- NANOG - lists.nanog.org

BGP route instabilities
by Matthew Huff 24 Oct '16

24 Oct '16

We saw a slight uptick in routes today (at least since the last time I looked), but a large number of route flaps coming out of the APNIC region. Anyone else notice anything? ---- Matthew Huff | 1 Manhattanville Rd Director of Operations | Purchase, NY 10577

3 2

Re: Death of the Internet, Film at 11
by Josh Reynolds 24 Oct '16

24 Oct '16

And then what? The labor to clean up this mess is not free. Who's responsibility is it? The grandma who got a webcam for Christmas to watch the squirrels? The ISP?... No... The vendor? What if the vendor had released a patch to fix the issue months back, and grandma hadn't installed it? Making grandma and auntie Em responsible for the IT things in their house is likely not going to go well. Making the vendor responsible might work for the reputable ones to a point, but won't work for the fly by night shops that will sell the same products under different company names and model names until they get sued or "one starred" into oblivion. Then they just change names and start all over. The ISPs won't do it because of the cost to fix... The labor and potential loss of customers. So once identified, how do you suggest this gets fixed? On Oct 22, 2016 5:11 PM, "Mark Andrews" <marka(a)isc.org> wrote: One way to deal with this would be for ISP's to purchase DoS attacks against their own servers (not necessarially hosted on your own network) then look at which connections from their network attacking these machines then quarantine these connections after a delay period so that attacks can't be corollated with quarantine actions easily. This doesn't require a ISP to attempt to break into a customers machine to identify them. It may take several runs to identify most of the connections associated with a DoS provider. -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

10 14

Re: Death of the Internet, Film at 11
by Larry Sheldon 24 Oct '16

24 Oct '16

On 10/23/2016 21:02, David Conrad wrote: > Shut down subnets of your own customers? That was the problem I broke my pick on 20 years or more ago. ISPs absolute refusal to put in filters at no-revenue-expense since it would cost money to install and maintain, and worst of all MIGHT conceivably block revenue-producing-abuse traffic. No matter that paying customers were not able to use the service they were paying for. -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

1 0

Re: Death of the Internet, Film at 11
by Keith Medcalf 24 Oct '16

24 Oct '16

Why would the provider want to do anything? They suuport (make money from) their cudtomers. And the more traffic the send/receive, the more money the providers make. Wouldn't surprise me if the providers were selling access to their customers networks to the botherders so they could make money from both ends. --- Sent from Samsung Mobile <div>-------- Original message --------</div><div>From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> </div><div>Date:2016-10-23 17:20 (GMT-07:00) </div><div>To: </div><div>Cc: nanog(a)nanog.org </div><div>Subject: Re: Death of the Internet, Film at 11 </div><div> </div>

3 2

Death of the Internet, Film at 11
by Ronald F. Guilmette 23 Oct '16

23 Oct '16

VICTOR LASZLO: If we stop fighing our enemies, the world will die. RICK BLAINE: Well, what of it? It will be out of its misery. -- From the movie "Casablanca" (1942) Sorry, but some days I just can't help thinking to myself "Oh well, as much fun as it has been, this whole lab experiment called The Internet was never really going last or stand the test of time anyway." The problem isn't the technology. It's the politics. It's fragility by design. Oh! And by the way, one news source that I was just reading a few minutes ago stated that all of the carnage at Dyn today was caused by something on the order of just 1/10th of the known CCTV bots out there. And I'm thinking, like, "Gee! I guess that we ought to count ourselves as lucky that whoever was running this thing, for whatever reason, just didn't much feel like firing up the whole entire bloody thing today. Otherwise, you know, we might have REALLY had a problem." :-) Regards, rfg P.S. To all of you Ayn Rand devotees out there who still vociferously argue that it's nobody else's business how you monitor or police your "private" networks, and who still refuse to take even minimalist steps (like BCP 38), congratulations. Via your inaction and self-centered intransigence you have today moved us all one step closer to the day when the relevant decisions will be taken out of your hands. You are succeding brilliantly at creating the exact thing that you most abhor, i.e. government control. Clemenceau said that war is too important to be left to the generals. Well, guess what? The Internet is too important to be left to the [[fill in the blank]]. It has already begun... https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-… This is just the first timid step. A few more days like today and more, much more, will follow.

