December 2005 - Test - lists.nanog.org

Ebay Verification?
by Mehgan Laveck 29 Dec '05

29 Dec '05

Hello all - I am hoping to enlist some help in verifying a problem that has affected several users on my network. Here's the deal. Over the course of the last month, we have noticed random timeouts in trying to reach certain IPs on Ebay's web farm. The following IPs seem to crop up repeatedly: 216.113.178.140 216.113.185.41 216.113.178.10 216.113.176.11 We have seen many cases where telnetting to port 80 on these IPs results in a timeout rather than the expected HTTP connection. So far, we have seen the problems most often from Linux boxes, I have not been able to recreate the issue from FreeBSD, OpenBSD or Solaris. I have heard one report of a failure from WindowsXP, but have not seen the problem on Windows myself. We have verified that the issue happens through 2 of our upstreams, Level3 and Cogent. There seem to be some thoughts as to akamai being the possible culprit, specifically as it interacts with Linux. I'm hoping a few of you Linux users out there will give it a shot, telnetting to port 80 on these IPs several times to see if you can get a failure. Any thoughts on this issue are greatly appreciated. -- Mehgan Laveck - Network Engineer Front Range Internet, Inc. mehganl(a)frii.net - (970) 212-0725

2 1

update on the DA list and botnet reporting by AS
by Gadi Evron 28 Dec '05

28 Dec '05

Hi! This is an update to all nanogers who have been waiting. 1. My apologies to all those waiting for reply on subscription. We have just re-opened additions to the list after a very long time. That aided by an Inbox loss on my side caused things to be a bit slow. Please email me again if you indeed haven't received a reply from me, and many others should be getting replies in the next couple of weeks. 2. The botnet reports which have been sent here mounthly up until not too long ago have stopped. That is because of 2 main reasons: - We started sending out botnet reports by AS, and are giving ISP's a chance to get used to them and how to handle them before we resume with "public shaming" as some here chose to call it. - We are in the process of automating these reports, so that they come from the AS reporting system once every set period of time. 3. The AS reporting mechanism is fully operational. If you would like to know about potential and suspect botnet C&C servers in your AS, please email me and we will add you to the system. Thanks, a very merry Christmas , Hanuka, all the rest and a happy new year! Gadi. -- My blog: http://blogs.securiteam.com/?author=6 "The third principle of sentient life is the capacity for self-sacrifice --- the conscious ability to override evolution and self-preservation for a cause, a friend, a loved one." -- Draal, "A Voice in the Wilderness", Babylon 5.

