April 2004 - Test - lists.nanog.org

tcp bgp vulnerability looking glass and route server issues.
by Smith, Donald 20 Apr '04

20 Apr '04

John Fraizer author of MRLG one of the looking glass implementations has updated his code to fix a flaw that provided too much information. MRLG-4.3.0 is available at: Available here: ftp://ftp.enterzone.net/looking-glass/CURRENT/ Some route servers also provide too much info. This audit was performed yesterday so if you have already fixed this issue please ignore:-) Part of this issue is the fact that some router servers provide too much information. Without knowing the source/destination ports and IP's this is still a difficult vulnerability to exploit. >From this URL I did a quick audit. http://www.traceroute.org/#Route%20Servers I did NOT look at the looking glass URLs just the route servers. This is the list of open route servers I did a quick audit on. No connection means I was unable to connect to it. Not misconfigured meant sho ip bgp nei did NOT work. Sho ip bgp nei gives full ports/ips means what you think it means. You have may want to see if any of them are yours of if you peer / are the upstream for any of them. "Route Servers" "telnet://ner-routes.bbnplanet.net" BBN Planet NER route monitor No connection "telnet://route-server.belwue.de" BelWue (AS553) Sho ip bgp nei gives full ports/ips. "telnet://route-views.on.bb.telus.com">Telus - East Coast (AS852) Sho ip bgp nei gives full ports/ips. telnet://route-views.ab.bb.telus.com" Telus - West Coast (AS852) Sho ip bgp nei gives full ports/ips. "telnet://route-server.cerf.net">CerfNet Route Server (AS1838)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.ip.tiscali.net">Tiscali (AS3257)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.gblx.net">Global Crossing (AS3549)</A></LI> Not misconfigured:-) "telnet://route-server.savvis.net/">SAVVIS Communications (AS3561)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://public-route-server.is.co.za" TARGET=NEW>Internet Solutions (AS3741)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server-ap.exodus.net">Exodus Communications Asia (AS4197)</A></LI> No connection "telnet://route-server.as5388.net">Planet Online (AS5388)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.opentransit.net">Opentransit (AS5511)</A></LI> Not misconfigured:-) "telnet://tpr-route-server.saix.net">South African Internet eXchange SAIX (AS5713)</A></LI> Not misconfigure:-) "telnet://route-server.gt.ca">GT Group Telecom (AS6539)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.as6667.net">EUNet Finland (AS6667)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.he.net">Hurricane Electric (AS6939)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.ip.att.net">AT&T (AS7018)</A></LI> No connection "telnet://route-views.optus.net.au">Optus Route Server Australia (AS7474)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.wcg.net">Wiltel (AS7911)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.colt.net">Colt Internet (AS8220)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server-eu.exodus.net">Exodus Communications Europe (AS8709)</A></LI> No connection "telnet://route-views.bmcag.net">Broadnet mediascape communications AG (AS9132)</A></LI> Not misconfigured:-) "telnet://route-server-au.exodus.net">Exodus Communications Australia (AS9328)</A></LI> No connection "telnet://route-server.manilaix.net.ph">Manila Internet Exchange, Philippines (AS9670)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.east.attcanada.com">ATT Canada - East (AS15290)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.west.attcanada.com">ATT Canada - West (AS15290)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.ip.ndsoftware.net">NDSoftware (AS25358)</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://route-server.loudpacket.net">Loud Packet (AS27276)</A></LI> No connection. "telnet://route-server.as28747.net/">RealROOT (AS28747)</A></LI> No connection "telnet://route-views.oregon-ix.net">Oregon-ix.net Route Server</A></LI> Sho ip bgp nei appears it WOULD provide full ports/ips if they had any? The command executed but came back empty!!?? This one can be used as a proxy bounce (connect ip port) too:-( "telnet://route-server.utah.rep.net">Utah Regional Exchange Point Route Server</A></LI> Sho ip bgp nei gives full ports/ips. "telnet://www.netlantis.org">The NetLantis Project Route Server</A></LI> Not misconfigured. http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC Increased trust is received by not violating the trust you have received.

