October 2003 - Test - lists.nanog.org

Trends in network operator security
by Sean Donelan 30 Dec '03

30 Dec '03

Its 2003 and everyone is making their predictions. What trends are network operators seeing for Internet security? Old favorites Buffer overflows Distributed Denial of Service Poor passwords (cisco/sanfran) Poorly coded systems Blame the user for not protecting poorly coded systems Trends Attack the network (why? because we can) Proxy relay hiding (its not just for SMTP anymore) Combo Bot/Trojan/Worms Embedded software "upgrades" Any other trends network operators are seeing?

2 2

Whitelisting, AOL E.mail etc.
by Robert Mathews 15 Dec '03

15 Dec '03

All: I have weighed the benefit of posting Vs. NOT posting this information to NANOG. I found that posting this note to the larger community was important perhaps for two reasons. They are: 1) The problems that we at the University of Hawai'i experienced from 10/17 - 10/20 with AOL, effected a fairly large userbase. Therefore, I am inclined to believe that someone who is at least partially responsible for the operation or managment of another network similar to our own - could benefit from having this information (I know of at least 2 other large University systems that were effected by the same issue). 2) Having the requisite AOL contact information in any event - might be important toward at least partially achieving a resolve to future problems. Now, a brief recap. Beginning the afternoon of the 17th (EDT), all E.mail traffic from UH' namespace to AOL began to bounce. This condition did not resolve until the morning of the 20th (EDT). Primarily, this was due to AOL's whitelisting, and whitelisting policies. Upon discovering this problem, I began an inquiry into the condition. We were informed that AOL had received complaints from 'its members', who stated that our central E.mail server was responsible for instances of spamming. Subsequently, AOL personnel and I were able to hold a dialog over the weekend to resolve pertinent issues regarding the matter. I wish to give praise the AOL Team, who responded quickly, and were both cooperative and sincere with respect to their desire to resolve issues. I MUST credit Carl Hutzler, Dir. of AntiSpam Operations at AOL, and Charles Stiles, Manager of the Postmaster-Team at AOL especially, for their commitment to resolve this issue expediently. Traffic exchange between AOL and us have been re-established. For your reference, I wish to present the following statement from Carl to me, which may be helpful to you as well. "Anyone can request to receive the complaints that mail transmitted from their IP space generated via a Complaint Feedback Loop. All we need is: 1. Address space (CIDR or otherwise) 2. Abuse email address where you want them sent We will send them in realtime as we get them with the entire original spam included for your analysis. Feel free to have them send this data to me and/or our abuse phone number for now ..." The relevant AOL contacts are as follows: Carl Hutzler Director, AntiSpam Operations America Online Mail Operations cdhutzler(a)aol.com 703.265.5521 work 703.915.6862 cell Carl Hutzler <cdhutzler(a)aol.com> or Charles Stiles <stilesch(a)aol.com> Manager, Postmaster-Team - AOL All my best, Robert. -------

4 4

RouteScience experience?
by matthew zeier 14 Nov '03

14 Nov '03

Anyone have any real-life experience with RouteScience's PathControl (5014 to be exact)? I've been evaluating Sockeye's GlobalRoute and will be looking at PathControl later this week. Looking for any feedback, thanks. -- matthew zeier - "Nothing in life is to be feared. It is only to be understood." - Marie Curie

4 3

hinet.net contact
by John Obi 08 Nov '03

08 Nov '03

Hello folks, I can tell you that hinet.net hosts being exploited by script kiddies and no one in hinet.net cares. And I really failed to get a contact of their abuse department, or any live person bothers to reply. All the complaints and report got no where. I need to report security issues about going DDoS attacks all the time by script kiddies from State of Kuwait using hinet.net as primary windows IRC servers to control the DDoS bots. If you know someone over there please help to get these issues resolved. Thanks, -J __________________________________ Do you Yahoo!? Exclusive Video Premiere - Britney Spears http://launch.yahoo.com/promos/britneyspears/

2 2

Content filter (was - Re: [arin-announce] IPv4 Address Space)
by william＠elan.net 04 Nov '03

04 Nov '03

> Leave content filtering to the ES, and *force* ES to filter the content. And just to make sure we know what content filter is, this is what I received immedialy following my previous post to nanog. Whoever you are, that did not see my post, please at least configure your content filter to reject email and specify your own mail server name there (and preferably specifying what original rcpt to as well), putting my own server name in "from" is just not very polite, nor is it according to standards (you have no idea if "Administrator" account exist on my machine, in fact for most it would not). ---------- Forwarded message ---------- Date: Wed, 29 Oct 2003 19:22:54 -0500 From: Administrator(a)sokol.elan.net To: william(a)elan.net Subject: [MailServer Notification]To sender: Message matched eManager setting and action was taken. **************** eManager Notification ***************** The following mail was blocked since it contains sensitive content. Source mailbox: william(a)elan.net Destination mailbox(es): nanog(a)merit.edu Rule/Policy: Profanity Action: Quarantine to D:\Logs\Trend\SMCF\Quarantine\2003-10-29\19\22\DFImessagebody3fa059de2479.tmp Content filter has detected a sensitive e-mail. ******************* End of message *********************