11 13

FW: Death of the Internet, Film at 11
by Keith Medcalf 23 Oct '16

23 Oct '16

> It's also generally counter to them being available outside of that > network. This does not follow and is not a natural consequence of sealing the little buggers up so that they cannot affect the Internet (or you private networks). Even if you lock you pet mouse in a cage, you can still feed it and clean up the shit in the cage. It just isn't free to wander out and eat the floral arrangements on the end-table. > (web and proprietary interfaces needed, SSH and telnet not). > That's also not much I can do as a network operator. > > > > > > > ----- > Mike Hammett > Intelligent Computing Solutions > http://www.ics-il.com > > Midwest-IX > http://www.midwest-ix.com > > ----- Original Message ----- > > From: "Chris Boyd" <cboyd(a)gizmopartners.com> > To: "Elizabeth Zwicky via NANOG" <nanog(a)nanog.org> > Sent: Saturday, October 22, 2016 11:42:05 AM > Subject: Re: Death of the Internet, Film at 11 > > > > On Oct 22, 2016, at 7:34 AM, Mike Hammett <nanog(a)ics-il.net> wrote: > > > > "taken all necessary steps to insure that none of the numerous specific > types of CCVT thingies that Krebs and others identified" > > > > Serious question... how? > > Putting them behind a firewall without general Internet access seems to > work for us. We have a lot of cheap IP cameras in our facility and none of > them can reach the net. But this is probably a bit beyond the capabilities > of the general home user. > > —Chris >

3 2

RE: Death of the Internet, Film at 11
by Keith Medcalf 23 Oct '16

23 Oct '16

On: Saturday, 22 October, 2016 17:41, Jean-Francois Mezei <jfmezei_nanog(a)vaxination.ca> wrote: > On 2016-10-22 19:03, Keith Medcalf wrote: > > This does not follow and is not a natural consequence of sealing the > little buggers up so that they cannot affect the Internet > Problem is that many of these gadgets want to be internet connected so > mother at work can check on her kids at home, start the cooking, raise > thermostat etc. This does not require that the devices be open to the Internet, nor does it require that they are under the control of an Internet based controller. > The problem is that as a novelty, people are quick to adopt, but don't > think about making their homes vulnerable to attack. (consider an > internet connected door lock) There are many people who do not read this list who would have nothing whatsoever to do with such a scheme (earlier similar schemes are routers & etc that are programmed and controlled from the "web", and remote access crap which is proxied through a third-party web server -- another ill-conceived and brain-dead idea). This is a self-limiting issue. Darwin will take care of it. Unfortunately there will be collateral damage as those not fit to the continuation of the species are eliminated from the gene pool. We should do our duty and make sure that the pool cleaning proceeds with the maximum speed and efficiency possible.

3 2

Re: Death of the Internet, Film at 11
by Brandon Butterworth 23 Oct '16

23 Oct '16

> From nanog-bounces(a)nanog.org Sat Oct 22 15:51:34 2016 > If they are easy to trace, then it should be easy for you to > tell me how to find them on my network. Not sure if you're trolling now, apologies if what I wrote wasn't clear. If you did want to find them before they attack then you could scan for them, the miscreants already did and easily found them. For some attack vectors there are services that are doing it for you, see the excellent https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork > The addresses being known to them doesn't help me at all clean > up my network or help other networks clean up theirs. Did you read my whole mail? The suggestion is people who get attacked tell the ISPs of the devices doing the attacking > It would be rather difficult for me (and I'm sure many other operators) > to distinguish normal Dyn traffic from DDoS Dyn traffic. I was not suggesting you try and guess, I was suggesting you be given data from actual attacks. brandon

4 3

Honorary Unsubscribe: Leo Beranek
by Jay R. Ashworth 23 Oct '16

23 Oct '16

How many people remember that Bolt Beranek and Newman was originally an acoustical consultancy, specializing in concert halls? http://www.honoraryunsubscribe.com/leo_beranek.html?awt_l=ACI.7&awt_m=JXfIg… Happy Landings, Leo! Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

2 1

Re: Death of the Internet, Film at 11
by Scott Weeks 22 Oct '16

22 Oct '16

> On Oct 22, 2016 5:11 PM, "Mark Andrews" <marka(a)isc.org> wrote: > One way to deal with this would be for ISP's to purchase DoS attacks > against their own servers (not necessarially hosted on your own > network) then look at which connections from their network attacking > these machines then quarantine these connections after a delay > period so that attacks can't be corollated with quarantine actions > easily. > > This doesn't require a ISP to attempt to break into a customers > machine to identify them. It may take several runs to identify > most of the connections associated with a DoS provider. Josh Reynolds writes: > > And then what? --- marka(a)isc.org wrote: From: Mark Andrews <marka(a)isc.org> They get in someone to clean up their network. When they say it is clean you reconnect them. If this happens more often than once a year you charge them a months fees per additional incident. Have the year timer start when reconnect is requested. You give them what data you have to backup the claim. -------------------------------------------------- I invoke randy's "i encourage my competitor's to do this". scott

1 0