September 2003 - Test - lists.nanog.org

Eureka/GGN Listening?
by Drew Linsalata 16 Sep '03

16 Sep '03

If anyone from Eureka/GGN is listening, please drop me a note. -- Drew Linsalata The Gotham Bus Company, Inc. Colocation and Dedicated Access Solutions http://www.gothambus.com

1 0

Re: What *are* they smoking?
by Rich Braun 16 Sep '03

16 Sep '03

VeriSign stands to gain financially, take a look at this excerpt from an AP news blurb published yesterday: > Ben Turner, VeriSign's vice president for naming services, described the service > as a way to "improve overall usability of the Internet." > > People mistype ".com" and ".net" names some 20 million times daily, Turner said, > and internal studies show "the vast majority of users prefer a page like this > than what they are getting today." >... > Currently, Site Finder sends lost Web surfers to both regular search results and > pay-for-placement listings, which are marked as such. Turner said VeriSign was > partnering with two search companies he would not name. > > He would not disclose how much VeriSign would earn from those companies, with > which it has revenue-sharing arrangements. Anyone find out any details of the contracts which VeriSign has apparently signed to profit from this little venture? -rich

3 2

Vote early...
by Christopher X. Candreva 16 Sep '03

16 Sep '03

When you're done patching your resolver, and openssh, you might want to cast a vote for Stratton in their monthly CEO opinion poll. http://www.forbes.com/2003/05/01/cx_ceointernetpoll.html (Thanks to, uhm, someone who might not want to be named from OpenSRS for passing this along.) ========================================================== Chris Candreva -- chris(a)westnet.com -- (914) 967-7816 WestNet Internet Services of Westchester http://www.westnet.com/

1 0

RE: new openssh issue
by Ingevaldson, Dan (ISS Atlanta) 16 Sep '03

16 Sep '03

As promised, our advisory: http://xforce.iss.net/xforce/alerts/id/144 Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Ingevaldson, Dan (ISS Atlanta) Sent: Tuesday, September 16, 2003 4:01 PM To: Valdis.Kletnieks(a)vt.edu; Richard A Steenbergen Cc: William Allen Simpson; nanog(a)nanog.org Subject: RE: new openssh issue ISS X-Force discovered this vulnerability and our advisory will be released shortly. We were working to determine the full scope of the vulnerability before we notified the vendor. Unfortunately, someone else found the flaw and began to cause discuss it using specifics. That caused us to push forward our disclosure. Typically, when we do X-Force Advisories, we have developed an in-house, functional exploit (not proof of concept) in order to verify the exact nature and scope of the issue. We have not done so in this case. Right now it is undetermined if the issue is exploitable on *any* platform. It may turn out that it may be exploitable on every platform. This issue is serious enough that it should be addressed on all platforms as quickly as possible. I'll forward our Advisory to the list when it is public. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, September 16, 2003 3:50 PM To: Richard A Steenbergen Cc: William Allen Simpson; nanog(a)nanog.org Subject: Re: new openssh issue On Tue, 16 Sep 2003 15:33:03 EDT, Richard A Steenbergen said: > > patched, but does anybody know whether there's a problem with the > > criscos? (as in "how do I configure my router for that?" ;-) > > Or better yet, the OpenSSH running on Junipers? Nothing on Juniper's > site > about a vulnerability so far. A posting to full-disclosure quotes Theo as saying HP and Cisco are affected, and I don't see any reason that Juniper would *NOT* be, given the common code base of the OpenSSH implementations. I'm not going to say the routers are vulnerable, but I *would* say that ACLs blocking port 22 to the router might be a good idea.....

1 0

Root Server Operators (Re: What *are* they smoking?)
by John Neiberger 16 Sep '03

16 Sep '03

>>>> <joej(a)Rocknyou.com> 9/16/03 2:18:58 PM >>> > > >Just came across this: > >http://www.washingtonpost.com/wp-dyn/articles/A996-2003Sep12.html > Interesting and well-written. And ICANN had no comment. John --

1 0

Root Server Operators (Re: What *are* they smoking?)
by joej＠Rocknyou.com 16 Sep '03

16 Sep '03

Just came across this: http://www.washingtonpost.com/wp-dyn/articles/A996-2003Sep12.html

1 0

Re: Root Server Operators (Re: What *are* they smoking?)
by John Neiberger 16 Sep '03

16 Sep '03

>>>> "Robert A. Hayden" <rhayden(a)geek.net> 9/16/03 2:07:08 PM >>> > >On Tue, 16 Sep 2003, Damian Gerow wrote: >> How about, 'Internet Operators Across North America Struggle to Deal with >> Impact of Business Decision: Internet Functionality Worldwide >> Tampered With by Verisign'? There doesn't really appear to be a unified >> decision to do one thing, there's a lot of bandying ideas around, and >> 'wouldn't-it-be-cool-if's being thrown out. Given the technical nature of the issue perhaps someone from the list with excellent writing skills could author the 'press release'. Then, if someone else has some media or press contacts they could simply pass the release along to them. To be sure, that idea has a few problems but at least you have a chance to make sure the release contains factual information while still conveying the importance of the issue, two things that wouldn't be guaranteed if this were written up by a non-technical member of the press. Anybody know someone that works for AP or Reuters? Or maybe Wall Street Journal? :-) John --

