- Test - lists.nanog.org

Death of the Internet, Film at 11
by Ronald F. Guilmette 23 Oct '16

23 Oct '16

VICTOR LASZLO: If we stop fighing our enemies, the world will die. RICK BLAINE: Well, what of it? It will be out of its misery. -- From the movie "Casablanca" (1942) Sorry, but some days I just can't help thinking to myself "Oh well, as much fun as it has been, this whole lab experiment called The Internet was never really going last or stand the test of time anyway." The problem isn't the technology. It's the politics. It's fragility by design. Oh! And by the way, one news source that I was just reading a few minutes ago stated that all of the carnage at Dyn today was caused by something on the order of just 1/10th of the known CCTV bots out there. And I'm thinking, like, "Gee! I guess that we ought to count ourselves as lucky that whoever was running this thing, for whatever reason, just didn't much feel like firing up the whole entire bloody thing today. Otherwise, you know, we might have REALLY had a problem." :-) Regards, rfg P.S. To all of you Ayn Rand devotees out there who still vociferously argue that it's nobody else's business how you monitor or police your "private" networks, and who still refuse to take even minimalist steps (like BCP 38), congratulations. Via your inaction and self-centered intransigence you have today moved us all one step closer to the day when the relevant decisions will be taken out of your hands. You are succeding brilliantly at creating the exact thing that you most abhor, i.e. government control. Clemenceau said that war is too important to be left to the generals. Well, guess what? The Internet is too important to be left to the [[fill in the blank]]. It has already begun... https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-… This is just the first timid step. A few more days like today and more, much more, will follow.

11 13

FW: Death of the Internet, Film at 11
by Keith Medcalf 23 Oct '16

23 Oct '16

> It's also generally counter to them being available outside of that > network. This does not follow and is not a natural consequence of sealing the little buggers up so that they cannot affect the Internet (or you private networks). Even if you lock you pet mouse in a cage, you can still feed it and clean up the shit in the cage. It just isn't free to wander out and eat the floral arrangements on the end-table. > (web and proprietary interfaces needed, SSH and telnet not). > That's also not much I can do as a network operator. > > > > > > > ----- > Mike Hammett > Intelligent Computing Solutions > http://www.ics-il.com > > Midwest-IX > http://www.midwest-ix.com > > ----- Original Message ----- > > From: "Chris Boyd" <cboyd(a)gizmopartners.com> > To: "Elizabeth Zwicky via NANOG" <nanog(a)nanog.org> > Sent: Saturday, October 22, 2016 11:42:05 AM > Subject: Re: Death of the Internet, Film at 11 > > > > On Oct 22, 2016, at 7:34 AM, Mike Hammett <nanog(a)ics-il.net> wrote: > > > > "taken all necessary steps to insure that none of the numerous specific > types of CCVT thingies that Krebs and others identified" > > > > Serious question... how? > > Putting them behind a firewall without general Internet access seems to > work for us. We have a lot of cheap IP cameras in our facility and none of > them can reach the net. But this is probably a bit beyond the capabilities > of the general home user. > > —Chris >

3 2

RE: Death of the Internet, Film at 11
by Keith Medcalf 23 Oct '16

23 Oct '16

On: Saturday, 22 October, 2016 17:41, Jean-Francois Mezei <jfmezei_nanog(a)vaxination.ca> wrote: > On 2016-10-22 19:03, Keith Medcalf wrote: > > This does not follow and is not a natural consequence of sealing the > little buggers up so that they cannot affect the Internet > Problem is that many of these gadgets want to be internet connected so > mother at work can check on her kids at home, start the cooking, raise > thermostat etc. This does not require that the devices be open to the Internet, nor does it require that they are under the control of an Internet based controller. > The problem is that as a novelty, people are quick to adopt, but don't > think about making their homes vulnerable to attack. (consider an > internet connected door lock) There are many people who do not read this list who would have nothing whatsoever to do with such a scheme (earlier similar schemes are routers & etc that are programmed and controlled from the "web", and remote access crap which is proxied through a third-party web server -- another ill-conceived and brain-dead idea). This is a self-limiting issue. Darwin will take care of it. Unfortunately there will be collateral damage as those not fit to the continuation of the species are eliminated from the gene pool. We should do our duty and make sure that the pool cleaning proceeds with the maximum speed and efficiency possible.

