January 2003 - Test - lists.nanog.org

FYI: krb5-realm.com/net/org
by Avleen Vig 16 Jan '03

16 Jan '03

This is purely an FYI. A non-fatal bug exists with regards to authentication in the following operating systems: FreeBSD 4.4 (at least) Allegedly in OpenBSD 3.0, 3.1 and 3.2 (untested) And in the following packages when kerberos authentication is compiled into them on the above operating systems: OpenSSH 2.3.0 (at least. not sure about newer versions) UW imapd, Pine, and other packages which are linked against the kerberos libraries I'm not blaming any of these packages, so please let no-one get up in arms about that :-) The bug revolves around the libraries trying to lookup TXT records in DNS for krb5-realm.'your_tld'. I control the name servers for krb5-realm.com/net/org It has been reported that when this nameserver goes down, authentication can take a very-long-time. I believe what happens is that authentication *failures* take a very-long-time. This is just a notification that the name servers for these domains will be changing in the next 48 hours. It shouldn't be a problem, but incase people see odd issues as described above, which I usually get mails and such about later, this may be the reason.

1 0

Re: Scaled Back Cybersecuruty
by Avi Freedman 16 Jan '03

16 Jan '03

In article <10309.2406.30280(a)avi.netaxs.com> Pete Kruckenberg wrote: : One of the criticisms of the change relative to this group : is that the previous stronger wording for the network : operator industry was watered down. Instead of : expecting/demanding/mandating that the industry collaborate : on network security (creating an ISAC and other measures), : the latest draft simply recommends that the industry : consider these measures. : Is there anything happening with collaborative security : policy and remediation in the industry? Has any effort : showed progress towards an effective ISAC or similar? Can : networks realistically collaborate on security, or do the : political and operational barriers not justify the effort? : Pete. Anything should of an action plan involving money or regulation is a very weak policy. Suggestions have never had much of an effect on Internet operators. I guess the real question is: What is going to happen over the next few years to get the infrastructure of the Internet to be more robust? I don't see market forces doing it. I don't suggest that the government use regulation, either. Perhaps the Feds (and maybe states) could use their purchasing power to effect change. Short of that, or regulation, the I don't see how the serious issues we have with the 'net will get resolved. I suppose that the "problem" is likely that people don't understand what a nice actually well-written worm could/would do if it were targeted at the infrastructure. Avi

14 15

Nordnog-2 Agenda items
by Kurt Erik Lindqvist 15 Jan '03

15 Jan '03

The agenda items for Nordnog-2 is starting to be posted on http://www.nordnog.org/nordnog2/agenda.html as the speakers final confirmation comes in. To register, please fill the form at http://www.nordnog.org/nordnog2 and mail it to register(a)nordnog.org Best regards, - kurtis -

1 0

Scaling up Internet Security (was: Scaled Back Cybersecuruty)
by Michael.Dillon＠radianz.com 15 Jan '03

15 Jan '03

> > i've had absolutely no luck getting the source isp's to care about > > the problems i've seen at my home firewall in recent weeks. > hehe... I know the feeling. With DShield, we try hard to send out > correlated and filtered reports in a standardized format to valid > 'contact' addresses. There are some success stories, but more misses > than hits overall. I think these efforts would get a lot of attention if there were two changes to the notification procedure: 1. The notice started by saying "This is a notice according to the procedures of the ISP-ISAC which operates in coordination with the FBI's NIPC(National Infrastructure Protection Center)". Of course before you can put this notice in your email the industry would first have to create the ISP-ISAC (see http://www.nipc.gov/infosharing/infosharing6.htm for background) and the ISAC would have to agree on some basic procedures for notifying other ISPs when network abuse occurs. But this is not rocket science and I think a half-dozen of the larger ISPs could kick this off with some kind of a BOF at NANOG. 2. If the email notice doesn't get a response, follow it up with a letter on paper to the company concerned and include another letter explaining the benefits of being an active participant in the ISAC (Information Sharing and Analysis Center). The paper letter could be addressed to the legal department because this really is a compliance issue. In other words the time could come when companies who do not comply with industry standards for cooperation in addressing network abuse will find themselves facing lawsuits. If you can get a company's legal department to agree that participation in an ISAC is a good way to cover their ass, then you will find it a lot easier to get inter-company cooperation. The other ISACs can be of use too. Imagine that you have a DDOS in progress and you can track it back to a number of compromised servers. Some of them are colocated so the ISP-ISAC would directly notify the hosting companies concerned. Some of them belong to companies who appear to be in the financial services industry so you notify the FS-ISAC about those ones. Some of the servers appear to be suffering from security holes that are introduced by using default install options for the O/S so you notify the IT-ISAC about those ones. Before long the members of the FS-ISAC are requiring their business partners to secure their Internet servers, the OS vendors are tightening up baseline OS security and the hosting companies are securing or shutting down compromised servers. The press reports on all of this activity and managers in all types of businesses and organizations start asking searching questions about the security of their own infrastructure. Or maybe the FS-ISAC gets all bank managers to ask questions about security as part of their regular business review meetings with customers. All of this requires an ISAC dedicated to the purpose of analyzing and stamping out network abuse. --Michael Dillon

