March 2001 - Test - lists.nanog.org

RE: Would anyone be interested (SQL/Bind)
by Roeland Meyer 13 Mar '01

13 Mar '01

> From: Steven J. Sobol [mailto:sjsobol@NorthShoreTechnologies.net] > Sent: Monday, March 12, 2001 5:44 PM > On Mon, 12 Mar 2001, David R. Conrad wrote: > > > I might point out that BIND version 9 comes with a > Postgres/SQL sample > > "simple database interface" driver that permits the storage > of DNS zone > > data in a Postgres/SQL database. Zone data is extracted > from the database > > per query (the data does not need to be extracted and BIND > reloaded). If > > the DNS load is too high to support SQL queries on a > per-DNS query basis, > > using a stealth primary would most likely work. > > I'll take a look at that. It might be a good idea to make it > modular, if > it isn't already modular[0], so that people could create > "plugins" that > work with other databases. Personally, I'm going to see how > much work is > involved in porting the code to MySQL, since I don't use Postgres. If "other databases" include Oracle 8i, I might be interested. Might as well put it on a production-ready DBMS.

1 0

Re: tcp,guardent,bellovin
by Jim Duncan 12 Mar '01

12 Mar '01

Rafi Sadowsky writes: > No eavesdropping at all ? how can a TCP connection be hijacked if you're > not on the connection path? > (Or capable of diverting the connection past you - > breaking routers/source_routing/<whatever>.... ) The attacker merely has to get his data into the TCP stream on the victim host. No return traffic necessary. This means the attacker can be _outside_ the victim's network if source address forgery isn't prevented. This is _not_ new; same attack Mitnick used on Shimomura. If you're on the path, you certainly don't need to guess the TCP ISN to hijack a connection. This isn't new, either. :-) By the way, Cisco stuff that has the fix we advertised in the security advisory a couple of weeks ago is *NOT* vulnerable to the attack announced by Guardent. The older stuff in IOS is not vulnerable either, but some of our other products _are_ vulnerable. Of course, we already announced that at http://www.cisco.com/warp/public/707/advisory.html . I'll be along with a more official announcement, but I figured I'd mention it here, too. Jim -- Jim Duncan, Product Security Incident Manager, Cisco Systems, Inc. <http://www.cisco.com/warp/public/707/sec_incident_response.shtml> E-mail: <jnduncan(a)cisco.com> Phone(Direct/FAX): +1 919 392 6209

1 0

Re: tcp,guardent,bellovin
by Steven M. Bellovin 12 Mar '01

12 Mar '01

In message <Pine.GSO.4.31.0103121911520.9269-100000(a)meron.openu.ac.il>, Rafi Sa dowsky writes: > > Hi > > Is there anything actually new in this exploit compared to the known TCP >hijacking vulnerabilities as portrayed say in Phrack 50(Juggernaut) ? Juggernaut requires eavesdropping; this one doesn't. --Steve Bellovin, http://www.research.att.com/~smb

2 1

Re: tcp,guardent,bellovin
by Steven M. Bellovin 12 Mar '01

12 Mar '01

In message <200103122349.f2CNndk28613(a)foo-bar-baz.cc.vt.edu>, Valdis.Kletnieks@ vt.edu writes: > >On Mon, 12 Mar 2001 18:09:32 EST, "Richard A. Steenbergen" said: >> And since the "victim" will have the current sequence number for inbound >> data, what would keep it from (correctly) sending an RST and tearing down >> this false connection? > >And THAT my friends, was the *original* purpose for a TCP SYN flood - it >wasn't to DOS the victim, it was to DOS a machine *trusted by* the victim >so you could forge a connection and NOT get nailed by an RST. > >I'm sure that Steve Bellovin can point us at the original discussion >of this, which was *ages* ago. I remember hearing that Kevin Mitnick >used that (in addition to other tricks) against Shimomura's machines >and thinking "Hmm.. so it's *not* just a theoretical attack anymore..." > > More or less. When doing a sequence number guessing attack, one of the problems faced by the attacker is preventing the spoofed machine from replying with an RST to the SYN+AC for a connection it knows nothing about. Morris's original version used a low-rate SYN flood that exploited a bug in the BSD kernel to effectively gag a low-numbered port. His paper can be found at ftp://ftp.research.att.com/dist/internet_security/117.ps.Z This isn't the same weakness that was exploited by the early SYN floods, but it took advantage of the same limit on half-open connections. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: tcp,guardent,bellovin
by Richard A. Steenbergen 12 Mar '01

