May 2004 - Test - lists.nanog.org

Dial up goes boom
by J. Oquendo 04 May '04

04 May '04

Once, twice, three times... an outtage. TNT's just went bonkers =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net 'Everything we hear is an opinion, not a fact. Everything we see is a perspective, not the truth.' -- Marcus Aurelius

1 1

RE: FW: Worms versus Bots now religion host security vs firewall/nat/acl
by Smith, Donald 04 May '04

04 May '04

The goal of the document is clearly stated below. Feel free to read the document and make suggestions (within scope) for improvements. The document is not intended to take the place of hardening XP documents. Today I learned from Sean that the firewall portion of XP sp1 comes up after services are enabled. I will request that information be added to the pdf. I am NOT arguing against firewalls. I like them, I use them, their grrrrrrrrrrrrrrrrrr8! Security in depth is a good idea, one that I support, encourage and practice. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: Rob Nelson [mailto:ronelson@vt.edu] > Sent: Tuesday, May 04, 2004 4:26 PM > To: Smith, Donald; Daniel Senie; Sean Donelan > Cc: nanog(a)merit.edu > Subject: RE: FW: Worms versus Bots > > > > >The goal of this document is help new XP users survive long > enough to > >do their updates. Many of them cant/wont put up > acls/nat/firewalls ... > >but if they follow the steps listed they have a better chance of > >successfully downloading and updating their new machine then > they will > >have with OUT these steps. > >It is not meant as a complete XP hardening document. There > are lots of > >documents that discuss in detail how to harden > >windows (xp,nt,2k...). > > If the person doesn't continue to do acls/nat/firewalls, > they'll just get > infected after the next hole is discovered. And yes, there > are plenty of > holes that a firewall/nat box won't fix. Still, better than > the user only > doing Windows Update on the day of install and never having a > firewall... > > Rob Nelson > ronelson(a)vt.edu > >

1 0

Verizon TLS ?
by Deepak Jain 04 May '04

04 May '04

Does anyone have any positive/negative experiences to share with Verizon TLS service (At the Gigabit level)? thanks, DJ

1 0

"Network Card Theft Causes Internet Outage"
by Andy Dills 04 May '04

04 May '04

Just in case any of you don't read slashdot: http://www.eweek.com/article2/0,1759,1583347,00.asp "Law enforcement officials said four DS-3 cards were reported missing from a Manhattan co-location facility owned by Verizon Communications Inc. The theft at 240 E. 38th St. occurred just after 10:30 p.m. on Sunday and is being investigated by New York City Police and members of the joint terrorism task force, according to NYPD spokesman Lt. Brian Burke. " 4 DS3 cards and the joint terrorism task force is called in? Aren't there enough gas tanks being stolen around the country for the joint terrorism task force to be kept busy? Trying to fix our terrorism problem like this is like trying to fix the spam problem using IP-based blacklists. Anyway, late in the article a spokesman for Sprint is quoted: "Fleckenstein said that the outage was "not major," and not large enough to require a report to the Federal Communications Commission." I just thought it was hilarious that a this outage is major enough to suspect terrorist motives and involve the appropriate agency, but not major enough to warrant reporting to the FCC. Sure, it didn't knock down the service of 50,000 customers, but doesn't it seem sad that an entire mid-sized city must lose service before the FCC gets to know about it? I think every fricking trouble ticket generated at an ILEC should be recorded at the FCC. It's not like they don't have the means and technology. It would be near-trivial, in fact, given their capabilities when properly motivated. Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

9 10

BGP Exploit
by kwallace＠pcconnection.com 04 May '04

04 May '04

Now that the firestorm over implementing Md5 has quieted down a bit, is anybody aware of whether the exploit has been used? Feel free to reply off list. Thanks, Keith Wallace Director, Telecommunications PC Connection Services