3 2

Re: Death of the Internet, Film at 11
by Brandon Butterworth 23 Oct '16

23 Oct '16

> From nanog-bounces(a)nanog.org Sat Oct 22 15:51:34 2016 > If they are easy to trace, then it should be easy for you to > tell me how to find them on my network. Not sure if you're trolling now, apologies if what I wrote wasn't clear. If you did want to find them before they attack then you could scan for them, the miscreants already did and easily found them. For some attack vectors there are services that are doing it for you, see the excellent https://www.shadowserver.org/wiki/pmwiki.php/Involve/GetReportsOnYourNetwork > The addresses being known to them doesn't help me at all clean > up my network or help other networks clean up theirs. Did you read my whole mail? The suggestion is people who get attacked tell the ISPs of the devices doing the attacking > It would be rather difficult for me (and I'm sure many other operators) > to distinguish normal Dyn traffic from DDoS Dyn traffic. I was not suggesting you try and guess, I was suggesting you be given data from actual attacks. brandon

4 3

Honorary Unsubscribe: Leo Beranek
by Jay R. Ashworth 23 Oct '16

23 Oct '16

How many people remember that Bolt Beranek and Newman was originally an acoustical consultancy, specializing in concert halls? http://www.honoraryunsubscribe.com/leo_beranek.html?awt_l=ACI.7&awt_m=JXfIg… Happy Landings, Leo! Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://www.bcp38.info 2000 Land Rover DII St Petersburg FL USA BCP38: Ask For It By Name! +1 727 647 1274

2 1

Re: Death of the Internet, Film at 11
by Scott Weeks 22 Oct '16

22 Oct '16

> On Oct 22, 2016 5:11 PM, "Mark Andrews" <marka(a)isc.org> wrote: > One way to deal with this would be for ISP's to purchase DoS attacks > against their own servers (not necessarially hosted on your own > network) then look at which connections from their network attacking > these machines then quarantine these connections after a delay > period so that attacks can't be corollated with quarantine actions > easily. > > This doesn't require a ISP to attempt to break into a customers > machine to identify them. It may take several runs to identify > most of the connections associated with a DoS provider. Josh Reynolds writes: > > And then what? --- marka(a)isc.org wrote: From: Mark Andrews <marka(a)isc.org> They get in someone to clean up their network. When they say it is clean you reconnect them. If this happens more often than once a year you charge them a months fees per additional incident. Have the year timer start when reconnect is requested. You give them what data you have to backup the claim. -------------------------------------------------- I invoke randy's "i encourage my competitor's to do this". scott

1 0

Re: MPLS in the campus Network?
by Marian Ďurkovič 22 Oct '16

22 Oct '16

> Compared to MPLS, a L2 solution with 100 Gb/s interfaces between > core switches and a 10G connection for each buildings looks so much > cheaper. But we worry about future trouble using Trill, SPB, or other > technologies, not only the "open" ones, but specifically the proprietary > ones based on central controller and lots of magic (some colleagues feel > the debug nightmare are garanteed). > > If you had to make such a choice recently, did you choose an MPLS design > even at lower speed ? A year ago we built NREN backbone using TRILL instead of MPLS. 40 POPs, no central controller, RFC standardized TRILL protocol i.e. L2 routing using IS-IS, no STP. See my recent presentation at http://md.bts.sk/sanet-100g-2.pdf for more details. Much easier to setup, operate & maintain than MPLS and obviously much lower cost. Based on 6-months production experience, my recommendation would be to stay away from MPLS in the campus. With kind regards, M.

