- Test - lists.nanog.org

Re: "Defensive" BGP hijacking?
by Bryant Townsend 21 Sep '16

21 Sep '16

Hello Everyone, I would like to give as much insight as I can in regards to the BGP hijack being discussed in this thread. I won’t be going into specific details of the attack, but we do plan to release more information on our website when we are able to. I also wanted to let Hugo (who started the thread) know that we harbor no hard feelings about bringing this topic up, as it is relevant to the community and does warrant discussion. Hugo, you may owe me a beer the next time we meet. :) We agree with others that NANOG is the most appropriate venue to answer any questions and discuss the topic at hand. I have been attending NANOG for the past 3-4 years, and I can assure you that it is of the utmost importance to me how the community views my company, my employees, and myself. There are many people in this community that I personally have the upmost respect for, and it would sadden me If I were to lose the respect of mentors, colleagues, and friends by not responding. That being said, I think there are a fair number of people in NANOG that would vouch for my character and ethics relating to the intent of my actions, even if I were to remain silent. I would also like to preface that my explanation of the events that occurred and actions taken by BackConnect are not to justify or provide excuses. My goal is to simply show what happened and give insight into our actions. I will start with a little background to bring anyone up to speed that is not aware of the events that transpired. *About the company, BackConnect, Inc.*: We are a new (~4 months old) open-sourced based DDoS mitigation and network security provider that specializes in custom intrusion detection and prevention systems. We also provide threat intelligence services, with an emphasis on active botnets, new and upcoming DDoS attack patterns, and boot services. From time to time, this information flows through our network for collection purposes. *Events leading to the Hijack*: On 9/6/2016, ~10:30AM PST, one of our clients and our website received a large and relatively sophisticated DDoS attack. The attack targeted entire subnets and peaked over 200 Gbps and 40Mpps. Although the attack was automatically detected and mostly filtered, there was initially a small leak. In response we quickly applied new security rules that rendered it entirely ineffective. The attackers continued to attack our network and client for roughly 6 hours before giving up. *Events that caused us to perform the BGP hijack*: After the DDoS attacks subsided, the attackers started to harass us by calling in using spoofed phone numbers. Curious to what this was all about, we fielded various calls which allowed us to ascertain who was behind the attacks by correlating e-mails with the information they provided over the phone. Throughout the day and late into the night, these calls and threats continued to increase in number. Throughout these calls we noticed an increasing trend of them bringing up personal information of myself and employees. At this point I personally filled a police report in preparation to a possible SWATing attempt. As they continued to harass our company, more and more red flags indicated that I would soon be targeted. This was the point where I decided I needed to go on the offensive to protect myself, my partner, visiting family, and my employees. The actions proved to be extremely effective, as all forms of harassment and threats from the attackers immediately stopped. In addition to our main objective, we were able to collect intelligence on the actors behind the bot net as well as identify the attack servers used by the booter service. *Afterthoughts*: The decision to hijack the attackers IP space was not something I took lightly. I was fully aware there were services that reported such actions and knew that this could potentially be brought up in discussion and hurt BackConnect’s image. Even though we had the capacity to hide our actions, we felt that it would be wrong to do so. I have spent a long time reflecting on my decision and how it may negatively impact the company and myself in some people’s eyes, but ultimately I stand by it. The experience and feedback I have gained from these events has proven invaluable and will be used to shape the policies surrounding the future handling of similar situations. I am happy to field questions, but cannot promise any answers, disclosure of further information, or when they will be responded to. Sincerely, Bryant Townsend

14 20

Re: PlayStationNetwork blocking of CGNAT public addresses
by Mark Andrews 21 Sep '16

21 Sep '16

Mark Andrews writes: > > In message <09342130-874F-4FA4-B410-B7B66A75FA4D(a)mtin.net>, Justin Wilson wri > te > s: > > PSN is one reason I am not a fan of CGNAT. All they see are tons of > > connections from the same IP. This results in them banning folks. Due > > to them being hacked so many times getting them to actually communicate > > is almost impossible. My .02 is just get the gamers a true public if at > > all possible. > > > > Justin Wilson > > j2sw(a)mtin.net > > What we need is business tech reporters to continually report on > these failures of content providers to deliver their services over > IPv6. 20 years lead time should be enough for any service. Additionally is the a role for the SEC in ensuring that companies take IPv6 seriously? If I remember correctly they got involved with Y2K. Just because there isn't a hard date it doesn't mean that IPv6 is any less important than Y2K to your business's survival. > Mark > -- > Mark Andrews, ISC > 1 Seymour St., Dundas Valley, NSW 2117, Australia > PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org -- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka(a)isc.org