1 0

RE: new openssh issue
by Ingevaldson, Dan (ISS Atlanta) 16 Sep '03

16 Sep '03

ISS X-Force discovered this vulnerability and our advisory will be released shortly. We were working to determine the full scope of the vulnerability before we notified the vendor. Unfortunately, someone else found the flaw and began to cause discuss it using specifics. That caused us to push forward our disclosure. Typically, when we do X-Force Advisories, we have developed an in-house, functional exploit (not proof of concept) in order to verify the exact nature and scope of the issue. We have not done so in this case. Right now it is undetermined if the issue is exploitable on *any* platform. It may turn out that it may be exploitable on every platform. This issue is serious enough that it should be addressed on all platforms as quickly as possible. I'll forward our Advisory to the list when it is public. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D dsi(a)iss.net 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Tuesday, September 16, 2003 3:50 PM To: Richard A Steenbergen Cc: William Allen Simpson; nanog(a)nanog.org Subject: Re: new openssh issue On Tue, 16 Sep 2003 15:33:03 EDT, Richard A Steenbergen said: > > patched, but does anybody know whether there's a problem with the > > criscos? (as in "how do I configure my router for that?" ;-) > > Or better yet, the OpenSSH running on Junipers? Nothing on Juniper's > site > about a vulnerability so far. A posting to full-disclosure quotes Theo as saying HP and Cisco are affected, and I don't see any reason that Juniper would *NOT* be, given the common code base of the OpenSSH implementations. I'm not going to say the routers are vulnerable, but I *would* say that ACLs blocking port 22 to the router might be a good idea.....

1 0

Re: Verisign insanity - Distributed non-attack
by Stephen J. Wilcox 16 Sep '03

16 Sep '03

Alternatively: Improve your hits - Point the IP to your company webserver or add an A record to your local DNS servers to resolve to your site If you want to help your peers to rid their networks of verisign, why not announce the IP via BGP anycast ;p I do like the idea of inundating their systems, my only gripe is that I see their server on my transits, which even if I leave things as is I assume verisign wont be paying for the extra bandwidth that they now cause ISPs across the world to use... Steve On Tue, 16 Sep 2003, RoDent wrote: > > After reading the posts on this list about Verisign's insane behaviour > regarding the .com and .net TLD wildcards, I'd like to make a suggestion: > > Anyone remember the old RC5, distributed.net or Seti@Home projects? > > If Verisign continues with this irrational behaviour I propose developing > a distributed client that will inundate their wildcard hosts with invalid > requests, thus making harvesting useful information from any HTTP, or > SMTP traffic that they hijack nigh impossible. > > I nice distributed effort, a simple win32, and Unix client, and a stats > based reporting system will make this a project where everyone can vote > with their IP address. > > I've also taken a look at the BIND code myself, to see how to rid myself > of these falsely reported A records, but the fact is that unless EVERYONE > joins in on running such a version of bind, Verisign will still get away > with it. > It's ridiculous that I as an administrator have to take steps to correct > the greedy self-righteousness that is the halmark of their "experiment" in > an > effort to get some of the FUNDAMENTALS of DNS behaviour to operate > as expected. > > Inundating them with requests (such as the small Lynx shell script posted > earlier), will force bigger ISP's to take a stance against this behaviour as > well, > since they'll be the ones footing the bill in terms of transparent cache > servers > being filled with invalid requests, sitting on expensive disc, and expiring > other > more cache-worthy documents, and filling up processing queues. > > Effectively this would amount to "denial of service" attack, but since > there is > nothing illegal about making an http request to an invalid hostname, > Verisign > will be bringing the denial of service attack upon themselves, and > unfortunately > dragging ISP's with them. Why ISP's haven't publically taken a stance > against > this yet is fascinating. > > I'm a mild mannered programmer/administrator by day, but blatantly > monopolistic practices such as this requires decisive mass action, and makes > my blood boil. There are enough issues to deal with on a day to day basis > just to combat the loopholes there currently are for spammers. > > Having Verisign give spammers free FROM: domains to spam from has just > made the task all the more unpleasant... > > If Verisign doesn't retract their mal-implemented "White Paper" and it's > insiduous > behaviour from the internet within the next week, I WILL start developing a > client > that allows netizens to vote with their IP's and HTTP, or SMTP traffic. > > I will personally put up a 100$ prize for the client that according to > statistics have > made the most requests to invalid .com/.net domains within the period > required > to get them to stop. > > Cheers, > Roelf Diedericks > Systems Programmer > > "I might be on the other end of a 56k modem, but I have a lot of friends > with > 56k modems..." > >

2 1

simple way to fix Verisign DNS issues
by John Brown 16 Sep '03

16 Sep '03

Ok, so the Verisign issue seems to impact a number of various things. 1. RBL's 2. Testing scripts 3. MX and mail handling 4. Taking eyeballs and possible revenue away from others I think the solution is quite simple. Each provider that is unhappy with this should stand up a ANYCAST server that answers on this IP. Use Zebra to inject AS 30060 into your network and have it goto a machine that simply answer NXDOMAIN. Have that DNS server(s) answer the same way "it should" or "the way you want" Make sure you tag the route with NO-EXPORT :) If you are a hosting company, you could redirect them to your "Buy Domains Now" page. Verisign is HELPING YOU get more customers. All you need is a few stewpid router tricks and poof you are set. I've stood up two anycast servers today and its working nicely. The DNS server just answers like it should. Heck you could have this server also become a AS112 box for your network as well. Kill two birds with one ,er two zebras Cheers

2 1