- NANOG - lists.nanog.org

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Ronald F. Guilmette 18 Jun '15

18 Jun '15

Harry Hoffman hhoffman at ip-solutions.net wrote: >I think it would be great if you were to include some source links in >your petition/email so that folks unaware of the specifics can educate >themselves in a non-partisan and factual manner. Well, as regards to the petition itself, I can't because now it is cast in stone and can't be edited, I think, which is too bad, because I slightly misspelled the lady's name. It is Katherine Archuleta, not Katherine Archueta. :-( But more to the point, they only give you a VERY limited number of characters to state what your petition is asking for, so there's really not room for much in the way of links within the petition itself. But elsewise, I'll give a few good links here, but really if you just go to Google News and search for "OPM breach" you will find one hell of a lot of VERY fresh news reports. =============================================================================== Fed Agency blames giant hack on 'neglected' security systems http://www.usnews.com/news/politics/articles/2015/06/16/cybertheft-of-perso… (Executive Summary: 4.2 mellion federal personel records stolen - OPM was warned, repeatedly, FOR YEARS that systems were insecure and didn't do squat.) =============================================================================== Military clearance OPM data breach 'absolute calamity' http://www.navytimes.com/story/military/2015/06/17/sf-86-security-clearance… (Executive Summary: Literally MILLIONS of detailed security clearance files were taken... quote: "everyone's".) =============================================================================== OPM Hack Probe Hindered Because Digital Trail Has Been Erased, US Official Says http://abcnews.go.com/US/opm-hack-probe-hindered-digital-trail-erased-us/st… (Executive Summary: They don't know how long this lasted or even what really happened because they over-write their log files every 60 days) =============================================================================== Will anyone at OPM be fired for not preventing this catastrophic mega-hack by China? http://hotair.com/archives/2015/06/16/will-anyone-at-opm-be-fired-for-not-p… Nope! In fact, Whitehouse has already come out expressing confidence in the OPM Director, Katherine Archuleta: http://thehill.com/policy/cybersecurity/245294-obama-has-confidence-in-opm-… =============================================================================== Catching Up on the OPM Breach - Krebs On Security http://krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach/ (Detailed timeline of the MANY screw-ups) =============================================================================== And last but by no means least, we have ArsTechnica's most recent contribution to the news coverage, it which the following UNBELIEVEABLE insanity is revealed: Encryption would not have helped" at OPM, says DHS official http://arstechnica.com/security/2015/06/encryption-would-not-have-helped-at… ... A consultant who did some work with a company contracted by OPM to manage personnel records for a number of agencies told Ars that he found the Unix systems administrator for the project "was in Argentina and his co-worker was physically located in the [People's Republic of China]. Both had direct access to every row of data in every database: they were root. Another team that worked with these databases had at its head two team members with PRC passports. I know that because I challenged them personally and revoked their privileges. From my perspective, OPM compromised this information more than three years ago and my take on the current breach is 'so what's new?'" Yea. Right. If you are trying to keep foreign nationals out of your "secure" system, then encryption quite certainly WILL NOT HELP if you have already given them root. Regards, rfg P.S. Regadless of your politics or what you think of Snowden, THIS INCIDENT is VASTLY WORSE that any leak that Snowden participated in. At least he and the reporters he worked with tried to exercise some discretion, and did not leak any personal details about any specific U.S. government employees. In the case of this massive OPM hack however, the incompetents in charge of OPM gave unknown foreign enemies EVERYTHING... enough data and personal dirt on millions of federal employees... including active service members and intelligence operatives... to allow them, our enemies, to engage in virtually unlimited blackmailing and spear-phishing of our people until the Second Coming. For those who were worriedly waiting for the much-predicted "Digital Pearl Harbor" attack on this country... well... you don't have to fret about THAT anymore, because this is it. It's already happened. And we did it to ourselves. P.P.S. Here is OPM Director Katherine Archuleta's personal biography. Executive Summary: She a long-time Democratic Party political hack with nothing other than a Master's degree in Education. (Still, isn't it comforting to know that "As a long-time public servant, she is a champion of Federal employees" ?) https://www.opm.gov/about-us/our-people-organization/senior-staff-bios/kath… P,P.P.S. Here's a nice clear explanation of how/why she got the job as the Director of the Office of Personel Management, overseeing the safety and security of millions of confidential federal government employee files and the people behind them: http://www.nationaljournal.com/decision-makers/government-operations/kather… July 18, 2013 - Even before President Obama nominated Archuleta to be director of OPM in late May, word leaked to the Washington press corps that the White House was intent on choosing a Hispanic. Both Interior Secretary Ken Salazar and Labor Secretary Hilda Solis had resigned from the Obama administration, and groups such as the National Council of La Raza had chided the president for nominating only one Hispanic to a Cabinet-level position in his second term. Enter Archuleta, who helped engineer the president's reelection win as Obama for America's national political director. Not only is she Latina, but Archuleta also hails from the swing state of Colorado, where Democrats have made inroads in recent years. If she is confirmed as OPM director, the 64-year-old will be the first Hispanic to hold that position. ...