1 0

Re: Compromised machines liable for damage?
by Hannigan, Martin 28 Dec '05

28 Dec '05

We didn't want it the first time. Try network operations. (rushes to finish the jc dill killfile entry) -----Original Message----- From: JC Dill [mailto:lists05@equinephotoart.com] Sent: Tue Dec 27 18:01:29 2005 To: NANOG Subject: Re: Compromised machines liable for damage? Here is the link again: <http://www.lectlaw.com/files/cur78.htm> Please spend some time reading that site to educate yourself about the facts and common misconceptions about this incident before you try any further analogies based on it. In *this* case the injured woman had done most[1] of the reasonable things one should do to try to mitigate injury, but she was seriously injured and the seriousness of the injury was directly due to the product being defective. McDonalds was held liable because they knowingly and intentionally sold a defective product even after having over 700 prior incidents (serious burns) reported to them due to this defect (the coffee being too hot). Jason Frisvold wrote: >Still, a little common sense... Hot coffee of any type, between the >legs, in a moving car? Umm.. even "normal" coffee still causes a >jump of pain. That jump of pain could easily cause a car accident. > <quote> Critics of civil justice, who have pounced on this case, often charge that Liebeck was driving the car or that the vehicle was in motion when she spilled the coffee; neither is true. </quote> The coffee wasn't just "hot", it was much too hot to be safely consumed. Note that <quote> [if the] spill had involved coffee at 155 degrees, the liquid would have cooled and given her time to avoid a serious burn </quote> and <quote> The company admitted its customers were unaware that they could suffer third degree burns from the coffee and that a statement on the side of the cup was not a "warning" but a "reminder" since the location of the writing would not warn customers of the hazard. </quote> Now let us consider Microsoft's continued sales of defective Windows and IE software given their track record for failing to ensure that their product works safely and doesn't enable others to cause damage to the user's system and data or (of primary importance to the networking community) the systems and networks of others: <http://bcheck.scanit.be/bcheck/page.php?name=STATS2004> Even if the end user updates their Windows/IE software the minute a security update is available, their browser would still have been vulnerable for all but 7 days in 2004! I wonder how 2005 has been shaping up. Hmmm. I wonder if Stella's lawyers would like to take on Microsoft.... jc [1] The jury awarded Liebeck $200,000 in compensatory damages. This amount was reduced to $160,000 because the jury found Liebeck 20 percent at fault in the spill. The jury also awarded Liebeck $2.7 million in punitive damages, which equals about two days of McDonalds' coffee sales. Post-verdict investigation found that the temperature of coffee at the local Albuquerque McDonalds had dropped to 158 degrees fahrenheit. The trial court subsequently reduced the punitive award to $480,000 -- or three times compensatory damages -- even though the judge called McDonalds' conduct reckless, callous and willful.

1 0

Re: Wireless networking failover
by Fergie 27 Dec '05

27 Dec '05

Have you looked at GLBP? - ferg -- "Snyder, Danny" <Danny.Snyder(a)swinc.com> wrote: I'm looking for information on the best practice for dealing with the following scenario. Any assistance that can be offered would be appreciated; if this isn't the best place to ask but someone can point me in the correct direction, I'd appreciate it. Connections: -A LED-based point-to-point wireless connection (100 Mbps) -A 802.1a or g-based point-to-point radio frequency wireless connection (54Mbps) -A point-to-point T1 The connections should be preferred in that order. The problem is that one or both of the wireless connections are affected by weather and can degrade to the point that they are operating at a very slow speed. For instance, the LED connection could degrade to less than 54 Mbps but the 54 Mbps connection is unaffected. Or both could degrade to less than T1 speeds. There is a Cisco 2851 on either end of the connections that makes the routing decision for traffic to go across one of the three connections. My question- is there a way (product, additional configuration, STP, routing protocol, etc.) that would allow the equipment to dynamically switch to the currently fastest connection, particularly in the situation that one connection has degraded but not failed? Thanks in advance, Danny Snyder -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Wireless networking failover
by Snyder, Danny 27 Dec '05

27 Dec '05

I'm looking for information on the best practice for dealing with the following scenario. Any assistance that can be offered would be appreciated; if this isn't the best place to ask but someone can point me in the correct direction, I'd appreciate it. Connections: -A LED-based point-to-point wireless connection (100 Mbps) -A 802.1a or g-based point-to-point radio frequency wireless connection (54Mbps) -A point-to-point T1 The connections should be preferred in that order. The problem is that one or both of the wireless connections are affected by weather and can degrade to the point that they are operating at a very slow speed. For instance, the LED connection could degrade to less than 54 Mbps but the 54 Mbps connection is unaffected. Or both could degrade to less than T1 speeds. There is a Cisco 2851 on either end of the connections that makes the routing decision for traffic to go across one of the three connections. My question- is there a way (product, additional configuration, STP, routing protocol, etc.) that would allow the equipment to dynamically switch to the currently fastest connection, particularly in the situation that one connection has degraded but not failed? Thanks in advance, Danny Snyder

1 0

OT: explaining "all-while etc. clubs"
by Gadi Evron 27 Dec '05

27 Dec '05

I believe I owe some people here an explanation as this was not understood by some. In the anti virus industry, closed groups often of people who know each other in person (snobs), and who trust no one outside their group, are referred to as a metaphore to be like 50's clubs for all-white, all-rich all Christian.. as an exaggeration. I meant no offense to anyone, and if you don't know, I am from Israel and was born a Jew. I believe that although as much information as possible should be shared with the outside world, closed and secure groups are a necessity in many occasions. Thanks and merry Christmas and sorry to those I offended, Gadi.

