July 2000 - Test - lists.nanog.org

RE: bad idea?
by Jamie Rishaw 06 Jul '00

06 Jul '00

| In the event of a route flap, or other instability, you could | potentially | have traffic shifted to another server without the | established TCP state, | which would prompt that server to generate an RST and end the | connection. If the route then comes back, you end up resetting your | connection for nothing. True, but in the world of what-would-we-use-this-practice-for, it mostly applies to web, which for most intents is a one shot connect-get-drop; I doubt a single TCP RST would really irk too many users. | Actually, DNS works very well for this kind of thing. Since its a | stateless protocol it isn't affected by this, and once your | client has its | answer it continues to use the same IP, which is routed normally. I | believe this is how's Akamai load balancer works (try looking up | www.yahoo.com from a name server on the left coast and on the right | coast). I see absolutily nothing wrong with using DNS in this manner. I've been a fan of advertising one globally-routed block for server farms in multiple locations for some time. Think in global terms: If you have a farm in the States (West, East), add one in AU, one in EU, one in JP, you don't have to worry about a smart DNS server. Just one server, one IP address, advertised at each data center (or site) you're at (or are). If a certain site goes down (in my argument, say, the AU site goes down), the AU clients that would normally hit the AU site would be seamlessly (as far as "seamless" goes) directed to the next closest site. If a smart DNS server gave a local AU address, AU clients with the AU IP address cached would fail.

2 1

Re: RBL-type BGP service for known rogue networks?
by Richard A. Steenbergen 06 Jul '00

06 Jul '00

On Thu, 6 Jul 2000, Dan Hollis wrote: > > On Thu, 6 Jul 2000, Tony Mumm wrote: > > I think that is similar to what you want....and it might be adequate > > against scanners and other simple hacks. I don't think it would be > > worth anything against a flood, > > The BL wouldnt try to block floods or DoS attacks. Its aim is to block > sites which originate breakins. "Script kiddie" sites come in 3 flavors, the script kiddies themselves (dialups or cable modems for the 14 year olds), the "helper sites" aka the sites run by those who are friends of the SKs or associated with them (usually machines on college dorm ethernets or some 18 year old's "linux shell server" business project), and the compromised sites from which attacks are launched. You'd probably have more luck just reporting the security breaches on the hacked machines, I don't know too many places that will take NO action against them assuming you can actually contact them (which can sometimes be extremely difficult to do). Getting the dialups will not be possible with this kind of a system, DHCP makes it useless, and even sites with static addresses like most cable modems will probably not be pollitically possible. Sometimes its difficult to form a proven association between the people behind the mischief and the mischief itself, because after they lose one or two accounts they generally catch on and try not to do it from their direct connections, but its possible. The "helper sites" are questionable as well, I don't see this being viable against university connections, and as for the "helper /24s" these are almost always some 18 year old's attempt at a small business by colo'ing a Linux server at some provider, paying a few hundred for a small connection, etc. Most of these places receive as many attacks as they generate (if any), and quickly get tossed by their providers. I can think of very few actual networks who are entirely uncooperative regarding proveable issues, certainly not enough to make any kind of impact in the grand scheme of things IMHO. While spam has an economic motivation which can draw semi-legit networks into "bad" activities, SK stuff generally does not. I think these are the reasons such a blackhole list has never been done. An unresponsive smurf amplifier blackhole list on the other hand, might be useful... but probably wouldn't have a huge impact either these days... -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

2 1

MCI Outage
by Larry McLemore 06 Jul '00

06 Jul '00

FYI At 17:10 all traffic from the initial MCI fiber cut has been restored. Larry

1 0

RE: scripts kiddie sites
by Karyn Ulriksen 06 Jul '00

06 Jul '00

Thanks, Scott. I figured that these were what was being referred to. I just never heard them referred to as scripts kiddies before. karyn -----Original Message----- From: Scott Francis [mailto:scott@virtualis.com] Sent: Thursday, July 06, 2000 3:01 PM To: Karyn Ulriksen Cc: 'nanog(a)merit.edu' Subject: Re: scripts kiddie sites Karyn Ulriksen wrote: > > For my edjumacation, could someone clarify what a scripts kiddie source > network as it's being bandied about here is? I can only *assume*, and I try > to avoid doing that (not always successfully). check rootshell.com, assorted BUGTRAQ postings, antionline.com, 2600.com, l0pht.com, cultdeadcow.com, etc. etc.and just start following links. CAVEAT: I am not saying that any of the above sites are exclusively script kiddie warehouses; however, I know from former experience that they are all good places to start if you're looking to crack some anonymous box somewhere. Most any well done Unix security site is. Please don't flame for either dissing a site you like or not including one that you think should be blackballed - this list was off the top of my head, and I haven't done any research on the subject in months. YMMV. -- Scott Francis ----BEGIN GEEK CODE BLOCK---- GCS/MC/>AT d--(?) s: a24 C++++ UBL++++$ P+++ L++@ E- W++(-) N+ o? K- w-- !O M-- !V PS+(-) PE Y+ PGP++ t* 5 X+ R(+) tv b++@ DI+++ D++@ G++ -----END GEEK CODE BLOCK-----

1 0

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 06 Jul '00

06 Jul '00

Q. Yeah, but do we really want to black hole Exodus?? :) A. Ok, Yeah, we really do... but can we get away with it?!! :) :) Karyn -----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Thursday, July 06, 2000 1:39 PM To: Brian Sheppard Cc: 'nanog(a)merit.edu' Subject: Re: RBL-type BGP service for known rogue networks? On Thu, 6 Jul 2000, Brian Sheppard wrote: > I doubt any such database exists publically. It's a liability issue for one > and if it was being compiled, officials at the big providers would probably > already have taken corrective action. And those that dont take corrective action are those who need to be blackholed. -Dan

