- Test - lists.nanog.org

Amazon Geolocation
by Sam Norris 24 Apr '18

24 Apr '18

Hey all, Having a hard time finding someone within Amazon to understand geolocation problems. We have lots of customers that started getting the amazon prime video message about not being able to watch because of geolocation / vpn restrictions. We are a wisp. We run BGP with our own netblocks and upstream netblocks. We have at least 15 customers that have reported this problem - many of which opened tickets directly with amazon but they have no clue. My guess is its related to entire netblocks. MaxMind shows the correct info and always has. Can someone point me to a contact at Amazon that can help? Thx, Sam

4 4

Re: The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Fredrik Korsbäck 24 Apr '18

24 Apr '18

Well there is quite abit of data around that particular server. So it definitely happened. https://twitter.com/GossiTheDog/status/988873775285460992 This tweet is a good start. The server answer to me right now and google safe browsing has flagged it as well for being insecure (no the regular cert-fail warning but deceptivness warning) The SSL-cert is a self-signed one impersonating MyEtherWallet.com. Id take it that 15169 accepted the prefix for some reason over a bilateral peering-sesssion (to the best of my knowledge the equinix routeservers does indeed do filter, but please correct me on this one) with 10297 and hence poisoned the 8.8.8.8 resolver for some time with the wrong ip-addr. > On Tue, Apr 24, 2018 at 08:35:17PM +0200, > Fredrik Korsbäck <hugge(a)nordu.net> wrote > a message of 28 lines which said: > >> Surprised this hasnt "made the news" over at this list yet. > > It was discussed several hours before on the Outages mailing list. > > Also, there are not a lot of hard facts. The BGP hijacking is clear > and easy to find in the usual places. > > The supposed rogue DNS server is much more elusive. Nobody apparently > thought of querying it with dig during the hijack. There are reports > of people being directed to a rogue www.myetherwallet.com but, again, > no detail, no IP address, not the certificate of the rogue server, > nothing. > >> seems to be some kind of transparent proxy out of russia with a >> bogus SSL-cert (but still pretty good) (https://46.161.42.42/) > > DNSDB does not confirm this: > > % isc-dnsdb-query rdata ip 46.161.42.42 > pigroot.sciencesupply.eu. IN A 46.161.42.42 > value.rollliquid.com. IN A 46.161.42.42 > campsprings.collaspepaw.com. IN A 46.161.42.42 > bronchopneumonic.collaspepaw.com. IN A 46.161.42.42 > server42.woodorganism.com. IN A 46.161.42.42 > ;;; Returned 5 RRs in 0.03 seconds. > ;;; DNSDB > > Currently, this machine does not accept connections. > > > > -- hugge

2 1

The story about MyEtherWallet.com hijack or how to become a millionare in 2 hours.
by Fredrik Korsbäck 24 Apr '18

24 Apr '18

Aloha. Surprised this hasnt "made the news" over at this list yet. https://doublepulsar.com/hijack-of-amazons-internet-domain-service-used-to-… https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/2teeVLJ44… https://twitter.com/barton_paul/status/988788348272734217 TLDR; So it seems that AS10297 (some small hostingprovider in the US) suddenly started to announce de-aggregated AWS IP-space, containing quite alot of Route53 infrastructure, put up resolvers on their own on the hijacked IP-space and pointed *ATLEAST* www.myetherwallet.com to a ip-address that seems to be some kind of transparent proxy out of russia with a bogus SSL-cert (but still pretty good) (https://46.161.42.42/) I did digging in my own logs and played it through BGP-play - seems like it was in fact only Hurricane Electric (6939) that actually propagated this prefix to the Internet. Which makes sense since we have seen them being part of the problem in almost all recent hijacks. Can we do some collaborative digging in other tools you have handy (i guess thousand eyes probes etc could be of help here) to track how big the propagation was? Being abit involved in the Ethereum world it could be noted that the login to MyEtherWallet.com is abit special since you actually login with you wallet-seed and not user/pass to the site... giving the possibility to make really swift transfers without having actual access to the real site (for good ....and bad). -- hugge @ 2603

4 4

Solera Peering Contact
by Mark Tinka 24 Apr '18

24 Apr '18

Hi all. Looking for a warm body that deals with peering over at Solera (www.solera.com) Trying to get someone to setup peering with their network at NAPAfrica in Johannesburg, but we can't seem to find anyone with "enable". If anyone from Solera is on-list, or if there is anyone that can point me in their direction, beer(s) on me in Vancouver :-). Thanks. Mark.