1 0

RE: Compromised machines liable for damage?
by Hannigan, Martin 27 Dec '05

27 Dec '05

Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting dichotomy. Marty -----Original Message----- From: Dave Pooser [mailto:dave.nanog@alfordmedia.com] Sent: Sun Dec 25 23:09:02 2005 To: NANOG Subject: Compromised machines liable for damage? > This should be another thread completely, but I am wondering about > the liability of the individual's who have owned machines that are > attacking me/my clients. As a practical matter, I'd expect it to be difficult to try. Convincing a jury that running a PHP version that's three months out of date constitutes gross negligence because you should have read about the vulnerability on the Web might be... tricky. Especially when you have to explain to the jury what PHP is. Dueling expert witnesses arguing about best practice, poor confused webmaster/Amway distributor looking bewildered at all this technical talk ("I figgered I just buy Plesk and I was good to go. I dunno nothin' about PHP. Isn't that a drug?") Not to mention working out what percentage of the damages you suffered should come from each host. But yeah, I'd like to see it tried. Lawyering up is one of our core competencies here in the USA; maybe we could use it for good instead of evil. -- Dave Pooser Manager of Information Services Alford Media http://www.alfordmedia.com

6 5

RE: Compromised machines liable for damage?
by Hannigan, Martin 27 Dec '05

27 Dec '05

Botnet code is open source, as far as I know. Maybe not by design, but I have gigs of it and its all googleable. Not being a lawyer, I'd guess the plaintiff size is highy debateable based on source or destination. Marty -----Original Message----- From: Owen DeLong [mailto:owen@delong.com] Sent: Mon Dec 26 23:32:04 2005 To: Hannigan, Martin; Joseph Jackson Cc: NANOG Subject: RE: Compromised machines liable for damage? RIAA is a very different context from what we are talking about here. First, the number of people getting attacked from Open Source systems is very small, so, you have a very small class of plaintiffs. Second, said class of plaintiffs is probably not as well funded as RIAA. OTOH, the number of people/organizations being attacked from Micr0$0ft based systems is relatively high, so, a large class of plaintiffs, and, some of them being enterprises are relatively well funded. Second, in the case of RIAA, it is businesses suing to do what they perceive as protecting their profit stream, and, they know they are suing a collection of defendants that are relatively poorly funded and have no organization. In the case of Open Source, I think there is a pretty good track record of the community coming to the aid of those that get sued for various reasons (DeCSS comes to mind). Sure, it's easy to sue someone who doesn't have any money, but, there's no point in doing so. Frankly, it's not the people with no money that are at risk here. It's the people with some money and some assets. If you have nothing, you're pretty safe ignoring a civil suit because you have nothing to lose. Frankly, if RIAA were to sue me, it wouldn't cost me $250,000 to fight it. It might cost me a few thousand if I chose to involve a lawyer in some portion of the process, but, initially, I think I could make their life difficult enough to get them to go away without involving a lawyer. I've already made MPAA/Disney go away twice without a lawyer. Admittedly, they went away before even filing a suit, so, technically, I haven't been sued, but, I've been threatened by them, and, I'm sure if I'd buckled under or failed to confront them appropriately, I would have either gotten sued or ended up handing over money. The costs of defending a suit are $0 until you hire a lawyer. Owen --On December 26, 2005 11:18:46 PM -0500 "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > > In the general sense, possibly, but where there are lawyers there is > always discoragement. > > Suing people with no money is easy, but it does stop them from > contributing in most cases. There are always a few who like getting sued. > RIAA has shown companies will widescale sue so your argument is