1 0

RE: Backbone IP network Economics - peering and transit
by Gary Hale 20 Apr '04

20 Apr '04

Daniel, That is way too cynical ... and does not address the question of whether building your own transport ever runs counter to the Internet as a consortium. There are business justifications that underpin peering relationships ... and they are based on understanding (or ... "philosophy") .... Gary -----Original Message----- From: Daniel Golding [mailto:dgolding@burtongroup.com] Sent: Tuesday, April 20, 2004 10:36 AM To: Gary Hale; Michel Py; Gordon Cook; nanog(a)merit.edu Subject: Re: Backbone IP network Economics - peering and transit On 4/20/04 8:45 AM, "Gary Hale" <ghale(a)globalinternetworking.com> wrote: > > The question is too simplistic ... It is not (simply) a matter of small > vs. big or being on your own network from source-to-destination. Peering > is an enabler ... and gives all an opportunity to share content globally > ... kinda' fundamental to the Internet consortium. > > Is your question, 'Since fiber is so cheap, why doesn't everyone build > an autonomous, facilities-based, global "Internet" network that competes > for narrowband/broadband "pullers" of data and hosting/data centers/etc. > for content providers ("pulled-fromers" or "pushers" of data)? > > Gary > > -----Original Message----- > From: Michel Py [mailto:michel@arneill-py.sacramento.ca.us] > Sent: Monday, April 19, 2004 10:46 PM > To: Gordon Cook; nanog(a)merit.edu > Subject: RE: Backbone IP network Economics - peering and transit > > >> Peering? Who needs peering if transit can be >> had for $20 per megabit per second? > > The smaller guys that don't buy transit buy the gigabit. > > Michel. > > > Gary, "Peering is an enabler" "gives all an opportunity to share content globally" "fundamental to the Internet consortium" This is like the "greatest hits" compendium collected from various failed 1990's service provider business plans :) People should be careful. Peering is a business/networking arrangement that can save them money (or not). Those who try to imbue it with philosophical significance must be viewed with skepticism. Daniel Golding Network and Telecommunications Strategies Burton Group

2 1

re: TCP vulnerability
by Allison Mankin 20 Apr '04

20 Apr '04

Hi, For those not helped too much the MD5 Signature Option, this i-d addresses the attacks in the Watson paper (it was meant to come out just when the advisory came out, but they jumped the gun). There are implementations in *xes and router OSes - more info from those sources. Allison -------- Forwarded Message A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the TCP Maintenance and Minor Extensions Working Group of the IETF. Title : Transmission Control Protocol security considerations Author(s) : R. Stewart Filename : draft-ietf-tcpm-tcpsecure-00.txt Pages : 10 Date : 2004-4-20 TCP (RFC793 [1]) is widely deployed and one of the most often used reliable end to end protocols for data communication. Yet when it was defined over 20 years ago the internet, as we know it, was a different place lacking many of the threats that are now common. Recently several rather serious threats have been detailed that can pose new methods for both denial of service and possibly data injection by blind attackers. This document details those threats and also proposes some small changes to the way TCP handles inbound segments that either eliminate the threats or at least minimize them to a more acceptable level. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-tcpm-tcpsecure-00.txt - --4737358894.1082487684/segue.merit.edu-- ------- End of Forwarded Message

1 0

TCP RST attack (the cause of all that MD5-o-rama)
by Mike Tancsa 20 Apr '04

20 Apr '04

http://www.uniras.gov.uk/vuls/2004/236929/index.htm -------------------------------------------------------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike(a)sentex.net Providing Internet since 1994 www.sentex.net Cambridge, Ontario Canada www.sentex.net/mike

15 24

Re: Lazy network operators - NOT
by Paul Vixie 20 Apr '04

20 Apr '04

> Maybe a stupid question... But if broadband providers aren't going to do > this, and considering there are way less legitimate SMTP senders than > broadband users, wouldn't it make more sense to whitelist known real SMTP > sources rather than blacklist all addresses that potentially have a fake > one? that's not a stupid question, and you're right that statistically it's better engineering to make a small list of good things than large lists of bad ones. IETF MARID, my own MAIL-FROM, somebody's SPF, yahoo's "domainkeys", and lots of other people are working on what amounts to "a whitelisting solution", and in a few more years you might actually see some results along those lines.

2 1

RE: Backbone IP network Economics - peering and transit
by Michel Py 20 Apr '04

20 Apr '04

> Peering? Who needs peering if transit can be > had for $20 per megabit per second? The smaller guys that don't buy transit buy the gigabit. Michel.

4 3

RE: Backbone IP network Economics - peering and transit
by Gary Hale 20 Apr '04

20 Apr '04

The question is too simplistic ... It is not (simply) a matter of small vs. big or being on your own network from source-to-destination. Peering is an enabler ... and gives all an opportunity to share content globally ... kinda' fundamental to the Internet consortium. Is your question, 'Since fiber is so cheap, why doesn't everyone build an autonomous, facilities-based, global "Internet" network that competes for narrowband/broadband "pullers" of data and hosting/data centers/etc. for content providers ("pulled-fromers" or "pushers" of data)? Gary -----Original Message----- From: Michel Py [mailto:michel@arneill-py.sacramento.ca.us] Sent: Monday, April 19, 2004 10:46 PM To: Gordon Cook; nanog(a)merit.edu Subject: RE: Backbone IP network Economics - peering and transit > Peering? Who needs peering if transit can be > had for $20 per megabit per second? The smaller guys that don't buy transit buy the gigabit. Michel.

