- NANOG - lists.nanog.org

Comcast and DGA like behavior
by J. Oquendo 25 Apr '18

25 Apr '18

Anyone else seeing DGA (1) like behavior for Comcast based customers? If so, is there any information on it? Seeing a lot of traffic to bogus domains all synonymous with their networks. 1: https://en.wikipedia.org/wiki/Domain_generation_algorithm -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM, GNFA "Where ignorance is our master, there is no possibility of real peace" - Dalai Lama 0A96 6318 EA49 4032 21C9 A7A8 81E9 3E95 414F 356E https://pgp.mit.edu/pks/lookup?op=get&search=0x81E93E95414F356E

3 2

Is WHOIS going to go away?
by Brian Kantor 25 Apr '18

25 Apr '18

There is concern that the WHOIS database service will be in violation of the new European GDPR which takes effect May 25th, and may have to shut down. http://www.theregister.co.uk/2018/04/14/whois_icann_gdpr_europe/ https://www.icann.org/en/system/files/correspondence/jelinek-to-marby-11apr… - Brian

21 71

Can someone from instagram contact me off list?
by Payam Poursaied 25 Apr '18

25 Apr '18

1 0

Re: The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Hank Nussbacher 25 Apr '18

25 Apr '18

On 24/04/2018 21:35, Fredrik Korsbäck wrote: > TLDR; So it seems that AS10297 (some small hostingprovider in the US) suddenly started to announce de-aggregated AWS > IP-space, containing quite alot of Route53 infrastructure, put up resolvers on their own on the hijacked IP-space and > pointed *ATLEAST* www.myetherwallet.com to a ip-address that seems to be some kind of transparent proxy out of russia > with a bogus SSL-cert (but still pretty good) (https://46.161.42.42/) > > I did digging in my own logs and played it through BGP-play - seems like it was in fact only Hurricane Electric (6939) > that actually propagated this prefix to the Internet. Which makes sense since we have seen them being part of the > problem in almost all recent hijacks. In addition to HE there was AS19151 -WV Fiber that accepted the /24s, but based on BGPlay (attached) it seems that the main culprit was HE that propagated it onward. -Hank

1 1

Amazon Geolocation
by Sam Norris 24 Apr '18

24 Apr '18

Hey all, Having a hard time finding someone within Amazon to understand geolocation problems. We have lots of customers that started getting the amazon prime video message about not being able to watch because of geolocation / vpn restrictions. We are a wisp. We run BGP with our own netblocks and upstream netblocks. We have at least 15 customers that have reported this problem - many of which opened tickets directly with amazon but they have no clue. My guess is its related to entire netblocks. MaxMind shows the correct info and always has. Can someone point me to a contact at Amazon that can help? Thx, Sam

4 4

Re: The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Fredrik Korsbäck 24 Apr '18

24 Apr '18

Well there is quite abit of data around that particular server. So it definitely happened. https://twitter.com/GossiTheDog/status/988873775285460992 This tweet is a good start. The server answer to me right now and google safe browsing has flagged it as well for being insecure (no the regular cert-fail warning but deceptivness warning) The SSL-cert is a self-signed one impersonating MyEtherWallet.com. Id take it that 15169 accepted the prefix for some reason over a bilateral peering-sesssion (to the best of my knowledge the equinix routeservers does indeed do filter, but please correct me on this one) with 10297 and hence poisoned the 8.8.8.8 resolver for some time with the wrong ip-addr. > On Tue, Apr 24, 2018 at 08:35:17PM +0200, > Fredrik Korsbäck <hugge(a)nordu.net> wrote > a message of 28 lines which said: > >> Surprised this hasnt "made the news" over at this list yet. > > It was discussed several hours before on the Outages mailing list. > > Also, there are not a lot of hard facts. The BGP hijacking is clear > and easy to find in the usual places. > > The supposed rogue DNS server is much more elusive. Nobody apparently > thought of querying it with dig during the hijack. There are reports > of people being directed to a rogue www.myetherwallet.com but, again, > no detail, no IP address, not the certificate of the rogue server, > nothing. > >> seems to be some kind of transparent proxy out of russia with a >> bogus SSL-cert (but still pretty good) (https://46.161.42.42/) > > DNSDB does not confirm this: > > % isc-dnsdb-query rdata ip 46.161.42.42 > pigroot.sciencesupply.eu. IN A 46.161.42.42 > value.rollliquid.com. IN A 46.161.42.42 > campsprings.collaspepaw.com. IN A 46.161.42.42 > bronchopneumonic.collaspepaw.com. IN A 46.161.42.42 > server42.woodorganism.com. IN A 46.161.42.42 > ;;; Returned 5 RRs in 0.03 seconds. > ;;; DNSDB > > Currently, this machine does not accept connections. > > > > -- hugge

2 1

The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Fredrik Korsbäck 24 Apr '18

24 Apr '18

Aloha. Surprised this hasnt "made the news" over at this list yet. https://doublepulsar.com/hijack-of-amazons-internet-domain-service-used-to-… https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/2teeVLJ44… https://twitter.com/barton_paul/status/988788348272734217 TLDR; So it seems that AS10297 (some small hostingprovider in the US) suddenly started to announce de-aggregated AWS IP-space, containing quite alot of Route53 infrastructure, put up resolvers on their own on the hijacked IP-space and pointed *ATLEAST* www.myetherwallet.com to a ip-address that seems to be some kind of transparent proxy out of russia with a bogus SSL-cert (but still pretty good) (https://46.161.42.42/) I did digging in my own logs and played it through BGP-play - seems like it was in fact only Hurricane Electric (6939) that actually propagated this prefix to the Internet. Which makes sense since we have seen them being part of the problem in almost all recent hijacks. Can we do some collaborative digging in other tools you have handy (i guess thousand eyes probes etc could be of help here) to track how big the propagation was? Being abit involved in the Ethereum world it could be noted that the login to MyEtherWallet.com is abit special since you actually login with you wallet-seed and not user/pass to the site... giving the possibility to make really swift transfers without having actual access to the real site (for good ....and bad). -- hugge @ 2603

4 4

Solera Peering Contact
by Mark Tinka 24 Apr '18

24 Apr '18

Hi all. Looking for a warm body that deals with peering over at Solera (www.solera.com) Trying to get someone to setup peering with their network at NAPAfrica in Johannesburg, but we can't seem to find anyone with "enable". If anyone from Solera is on-list, or if there is anyone that can point me in their direction, beer(s) on me in Vancouver :-). Thanks. Mark.

1 0

Lumos Salesman
by Rod Beck 23 Apr '18

23 Apr '18

Hi, Please contact me off list. I have a 100 gig wave to discuss. It is on-net for this carrier. Thanks. Regards, Roderick. Roderick Beck Director of Global Sales United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-30-859-5144 [1467221477350_image005.png]

2 1

Anyone at Microsoft able to get in touch?
by Matt Peterman 23 Apr '18

23 Apr '18

TLDR: Moved v4 prefix from Europe to US and now unable to activate MS products because “This key is not supported in your region”. Trying to figure out how to get this updated (space is correctly mapped to the US in Akamai Edgecape, MaxMind etc) Any advice is appreciated! Matt

1 0