suspect, > IMO.. > > > > > -----Original Message----- > From: Owen DeLong [mailto:owen@delong.com] > Sent: Mon Dec 26 23:11:13 2005 > To: Hannigan, Martin; Joseph Jackson > Cc: NANOG > Subject: RE: Compromised machines liable for damage? > > I've seen this argument time and again, and, the reality is that it is > absolutely > false. > > In fact, it will do nothing but encourage freeware. Liability for a > product > generally doesn't exist until money changes hands. If you design a piece > of > equipment and post the drawings in the public domain, you are not liable > if someone builds it and harms themselves. You are liable if someone pays > you for the design, because, the money changing hands creates a "duty to > care". > Outside of a "duty to care", the only opening for liability is if they > can prove that you failed to take some precaution that would be expected > of any "reasonably prudent" person. > > So, liability for bad software and the consequences it creates would be > bad for the Micr0$0ft and Oracles of the world, but, generally, very good > for the Free Software movement. It might turn out to be bad for > organizations > like Cygnus and RedHat, but, that's more of a gray area. > > As to the specific example cited... > > If no update has been released, in the case of Open Source, that's no > excuse. > You have the source, so, you don't have to wait for an update. In the > case > of closed software, then, I think manufacturer liability is a good thing > for the industry in general. > > Owen > > > --On December 26, 2005 10:07:20 PM -0500 "Hannigan, Martin" > <hannigan(a)verisign.com> wrote: > >> >> >> If you want to choke off freeware(gnu, et. Al), sure, go after them. I >> doubt the licensing agreement allows it though. (IANAL). >> >> I think all you'd do is encourage people to write more music about >> 'freeing the software'. I'd rather not be stricken in that fashion. >> >> I think that angle is DOA. >> >> Martin >> >> >> -----Original Message----- >> From: Joseph Jackson [mailto:jjackson@aninetworks.com] >> Sent: Mon Dec 26 03:13:02 2005 >> To: Hannigan, Martin >> Cc: NANOG >> Subject: RE: Compromised machines liable for damage? >> >> What about the coders that write the buggy software in the first place? >> Don't they hold some of the responsibility also? IE I am running some >> webserver software that a bug is found in it. Attackers use that bug in >> the >> software to generate a DOS attack against you from my machines. No >> update has been released for the software I am running and/or no warning >> as been released. You sue me I sue the coders. What a wonderful world. >> (I'm not for this but its another side of the issue.) >> >> >> >> _____ >> >> From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of >> Hannigan, Martin >> Sent: Sunday, December 25, 2005 9:22 PM >> To: Steven M. Bellovin >> Cc: Dave Pooser; NANOG >> Subject: Re: Compromised machines liable for damage? >> >> >> >> >> >> Yes, I agree. As usual, I too am 'IANAL'. >> >> Marty >> >> >> >> -----Original Message----- >> From: Steven M. Bellovin [mailto:smb@cs.columbia.edu >> <mailto:smb@cs.columbia.edu> ] >> Sent: Sun Dec 25 23:52:27 2005 >> To: Hannigan, Martin >> Cc: Dave Pooser; NANOG >> Subject: Re: Compromised machines liable for damage? >> >> In message >> <80632326218FE74899BDD48BB836421A033001(a)Dul1wnexmb04.vcorp.ad.vrsn.c >> om>, "Hannigan, Martin" writes: >> >>> >>> Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting = >>> dichotomy. >>> >> >> "Wins" is too strong a word, since I don't think any have gone to >> court -- see >> http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html >> <http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html> >> as my source. >> >> Besides, it's a very different situation. For my take on liability >> issues -- note that I'm not a lawyer, and note that this is from 1994 >> -- see http://www.wilyhacker.com/1e/chap12.pdf >> <http://www.wilyhacker.com/1e/chap12.pdf> >> >> --Steven M. Bellovin, http://www.cs.columbia.edu/~smb >> <http://www.cs.columbia.edu/~smb> >> >> >> >> > > > > -- > If this message was not signed with gpg key 0FE2AA3D, it's probably > a forgery.

