the point comes down to this.Who should be doing the ingress > > filtering?Tier-2's, Tier-1's, the actual customer?I know this whole > > idea sounds very pretty and nice, however, when it comes down to it there > > are many real problems with this idea.One, the hardware on most ISP's > > backbones cannot realistically do ingress filtering.I'm sorry to say but > > a GSR is not able to do ingress filtering on 5 Channelized OC-12's that > > hold 400+ Customers a piece.It just does not work, I don't care what > > Cisco claims, it just does not work.What about other vendors? I have no > > experience with Bay or Lucent, however, Juniper (which I do have > > experience with) has the ability due to the hardware based filtering > > available but that brings up a whole set of other questions.How will > > ingress filtering from an ISP level effect downstream customers that do > > asymmetrical routing?How about the management overhead that comes into > > play when you are a Tier-1 or a large Tier-2 with tens of thousands of > > customers?What is comes down to is that customers need to be doing > > egress filtering, it's the only scalable solution, however this just is > > not happening.Don't blame the ISPs only, it's their customers that are > > really the problem.Lack of security/knowledge on the customer's end > > leads to hacked boxes, which in turn lead to DoS attacks.It really comes > > down to not the responsibility of the ISP, but in fact the responsibility > > of the customers!Maybe we all should thinkg about that before we point > > fingers. > > > > > > > > On Thu, 2 Nov 2000 Valdis.Kletnieks(a)vt.edu wrote: > > > > > On Thu, 02 Nov 2000 09:59:04 EST, MarkMentovai > <mark-list(a)mentovai.com>said: > > > > This can't go on forever.I'd like to spread the clue about ingress > > > > filtering, and am willing to commit time to the cause.Is anyone > with me? > > > > > > The problem is that for many ISPs, I fear the only way to get them to > > > implement 2827-style filtering is for their upstreams to implement a > > > policy of fascist-mode ingress filtering - "We see a bogon packet that > > > your site should have filtered, we pull the plug on your link till you > > > fix it". > > > > > > Time alone won't be enough.Bring a baseball bat. And a spare bat. > > > > > > -- > > > Valdis Kletnieks > > > Operating Systems Analyst > > > Virginia Tech > > > > > > > > > > > > > > >-- >Ariel Biener >e-mail: ariel(a)post.tau.ac.il Work phone: 03-6406086 >fingerprint = 07 D1 E5 3E EF 6D E5 82 0B E9 21 D4 3C 7D 8B BC

1 0

RE: Security on a home DSL Line
by Roeland Meyer 03 Nov '00

03 Nov '00

The common answer is to install Linux/Unix/FreeBSD and build a firewall. However, I have recently been surveying the market for DSL gateways. Guess what, ALL of them include some sort of firewall capability and the LinkSys product even includes a 5-way switch ... for under $300! Then there are always Ascend/Lucent Pipeline 130's which includes a router and can gateway ISDN, IDSL, Cable, and DSL. I have a friend that hangs an entire /24 behind one of them. Setting up a host may be a fun excersize, but something that runs with the reliability of a toaster is better, in my view. With the host, you always have the tinker-factor to contend with. -----Original Message----- From: J. Gilmore [mailto:reece0011@yahoo.com] Sent: Thursday, November 02, 2000 3:38 PM To: nanog(a)merit.edu Subject: Security on a home DSL Line I'm looking to beef up security on a home DSL line. Currently I am using ZoneAlarm (the freeware version). I'm thinking of taking an old Pentium 120, and setting that up as a firewall, but wanted to know if anyone else had a better idea. __________________________________________________ Do You Yahoo!? >From homework help to love advice, Yahoo! Experts has your answer. http://experts.yahoo.com/

2 1

Re: Exodus NOC phone number?
by Sean Donelan 02 Nov '00

02 Nov '00

On Wed, 01 November 2000, "Dominic J. Eidson" wrote: > On Wed, 1 Nov 2000, Mathew Butler wrote: > > Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk > > to in this situation?): > From http://www.exodus.net/contact_us.html > Response Center: > 1.877.393.7878 > (from outside the U.S. call 1.800.13937878) ^ A one at the beginning of the NXX I'll be more specific, does this number work outside the USA. Its not a typical US 1-800 number, because it has too many digits and a "1" as the beginning of the NXX. Is it a special ITU number?