2 1

Re: Microsoft XP SP2 (was Re: Lazy network operators - NOT)
by Dr. Jeffrey Race 20 Apr '04

20 Apr '04

On Mon, 19 Apr 2004 17:07:45 -1000 (HST), Scott Weeks wrote: >Think globally. Even though this forum has NA as its heading, we need to >think globally when suggesting solutions. You'll never get any sort of >licensing globally nor will you EVER get end users (globally) educated >enough to stop doing the things that they do which allow these events to >continually occur. We are in violent agreement about this. Since many gateway service providers will not prevent insufficiently skilled users from connecting to the internet and injuring others, the only remaining solution, as far as I can see, is cutting connectivity with those enablers. That is the proposal I advanced in <http://www.camblab.com/misc/univ_std.txt>. The logic seems quite simple: either fix all the users (impossible as you state) or keep them off the net (which you say many SPs won't do; I believe some will but many won't) so the only solution is to cut the latter off. If you are not willing to do that, then you will just have to accept the spam and we might as well stop whining about it. It is your choice. Jeffrey Race

3 2

RE: remote reboot power strips
by Cheung, Rick 20 Apr '04

20 Apr '04

We use Baytechs with much success. Not only does it allow remote reboots via the modem, it supports connectivity to the console ports via serial cables; ideal for troubleshooting or Xmodem-ing new code if necessary. http://www.baytechdcd.com/ Rick Cheung -----Original Message----- From: Alexei Roudnev [mailto:alex@relcom.net] Sent: Tuesday, April 20, 2004 1:50 AM To: Roy; 'Nanog List' Subject: Re: remote reboot power strips The same. ----- Original Message ----- From: "Roy" <garlic(a)garlic.com> To: "'Nanog List'" <nanog(a)merit.edu> Sent: Monday, April 19, 2004 10:10 AM Subject: RE: remote reboot power strips > > > We use a number of both the APC Masterswitch and the WTS NPS-115 with good > results. I don't think either of them have had a failure. > > Roy > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Christopher J. Wolff > Sent: Monday, April 19, 2004 8:24 AM > To: 'nanog list' > Subject: remote reboot power strips > > > > Hello, > > Last time I researched remote reboot power strips it seemed like most of the > power strips were garbage. Any recommendations for a solid performer would > be appreciated. Thank you. > > Regards, > Christopher J. Wolff, VP CIO > Broadband Laboratories, Inc. > http://www.bblabs.com > > > This message, including any attachments, contains confidential information intended for a specific individual and purpose and is protected by law. If you are not the intended recipient, please contact sender immediately by reply e-mail and destroy all copies. You are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The sender accepts no liability for any damage caused by any virus transmitted by this email. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission.

1 0

Re: Lazy network operators - NOT
by Doug White 20 Apr '04

20 Apr '04

: : >Ok, you have eloquently described the problem, now, please be good enough to : >give your solution : : : There is no easy solution. That's why we still have problems with spam in : postal mail, and that's been around for how many centuries? I'd go so far : as to say there's no easy solution, either. If there's authentication, then : new worm/trojans will focus on breaking the auth scheme or the auth : servers. If there's a blackout on port 25, then they'll use other ports. If : there's a list of trusted hosts, that list will be attacked. : : The only chance in hell of making a dent in spam is making a dent in its : profitability. If the guy sending the spam gets hassled once in a while, he : probably thinks it's worth it considering the new house and stable of : sports cars he has. If he's getting hassled AND he's just as poor or rich : as when he started, then and only then will it not be worth the hassles to : the spammer. : : Honestly, I don't understand how the spammers make money at all, so I can't : comment on it. However, I'd definitely suggest any solution look at the : profitability of spam, not the feasibility. : : : Rob Nelson : ronelson(a)vt.edu : : : Cost transference. The cost of Spam via postal mail is borne by the sender. When sent via email, the cost is shouldered by the recipient. Spamming is pervasive mainly due to the inattention or failure to enforce acceptable use policies by the service provider. A response rate of .0001 is sufficient for the spammer to profit because of being able to take advantage of the recipient bearing the cost of delivery. There is no "only chance." What seems to be required is the blended approach. Educating that user who does respond to UCE is a monumental, if not impossible task, while the safety and protection of individual networks is a need which is far more immediate. That education task is beyond the resources and capability of the offended mail server administrator. There is a plethora of methodology, and suggestions as to how best to combat the spew, and most of us have accepted the risk of the occasional false positive, especially when your correspondent chooses to continue to do business with a black hat provider. We have resorted to trying to get the customer to bring his own pressure on his provider, we have tried to pressure providers to be more responsive, unfortunately with mixed results. Especially when legislation and rules are formulated that can be at odds with the advertising campaigns of the providers themselves. All in all though we are trying to fight the good fight, and believe in technology, not legislation. cheers. Doug ====================================== We can get rid of spam on your domain! , Anti-spam solutions http://www.clickdoug.com/mailfilter.cfm For hosting solutions http://www.clickdoug.com ======================================

24 40