7 9

Re: Dyn DDoS this AM?
by Alexander Maassen 22 Oct '16

22 Oct '16

Remember ping packets containing +++ATH0 ? Kind regards, Alexander Maassen - Technical Maintenance Engineer Parkstad Support BV- Maintainer DroneBL- Peplink Certified Engineer -------- Oorspronkelijk bericht --------Van: Alain Hebert <ahebert(a)pubnix.net> Datum: 21-10-16 23:37 (GMT+01:00) Aan: nanog(a)nanog.org Onderwerp: Re: Dyn DDoS this AM? Just a FYI, That "horrific trend" has been happening since some techie got dissed on an IRC channel over 20 years ago. He used a bunch of hosted putters to ICMP flood the IRC server. Whatever the community is behind, until the carriers decide to wise up this will keep happening, that is without talking about the industries being developed around DDoSes events. Enjoy your weekend. ( I ain't on call anymore anyway =D ) ----- Alain Hebert ahebert(a)pubnix.net PubNIX Inc. 50 boul. St-Charles P.O. Box 26770 Beaconsfield, Quebec H9W 6G7 Tel: 514-990-5911 http://www.pubnix.net Fax: 514-990-9443 On 10/21/16 11:52, Brian Davies via NANOG wrote: > +1! > > Well said, Patrick. > > B > > On Friday, October 21, 2016, Patrick W. Gilmore <patrick(a)ianai.net> wrote: > >> I cannot give additional info other than what’s been on “public media”. >> >> However, I would very much like to say that this is a horrific trend on >> the Internet. The idea that someone can mention a DDoS then get DDoS’ed Can >> Not Stand. See Krebs’ on the Democratization of Censorship. See lots of >> other things. >> >> To Dyn and everyone else being attacked: >> The community is behind you. There are problems, but if we stick together, >> we can beat these miscreants. >> >> To the miscreants: >> You will not succeed. Search "churchill on the beaches”. It’s a bit >> melodramatic, but it’s how I feel at this moment. >> >> To the rest of the community: >> If you can help, please do. I know a lot of you are thinking “what can I >> do?" There is a lot you can do. BCP38 & BCP84 instantly come to mind. Sure, >> that doesn’t help Mirai, but it still helps. There are many other things >> you can do as well. >> >> But a lot of it is just willingness to help. When someone asks you to help >> trace an attack, do not let the request sit for a while. Damage is being >> done. Help your neighbor. When someone’s house is burning, your current >> project, your lunch break, whatever else you are doing is almost certainly >> less important. If we stick together and help each other, we can - we WILL >> - win this war. If we are apathetic, we have already lost. >> >> >> OK, enough motivational speaking for today. But take this to heart. Our >> biggest problem is people thinking they cannot or do not want to help. >> >> -- >> TTFN, >> patrick >> >>> On Oct 21, 2016, at 10:55 AM, Chris Grundemann <cgrundemann(a)gmail.com >> <javascript:;>> wrote: >>> Does anyone have any additional details? Seems to be over now, but I'm >> very >>> curious about the specifics of such a highly impactful attack (and it's >>> timing following NANOG 68)... >>> >>> https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts- >> twitter-spotify-reddit/ >>> -- >>> @ChrisGrundemann >>> http://chrisgrundemann.com >>

3 2

Re: Death of the Internet, Film at 11
by Brandon Butterworth 22 Oct '16

22 Oct '16

> "their" Whose addresses are known The "CCVT thingies" you refer to. Unlike spoof attacks these are easy to trace > and who are they known to? Those who were attacked by them or worked on mitigation of the attack. If not this time then they should next time as there will be a next time. > Some work can produce Dyn allocations, I suppose. Indeed, that is what I was saying brandon

2 1

Re: Death of the Internet, Film at 11
by Brandon Butterworth 22 Oct '16

22 Oct '16

> From: Mike Hammett <nanog(a)ics-il.net> > "taken all necessary steps to insure that none of the numerous specific types of CCVT thingies that Krebs and others identified" > > Serious question... how? Well their addresses are now known so one way would be for each ISP to drop traffic from them. If people don't fix them why should these devices stay on the net? If say Comcast has a million of them it might be tricky to scale but not impossible It'd take a bit of effort and care to aggregate and disseminate the data to each responsible AS, there'd be risk of bad guys getting the data and false positives/people spoofing to attack others. They'd also be building a tool that some might try to hijack for other purposes. None of that is an excuse to do nothing as is usually the result with any suggested measure that involves doing work to fix a problem I know ISPs generaly don't want the support calls but they'll end up with them and a legislative burden with commerial liability if they don't sort it out themselves. brandon

3 2