2 1

Violation of Acceptable Use Policies
by Sean Donelan 15 Jan '03

15 Jan '03

Almost every major Internet provider's acceptable use policy prohibits the sending of unsolicited bulk e-mail. ISPs have been encouraged to terminate the accounts of people who engage in the sending of unsolicited bulk e-mail. Several third-party groups maintain RBL's of groups which send unsolicited bulk e-mail. http://www.cnn.com/2003/WORLD/meast/01/11/sproject.irq.email/index.html Which ISP gets to tell the US Military their connection is being pulled because Iraq complained about unsolicited bulk e-mail?

5 7

Re: Scaled Back Cybersecuruty
by Avi Freedman 15 Jan '03

15 Jan '03

In article <103014.205135.1508(a)avi.netaxs.com> John wrote: : The problem is that the "government" does not have large purchasing power : compared to the commercial side of the house. The government doesn't buy in : bulk, doesn't buy often and usually selects the lowest cost. Vendors design : equipment/services for the customers who will buy it. The majority of those : customers are revenue driven commercial entities that have always questioned : the need to pay for any additional security. In the past, "security" has : never been an easy sell to anyone when a cost was attached because it was : never perceived to have the potential to bring in additional revenue and : because those who were aware of security breaches of substance would not : acknowledge them (this goes for government and industry). And sadly there : are some vendors who are so big or have such a large share of their market : space, that they just do what they want regardless. : John S. Maddaus I really can't agree... 2 years ago you'd be laughed at for a $10k/mo order, especially if you wanted non-standard services or terms. Today that gets any of the larger providers to stand up and pay severe attention, especially with the financial questions lingering over the space that have destroyed a lot of the "you must buy from us" clout in the minds of the buyers. Avi

2 1

Re: Scaled Back Cybersecuruty
by Avi Freedman 14 Jan '03

14 Jan '03

In article <103014.212147.2001(a)avi.netaxs.com> Mr. Maddaus wrote: : This may be true on the services side of the business but the hw/sw : manufacturing side that provisions the service side has seen fit in years : past to ignore small issues. It is just too costly to develop and support : with limited R&D resources in financially sparse times. For example, the : major telecom manufacturers (i.e. Lucent,Nortel...) do customize code and : equipment for the major telcos, but only when the proverbial "mega-deal" is : signed and booked. : regards Avi, : Maddaus Agreed on the hardware side, certainly... But network providers are only very recently getting good at prioritizing "it must work and pass packets without crashing" vs. "it needs the features to let me network scale, provide multi-application support, etc etc etc ". It sounds like AOL is voting with their $ there, so at least that's a good sign. Regards, John... Avi

1 0

Safety alert
by blitz 14 Jan '03

14 Jan '03

Check your UPS's.... >January 14, 2003, 7:48 PM EST > >WASHINGTON -- A Rhode Island company is recalling about 900,000 backup >power supply devices that can overheat and cause a potential fire >hazard. > >American Power Conversion Corp., of West Kingston, R.I., has received >six reports of overheated units melting their outer casings and three >reports of minor property damage, the Consumer Product Safety Commission >said Tuesday. > >The recalled Back-UPS CS Uninterruptible Power Supply devices, commonly >used to protect computers in case of power failures, include the >Back-UPS CS350 and the Back-UPS CS 500 models. > >Retailers, computer and electrical distributors and catalogs nationwide >sold the power supply devices from November 2000 through December 2002. > >Consumers should immediately stop using the devices by turning off power >to all connected equipment, turning the Back-UPS CS off and unplugging >it from the electrical outlet, the company said. > >Consumers can receive a free replacement unit by contacting the company >at 1-866-272-7359. >* __