11 18

ISPs' willingness to take action
by kenw＠kmsi.net 03 Nov '03

03 Nov '03

I'm a little puzzled, and I hope people won't object to my asking about this. As I see it, we're experiencing an ever-increasing flood of garbage network traffic. While not all of it is easy or appropriate to target, it seems to me there's some "low hanging fruit" that could generate serious gains with relatively little investment. A few things that make sense to me (as a non-ISP network consultant) include: 1) Summarily fencing/sandboxing/disconnecting clients sending high volumes of spam, virii, etc. You might politely contact your commercial/static clients first, but anyone connecting a "bare" PC on a broadband circuit is too stupid to deserve coddling. The great majority of your clients would thank you profusely. So far as I can see, detection of serious abusers should pretty straightforward. It wouldn't require any pretense at spam or virus filtering, per se; just pick off the clients that are flagrant sources of the plague of the month. 2) Notwithstanding the above, would it really be so hard to trap network packets bearing clear signatures of the "plague of the month"? Sure, it would create an extra load on routers or require special filtering hardware, but wouldn't it be worth it? Again, no need to be comprehensive; just blast the ones that are easy pickings. 3) There was a thread a little while ago that talked about a way to cut down spam by simply restricting who you would accept SMTP traffic from. Unfortunately, I don't recall the details, but at the time it struck me as eminently sensible, and just required cooperation between ISPs to implement effectively. One problem for the average ISP would be the monitoring and updating of plague control infrastructure. It would probably be a lot easier with a bit of cooperation and sharing -- either that, or someone could get rich offering services to ISPs for a fee. By the way, can anybody explain to me a legitimate use for port 135/137 traffic across the Internet, like it's somebody's private LAN? Seems to me anybody who still thinks that's legitimate is living in the past. So, the big question: why don't ISPs do more of this? Are they afraid of client reaction? Doesn't wash, for me: most clients would be highly grateful, and all it really takes for the remainder is fair warning. Cost? Again, you can judge for yourselves how low the fruit you choose to pick; the biggest gains have the best ROI. Happy clients, liberated bandwidth, faster servers -- what's to loose? /kenw Ken Wallewein CDP,CNE,MCSE,CCA,CCNA K&M Systems Integration Phone (403)274-7848 Fax (403)275-4535 kenw(a)kmsi.net www.kmsi.net

15 18

Re: IPv6 NAT
by Michael.Dillon＠radianz.com 01 Nov '03

01 Nov '03

>This does not mean we should NAT everything, since I use some of those >protocols. But if every Joe User had a DLink NAT box in front of his >Winbloze box, the Internet would be a safer place. And you know it. You're forgetting Rob Thomas's peripatetic presentation in Chicago. Not to mention the guy whose SSH session was outed by a keylogger. Check http://www.safer-networking.org/ for more on spyware and trojans. If this was the only way the black hats could wreak havoc then we would be seeing a lot more of it. I think that the only thing which will make the Internet a safer place is time and hard work. We have to put in the effort to address *ALL* the weaknesses until we've raised the bar so high that only the toughest black hats have the time, skills and energy to break the weakest link. --Michael Dillon

2 1

Fw: [Full-Disclosure] Gates: 'You don't need perfect code' for good security
by james 01 Nov '03

01 Nov '03

One word.... HA ! james ----- Original Message ----- From: "Jeremiah Cornelius" <> To: <full-disclosure(a)lists.netsys.com> Sent: Friday, October 31, 2003 11:32 AM Subject: [Full-Disclosure] Gates: 'You don't need perfect code' for good security : -----BEGIN PGP SIGNED MESSAGE----- : Hash: SHA1 : : FLAME ON! : : http://www.itbusiness.ca/index.asp?theaction=61&sid=53897 : : "But there are two other techniques: one is called firewalling and the other : is called keeping the software up to date. None of these problems (viruses : and worms) happened to people who did either one of those things. If you had : your firewall set up the right way - and when I say firewall I include : scanning e-mail and scanning file transfer -- you wouldn't have had a : problem. But did we have the tools that made that easy and automatic and that : you could really audit that you had done it? No. Microsoft in particular and : the industry in general didn't have it." : : "The second is just the updating thing. Anybody who kept their software up to : date didn't run into any of those problems, because the fixes preceded the : exploit. Now the times between when the vulnerability was published and when : somebody has exploited it, those have been going down, but in every case at : this stage we've had the fix out before the exploit. So next is making it : easy to do the updating, not for general features but just for the very few : critical security things, and then reducing the size of those patches, and : reducing the frequency of the patches, which gets you back to the code : quality issues. We have to bring these things to bear, and the very dramatic : things that we can do in the short term have to do with the firewalls and the : updating infrastructure. " : -----BEGIN PGP SIGNATURE----- : Version: GnuPG v1.2.3 (GNU/Linux) : : iD8DBQE/oqq3Ji2cv3XsiSARAlkdAJ0aGkBViYkoE193iZycTmQZohzwbQCg1KDA : SjPLY1EEzamQCtIGKwJT1Vk= : =mIsY : -----END PGP SIGNATURE----- : : _______________________________________________ : Full-Disclosure - We believe in it. : Charter: http://lists.netsys.com/full-disclosure-charter.html James Edwards Routing and Security Administrator jamesh(a)cybermesa.com At the Santa Fe Office: Internet at Cyber Mesa Store hours: 9-6 Monday through Friday 505-988-9200 SIP:1(747)669-1965