12 Mar '01

On Mon, Mar 12, 2001 at 11:25:35PM +0100, bert hubert wrote: > > The 50.000 foot view: There is a further vulnerability in TCP/IP if > you can determine the Initial Sequence Number without actually > starting a connection. By exploiting your knowledge of the remote > host, a telephone modem user can cause webservers to become massive > Denial of Service agents, targeting arbitrary targets. Lots of > consumer editions of windows come with easily guessable sequence > numbers. ... > Now, if you are able to guess the number '14' above, and you know the > packet sizes a server will produce, you can invent ACKs from arbitrary > source IP addresses. The Server Computer doesn't notice anything > interesting, and blasts out data at speeds possibly exceeding its > interface or line speed. And since the "victim" will have the current sequence number for inbound data, what would keep it from (correctly) sending an RST and tearing down this false connection? Also, even given the assumption that Windows is easily ISN spoofable (which I would certainly hope is not the case, I thought everyone learned that lesson years ago), I don't see many consumer editions of windows being readily available to hackers, running webservers with large files on fast uplinks. I think any kind of useful ISN-guessing based DoS would require sniffing access to the server in question. It might be possible to "speed up" the transmission of an already established connection inproperly for a short time, but this would quickly fall over and die. It might also be possible to trick the "big server" into sending more data to a host which does not exist and cannot reply then it can successfully deliver outbound for an extremely short time, but I think if your "big server" is ISN-guessable you have bigger problems to worry about. And if the hacker does have ISN-sniffable access, why would it not be easier for them to launch the attack directly from their compromised machine on the same network? BTW If you wanted to force the packets to a known size, this could easily be done with a small MSS option. Infact its probably far deadlier to establish a real connection to a big webserver with a tiny MSS and watch it send tons of small packets. To my knowledge there is no (reasonable) minimium size limit for a requested MSS? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

3 2

RE: Looking Glass Code
by Ukyo Kuonji 12 Mar '01

12 Mar '01

You could always code in expect. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Don Simpson Sent: Monday, March 12, 2001 3:18 PM To: nanog(a)merit.edu Subject: Looking Glass Code I have been thinking about putting together a looking glass site on my network and have looked at Ed Kern's (DIGEX) html and perl script but do not want to enable rsh (anywhere) and do not want to reinvent the wheel if not necessary. Has anyone seen an updated script written to use other access means like telnet or ssh to exchange CLI/commands and results with an IOS router? ---------------------------------------------- Don Simpson ---------------------------------------------- _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com

1 0

massive mail replication from 24.93.35.225
by Randy Bush 12 Mar '01

12 Mar '01

the host 24.93.35.225, from roadrunner space, tried to dump MASSIVE mailing list recycles on me. like many thousands of messages. randy