2 1

RE: Exodus NOC phone number?
by rdobbins＠netmore.net 02 Nov '00

02 Nov '00

I have an international 800-number that works pretty well, as long as the locals in any given country know how to get to it via their own phone network conventions. In the UK, for example, it's a '0800' number. In less-developed countries, though, it often isn't possible to access the number. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Sean Donelan [mailto:sean@donelan.com] Sent: Thursday, November 02, 2000 11:43 AM To: nanog(a)merit.edu Subject: Re: Exodus NOC phone number? On Wed, 01 November 2000, "Dominic J. Eidson" wrote: > On Wed, 1 Nov 2000, Mathew Butler wrote: > > Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk > > to in this situation?): > > From http://www.exodus.net/contact_us.html > Response Center: > 1.877.393.7878 > (from outside the U.S. call 1.800.13937878) Does this phone number really work from outside the US? I know the ITU was working on an international "800" number, but I haven't kept up with it.

1 0

Re: Exodus NOC phone number?
by Sean Donelan 02 Nov '00

02 Nov '00

On Wed, 01 November 2000, "Dominic J. Eidson" wrote: > On Wed, 1 Nov 2000, Mathew Butler wrote: > > Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk > > to in this situation?): > > From http://www.exodus.net/contact_us.html > Response Center: > 1.877.393.7878 > (from outside the U.S. call 1.800.13937878) Does this phone number really work from outside the US? I know the ITU was working on an international "800" number, but I haven't kept up with it.

2 1

Re: DoS attacks, NSPs unresponsiveness
by Valdis.Kletnieks＠vt.edu 02 Nov '00

02 Nov '00

On Thu, 02 Nov 2000 12:28:19 PST, Alexei Roudnev said: > Just again - what's about an attempt to creta e ISP association which - > - promise to do ingress filtering It's already an IETF BCP, all clued ISP's should be doing it already - the problem is the *unclued* ISPs, which will neither do ingress/egress filtering, nor join any ISP association.. Hint: How many of those ISPs do we hear from on NANOG? ;) > - promise to do active filtering "active filtering" in what meaning? You have to be careful here, to avoid a DOS attack by triggering active filtering... > - promise to investigate any case Would "investigate" include the form letter I send out whenever I get a complaint that one of our NTP servers is trying to hack through somebody's firewall on ports 13, 37, and 123? Our CIRT is just basically 5-6 people who do security on top of everything else. We have to perform triage - in the last week, we got the disk drive of a compromised system into an evidence bag within 3 hours or so of our first notification there was a problem. On the other hand, we most certainly do *NOT* guarantee that level of response unless it's a very high profile incident. I'm sure the situation is similar at every other site out there.... -- Valdis Kletnieks Operating Systems Analyst Virginia Tech

1 0

InterNAP?
by Tom Schmidt 02 Nov '00

02 Nov '00

I need your opinion on InterNAP. I am currently have a DS3 to my current provider and want to add an additional DS3 for redundancy to the same location. We plan to run BGP4 on both connections. InterNap has some technology to avoid congested peering points. Does this technology actually work? Isn't it impossible to avoid these peering points? What are your experiences with InterNAP? _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

6 5

Re: RADWare Linkproof? (or better ways to multihome)
by Mike Johnson 02 Nov '00

02 Nov '00

Larry Rosenman [ler(a)lerctr.org] wrote: > For the record, I've got a customer taking 2 full BGP tables with a > 3640 with 128Meg of RAM. Can anything less than a 7200 handle three (preferably four) fast ethernet interfaces? That was my sole reason for going that route as it seems to be the smallest Cisco that will provide four fast-E connections (according to Cisco docs that I may have misread). > (not sure of cost...) Well, it's certainly cheaper than a 7206... Thanks, Mike -- Mike Johnson Network Engineer / iSun Networks, Inc. Morrisville, NC All opinions are mine, not those of my employer