1 0

Is it safe to use 240.0.0.0/4
by Luan Nguyen 18 Jun '15

18 Jun '15

Is that safe to use internally? Anyone using it? Just for NATTING on Cisco gears...

17 22

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> *) The Director of the Office of Personnel Management, Ms. Katherine Archueta was warned, repeatedly, and over several years, by her own department's Inspector General (IG) that many of OPM's systems were insecure and should be taken out of service. Nontheless, as reveled during congressional testimony yesterday, she overruled and ignored this advice and kept the systems online. ------------------------------------------- >From personal experience (at a different level) this is SOP, unfortunately. They just don't understand the importance until catastrophic failure. scott

1 0

DMARC in education
by Matthew Black 18 Jun '15

18 Jun '15

Looking at implementing DMARC for my institution. We currently have an SPF record and use DKIM to sign a small subset of messages. Rollout recommendations for DMARC suggest initially creating a "p=none" record to gather information on how a domain is being used. The RUA tag specifies a URI of where to send daily reports. Trying to get an idea of how many reports to expect a day or two after the dust settles. Does anyone use an aggregator to process their feedback (RUA tag) and/or forensic reports (RUF tag)? DMARC information. https://dmarc.org/ See slide 38 of 93 at http://www.slideshare.net/kka7/fighting-email-abuse-with-dmarc?qid=5e90be27… Everyone's first DMARC record V=DMARC1; p=none; rua=mailto:aggregate@example.com; Cheers! matthew black information technology services california state university, long beach

5 4

Re: Google contact?
by Shawn L 17 Jun '15

17 Jun '15

I'm replying on-list since it seems like a lot of people are in the same boat. Here's a summary of what happened to us. Please feel free to jump in if you had a different experience, or have more information. Google sent us a notice in December that as of June 8 they would be discontinuing the Google for ISPs program and that we had to find a different e-mail provider. Unfortunately, they only sent this notice to the account that initially created the service, which was un-monitored. I have heard the same thing from others. They did not include a notice about the discontinuation in their monthly billing, only in e-mail and only to the account that initiated the google service. We actually found out about it some time in February. I spoke with the Google contact listed in the e-mail and was told that they were indeed cancelling the service, but wasn't given a reason. We also asked if it was possible to move to a different Google service, Google Apps for Business for example, but was told that it would be against their terms or service and would result in a cancellation of the service. After a lot of research in Google's forums, it looked like a lot of other people were in the same boat we were. We ended up talking with another e-mail provider and migrating all of our mail. Several weeks ago we asked Google for an extension because the migration was taking longer than expected. We were given until the 16th of June and told that no further extensions would be given. I have spoken to one person who was given until the end of June. Here is the original notice we received from google. I hope this helps others in the same boat December 10, 2014 [ your-domain,com ]( http://baragatelephone.com ) Subject: Notice of Non-Renewal of The Google Apps - ISP Partner Edition Agreement. Dear Administrator, Thank you for being a Google customer and for using Google Apps Partner Edition (collectively, "Partner Edition"). As part of Google's integration plans, we have elected to discontinue providing the Partner Edition Services going forward. As provided in the Agreement between Google Inc. and [ your-domain.com ]( http://baragatelephone.com ), this letter serves as your formal notice that the Services will not be renewed, and our Agreement with you will terminate on June 8, 2015. Any other Google services you have purchased (or resold, if applicable), in addition the Partner Edition product and services, will not be affected by this change. Please also note that this notice of non-renewal does not relieve you of any payment obligations you may have under the current Agreement and that you remain responsible for remitting any such owed payments in full by the applicable invoice due date for the Services. We have prepared an Administrator transition resource website ([ https://support.google.com/appstransition/go/admin ]( https://support.google.com/appstransition/go/admin )) and an End User resource website ([ https://support.google.com/appstransition ]( https://support.google.com/appstransition )) to assist you through the transition. This resource center presents some of the migration options available to you and provides instructions that you can share with your customers. We regret any inconvenience this may cause, and thank you again for your business. If you have any questions, please contact your Account Manager below. Account Manager: John Coull Phone Number: [ 212- 565-3131 ]( tel:212-%20565-3131 ) Email Address: [ johnbc(a)google.com ]( mailto:johnbc@google.com ) Sincerely, Omid Kordestani Chief Business Officer -----Original Message----- From: "Marciano Lopes" <marciano.lopes(a)gsurfnet.com> Sent: Wednesday, June 17, 2015 11:48am To: "Shawn L" <shawnl(a)up.net> Subject: Re: Google contact? Hello Shawn! They cancelled ours as well. What we can do? Thanks! Atenciosamente, Marciano Lopes GSURF Fixo (48) 3254-8700 Ramal 6272 Móvel (48) 9125-5081 Atendimento 24h 0800-644-4833 2015-06-17 12:15 GMT-03:00 Shawn L <[ shawnl(a)up.net ]( mailto:shawnl@up.net )>: Google cancelled their ISP program as of the 8th of June. Feel free to contact me off-list for more info. They cancelled ours as well. -----Original Message----- From: "Christopher Tyler" <[ chris(a)totalhighspeed.net ]( mailto:chris@totalhighspeed.net )> Sent: Wednesday, June 17, 2015 9:28am To: [ nanog(a)nanog.org ]( mailto:nanog@nanog.org ) Subject: Google contact? Need some help.. Does anyone have an email contact at Google that they are willing to pass along? All of our [ mowisp.net ]( http://mowisp.net ) Apps for ISP accounts were disabled last night at about 8-9PM without notice and we are now getting swamped with calls. Possibly several hundred users affected. -- Christopher Tyler MTCRE/MTCNA/MTCTCE/MTCWE Total Highspeed Internet Services [ 417.851.1107 ]( tel:417.851.1107 )