4 3

RE: FW: Worms versus Bots
by Michel Py 04 May '04

04 May '04

> Smith, Donald wrote: > The goal of this document is help new XP users > survive long enough to do their updates. It is regrettable though that no mention is made of real personal firewalls such as ZoneAlarm (ICF has no egress control whatsoever). Although the intentions behind this document are good, I am concerned that users might get a false sensation of security after reading it (because after doing some steps it is now "safe" to plug the network). > Many of them cant/wont put up acls/nat/firewalls... IMHO there is no excuse not to have a $39 box on a broadband connection. And, contrary to ICF, it can't be deactivated. Talking about defense in depth, this box _is_ the first line of defense. When I install a PC at friends and family, my sequence is: 1. Hardware NAT/router/firewall. Deactivate uPNP and wireless. 2. Passwords 3. Windows Update 4. Office online 5. Norton anti-virus with automatic updates and scheduled scans. 6. ZoneAlarm 7. Ad-aware with update 8. Run a full virus scan 9. Run a full spyware scan ICF is not even part of the picture as it does not remove the need for the hardware nor the need for ZoneAlarm. As far as spending money on hardware, it's part of what is required to have my help, along with beer and baked goods. Michel

1 0

RE: FW: Worms versus Bots
by Daniel Senie 04 May '04

04 May '04

At 12:35 PM 5/4/2004, Smith, Donald wrote: >Daniel I agree a nat/firewall/router with acl's ... will all help >prevent windows compromises. >I believe security in depth is an essential element of any good security >system. > >The goal of this document is help new XP users survive long enough to do >their updates. >Many of them cant/wont put up acls/nat/firewalls Note that I said "have this NAT box in your bag." My suggestion is that this be used during installation. Is $50 too high an extra expense to suggest people just buy one with the machine, and use it as a tool for doing installations? That's what I was suggesting. For the money, this is FAR better protection than that provided by the document. >... but if they follow >the steps listed they have a better chance of >successfully downloading and updating their new machine then they will >have with OUT these steps. >It is not meant as a complete XP hardening document. There are lots of >documents that discuss in detail how to harden >windows (xp,nt,2k...). > >Donald.Smith(a)qwest.com GCIA >http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC >pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC >kill -13 111.2 > > > -----Original Message----- > > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > > Behalf Of Daniel Senie > > Sent: Tuesday, May 04, 2004 9:39 AM > > To: Sean Donelan > > Cc: nanog(a)merit.edu > > Subject: RE: FW: Worms versus Bots > > > > > > > > At 10:54 AM 5/4/2004, Sean Donelan wrote: > > > > >On Tue, 4 May 2004, Smith, Donald wrote: > > > > If you follow these steps outlined by SANS you should be able to > > > > successfully update and NOT get infected. This is short, > > easy, fully > > > > documented (with pictures :) > > > > http://www.sans.org/rr/papers/index.php?id=1298 > > > > > >The risk is smaller, but still exists if you follow these directions > > >for XP pre-SP2. See the Microsoft release notes for XP SP2 > > for details > > >about the fix. > > > > > >If you do not have XP SP2, you need to disconnect your computer from > > >the network prior to every boot cycle until it is fully patched. > > > > A much simpler mechanism than that described by SANS is to > > have a small, > > cheap NAT box in your bag (e.g. D-Link DI-604 or similar). > > Worth the $50 > > cost to have one available. Put the little router between the > > new machine > > to be brought up and whatever network you have access to. Now > > you can bring > > up the new machine and update it without having it get > > instantly infected. > > (Use some common sense... don't set up email until the > > machine is patched, > > or use any other sort of mechanism to pull in potential > > viruses before > > patching is done). > > > > (To deflect the inevitable "NAT is not a firewall" > > complaints, the box is a > > stateful inspection firewall -- as all NAT boxes actually are). > > > >

1 0

L2TPv3 encaps performance (again)
by Joe Abley 04 May '04

04 May '04

I had quite a large number of people reply privately to me on this (see below), but a singular lack of vendors (just one) who had anything to say on the subject. So, before I conclude that there is only one vendor in the world that supports L2TPv3 at anything close to gigabit speeds, I thought I'd ask again, more explicitly: If there are any vendors interested in selling L2TPv3 boxes, and they'd like the list of potential customers who have sent me mail about this to find out about them, then they should feel free to send me a sentence or two about what their boxes can do so I can pass the information on. Suggestions and recommendations from operators would be also wildly good to hear. Thanks! Begin forwarded message: > From: Joe Abley [mailto:jabley@isc.org] > Sent: Wednesday, April 28, 2004 11:05 AM > To: nanog(a)nanog.org > Subject: L2TPv3 encaps performance > > Someone asked me the other day if I could recommend some L2TPv3 tunnel > termination devices which might be capable of encaps/de-encaps of > traffic which bursts near to 1Gbit/s (e.g. with GE uplinks to a > core/transport network, and GE interfaces for hand-off towards the > subscriber). Application is providing transparent/pseudowire wide-area > ethernet transport service over a routed-IP but non-LDP-capable core. > > This didn't sound like a particularly hard question, but I couldn't > find any performance numbers on L2TPv3 edge boxes anywhere. What boxes > exist that can do this stuff at gig speeds? > > Replies off-list would be fine, I can summarise if there's interest. >