1 0

Lumos Salesman
by Rod Beck 23 Apr '18

23 Apr '18

Hi, Please contact me off list. I have a 100 gig wave to discuss. It is on-net for this carrier. Thanks. Regards, Roderick. Roderick Beck Director of Global Sales United Cable Company www.unitedcablecompany.com<http://www.unitedcablecompany.com> New York City & Budapest rod.beck(a)unitedcablecompany.com 36-30-859-5144 [1467221477350_image005.png]

2 1

Anyone at Microsoft able to get in touch?
by Matt Peterman 23 Apr '18

23 Apr '18

TLDR: Moved v4 prefix from Europe to US and now unable to activate MS products because “This key is not supported in your region”. Trying to figure out how to get this updated (space is correctly mapped to the US in Akamai Edgecape, MaxMind etc) Any advice is appreciated! Matt

1 0

Experience with CER 2000/MLXe/SLX/VDX
by howard stearn 20 Apr '18

20 Apr '18

Contact me off-list. (Unless you want to share publicly.) I'm interested in knowing if anyone has information about their transition from Brocade to Avgo/Broadcom to Extreme and if the transition was seamless and ended up well. Please tell me a little about your self. How you were a customer / partner, and what your experience has been transitioning to Extreme. I'm also curious if anyone has insider stories about Avgo purchasing Broadcom, and if has any wider implications than Wikipedia is rendering. -HS

1 0

RE: Is WHOIS going to go away?
by Scott Weeks 20 Apr '18

20 Apr '18

------------------------- "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." ------------------------- One last OT point. It's Friday after all... :) https://www.npr.org/2015/03/02/390245038/ben-franklins-famous-liberty-safet… scott ps. whatever happened to the "Friday Fun" thing?

1 0

Quanta LB4M
by Mike Hammett 20 Apr '18

20 Apr '18

Has anyone gotten a "non-factory" firmware to go onto these guys? There are a couple threads on Google that are inconclusive. There are rumors that it's the same as a Dell something or an HP something else, but no one has outright said, "I loaded a Dell XXXX firmware onto it and solved all of the random ass bugs." If I didn't already have a couple of stacked Extreme x400s, I'd consider these at home, but they're somewhat buggy. Quanta told me to contact whomever I bought it from... but I don't think the random guy on eBay is going to have much of anything useful to say. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest Internet Exchange http://www.midwest-ix.com

4 7

Reminder: NANOG 73 CFP is open!
by Ryan Woolley 20 Apr '18

20 Apr '18

NANOG Community, As a reminder, we are still accepting proposals for all sessions at NANOG 73 in Denver, CO, June 25-27, 2018. The full Call For Presentations can be found at: http://www.cvent.com/d/ttqv1z/6K Remaining Key Dates for NANOG 73: Tuesday, 05/08/18 CFP Deadline: Presentation Slides Due Tuesday, 05/08/18 CFP Topic List and NANOG Highlights Page Monday, 06/18/18 Speaker FINAL presentation Slides to PC Tool Sunday, 06/24/18 Lightning Talk Submissions Open (Abstracts Only) Sunday, 06/24/18 On-site Registration Finals slides must be submitted by Monday, June 18, 2018, and no changes will be accepted between that date and the conference. Materials received after that date will be updated on the web site after the completion of the conference. We look forward to seeing you in June in Denver! Sincerely, Ryan Woolley NANOG PC

1 0