August 2002 - Test - lists.nanog.org

Re: NYT: Phone Network Is Vulnerable, Report Finds
by Martin Hannigan 06 Aug '02

06 Aug '02

At 03:27 PM 8/6/2002 -0400, Sean Donelan wrote: >Sigh, I already have a copy of the news paper article. I was looking for >a copy of the report mentioned in the article. If you get the report, I'd be interested, but they'd have to encase the entire country, poles, manholes, generators, central offices, etc into concrete and steel to make it secure. With enough knowledge, it's easy, and the terrorists aren't all stupid. Mostly. Regards, -- Martin Hannigan hannigan(a)fugawi.net

1 0

RE: Deaggregating for emergency purposes
by Jeff S Wheeler 06 Aug '02

06 Aug '02

On Tue, 2002-08-06 at 14:59, Phil Rosenthal wrote: > > Yes, it is lovely when things work out like that. > My one experience with this problem was with Telia announcing my more > specifics, and their US NOC referred me to their Europe NOC, and there > no one spoke English. They are a tier1, so they don't have any upstream > to call. It took 20 phone calls and more than an hour to get to someone > who cared enough to do anything about it. > Surely, Phil, it will take longer than an hour for IRR updates to reach tier1 router filter configuration files. Are you advocating that we all pre-emptively populate the IRRs with /24s for all our mission critical networks? If that becomes fad, IRR growth will quickly become a serious concern, and its utility will be reduced. In addition, many networks will not accept /24s from the former B-class space which is now being assigned by the various regional registries. Advertising /24s might help the problem, or it might not. Cluttering up the IRRs is not the answer to someone blackholing your network. Rather, use administrative channels or forums such as NANOG to get the rogue advertisements withdrawn at their origin or filtered by their upstreams. -- Jeff S Wheeler

2 1

GBLX router upgrade breaks bgp sessions
by nanog 06 Aug '02

06 Aug '02

Subject says it all. GBLX upgraded some edge routers to a new JunOS release (possibly 5.3 rev 24)- and now our bgp sessions continually reset with: Jul 10 06:58:24 MST: %BGP-3-NOTIFICATION: sent to neighbor X.X.X.X 3/3 (update missing required attributes) 0 bytes Anyone clueful at GBLX listening? We've been down for about 4 hours, and the NOC (call center) people are less than helpful. bill

5 7

NYT: Phone Network Is Vulnerable, Report Finds
by Sean Donelan 06 Aug '02

06 Aug '02

Does anyone know where I could get a copy of the report mentioned in today's New York Times (registration required)? http://www.nytimes.com/2002/08/06/nyregion/06TELE.html

3 3

Re: If you have nothing to hide
by Simon Waters 06 Aug '02

06 Aug '02

> From: Sean Donelan <sean(a)donelan.com> > "Why is it that companies have sold products that they know are > insecure?" asked Richard Clarke, President Bush's chief cybersecurity > adviser. I would have though he might better concern himself with why is the Government still buying them. Market forces will ensure the supply of whatever is demanded, the US federal and state government is presumably the single largest purchaser in the IT market, yet still seems to be buying plenty of products with dubious security records. Government purchasing changes have and could improve security, where do you think Ctrl-Alt-Delete to login to NT came from, it wasn't the Microsoft usuability department I'm sure. Let him who is without sin.....

3 2

Re: If you have nothing to hide
by bdragon＠gweep.net 05 Aug '02

05 Aug '02

> Thus spake <bdragon(a)gweep.net> > > <snip> > > > our packets. While I'm certainly in favor of anything edge providers can > > > do to eliminate denial of service attacks based on source-routing, > > > I certainly don't want anything further. > > <snip> > > > > denial of service based upon source routing? I hadn't heard of any denial > > of service attacks of that sort. > > > > Disabling source-routing is like filtering icmp, sure you might block > > a few abuses, but more often than not, you are throwing out legitimate > > traffic. > > I can't come up with any legitimate reason to use source-routed packets today. > If your routers even support them, they probably consume orders of magnitude > more processing power than normal packets; that is enough reason to disable > source-routing, not to mention the security implications. > > S Validation of routing policy to ensure others aren't abusing you (pointing default, for example). As for orders of magnitude, once an IP option is in a packet, the damage is essentially done, otherwise looking up the path to an address in the options is no more impactive than looking up the address in the original destination field. source-routing only has security implications to those with defenses which permit traffic through some type of backdoor. The backdoor has more security implications than the source-routing, since it may be compromised in other manners.