1 0

RE: FW: Worms versus Bots
by Smith, Donald 04 May '04

04 May '04

Daniel I agree a nat/firewall/router with acl's ... will all help prevent windows compromises. I believe security in depth is an essential element of any good security system. The goal of this document is help new XP users survive long enough to do their updates. Many of them cant/wont put up acls/nat/firewalls ... but if they follow the steps listed they have a better chance of successfully downloading and updating their new machine then they will have with OUT these steps. It is not meant as a complete XP hardening document. There are lots of documents that discuss in detail how to harden windows (xp,nt,2k...). Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Daniel Senie > Sent: Tuesday, May 04, 2004 9:39 AM > To: Sean Donelan > Cc: nanog(a)merit.edu > Subject: RE: FW: Worms versus Bots > > > > At 10:54 AM 5/4/2004, Sean Donelan wrote: > > >On Tue, 4 May 2004, Smith, Donald wrote: > > > If you follow these steps outlined by SANS you should be able to > > > successfully update and NOT get infected. This is short, > easy, fully > > > documented (with pictures :) > > > http://www.sans.org/rr/papers/index.php?id=1298 > > > >The risk is smaller, but still exists if you follow these directions > >for XP pre-SP2. See the Microsoft release notes for XP SP2 > for details > >about the fix. > > > >If you do not have XP SP2, you need to disconnect your computer from > >the network prior to every boot cycle until it is fully patched. > > A much simpler mechanism than that described by SANS is to > have a small, > cheap NAT box in your bag (e.g. D-Link DI-604 or similar). > Worth the $50 > cost to have one available. Put the little router between the > new machine > to be brought up and whatever network you have access to. Now > you can bring > up the new machine and update it without having it get > instantly infected. > (Use some common sense... don't set up email until the > machine is patched, > or use any other sort of mechanism to pull in potential > viruses before > patching is done). > > (To deflect the inevitable "NAT is not a firewall" > complaints, the box is a > stateful inspection firewall -- as all NAT boxes actually are). > >

1 0

RE: FW: Worms versus Bots
by Smith, Donald 04 May '04

04 May '04

Sean thanks I just reread XP sp2 details and your right sp2 starts the firewall SOONER during boot (like before it starts most network services :-) http://msdn.microsoft.com/security/default.aspx?pull=/library/en-us/dnwx p/html/securityinxpsp2.asp Boot time security. In earlier versions of Windows there is a window of time between when the network stack started and when ICF provided protection. Consequently, a packet could have been received and delivered to a service without ICF filtering it, potentially exposing the computer to vulnerabilities. In SP2, the firewall driver has a static rule called a boot-time policy to perform stateful filtering. This will allow the computer to perform basic networking tasks such as DNS and DHCP and communicate with a Domain Controller to obtain policy. Once the firewall service is running, it will load and apply the run-time ICF policy and remove the boot-time filters. This change should increase system security without affecting applications. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: Sean Donelan [mailto:sean@donelan.com] > Sent: Tuesday, May 04, 2004 8:55 AM > To: Smith, Donald > Cc: nanog(a)merit.edu > Subject: RE: FW: Worms versus Bots > > > On Tue, 4 May 2004, Smith, Donald wrote: > > If you follow these steps outlined by SANS you should be able to > > successfully update and NOT get infected. This is short, > easy, fully > > documented (with pictures :) > > http://www.sans.org/rr/papers/index.php?id=1298 > > The risk is smaller, but still exists if you follow these > directions for XP pre-SP2. See the Microsoft release notes > for XP SP2 for details about the fix. > > If you do not have XP SP2, you need to disconnect your > computer from the network prior to every boot cycle until it > is fully patched. > >

1 0