September 2002 - Test - lists.nanog.org

Re: Vulnerbilities of Interconnection
by Dave Israel 06 Sep '02

06 Sep '02

alex(a)yuriev.com said: >Taking out an a collo would more than just increase time to download porn >for a few days. and went on to say: > > > Is there a general consensus that cyber/internal attacks are more > > > effective/dangerous than physical attacks. Anecdotally it seems the > > > largest Internet downages have been from physical cuts or failures. > > > > It depends on what you consider and internet outage. Or how you define > > that. IMHO. > > Lets bring this discussion to a some common ground - > > What kind of implact on the global internet would we see should we observe > nearly simultaneous detonation of 500 kilogramms of high explosives at N of the > major known interconnect facilities? The answer to the first thing is "Yes, it would be back at full speed in 24 hours" and the second thing is "Unless N is unreasonably large, not much." The reason is that people like us work on running the internet. In case 1, suppose I am a porn magnate. (Obviously, I am not, or I would dress better and work less, but stay with me for a moment.) I sell two products: pictures, and online strippers. The pictures are a static gold mine, so chances are, I have them backed up. The strippers are at a studio near my hosting/colocation site, and backhauled via your favorite fiber-based protocol. I get a call saying, "Hey, a terrorist from group X walked into the colo facility with a 12008 chassis filled with plastique, and, well, the entire site is a charred hole in the ground." After a few seconds of horror, greed takes over, and I call other nearby providers to see who can get me back up today, pay the telco a nice hefty fee to reroute my SONET connection to that provider, and the money is rolling in before sunset. In case 2, suppose it is 4 major peering points. No big deal for the bulk of traffic, because the bulk of traffic goes between the big players, and they are all privately peering. So are many of the medium-sized folks. Smaller folks often buy transit from a larger provider to reach everybody they cannot peer with. And even if you don't buy transit and don't have overseas peering and lose your connectivity because they picked your 4 favorite sites, you're not going to be down for long, because somewhere, you are close enough to a UUnet or a AT&T or a Level 3 who can toss you a cable until you can get back on your feet. Yeah, an attack can make the Internet uncomfortable and cause a lot of scurrying and odd deals, but the provider who is completely screwed by an attack on 1 colo or 4 peering points is going to be an exception, not the rule. -Dave

1 0

Bad Dog, no biscuit, Interland
by John M. Brown 06 Sep '02

06 Sep '02

So after four different phone calls to Interland, and four different hangups by the techs and a refusal to do anything Interland, your client is being bad. Five minute rate was very high Folks need to take security and abuse issues seriously. The time has come for operators to have responsive staff, and to use technology to thwart known bad things. Folks look at DOS/DDOS/IDS tools to check ingress traffic, lets also use them to check EGRESS as well.. Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3753 xx.yy.36.94:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3755 xx.yy.36.96:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3756 xx.yy.36.97:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3760 xx.yy.36.101:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3762 xx.yy.36.103:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3764 xx.yy.36.105:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3766 xx.yy.36.107:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3765 xx.yy.36.106:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3719 xx.yy.36.60:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3721 xx.yy.36.62:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3722 xx.yy.36.63:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3725 xx.yy.36.66:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3727 xx.yy.36.68:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3730 xx.yy.36.71:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3736 xx.yy.36.77:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3738 xx.yy.36.79:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3739 xx.yy.36.80:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3741 xx.yy.36.82:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3743 xx.yy.36.84:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3744 xx.yy.36.85:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3746 xx.yy.36.87:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3748 xx.yy.36.89:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3752 xx.yy.36.93:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3754 xx.yy.36.95:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3757 xx.yy.36.98:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3758 xx.yy.36.99:80 in via sis0 Sep 6 09:04:40 sentinel /kernel: ipfw: 2100 Deny TCP 64.19.151.228:3759 xx.yy.36.100:80 in via sis0

1 0

RE: Vulnerbilities of Interconnection
by Kris Foster 06 Sep '02

06 Sep '02

> What kind of implact on the global internet would we see > should we observe > nearly simultaneous detonation of 500 kilogramms of high > explosives at N of the > major known interconnect facilities? Not knowing how much damage would result from 500kg of explosives.. What is the typical size of pipe a carrier would pull into an interconnect facility, how many carriers, how much traffic? Now how much traffic would shift to other facilities if one went down? How many would it take to saturate the pipes? And at what point would congestion be bad enough to render them useless? At some point traffic will shift over to private interconnects either through complete loss of peering in third party facilities, or through manual intervention. Kris