6 7

Exodus NOC phone number?
by Mathew Butler 02 Nov '00

02 Nov '00

Does anyone have the Exodus NOC phone number? (Or who I'm supposed to talk to in this situation?): I got a spam mail on AOL, with a link to a decimal IP (the exact link in question is: http://3626046468//nv/zawixmecwhcxejb ). After figuring out the dotted-decimal notation for it (216.33.20.4), I did a whois on arin for that. Turns out it belongs to Exodus, and there's an additional field for rwhois info. I got the rwhois info, and it shows that it belongs to WhoWhere. So I get curious, and go to the URL in question (speaking raw HTTP, as I am wont to do when checking out spam links)... it redirects me to an angelfire.com address. (A transcript is below: $ telnet 216.33.20.4 80 Trying 216.33.20.4... Connected to 216.33.20.4. Escape character is '^]'. GET //nv/zawixmecwhcxejb HTTP/1.1 Host: 3626046468 User-Agent: SecurityBreachDetected/1.0b2 HTTP/1.1 301 Moved Permanently Date: Thu, 02 Nov 2000 05:19:15 GMT Server: Apache/1.3.9 (Unix) FrontPage/4.0.4.3 Set-Cookie: CookieStatus=COOKIE_OK; path=/; domain=angelfire.lycos.com; expires= Fri, 02-Nov-2001 05:19:15 GMT Location: http://www.angelfire.com//nv/zawixmecwhcxejb/ Connection: close Transfer-Encoding: chunked Content-Type: text/html f9 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>301 Moved Permanently</TITLE> </HEAD><BODY> <H1>Moved Permanently</H1> The document has moved <A HREF="http://www.angelfire.com//nv/zawixmecwhcxejb/">h ere</A>.<P> </BODY></HTML> 0 Connection closed by foreign host. $ ) So, I need to inform someone that they need to inform someone that their server's being used for something it's not supposed to be. Thanks for any help! -Mat Butler Systems Engineer Tonbu, Inc

3 2

Re:DoS attacks, NSPs unresponsiveness
by rkuhljr＠uol.com.br 02 Nov '00

02 Nov '00

> Irc tends to be a volatile medium, like interpersonal relationships in >real life. Thus, many times arguements turn into heated disputes, and >sometimes, some people pick up arms, and attack. The attacks usually take >out whole ISPs for hours, or days. Networks with no IRC server running are also targeted by DoS; personal experience on this one. > The problem is that when trying to get help from the upstream provider >(UUnet in this example), you either receive a negative answer, or you're just ignored completely. We've had the same (lack of) responses from UUnet... > Smurfing, icmp attacks, udp attacks, tcp synflooding (spoofed >sources) are just a number of these weapons. The problem with alot of >networking entities, be it ISPs, enterprises, and such, is that they allow >spoofed packets to leave their network (i.e. do not check if the packets >originate from within their netblocks before letting them leave their >routers). Backbones should enforce RFC 2827 filtering on all static-routes customers; I think most do, but many networks with large amounts of computer power and router capacity are multi-homed, preventing their upstreams of filtering them. > The question is, how can we defend ourselves, and why do the large NSPs >turn a blind eye, and act as if it's not their concern ? A combination of access-list/rate-limit/tcp-intercept on routers and proper TCP/IP stack configuration on servers may put you back online while they track the attack sources and shut them down. > Is there a chance that by helping one another, and by implementing >Internet RFCs corrctly (rfc 1918 for example), we can contribute to the >elimination of this kind of electronic terrorism ? Or change some RFC defaults. Changing directed broadcast default from on to off helped to decrease smurf attacks, making reverse-path-checking the default might be a good move. > Any chance a UUnet person might answer ? Unlikely... but it's curious that the most interesting ideia I've ever saw about DoS tracking was presented at NANOG by an UUnet person. It seems that plan didn't make into deployment, or it is used for premium-class customers that don't include my upstream (also a Worldcom company...). Rubens Kuhl Jr.

1 0