6 6

RE: IPv6 NAT
by Kuhtz, Christian 01 Nov '03

01 Nov '03

> Or you could simply call it what it is -- a firewall -- since > that's what most consumers think NAT is anyways. > > While I disagree with the general sentiment that NATs create > security, the standard usage of such devices is certainly > that of a stateful firewall. All hairsplitting aside, given that the term NAT these days is mostly used in a PAT (particularly in a customer connecting to the I) context, what isn't secure about? ***** "The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from all computers.61"

9 14

RE: Yankee Group declares core routing obsolete (was Re: Anybodyu sing GBICs?)
by Martin, Christian 31 Oct '03

31 Oct '03

Stephen, > I've always stated that "switch" is a marketing term meaning > "fast". Thus a > "L2 switch" is a "fast bridge" and a "L3 switch" is a "fast > router". In this light, the Yankee Group is just now > catching on to something we all knew a decade ago -- slow > (i.e. software) routers are dead. As you are probably more aware than I, software-based-forwarding routers will die when people stop running the so-called "desktop protocols", and even then, most next-gen routers will continue to need functions that can only be provided economically and perhaps thermodynamically (in terms of heat dissipation) in the form of sw "services" running on purpose-built and/or general-purpose CPUs. Examples are VOIP call processors, some FW ALGs as new protocols emerge, etc. The concept of L2 switching based on L3 information tends to be viable only when one can transparently bridge between the L2 protocols - otherwise, you are making L3-only decisions, and doing all sorts of L2 rewrite which many traditional Ethernet switches can't necessarily do. Things are getting better, but "L3-switches" pale in comparison to today's high-end routers on almost all fronts. If you take GigE out of the equation, modern "L3 Switches" are just as expensive as modern "core routers" - and routable, "mpls-able" L3 GE ports are _more_ expensive on "switches" than "routers" (see 4xGE OSM vs 4xGE GSR 'tetra' pricing). Media diversity, queuing performance, and FIB density is what really differentiates the two at this point, IMO. I am unaware of a traditional switch-turned-router (and I use these terms here as most do who draw a distinction) that can exceed the forwarding capacity of a core router when the media is largely WAN-based, there are complicated classification and filtering rules that are very dense, when complex queuing policy needs to be applied, and when the routing table is huge. Or perhaps my earlier experience with these switches-trying-to-be-routers has left me a bit jaded.... > There's a more interesting level to the discussion if you > look at what carriers are interested in for their backbone > hardware today; while I'm obviously biased based on my > employer, I've seen a lot more emphasis on $20k-per-10GE-port > "L3 switches" than $200k-per-10GE-port "core routers" in the > current economic climate. Of course, a "routable" 10GE port does NOT cost $20k - sure you can do MLS or whatver it is called - but things like label imposition/disposition is not possible. Also, last I saw, my MLS-enabled MSFCs weren't able to gather "vlan interface" statistics - they were all embedded in some L2 asic that I had to glean from the "switch." Further, Ethernet has the worst OAM capabilities of any modern media. BFD will help detect failures when it is available, but will never be able to tell me "why". SONET is clearly superior in the aspect. So, for enterprise switching, "L3 switches" are mostly fine - barring any funky bridging requirements (Blue protocols). But for carrier backbones, I suspect we will continue to see the majority of implementations usng modern "core routers". And we haven't even begun talking ATM and FR, and what device better suits these applications. Judging from your company's position on this front, I suspect that "core routers" may be our best bet here, given that many who could do switching well were unable to "bolt on" a usable, stable routing implementation. But that is another religious discussion for another day! My .02 chris > S > > Stephen Sprunk "God does not play dice." --Albert Einstein > CCIE #3723 "God is an inveterate gambler, and He throws the > K5SSS dice at every possible opportunity." --Stephen Hawking >

3 2