April 2000 - Test - lists.nanog.org

Proposed NANOG topics
by Sean Donelan 28 Apr '00

28 Apr '00

On Fri, 28 April 2000, Paul Ferguson wrote: > What does the list, in general, think about this proposal? I think it is a fine idea. Although some may think it isn't a technical topic, instead handled by PR people and those worried about stock prices, not by engineers. On a more proactive stance, I'd like to see a Best Common Practice for how a service provider configures its management network. We've all seen those USR modems stuffed in ISP racks for "out-of-band" management which are likely connected to POTS lines anyone could call if they knew the "secret" phone number. Secure - A relative term, but secured against at least "common" attacks known and used. Fault-tolerant - The management access stills works, even when the network doesn't. Maintainable - People come and go, if you revoke access is it really revoked everywhere. I've seen several proposals, each with their plus and minus. TACACS, Kerberos and other centralized authorization mechanisms tend to have poor fault-tolerant qualities when dealing with misbehaving networks. SSH distributes the authorization, but tends to be difficult to be sure you have revoked everything, everywhere. SecureID does everything, include slice bread, according to the SecureID sales people. But how well does it work when everything isn't working. Using POTS as your out-of-band access tends to be vulnerable to others having access to the public switched network. Using frame-relay or some other closed-user group data transport tends to have nasty fate-sharing properties with your IP network. Do you have "backup" administrative passwords configured in your network equipment for use only when the network is down. How do you prevent someone from taking down your network, just so they can use those backup passwords. If you don't have backup passwords, what do you do if your password doesn't work. At what point do you punt, and if Murphy still gets you, can you say you did everything reasonable to avoid it with a straight face.

3 2

Re: Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Paul Vixie 28 Apr '00

28 Apr '00

rdobbins(a)netmore.net (Roland Dobbins) writes: > ... Paul Vixie, in particular, has made enormous contributions to the Net Thanks for your kind words. However, just for the public record... > Whilst I'm not privy to Mr. Vixie's schedule, I doubt very seriously that he > configures every single router and switch in his network himself, by hand. ...the people here who configure routers are MUCH smarter than I am. -- Paul Vixie <vixie(a)mibh.net> SVP for Internet Services, MFNX M.I.B.H. Inc. is a subsidiary of Metromedia Fiber Network, Inc.

1 0

RE: ABOVE.NET SECURITY TRUTHS?
by Bandy Rush 28 Apr '00

28 Apr '00

--- Exiled Dave <exiled_dave(a)yahoo.com> wrote: > > Maybe this is just the "conspirator" in me, but, > what > if that husband/wife team was 'contracted' for > revenge, for the ebay move, and participated in paid > corporate espionage? > lets stop the public mudslinging, as it is totally uncalled for. next you will be saying Elian, Elvis, Mitnick, and a few Area51 employees co-conspirited on the above.net issue, in addition to leaving some crop circles last nite, and swinging by 50 W Market to leave a suspicious package on MAE-West's doormat. for some reason, i highly doubt this will be investigated by Fox and Mulder of X-Files fame, so let it rest. All we need is our CIDR Report and we will be fine... -BR __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