3 2

Google contact?
by Christopher Tyler 17 Jun '15

17 Jun '15

Need some help.. Does anyone have an email contact at Google that they are willing to pass along? All of our mowisp.net Apps for ISP accounts were disabled last night at about 8-9PM without notice and we are now getting swamped with calls. Possibly several hundred users affected. -- Christopher Tyler MTCRE/MTCNA/MTCTCE/MTCWE Total Highspeed Internet Services 417.851.1107

3 2

Fkiws with destination port 0 and TCP SYN flag set
by Maqbool Hashim 17 Jun '15

17 Jun '15

Hi, I am doing some flow analysis within our network primarily for understanding application flows to aid in network segregation activity and mainly understand what is going on inside the network. To do this I have been using netflow where the switches/firewalls support it. In some cases I have used a monitor port and fed full packet capture into the nfdump toolset for conversion into flows. There is a portion of our network where the switches only support sflow which is not ideal, but hopefully will be able to gather enough data over time to be useful. One of the things I was trying to identify was flow initiation, i.e. the client and server in the flow- so filtered for TCP packets with SYN flag set. It was at this point that I saw TCP SYN packets with a destination port of 0. I have seen this discussed before in this thread http://www.gossamer-threads.com/lists/nanog/users/155141 It was stated in that thread that netflow reports source/dest port 0 for non-initial fragments. My question was is this what I am seeing here, so any SYN packet with dest port 0 is a non-initial fragment seen by the tool? Therefore should I always see a corresponding response with Ack and Reset flags set? I do see a set of flows with R and A set with a source port of 0, all the dest port 0 flows have the SYN flag set, but it's hard to find ones that match a SYN packet due to only receiving a sample of flows. Some notes on the setup: Capture is from inside one VLAN Switches are sending sflow back to analysis tools, sampling rate of 1/1024 packets Using nfdump suite of tools for analysis. sfcapd as as the collector Thinking about this, is what I am seeing a symptom of the fact that the tools don't see all packets, i.e. the tools don't see the initial fragment due to sampling. However I still don't quite understand it appearing with the SYN flag set? I am starting to think that for these purposes I might be better abandoning sflow and go with setting up collectors on the switches to get full flow information for my purposes. Any clarification/input much appreciated. Regards MH