3 2

new.net: yet another dns namespace overlay play
by Paul A Vixie 12 Mar '01

12 Mar '01

[ this came from http://www.new.net/about_us_press.tp and appears not to be a joke. its operational impact will not be felt today, but if it's even moderately popular before it dies, operational impact WILL be felt. i'm quite surprised by some of the folks they list as their partners. --vix ] Contact: Claudia de Llano or Lisa Doiron Connors Communications (310) 452-7540 claudia(a)connors.com or lisa(a)connors.com Brad Copeland New.net, Inc. 626-229-7800 pr(a)new.net New.net Expands Internet Naming With Launch of 20 New Top-Level Domain Names New Domain Name Registry's Technology Uses Existing Internet Naming System to Make Available Sensible, Meaningful Web Addresses Pasadena, Calif. - March 5, 2001 - New.net (http://www.new.net) a domain name registry created to meet the market demand for Web addresses with logical, easy-to-remember extensions that make Internet navigation easier, today officially released its first 20 new top-level domains. New.net has developed a novel, proprietary approach, using software technology deployed at either the network level by partner ISPs or on individual PCs, that uses the existing Internet naming system to enable millions of users to gain access to these new addresses. With this launch, the Internet community will be able to purchase and use domain names with extensions ("top-level domains") that were previously unavailable. Each of the new top-level domains was chosen to enable organizations and individuals to create Web addresses that more clearly describe their product, service offering, group activity or passion. The first 20 top-level domains being released are: .CHAT .GMBH .LTD .SPORT .CLUB .HOLA .MED .TECH .FAMILY .INC .MP3 .TRAVEL .FREE .KIDS .SHOP .VIDEO .GAME .LAW .SOC .XXX "New.net will dramatically broaden the scope of available domain names," said David Hernand, CEO of New.net. "Our research has indicated a tremendous market demand to move beyond .com and .net. We believe these new extensions will make it far easier for companies and individuals to market their Web sites using more intuitive addresses and for Internet users to navigate the Web." Availability Domain names using the initial set of extensions are available on a first-come, first-served basis for a flat fee of $25 per year. New.net anticipates that the availability of such descriptive extensions will inspire purchasers to provide content that is relevant to the specific domain names purchased. However, as an added benefit to parents, the company will require those purchasing domain names ending in .kids to offer Web sites that contain kid-friendly content and comply with the Children's Online Privacy Protection Act, and it reserves the right to revoke names that aren't used accordingly. Partnerships Through strategic relationships with leading Internet Service Providers (ISPs), including EarthLink, Excite@Home, and NetZero, over 16 million users will have access to the New.net domains beginning this week. Other Web users can activate their Internet browsers to recognize the new domain names in a few seconds by visiting www.new.net. "EarthLink is excited to partner with New.net as we identify new ways for our subscribers to more easily find information on the Internet and in turn, make their own Web sites more readily accessible to others," said, Jon Irwin, executive vice president of EarthLink's user experience. "By automatically making New.net available to our customer base, we are enhancing EarthLink's online experience and helping to provide an open, uncensored connection to the real Internet." New.net has also embarked on a series of partnerships designed to promote the mass downloading of its browser plug-in and widespread use of its new domain names. In the first of these announcements, New.net has partnered with MP3.com. As a result of this partnership, MP3.com will be an exclusive third-party seller of .mp3 domain names and will encourage its millions of visitors to activate New.net's browser plug-in. MP3.com's Web site hosts what it believes is the largest collection of digital music available on the Internet, with audio files posted from over 135,000 digital artists and record labels. These artists will be able to sign up for unique Web addresses with their name and the .mp3 extension (e.g., www.artistname.mp3) Opportunities also exist for current registries and registrars of .com and other domain names. New.net is currently in discussions with a wide variety of companies to offer the New.net domains to their customers. New.net is making additional efforts to win the trust of parents that .kids sites will be appropriate for their children. As part of that effort, New.net has reached an agreement in principle with .KIDS Domains, Inc. to be the official registry of .kids domain names. Those applying for .kids domain names will be required to publish content that is "kid-friendly" and in compliance with the Children's Online Privacy Protection Act (COPPA) and .KIDS Domains guidelines. .KIDS Domains will be screening all requests for .kids domain names for appropriateness and will be implementing a process to evaluate sites' compliance with guidelines for kid-friendly content. The International Solution "We believe that New.net's new domains will be particularly attractive to the international community, which has been long-neglected by the existing naming system," added Hernand. "By adding .gmbh, .ltd and .soc, in addition to .inc, we can provide a more sensible naming system for businesses in a wide variety of countries. And by introducing the .hola extension, we have a unique top-level domain that will appeal to the growing population of Spanish-speaking Internet families in the U.S. and around the world. In addition, New.net's technology will allow the use of foreign-language characters in both the domain name and the extension, unique among naming systems." The Technology New.net is able to provide use of these new, top-level domains through innovative, patent-pending technology that allows the New.net names to live within the existing Internet domain name system. Whether on an individual browser level via the New.net plug-in, or through software resident on a participating ISP's server, requests to display Web pages with New.net domain names are resolved by appending the additional extension .new.net onto the address. As a result, requests are automatically routed to New.net's DNS servers to determine the correct IP address of the computer hosting the Web page. New.net has partnered with UltraDNS, one of the Internet's leading DNS infrastructure services companies, to provide scalable, global DNS services. The Future New.net plans to introduce additional new top-level domains based on consumer and business demand. The company is engaged in ongoing market research to narrow the list of possibilities and is actively seeking consumer feedback on its Web site in order to assist in making sound, market-driven choices. New.net will also consider proposals submitted by third parties interested in having particular top-level domains released. About New.net New.net (http://www.new.net) is building the Internet's leading market-driven domain name registry business by selling domain names with logical, easy-to-remember top-level domain extensions that make the Internet easier to navigate. Based in Pasadena, California, the company was started in May 2000 by idealab!, a leading Internet incubator. Since that time, New.net has developed propriety technology that allows its domain-naming system to exist alongside the traditional naming systems currently in use on the Internet. # # # © 2001 New.net, Inc. All rights reserved.

32 46

Re: new.net
by Scott Gifford 12 Mar '01

12 Mar '01

richb(a)pioneer.ci.net writes: > Corporate entities should be *required* to register in the flat dot-com > namespace, IMHO, and not be *allowed* names in any other namespace. I like the idea of creating a new ".tm" TLD (or something less likely to conflict with a CCTLD), and requiring anybody who wants trademark protection to register there; everything else is a free-for-all, as it pretty much is now. Let them have their little trademark disputes over there, and let less litigious heads rule in the other TLDs. -----ScottG.

6 6

tcp,guardent,bellovin
by Chris Beggy 12 Mar '01

12 Mar '01

tcp,guardent,bellovin are all mentioned in a WSJ article on DOS and session hijacking, but I don't see anything on CERT yet. Any details? Any incidents using the exploit guardent has identified? Chris

1 0