2 1

Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Roland Dobbins 28 Apr '00

28 Apr '00

OK, I've had just about enough of this. I was subscribed read-only, but this latest brouhaha has motivated me to post the following semi-diatribe: First of all, there -is- a bug in the Catalyst Supervisor software revision 5.4.1 which basically disables the functionality of the enable password. If someone has the login password to the router, they can use the same password to get to enable mode. Yes, someone has to either a) get his password sniffed internally or b) re-use the password on some external network which allows it to get sniffed or c) use a weak and/or easily-guessable password for this exploit to be used. But your blanket statement about the enable password on Cisco switches is incorrect. And while shared segments are generally a Bad Thing, there are certain instances in which they make sense. See http://www.cisco.com/warp/public/707/catos-enable-bypass-pub.shtml for more details. Secondly, there's also a bug in the Cisco telnet daemon for IOS 11.3AA, 12.0(2)-12.0(6) and 12.0(7), excluding 12.0(7)S, 12.0(7)T, and 12.0(7)XE, which allows a very easy DoS attacks against routers and switches running those revs. The bug ID is CSCdm70743, and more information can be found at http://www.cisco.com/warp/public/707/iostelnetopt-pub.shtml . Thirdly, 12-series IOSes can make use of ssh, but there are a lot of other issues with the 12.x revs (see the above paragraph for an example) which have prevented their wide-scale adoption. Kerberos is certainly an option, and a good one, but Monday-morning quarterbacking is really easy, especially when one doesn't have direct knowledge of all the various factors involved, nor any responsibility for maintaining the network in question. Fourthly, being abrasive and condescending certainly isn't a way to get your point across. There is a huge amount of collective talent on this list; Paul Vixie, in particular, has made enormous contributions to the Net community as a whole, and therefore is someone who is, I think, deserving of a more respectful tone than your previous posts on this subject. He's a really smart guy, and he's donated a lot of time and effort and sheer technical know-how towards making the entire Internet more usable and useful for -everyone-. Whilst I'm not privy to Mr. Vixie's schedule, I doubt very seriously that he configures every single router and switch in his network himself, by hand. Most of the real operators here have, at one time or another, had an employee or a group of employees who violated security policy in the name of expediency, and thereby caused a security breach, potential or otherwise. I have no knowledge of the incident at above.net other than the rumors which been bandied about in the public domain, but I wouldn't be surprised if something of this latter sort played a role in their problems, which have long since been resolved. If you have views to contribute, you're going to get far more attention and thought paid to them by refraining from condescension and patronizing rhetoric. You're not going to educate or enlighten anyone my implying that they're stupid or incompetent; and, if you'll think about it, you're probably not perfect, yourself. I think Gary Kasparov summed it up best when he said that he's never learned anything from a chess game he -won-. ----------------------------------------------------------- Roland Dobbins <rdobbins(a)netmore.net> // 818.535.5024 voice -----Original Message----- From: Exiled Dave [mailto:exiled_dave@yahoo.com] Sent: Friday, April 28, 2000 1:10 PM To: nanog(a)merit.edu Subject: Re: ABOVE.NET SECURITY TRUTHS? Ive had some private messages asking if i was involved in this. I wasnt. I was asked to write this initial email by someone who KNOWS the real truth of what happened at above, and why they are being so tight-lipped. Lets think about this, cisco in no way has such a flaw that would allow someone to 'root' and erase all the info on switches. The password was sniffed. Unless above has some employee who felt the need to do do this. But, my Above rep laughling CONFIRMED that this was the problem. COMMON PASSWORDS. Cant we make it a LITTLE tougher on the script kiddies? And not make EVERY MAJOR switch the same password? This is safe to post, because my above sales rep told me what the old password was. God. THATS SECURITY. Sales reps telling Clients OLD PASSWORDS. So, if we wanna verify my authenticity, Here's what she told me: whY2Ghay/1Pee-Fr331y Sound framiliar Above? Im suprised by lack of comment from you. Im out to HELP. Not to hurt. __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

2 1

Re: ABOVE.NET SECURITY TRUTHS?
by Michael Shields 28 Apr '00

28 Apr '00

In article <Pine.BSO.4.21.0004281457540.31198-100000(a)dqc.org>, Chris Cappuccio <chris(a)dqc.org> wrote: > This generally takes a lot of CPU time, and on a 2501 it would probably take > quite a while!!! But in most environments, it is probably worth the tradeoff. (Yes, I did run ssh images on a 2501, when they were available.) -- Shields.

1 0

Re: ABOVE.NET SECURITY TRUTHS?
by Vadim Antonov 28 Apr '00

28 Apr '00

Exiled Dave -- why won't you just go away? Or at least learn not to overuse Caps Lock. --vadim

2 1

RE: ABOVE.NET SECURITY TRUTHS?
by Greene, Dylan 28 Apr '00

28 Apr '00

Well, maybe from the router back to the tacacs server, but it's still cleartext telnet to the router. ..dylan | -----Original Message----- | From: Paul Froutan [mailto:pfroutan@rackspace.com] | Sent: Friday, April 28, 2000 4:46 PM | To: rmeyer(a)mhsc.com | Cc: nanog(a)merit.edu | Subject: RE: ABOVE.NET SECURITY TRUTHS? | | | | I don't think you can. However, I use TACACS on all my switches and | routers. From what I know, TACACS passwords are encrypted | using the key on | your network devices and the TACACS server. So, that, in | combination with | a private management LAN not accessible by your customers | should lock down | your network pretty effectively. Any comments? | | At 4/28/00 -0700, you wrote: | | > > Exiled Dave | > > Sent: Friday, April 28, 2000 1:10 PM | > | > > Lets think about this, cisco in no way has such a flaw | > > that would allow someone to 'root' and erase all the | > > info on switches. The password was sniffed. | > | >Can one setup SSH on a Cisco 6509? | | Paul Froutan Email: | pfroutan(a)rackspace.com | Rackspace, Ltd <http://www.rackspace.com> | |