1 0

RE: Vulnerbilities of Interconnection
by Dave Israel 06 Sep '02

06 Sep '02

My explanation accounts for suicide bombers in the statement: "Even terrorist that will die to kill will probably not die to inconvenience." This does not presume a western value system, either, as somebody suggested. Many a terrorist will gladly give their lives to destroy a hated enemy, or to terrify them, or to change their way of life. I cannot believe, however, that there are people who will give their lives to increase the download times for porn for a few days. -Dave On 9/5/2002 at 13:49:29 -0700, Al Rowland said: > To reinforce a dissenting opinion, And your explanation accounts for > suicide bombers how? I would think a smoking hole in the ground > containing a train or whatever, particularly if lose of life is > involved, would be much more appealing to the motivations of most > terrorists than a couple of computers with blue screens of death. I > would think 9-11 would provide a compelling example of current terrorist > practice. > > Just my 2¢ > > Best regards, > _________________________ > Alan Rowland > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Dave Israel > Sent: Thursday, September 05, 2002 1:29 PM > To: alex(a)yuriev.com > Cc: Dave Israel; sgorman1(a)gmu.edu; nanog(a)merit.edu > Subject: Re: Vulnerbilities of Interconnection > > > > On 9/5/2002 at 16:01:02 -0400, alex(a)yuriev.com said: > > > > > > The thing is, the major cuts are not "attacks;" the backhoe > > > operators aren't gunning for our fiber (no matter how much it seems > > > like they are). If I wanted to disrupt traffic, intentionally and > > > maliciously, I would not derail a train into a fiber path. Doing so > > > > would be very difficult, and the legal ramifications (murder, > > > destruction of property, etc, etc) are quite clear and severe. > > > However, if I ping-bomb you from a thousand "0wn3d" PCs on cable > > > modems, I never had to leave my parents' basement, I'm harder to > > > trace by normal police methods, and the question of which laws that > > > can be applied to me is less clear. > > > > This fails to address how this affects someone who has no problem with > > > legal ramfications - i.e. a terrorist. > > Even a terrorist will tend towards things that allow him to continue to > be a terrorist. If I can do X amount of damage, and get caught, or do X > amount of damage, and not get caught, then he'll do the second. Even a > terrorist that will die to kill will probably not die to inconvenience. > > > -- Dave Israel Senior Manager, DNE SE

2 1

Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

Thanks for all the answers on the previous question about Equinix. The reason for the question is that we are working on a study here at George Mason on assesing the vulnerbilities of the Internet and telecommunications infrastructure to physical attack. One part that we are looking at are the vulnerbilites of interconnection facilites. Doomsday scenarios like 60 Hudson street being a target instead of the WTC or the loss of MAE east, etc. The earlier question about Equinix and the Big 7 was really a vulnerbility question. Are interonnection locations aggreating or dispersing. How real of a threat is the physical loss of a major interconnection point. Incidents like the Balitmore train tunnel wreck point in one direction. We are working on putting several models together to try and simulate some of these scenarios with varying degrees of success, but I would very much like to avoid doing the research in a vaccuum. I was hoping a discussion on NANOG wold be a good first step. The project is quite hot with the politicos and I very much want to make sure to best recommendations are made. Formal industrsy cooperation is one side of this, but I think a lot of information can be gained from an informal approach as well. Any and all feedback is greatly appreciated Thanks, sean

7 9

Updated DNS monitoring, take 2
by Rob Thomas 05 Sep '02

05 Sep '02

Hi, NANOGers. Rodney Joffe (thanks, Rodney!) correctly pointed out that my gTLD monitoring was only tracking the Verisign gTLD (com, net, org) name servers. I have now added the other TLDs to the mix. It can all be found in two places: http://www.cymru.com/DNS/ http://bgp.lcs.mit.edu/dnsmirror/ I will shortly have an additional web server on a much faster set of links, as well as another mirror. For the impatient, I recommend the MIT site. Don't forget to check the Lame Report while you're there. :) Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

Sean, I completely agree with statement. It is not a matter of wanting to know where the importants hubs are - we have a pretty good handle on that, but what the impacts would be of a hub loss from an operational stand point. Maybe this is a discussion that needs to be off-line. My goal is to provide some context and validation for the research that is being carried out. There have been some interesting discussion on this forum about multi- provider cooperation in case of emergencies/catastropes. Your suggestion of the creation of a directory for contacts across providers was an insightful addition. I believe more discussion along these lines would be of benefit. The desire is for something high level, not any network details that could prove compromising. Thanks, sean ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Thursday, September 5, 2002 12:48 pm Subject: Re: Vulnerbilities of Interconnection > > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > very much like to avoid doing the research in a vaccuum. I was > hoping> a discussion on NANOG wold be a good first step. The > project is quite > > hot with the politicos and I very much want to make sure to best > > recommendations are made. Formal industrsy cooperation is one > side of > > this, but I think a lot of information can be gained from an > informal> approach as well. Any and all feedback is greatly > appreciated > http://www.infosecuritymag.com/2002/sep/2002survey/voices/verylarge.sht ml > > On security reporting... > "Since Sept. 11, state, local and federal authorities have tried > to get > their arms around the potential threats to the nation's > infrastructure--including the telecommunications infrastructure. > They have > asked us questions like, 'What are your 100 most vulnerable places > in the > network?'" > > "As much as we would like to help the government in its attempt to > helpus, we believe it would be counterproductive to share such > informationwidely because if it were released, it would provide a > terrorist with a > roadmap to our key locations. Unless the government agrees that it can > protect our information, we will continue to respectfully decline such > blanket requests." > > Bill Smith > CTO and President of Interconnection Services, BellSouth > > > >