2 1

RE: Compromised machines liable for damage?
by Hannigan, Martin 27 Dec '05

27 Dec '05

If you want to choke off freeware(gnu, et. Al), sure, go after them. I doubt the licensing agreement allows it though. (IANAL). I think all you'd do is encourage people to write more music about 'freeing the software'. I'd rather not be stricken in that fashion. I think that angle is DOA. Martin -----Original Message----- From: Joseph Jackson [mailto:jjackson@aninetworks.com] Sent: Mon Dec 26 03:13:02 2005 To: Hannigan, Martin Cc: NANOG Subject: RE: Compromised machines liable for damage? What about the coders that write the buggy software in the first place? Don't they hold some of the responsibility also? IE I am running some webserver software that a bug is found in it. Attackers use that bug in the software to generate a DOS attack against you from my machines. No update has been released for the software I am running and/or no warning as been released. You sue me I sue the coders. What a wonderful world. (I'm not for this but its another side of the issue.) _____ From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Hannigan, Martin Sent: Sunday, December 25, 2005 9:22 PM To: Steven M. Bellovin Cc: Dave Pooser; NANOG Subject: Re: Compromised machines liable for damage? Yes, I agree. As usual, I too am 'IANAL'. Marty -----Original Message----- From: Steven M. Bellovin [mailto:smb@cs.columbia.edu <mailto:smb@cs.columbia.edu> ] Sent: Sun Dec 25 23:52:27 2005 To: Hannigan, Martin Cc: Dave Pooser; NANOG Subject: Re: Compromised machines liable for damage? In message <80632326218FE74899BDD48BB836421A033001(a)Dul1wnexmb04.vcorp.ad.vrsn.c om>, "Hannigan, Martin" writes: > >Dave, RIAA wins almost 100pct vs p2p'ers ir sues. Its an interesting = >dichotomy. > "Wins" is too strong a word, since I don't think any have gone to court -- see http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html <http://www.nytimes.com/aponline/arts/AP-Music-Download-Suit.html> as my source. Besides, it's a very different situation. For my take on liability issues -- note that I'm not a lawyer, and note that this is from 1994 -- see http://www.wilyhacker.com/1e/chap12.pdf <http://www.wilyhacker.com/1e/chap12.pdf> --Steven M. Bellovin, http://www.cs.columbia.edu/~smb <http://www.cs.columbia.edu/~smb>

2 1

Re: Destructive botnet originating from Japan
by Hannigan, Martin 27 Dec '05

27 Dec '05

What's nsp-sec? -----Original Message----- From: Richard A Steenbergen [mailto:ras@e-gerbil.net] Sent: Sun Dec 25 04:25:15 2005 To: Gadi Evron Cc: Rob Thomas; NANOG Subject: Re: Destructive botnet originating from Japan On Sun, Dec 25, 2005 at 02:06:38AM -0600, Gadi Evron wrote: > > It is difficult to hear something important that one invested much in is > doing harm, but that is the only conclusion I and others can come up with > after years of study, and NSP-SEC, as amazing as it has been, has been of > a negative impact other than to cause a community to form and act > together. Which is amazing by itself and which is why I believe it > can do so much more.. even if it is relatively young it has proven > itself time and time again... I am straying from the subject here. Could have told you that a long time ago. NSP-SEC became useless the day it became so bogged down in its own self-aggrandizing paranoia that no one could possibly be bothered to actually tell anyone outside of the secret handshake club about security issues they've spotted. On the other hand, if you ARE going to sit around pissing and moaning about botnets you are too "sekure" to tell anyone else about, thus assuring they never get fixed, at least it's nice to do it in one secret place so I don't have to hear it. :) -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)

11 12