February 2001 - Test - lists.nanog.org

It was documented (Re: Warning: Cisco RW community backdoor. )
by Sean Donelan 26 Feb '01

26 Feb '01

On Mon, 26 February 2001, John Fraizer wrote: > While I agree that "public" and "private" are "wellknowns," in most > implementations, they at least show up in the code. Cisco chose to hide > this one where it would not show up in the code. That IMHO is a very bad > thing and does bad things to my confidence level in Cisco. What is the difference between a bug and a feature, the feature is documented. http://www.protocols.com/pbook/ilmi.htm Protocol Limitations The following are some known SNMP limitations. ATM messages must be formatted according to SNMP version 1, not SNMP version 2. ALL SNMP messages will use the community name ILMI. In all SNMP Traps, the agent address field always has an IP Address value of 0.0.0.0. The supported traps are coldStart and enterpriseSpecific. In all SNMP traps, the timestamp field contains the value of the agents sysUpTime MIB object at the time of trap generation. In all of the standard SNMP traps, the enterprise field in the Trap PDU contains the value of the agents sysObjectID MIB object. The size of messages can be up to 484 octets. Those darn ATM people again. Screwing up a perfectly good protocol for their ATM UNI ILMI stuff.

1 0

Re: Warning: Cisco RW community backdoor.
by Shawn McMahon 26 Feb '01

26 Feb '01

There are some folks who think this only lets you change the contact string. This is false; it lets you change several strings. However, they appear to all be informational in nature, not operational. I think the information leakage point is a bigger deal than the information change point, although you could confuse a sufficiently clueless administrator by changing the location information.

1 0

Re: Warning: Cisco RW community backdoor.
by Shawn McMahon 26 Feb '01

26 Feb '01

Would it be redundant to add that if IOS was open, we'd have known about this years ago and it would have been fixed years ago?

2 1

Fw: Re: Warning: Cisco RW community backdoor. (fwd)
by Simon Lyall 26 Feb '01

26 Feb '01

Further updates.. It's not TOO bad. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz ---------- Forwarded message ---------- Date: Mon, 26 Feb 2001 21:54:50 -0400 From: Joe Abley <jabley(a)automagic.org> To: nznog(a)list.waikato.ac.nz Subject: Fw: Re: Warning: Cisco RW community backdoor. More details below. -----Original Message----- From: "James A. T. Rice" <jamesr(a)rd.bbc.co.uk> Date: Tue, 27 Feb 2001 01:46:37 +0000 (GMT) Subject: Re: Warning: Cisco RW community backdoor. To: <members(a)lonap.net>, , , <ops(a)linx.net> Just a couple of things to note, I've been asked what the backdoor is, if its the community "ILMI" or if that was just an example, the answer is yes - "ILMI" is the backdoor which gives read-write access to parts of the SNMP base. Its looks like parts of my earlier email are somewhat misleading, the ILMI community appears to only allow RW access to the system object and possibly some more objects. Its not a 'standard' open RW community. hence the damage caused by this backdoor is limited. There is still some write access however, so the fix mentioned below is still highly recommended. And of course - it allows people to read what IOS/model cisco you have, which could be used to find exploitable bugs in that particular release. Oh I wonder what the chances of having a router stolen due to discovery of system.sysLocation is! :-) Warm Regards James -- James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk Internet Operations Engineer | Phone: 01737 839 737 BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. On Tue, 27 Feb 2001, it was written: > If your router responds to `snmpwalk router.isp.net.uk ILMI`, you > probabally will want to do the following to disable it: > conf t > snmp-server community ILMI RO 99 > access-list 99 deny any log > (pick another spare access-list if 99 isn't available) > > If you dont, assuming your ios/hardware combination supports it, > (most of the bigger routers do) anyone can do things like: > `snmpset router.isp.net.uk ILMI system.sysName.0 s \ > "ALL YOUR ROUTER ARE BELONG TO US."` > Thats a harmless example. You can do almost anything with RW snmp. > > Warm Regards > James > > -- > James A. T. Rice | Email: jamesr(a)rd.bbc.co.uk > Internet Operations Engineer | Phone: 01737 839 737 > BBC Internet Services, Kingswood Warren, Tadworth, Surrey, UK. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Update for noc .nl problem..
by Shawn McMahon 26 Feb '01

26 Feb '01

On Sun, Feb 25, 2001 at 09:02:46PM -0800, Ben Browning wrote: > > The only possible reason you could want names, or account names, or > addresses, or copies of my logs, etc would be to initiate civil or criminal > proceedings, in which case the subpoena should be a piece of cake. Wow; despite the lengthy discussion in which I've posted at least two messages talking about another possible reason, you've gotten this far in the thread without realizing there was more than one possible reason? This reminds me of the old joke about how you tell something to a blonde with two black eyes. I've already tried to tell you twice, a third time would just waste my time and annoy the pig.

1 0

Re: Next NANOG
by Aviva Garrett 26 Feb '01

26 Feb '01

No. In message <Pine.LNX.4.30.0102261033550.8406-100000(a)localhost.localdomain>you w rite: > > Was the date/place of the next NANOG announced in Atlanta? > > Pete. > > >

1 0

Circuit Database
by Berger, Gary 26 Feb '01

26 Feb '01

Can anyone point me to a good tool that manages circuit information Thanks Gary Berger Internal Consultant, Principal Dow Jones & Company Enterprise Network Services

1 0

RE: IXs
by Akio Sugeno 25 Feb '01

25 Feb '01

At PM 12:31 02/25/01, Daniel Golding wrote: >MAE-LA has never been very hot. Same with NYIIX. Currently we have about 40 members and the peak traffic is approx. 320Mbps. Entering 2001, our growth rate jumped to 3-5 member/mo. We've got 5 members in January and 3-5 member are currently under contract including fairy large ISPs. --akio ----------------------------------- Akio Sugeno Chairman of NYIIX/LAIIX/6IIX Voice: 718-355-2509, Fax: 718-355-2517

1 0

Re: IXs
by Akio Sugeno 25 Feb '01

25 Feb '01

> >Via Telehouse's LAIIX <URL:http://www.laiix.net/> it is possible to gain >access to MAE-LA connected peers still. Or, at least, that is the claim. You are absolutely correct. The configuration is: LAIIX ---- LAAP ---- MAE-LA LAIIX members can peer with anyone at LAAP and MAE-LA. --akio ----------------------------------- Akio Sugeno Chairman of NYIIX/LAIIX/6IIX Voice: 718-355-2509, Fax: 718-355-2517

1 0

Re: IXs
by Josh Richards 25 Feb '01

25 Feb '01

* Troy Davis <troy(a)nack.net> [20010225 00:48]: > > Per www.mae.net, MFS isn't accepting new peers at MAE-LA or MAE-Houston. Via Telehouse's LAIIX <URL:http://www.laiix.net/> it is possible to gain access to MAE-LA connected peers still. Or, at least, that is the claim. Though, that is a good point against worrying about going into MAE-LA I suppose, since more potential peers will be discouraged and unlikely to join. Is the significance of MAE-LA so small that someone with a presence at all of the other major NAPs (MAE-West, MAE-East, AADS, PacBell-NAP, Sprint-NAP, PAIX) can safely ignore it? -jr ---- Josh Richards [JTR38/JR539-ARIN] <jrichard(a)geekresearch.com/cubicle.net/fix.net/freedom.gen.ca.us> Geek Research LLC - <URL:http://www.geekresearch.com/> IP Network Engineering and Consulting

3 2