1 0

Level 3 GBLX / Legacy Twt IPv6 Issue
by Jeff Waddell 20 Sep '16

20 Sep '16

I am having an issue where since the the old twt convergence by Level 3 to the GBLX network/AS3549 our v6 prefix isn't being announced outside of Level 3. I have had a ticket open for a week and had one engineer who seemed to be on to fixing it (regarding an export policy) but then that went silent and now I am getting no-where with support (other than promised call backs) Can someone from Level 3 reach out off list and help me out? Thanks Jeff jeff(a)waddellsolutions.com

1 0

Re: "Defensive" BGP hijacking?
by Scott Weeks 20 Sep '16

20 Sep '16

--- dougm.work(a)gmail.com wrote: From: Doug Montgomery <dougm.work(a)gmail.com> If only there were a global system, with consistent and verifiable security properties, to permit address holders to declare the set of AS's authorized to announce their prefixes, and routers anywhere on the Internet to independently verify the corresponding validity of received announcements. *cough https://www.nanog.org/meetings/abstract?id=2846 cough* ------------------------------------------------ Yes, RPKI. That's what I was waiting for. Now we can get to a real discussion... ;-) scott

8 15

Customers announcing communities to SP of SP
by Jason Lixfeld 20 Sep '16

20 Sep '16

Hi, Consider the following scenario: - Customer A is a customer of SP A - SP A is a customer of SP B - SP B has a traffic engineering community implementation With regards to using BGP communities for TE: - Does SP A write their own community implementation that maps to (some portion of) the community implementation of SP B? - Does SP A write their own community implementation that has no mappings at all to the community implementation of SP B; any TE that is required to be pushed to SP B is done by some dialog and coordination between Customer A and SP A? - Does SP A allow Customer A to announce prefixes tagged with SP B’s communities[1][2] - Is this sort of thing really complicated today, but one of the goals of draft-heitz-idr-large-community? [1] Customer A has knowledge of SP A’s upstream SP B [2] This opens up a can of worms where SP A or SP B implements some communities prefixed with reserved ASes, so we’ll assume that SP A implements some method of allowing communities prefixed with ASes of SP A and SP B only. Thanks!

4 3

ATT contact about BGP leak
by Fabien V. 19 Sep '16

19 Sep '16

Hi the list =) Someone from AT&T on the list ? We have a potential BGP leak on a recently transfered /16 Sent email to noc @ but no reply since 6 hours. Perhaps someone can contact me directly ? fabien AT beufa DOT net Thanks ----- Fabien VINCENT ------------------------------------------------------------------- Twitter : @beufanet Website : https://beufa.net

1 0

Ebay operations contact please
by Inglis, Adam 19 Sep '16

19 Sep '16

Can someone from ebay NOC (or similar) contact me off list for an issue with search results from a specific CIDR of our network that the end user swears doesn't happen elsewhere? Thanks. The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender or send back to returns(a)agoc.com and delete the material from any computer.

1 0

Huawei NE
by Lewis,Mitchell T. 19 Sep '16

19 Sep '16

Hi All, Does anyone have any experiences with the Huawei NE platform in a service provider environment they can share? Private message is fine. I am comparing against Cisco ASR & Juniper MX. Regards, Mitchell T. Lewis MLewis(a)TechCompute.Net |203-816-0371 PGP Fingerprint: 79F2A12BAC77827581C734212AFA805732A1394E Public PGP Key

1 0

Re: PlayStationNetwork blocking of CGNAT public addresses
by Larry Sheldon 18 Sep '16

18 Sep '16

On 9/18/2016 16:26, Larry Sheldon wrote: > > > On 9/18/2016 08:19, Mike Hammett wrote: >> People love to hate incumbent telcos because of their arrogance (and >> frankly it's deserved), but people forget that big content can be >> just as arrogant and just as deserving of hatred. > > I never did see the benefit or the approach. To anybody. > I never did see the benefit oF the approach. To anybody. -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

1 0

Re: PlayStationNetwork blocking of CGNAT public addresses
by Larry Sheldon 18 Sep '16

18 Sep '16

On 9/18/2016 08:19, Mike Hammett wrote: > People love to hate incumbent telcos because of their arrogance (and > frankly it's deserved), but people forget that big content can be > just as arrogant and just as deserving of hatred. I never did see the benefit or the approach. To anybody. -- "Everybody is a genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is stupid." --Albert Einstein From Larry's Cox account.

1 0