5 14

Unified Layer contact
by Chuck Church 16 Jun '15

16 Jun '15

Anyone on here from Unified Layer? Having an issue with a small ISP I help out occasionally. Some of their IP Space can reach a hosted web server, but their other prefixes cannot reach the destination. Traceroute from working IP space to destination web server (a bank) : 15 162-144-240-55.unifiedlayer.com (162.144.240.55) [AS 46606] 68 msec 162-144-240-43.unifiedlayer.com (162.144.240.43) [AS 46606] 68 msec 68 msec 16 grandsouth.com (162.144.109.184) [AS 46606] 76 msec 76 msec 72 msec >From non-working IP space: 15 162-144-240-51.unifiedlayer.com (162.144.240.51) [AS 46606] 80 msec 162-144-240-43.unifiedlayer.com (162.144.240.43) [AS 46606] 80 msec 162-144-240-47.unifiedlayer.com (162.144.240.47) [AS 46606] 84 msec 16 * * * 17 * * * 18 * * * We're not a customer of Unified Layer whom the bank uses for hosting, not getting much help via normal channels. Thanks, Chuck

1 0

[NANOG-announce] NANOG On The Road Comes to Herndon!!
by Valerie Wittkop 16 Jun '15

16 Jun '15

We are very excited to be holding the next NOTR event in the great city of Herndon, VA next Tuesday, and we invite you to join us! Are you interested in Internet networking/peering? Do you work at a colocation, hosting or data center facility? Are you a provider of hardware/software solutions for the Internet industry? If so, the NANOG On The Road <https://www.nanog.org/meetings/road7/home> Herndon event is perfect for you! Date: June 23, 2015 Time: Registration Desk opens at 8:30am and Program is from 9:00 AM - 5:00 PM Location: Westin Dulles Airport Hotel <https://www.nanog.org/meetings/road7/hotel> - 2520 Wasser Terrace, Herndon, VA 20171 The FREE to attend event is open for registration. Register Now! <https://www.cvent.com/events/notr-herndon-va/registration-8c87c541134e4d2eb…> The agenda <https://www.nanog.org/meetings/road7/agenda> is posted - topics to be discussed include: - Recent & Future Developments in DNS Security - International Network Supply, Traffic & Pricing - DNSSEC & RPKI - High fibre-coaxial networks - Optical Networking Tutorial - IPv6 Tutorial - BGP Tutorial If you are, or will be, in the Herndon area, we invite you to attend. And don’t forget to share the invitation with your colleagues or others you feel may benefit from attending. Make NANOG On The Road your first step toward learning how you can take the wheel and steer the future of the Internet. Learn more about On The Road events here <https://www.nanog.org/meetings/road/home>. Feel free to contact us at nanog-support(a)nanog.org <mailto:nanog-support@nanog.org> if you have any questions. Regards, Valerie Valerie Wittkop NANOG Program Director Tel: +1 866 902 1336, ext 103 _______________________________________________ NANOG-announce mailing list NANOG-announce(a)mailman.nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

RE: Greenfield ISP (In January)
by Nicholas Warren 16 Jun '15

16 Jun '15

Does anyone beside Cisco do MAP? Brocade, Juniper, Huawei? Thank you, - Nich Warren -----Original Message----- From: Tore Anderson [mailto:tore@fud.no] Sent: Friday, June 12, 2015 12:15 AM To: Baldur Norddahl Cc: Nicholas Warren; nanog(a)nanog.org Subject: Re: Greenfield 464XLAT (In January) * Baldur Norddahl <baldur.norddahl(a)gmail.com> > The high tech solution is stuff like MAP where you move the cost out > to the CPE. But then you need to control the CPE - if you have that > then great. You would still want to sell a non-NAT (and MAP is NAT) to > users that require a public IPv4 address, so you still need to go dual > stack or use some tunnelling for that. Hi Baldur, MAP is *not* NAT; that's what's so neat about it. The users do get a public IPv4 address (or prefix!) routed to their CPE's WAN interface, towards which they can accept inbound unsolicited connections. The public IPv4 address could be port-restricted if the operator wants address sharing, but it does not have to be. You could do both at the same time, e.g., giving your "premium" users a /32 or /28, while the standard subscription includes a /32 with 4k ports. I will grant you that MAP-T performs NAT (i.e., protocol translation) internally, but the translations that happens when a packet enters the MAP domain are reversed when it exits. So the IPv4 addresses are transparent end-to-end. MAP-E (and lw4o6 for that matter), on the other hand, has no form of NAT anywhere. (Unless you count the NAPT44 that sits between the subscriber's RFC1918 LAN segment and the CPE's WAN interface, but that's not exactly something that's unique to MAP.) Nicholas: If I were you, before going down the 464XLAT route, I'd first look closely at these technologies, in the order given: 1) MAP (because it is fully stateless) 2) lw4o6 (because it is mostly stateless, i.e., no session tracking) 3) DS-Lite (which, like 464XLAT, is stateful, but you'll have way more CPEs to choose from than with 464XLAT, which is mostly for mobile) Tore

1 0