1 0

RE: Anyone seen this?
by blitz 14 Jan '03

14 Jan '03

Thanks Arjen, Glad to see that...the most disturbing part here, is the creation of a DDos network. When I read that, I could clearly see conflict with computer intrusion statutes. At 14:36 1/15/03 +1300, you wrote: >Hoax. See www.e-secure-it.us Global security News > >A hoax message posted to two security mailing lists Monday suggests that the >Recording Industry Association of America has hired a group of hackers who >have developed a worm capable of infecting and shutting down peer-to-peer >file-sharing software. The hackers claim to have released the worm, on the >RIAA's orders, and that it now controls almost 95 percent of "all P2P >participating hosts." The RIAA said the message was a total fabrication. >"It's a complete hoax," said an RIAA spokesman in Washington. "Someone >forwarded the message to us and that was the first we heard or read about >it." The outlandish claims are part of a "security advisory" supposedly >written by a group called Gobbles Security. However, the message bears >little resemblance to the group's other advisories and also seems to make >fun of Gobbles' habit of posting vulnerability information and exploits >without notifying affected vendors in advance. > >Cheers, >Arjen >New Zealand > > > >-----Original Message----- >From: blitz [mailto:blitz@macronet.net] >Sent: Wednesday, 15 January 2003 2:17 p.m. >To: nanog(a)merit.edu >Subject: FYI: Anyone seen this? > > > > From ISN: > > > > > >http://www.theregister.co.uk/content/6/28842.html > > > >By Andrew Orlowski in San Francisco > >Posted: 14/01/2003 > > > >The RIAA is preparing to infect MP3 files in order to audit and > >eventually disable file swapping, according to a startling claim by > >hacker group Gobbles. In a posting to the Bugtraq mailing list, > >Gobbles himself claims to have offered his code to the RIAA, creating > >a monitoring "hydra". > > > >"Several months ago, GOBBLES Security was recruited by the RIAA > >(riaa.org) to invent, create, and finally deploy the future of > >antipiracy tools. We focused on creating virii/worm hybrids to infect > >and spread over p2p nets," writes Gobbles. > > > >"Until we became RIAA contracters [sic], the best they could do was to > >passively monitor traffic. Our contributions to the RIAA have given > >them the power to actively control the majority of hosts using these > >networks." > > > >Gobbles claims that when a peer to peer host is infected, it catalogs > >media and sends the information "back to the RIAA headquarters > >(through specifically crafter requests over the p2p networks) where it > >is added to their records", and also propagates the exploit to other > >nodes. > > > >"Our software worked better than even we hoped, and current reports > >indicate that nearly 95% of all p2p-participating hosts are now > >infected with the software that we developed for the RIAA." > > > >The "hydra" is uncorroborated. > > > >Gobbles attached two pieces of code, one of which jinglebellz.c > >details a frame header exploit for the Linux player mpg123. The code > >chastises OpenBSD lead Theo de Raadt for failing to checksum the > >public MP3s (written to celebrate each OpenBSD release). The group has > >singled out OpenBSD in its previous exploits > > > >In their presentation to last year's DefCon, the group described > >itself as "the largest active nonprofit security group in existence > >(that favors full disclosure)," consisting of 17+ members. > > > >"They're real, and they're damn good. They have made what appeared to > >be extremely exaggerated claims in the past, and when mocked, they > >have demonstrated that they are serious," one security expert familiar > >with their work, who declined to be named, told The Register. > > > >"He's a funny guy," De Raadt told us. "This is a buffer overflow > >exploit," he confirmed. De Raadt said he was more concerned by social > >engineering than by external exploits. "We had Fluffy Bunny, now we > >have Gobbles. They come in waves. " > > > >An exploit of this nature is of dubious legality, right now, but > >language in Howard Berman's "P2P Piracy Prevention" bill last year > >legitimizing such exploits was backed by RIAA chief Hilary Rosen:- > > > >The Berman bill, ensured a copyright owner would not be liable for > >"disabling, interfering with, blocking, diverting, or otherwise > >impairing the unauthorized distribution, display, performance, or > >reproduction of his or her copyrighted work on a publicly accessible > >peer-to-peer file trading network, if such impairment does not, > >without authorization, alter, delete, or otherwise impair the > >integrity of any computer file or data residing on the computer of a > >file trader." Berman is expected to re-introduce the bill in this > >Congressional session.

1 0

fast ethernet limits
by Steve Rude 14 Jan '03

14 Jan '03

Hi NANOG, Could someone please help me with a fast ethernet problem I am having. We have a POP in a 27 floor building, and have a rj45 run from the the bottom of the building (in the telco room) to the top of the building. We have cisco switches on either end and we are seeing about 5-20% packet loss on the trunk. Are we running into a distance limitation of fast ethernet, or are we suffering from another problem? I read that 328 feet is the limitation of fast ethernet. Is there anything short of getting a repeater for the cable run that I can do to boost the signal? TIA for your help. Ciao. Steve Rude

23 30