1 0

Re: ICQ & AOL
by Universal Rundle 28 Apr '00

28 Apr '00

I'd venture to say that this is the result of the following phenomena: Block all APNIC and RIPE assigned networks at the border and all of the sudden, hack attempts and CC fraud disappear. It's fan-%^&#ing-tasticly simple to do and so very effective. >From: "Igor V. Vorontsov" <iv(a)akcecc.net> >To: nanog(a)merit.edu >Subject: ICQ & AOL >Date: Thu, 27 Apr 2000 13:35:10 +0300 (EEST) > > >Hello colleque, > >Sorry my English. > >If engeneers from AOL or ICQ is present here... > >Many pople from Russia and Ukraine can't connect to your service. >Your engeeners was closed many networks from Russia and Ukraine. >But why? Many people from our country was usable service ICQ, but now >this service is closed for them. > >Please open for your service our networks and resolve this problem. >One of them - network 193.227.207.0/24 > > > >Igor V. Vorontsov >IV144-RIPE ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

5 5

Re: ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 28 Apr '00

28 Apr '00

EXACTLY. You'd think Above.Net would realize this. And maybe not use the SAME password everywhere, and permit some 12 year old to put all of our livlihood at risk. This was so easily done with ONE sniffed password, I hope that everyone takes a second look at their own security procedures. Dont you? --- dhudes(a)hudes.org wrote: > the whole issue you raise is password management, > long since addressed > in the UNIX world and supported by cisco routers: > Kerberos. > > On Fri, 28 Apr 2000, Exiled Dave wrote: > > > > > > > > > I guess by now everyone knows what happened. > > Paul, can you share some info > > > > with the rest of us about what the > vulnerability > > was so we can "plug the > > > > hole"? > > > > > > "Plug the hole" was a figure of speech. You > pretty > > much all know that if > > > MFN/Abovenet suspected a way in which other > > providers were vulnerable, we'd > > > have shared that information with you > (privately) by > > now. > > > -- > > > Paul Vixie <vixie(a)mibh.net> > > > SVP for Internet Services, MFNX > > > > HAHAHA the reason no other provider is vulnerable > is > > because no other > > provider with half a clue has the same simple > login > > and enable "p4ssw0rds" > > on all their switches, and internal machines in > their > > sjc facilities on > > hubs. What does one expect will happen when their > > switch passwords become > > public knowledge? The funny thing is the passwords > > were originally sniffed > > by MafiaBoy. > > > > There's no need to "privately" share a fix/hole in > > this case. > > The ENTIRE problem here, is above's total > inability to > > secure their own switches. > > And it SHOULD be public. People who control > literally > > MILLIONS OF DOLLARS of other people's data per > second > > NEED to learn, that CORE NETWORKS NEED TO BE > > PROTECTED. (i.e. CHANGING PASSWORDS, NOT > PERMITTING > > "COMMON PASSWORDS") > > I hope we ALL learn a lesson from this. > > > > > > > > > > > > __________________________________________________ > > Do You Yahoo!? > > Talk to your friends online and get email alerts > with Yahoo! Messenger. > > http://im.yahoo.com/ > > > __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

1 0

ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 28 Apr '00

28 Apr '00

> > I guess by now everyone knows what happened. Paul, can you share some info > > with the rest of us about what the vulnerability was so we can "plug the > > hole"? > > "Plug the hole" was a figure of speech. You pretty much all know that if > MFN/Abovenet suspected a way in which other providers were vulnerable, we'd > have shared that information with you (privately) by now. > -- > Paul Vixie <vixie(a)mibh.net> > SVP for Internet Services, MFNX HAHAHA the reason no other provider is vulnerable is because no other provider with half a clue has the same simple login and enable "p4ssw0rds" on all their switches, and internal machines in their sjc facilities on hubs. What does one expect will happen when their switch passwords become public knowledge? The funny thing is the passwords were originally sniffed by MafiaBoy. There's no need to "privately" share a fix/hole in this case. The ENTIRE problem here, is above's total inability to secure their own switches. And it SHOULD be public. People who control literally MILLIONS OF DOLLARS of other people's data per second NEED to learn, that CORE NETWORKS NEED TO BE PROTECTED. (i.e. CHANGING PASSWORDS, NOT PERMITTING "COMMON PASSWORDS") I hope we ALL learn a lesson from this. __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

1 0