3 2

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 06 Jul '00

06 Jul '00

Genuity used to do a lot of work with this type of service, they refered me to Paul Vixie for mediation when a site we hosted back when I was at AnaServe decided to spam the world and they blackholed us. Also, Paul Vixie (www.vix.net, I think)has some links to services of this type originally geared towards SPAM, but I'm sure it has these types of capabilities. -----Original Message----- From: Dan Hollis [mailto:goemon@sasami.anime.net] Sent: Thursday, July 06, 2000 11:53 AM To: 'nanog(a)merit.edu' Subject: RBL-type BGP service for known rogue networks? Is there any RBL-type BGP service for blackholing known rogue networks? Eg, networks which harbor script kiddies and refuse to take any action when notified of ongoing attacks? For instance the network tin.it (194.243.154.0 - 194.243.155.255) appears to be rogue. -Dan

7 8

Re: RBL-type BGP service for known rogue networks?
by Richard A. Steenbergen 06 Jul '00

06 Jul '00

On Thu, 6 Jul 2000 Valdis.Kletnieks(a)vt.edu wrote: > On Thu, 06 Jul 2000 12:22:09 PDT, Dan Hollis said: > > Im not talking about spammer networks im talking about script kiddie > > networks. We already have several systems for dealing with spammers but > > none for script kiddies. (I cant be the only person who sees a problem > > with this picture?) > > The biggest problem is that it's a lot easier to verify that a given site > is a spamhaus. Remember that source IP addresses (which is all that your > border router sees) are forgeable - making for a nice DOS attack. Forge > packets from a competitor's site, get them labelled as a skriptz kiddie site, > and BGP-blackholed. DoS attacks with possible spoofed source addresses would obviously not be a good criteria to blackhole by... Unauthorized mass vunerability scans on the other hand, COULD be. You'd have to make sure that it wasn't just a spoofed SYN flood designed to look like a scan, and that there were actual successfully opened sockets (this is assuming TCP scans). For certain things this pretty much entails setting up a "bait" server, perhaps binding a range of IPs on it, to look for at least the "obvious" scans. I suspect not as many people as you would think are qualified to setup and accurately use this kind of system (the number of stupid and paranoid people who will complain about innocent behavior is almost as high as the number of stupid and unconcerned people out there who will be compromised). -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

4 4

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 06 Jul '00

06 Jul '00

>You can play tricks with BGP to do this. Here's how MAPS RBL does it, and >how you can use it: > >http://www.mail-abuse.org/rbl/usage.html#BGP > >Mark That's actually pretty clean, too. I haven't implemented a route server on my networks. But I play around on Cerf Net's sometimes when I tracking down BGP problems. What's the consensus on using one at the Tier 2 level? Karyn -----Original Message----- From: Mark Mentovai [mailto:marklist@ggn.net] Sent: Thursday, July 06, 2000 1:23 PM To: nanog(a)merit.edu Subject: RE: RBL-type BGP service for known rogue networks? Karyn Ulriksen wrote: >What I was saying is that they had already set up some type of blackhole >system that I was lead to believe they were doing at the router level (not >mail system level). When they had us blackhole, we couldn't get past their >core routers. I know your next thougt is that they just threw us into their >route filter, but my understanding is that they offered a service that you >subscribed to and the updated the filter on the fly. Which sounds like it >would work for what you may be looking for in the "kiddie script network" >scenario (which I assume means either IRC crapola or DOS crapola in general) >or those wonderful .ru sites serving out that hardcore kiddie porn stuff via >cgi calls. You can play tricks with BGP to do this. Here's how MAPS RBL does it, and how you can use it: http://www.mail-abuse.org/rbl/usage.html#BGP Mark -- Do not reply directly to this e-mail address -- Mark Mentovai UNIX Engineer Gillette Global Network

1 0

RE: RBL-type BGP service for known rogue networks?
by Karyn Ulriksen 06 Jul '00

06 Jul '00

>I don't know if this what you were observing, but the MAPS RBL can be >used in this capacity. See also: > > http://www.mail-abuse.org/rbl/usage.html#BGP > >Of course, you'd want a different database for blocking script kiddies. > >-- David Ahhh, the sweet smell of validation at last! :) That's it, that what kicked my network into the ole blackhole back then! - Thanx! Karyn. Karyn Ulriksen wrote: > > What I was saying is that they had already set up some type of > blackhole system that I was lead to believe they were doing at the > router level (not mail system level). When they had us blackhole, we > couldn't get past their core routers. I know your next thougt is that > they just threw us into their route filter, but my understanding is > that they offered a service that you subscribed to and the updated the > filter on the fly. I don't know if this what you were observing, but the MAPS RBL can be used in this capacity. See also: http://www.mail-abuse.org/rbl/usage.html#BGP Of course, you'd want a different database for blocking script kiddies. -- David

1 0

Re: RBL-type BGP service for known rogue networks?
by Dan Hollis 06 Jul '00

06 Jul '00

On Thu, 6 Jul 2000, Brian Sheppard wrote: > I doubt any such database exists publically. It's a liability issue for one > and if it was being compiled, officials at the big providers would probably > already have taken corrective action. And those that dont take corrective action are those who need to be blackholed. -Dan

1 0