3 2

RE: Vulnerbilities of Interconnection
by Crist J. Clark 05 Sep '02

05 Sep '02

"Daniel Golding" <dgolding(a)yahoo.com> wrote: > The crux of the issue are FOIA requests. The government won't make these > types of vulnerability reports immmune to FOIA requests - thus a foreign > terrorist or home-grown "farmbelt fuhrer" could simply order up a list of > the most vulnerable sites, and select some to attack. They already are exempt from FOIA requests. Namely, EXEMPTION 4, "Trade Secrets, Commercial or Financial Information" or possibly EXEMPTION 7(F) "Physical Safety to Protect a wide Range of Individuals." IANAL. -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

1 0

Re: Vulnerbilities of Interconnection
by sgorman1＠gmu.edu 05 Sep '02

05 Sep '02

Batz, I believe we are talking about two different perspectives here operational and end user. The concern I have is with the ability of sectors dependent on information infrastructure to operate if there are problems. What web-site is abvailable to the end user is not the value judgement but if NASDAQ can facilitate stock trades, if banks can clear settlements, etc. It does get a little fuzzy in what you consider Internet and what you consider private networks. From a physical perspective they all use a common fiber infrastructure - it all runs in the same trench - so in some terms it does not matter. There has been quite a bit of discussion about physical downage being an inconveniance, and if you limit yourself to just the Internet (web sites, email, porn, etc) this is a valid statement. Where this goes off track is that the Internet is only part of the equation - the operation of several critical infrastructures is dependent on fiber based communications. A cut is a cut - it does discriminate against private networks, security protocols, encryption or anything else. A leased line does not mean you get a special ditch. ----- Original Message ----- From: batz <batsy(a)vapour.net> Date: Thursday, September 5, 2002 7:41 pm Subject: Re: Vulnerbilities of Interconnection > On Thu, 5 Sep 2002 sgorman1(a)gmu.edu wrote: > > :The question is what if someone was gunning for your fiber. To > date > :cuts have been unintentional. Obviously the risk level is much > higher > :doing a phyisical attack, but the bad guys in this scenario are > not > :teenage hackers in the parents basement. > > This happened recently in Quebec where there is a labour > dispute with Videotron and one of the unions representing its workers. > The dispute has been exaserbated by the sabotage of the companies > fiberlines. > > Now, while this may affect Videotrons bottom line, it only becomes > a > critical infrastructure issue when it becomes a Hydro Quebec > issue, > or it interferes with the provinces ability to deliver services. > > Honestly, if a few million people can't get their porn streams, the > world isn't going to end. If 911 operators, or ambulance services > can't direct emergency crews for 10 people, then you have a serious > problem. > > :There is a good foundation of knowledge on the implications of > cyber > :attacks, but the what-if of an intentional physical attack is an > :important question I believe. The context in this discussion has > been > :very valuable and many thanks to everyone that has offered opinions. > > The What-If questions have to be sorted from a particular view, and > it will be the legislators view which will ultimately matter. You > can bluesky, whiteboard, game and scheme all you like, but there are > only a few opinions that matter when it comes to deciding what > is of importance to national security, and until we hear from > them, > we can be as paranoid and imaginative as we want, and it won't help > the infrastructure become more secure. > > So, as for Nasdaq, vs Google, vs the GSA vs Agriculture vs CNN, > until we have the correct order in which to place these entities, > we can't provide a useful or accurate model of how vulnerable the > infrastructure is. > > You mentioned that you thought Nasdaq would be the most important > asset to protect, but what happens if some Internet > traders on AOL can't make their trades because of a fiber cut, vs > not being able to get their infotainment from CNN, vs weather > and crop data data not getting to farmers on time. It's a relative > and ultimately political discussion. > > > -- > batz > > >

1 0

Re: IP address fee??
by Christopher X. Candreva 05 Sep '02

05 Sep '02

On Thu, 5 Sep 2002 nbastin(a)mac.com wrote: > I'm trying to figure out what you think IP space allocation has to do > with bandwidth. IP space is not just another bullet point on the > marketing slide that makes a particular service option that more > attractive - if you can't use it, you can't have it. I have to believe Who said anything about NOT showing justification ? That thread had already been fairly well covered - but didn't address the question as I saw it. The question was about price and that's what I was addressing. You might request justification for any allocation over a single address -- but still not charge until they have 255, or 65,536, or whatever you might decide. ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 0