2 3

Re[4]: If you have nothing to hide
by Richard Welty 05 Aug '02

05 Aug '02

On Mon, 5 Aug 2002 17:10:50 -0400 (EDT) John Fraizer <nanog(a)Overkill.EnterZone.Net> wrote: > On Mon, 5 Aug 2002, Richard Welty wrote: > haven't you ever heard of smurf? > I wasn't aware the SMURF used source-routing. It generally simply > spoofed > the source address of the packet. If more ISPs properly filtered on the > customer edge back then, SMURF wouldn't have been as deadly as it > was/(is). my mistake. when smurf was first explained to me lo those many years ago, the person who explained it (and it's been so long i don't even remember who that was) claimed it used source routing. i never really questioned that, but everyone who has corrected me is right -- it doesn't need source routing to work. oops, richard -- Richard Welty rwelty(a)averillpark.net Averill Park Networking 518-573-7592 Unix, Linux, IP Network Engineering, Security

1 0

Re: If you have nothing to hide
by bdragon＠gweep.net 05 Aug '02

05 Aug '02

> > > "You know, there's quite a difference between source routing and > IP spoofing .." > > > > As true as this statement is, the two walk hand in hand (especially during > certain attacks). > > If I send an attack from a spoofed address to a victim, I can turn blue in > the face waiting for a response that will never come. > If I spoof an address and use loose source routing I can force the response > to return right through my network. I was not aware that responses to source-routed packets were themselves source-routed. I also don't believe it is the case, but am open to being contradicted. If the responses aren't source-routed, then the packets would only return through your network if your network was the path back to the spoofed source. > Also loose source routing can be used for Man-in-the-middle attacks by using > a loose source route you can force all traffic to pass through the attackers > network. You could make the outbound traffic pass through a secondary target, but with software-processing of ip options, your goodput of dos payload may go way down. You are more likely to take down something closer to yourself and self-limit the attack. > Strict source routing does not benefit an attacker, but as I said loose > source routing does.

1 0

Re: If you have nothing to hide
by Dave Crocker 05 Aug '02

05 Aug '02

At 06:31 AM 8/4/2002 -0400, Sean Donelan wrote: >I encourage network operators (or IX operators, DNS operators, etc) to let >the government know what you think. Mr. Clarke's crew is writing the >plan, and taking input from many sources. If you think RPF (or some other >source address validation) is a solution let them know. If you think >S-BGP is a solution, let them know. If you think network operator managed >firewalls on every DSL/Cable modem is a solution, let them know. On the >other hand, if to think some of those things are not a solution (or a >really bad idea), tell them that. These are technical operations matters. Seems like there might be some benefit in formulating consensus views within the technical operations community. Any chance that an IETF BCP would be possible and helpful? Diverse input to a government process can be good for learning about choices, but consensus views should be helpful for making them. d ---------- Dave Crocker <mailto:dave@tribalwise.com> TribalWise, Inc. <http://www.tribalwise.com> tel +1.408.246.8253; fax +1.408.850.1850

3 2

Re: Re[2]: If you have nothing to hide
by Miquel van Smoorenburg 05 Aug '02

05 Aug '02

In article <cistron.E17bkHu-0005Mi-00(a)skipper.averillpark.net>, Richard Welty <rwelty(a)averillpark.net> wrote: >On Mon, 5 Aug 2002 12:00:20 -0400 (EDT) bdragon(a)gweep.net wrote: >> I understood what you were saying, I just was not aware of any attacks >> which used source routing. > >umm, haven't you ever heard of smurf? You know, there's quite a difference between source routing and IP spoofing .. Mike.

1 0