July 2005 - Test - lists.nanog.org

"Cisco gate" and "Meet the Fed" at Defcon....
by Fergie (Paul Ferguson) 04 Aug '05

04 Aug '05

No one ever said the Internet wasn't chock full of contradictions. One one hand, we have what some are now calling "Cisco gate": http://news.com.com/Hackers+rally+behind+Cisco+flaw+finder/2100-1002_3-5812… ...and on the other hand, we have the DOD Cyber Crime Center folks at Defcon looking to hire people: http://news.com.com/2061-10789_3-5812102.html Wow, what a world, huh? ;-) - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

18 30

NETGEAR in the core...
by Robert E.Seastrom 03 Aug '05

03 Aug '05

OK, not really "in the core", but the subject made you look at least. :) I'm interested in people's experiences with consumer-grade routers functioning in non-NAT mode; that is to say, running PPPoE to the ISP and routing a /29 or a /28. A sane filtering language and stateful firewall that can operate in non-NAT mode is a plus. My experiences with Linksys (and Netscreen, which isn't really at the price point I wanted anyway) have caused me to rip out substantial amounts of my already insufficient hair. "Cisco 1700 series" or "Cisco 2600XM" would be nice answers if their price had the decimal point moved one place to the left. Linux or other non-vendor-supplied firmware, while cool, represents an unacceptable support load for my application. Any thoughts? ---Rob

17 18

Tiscali switches to Public-Root?? What do you think?
by John Palmer (NANOG Acct) 02 Aug '05

02 Aug '05

>From their press release at http://www.tiscali.com/press/releases/10552825f1a.html "... As a result of this agreement, Tiscali will offer to its subscribers across Europe the access to the entire World Wide Web, including the new alternative domain names. The agreement underscores Tiscali's commitment to embrace technological developments that simplify, improve and expand the opportunities offered by internet ..." John

6 6

as numbers
by Randy Bush 01 Aug '05

01 Aug '05

geoff has a quite good article on antonymous systems, usage, ... at <http://www.potaroo.net/ispcol/2005-08/as.html>. randy

10 15

Re: as numbers
by Robert Boyle 01 Aug '05

01 Aug '05

At 01:12 AM 7/31/2005, you wrote: This kind of response does have a certain market-based logic to it, I must admit, but its highly risky. I don't think its all that wise for this to be delayed indefinitely until the point at which its turning from an orderly transition into a last second panic, and I don't think that many customers will place this high on their vendor support priority list until they are actually allocated a 4-byte AS number because the 2-byte pool has been exhausted. . >So - to NANOG at large - if you want your vendor to include 4-Byte AS >support in their BGP code anytime soon, in order to avoid some last minute >panic in a couple of years hence, then it would appear that you should >talk to them now and say clearly that you want 4-Byte AS support in your >BGP software right now. I agree that implementation sooner rather than later is a good idea, but all of us already have a 2-Byte AS so although we care in theory and believe it is a good idea, we don't _really_ care as much as the first guy who gets a 4-Byte AS will. Eventually one of our BGP speaking transit customers will be assigned these AS numbers and other newer providers will too, but unless someone plans to chop up their network or split into two companies, I don't see that there will be much clamoring for this - yet. When we can't provide connectivity to a potential customer because we can't accept or wrap up their 4B AS, then there will be demand. Just some food for thought... -R Tellurian Networks - The Ultimate Internet Connection http://www.tellurian.com | 888-TELLURIAN | 973-300-9211 "Well done is better than well said." - Benjamin Franklin

7 9

Re: More info on the Exploit from Black Hat conference
by Piotr KUCHARSKI 01 Aug '05

01 Aug '05

On Sat, Jul 30, 2005 at 09:18:12PM -0400, Robert Guess wrote: > > Piotr KUCHARSKI <chopin(a)sgh.waw.pl> 7/30/2005 8:40:21 PM >>> > > On Sat, Jul 30, 2005 at 07:03:47AM -0400, Scott Morris wrote: > > > Based on some pictures from > > > http://tomsnetworking.com/Sections-article131.php I would agree with > > > you that they were edited. > > Contents seem the same, just the pics are missing. > > Anyone from conference to judge the completeness of circulating > > presentation? > I took pictures of the slides but may have missed one or two. Grab them > here: http://164.106.251.250/docs/netsec/defcon13/7-27-05.zip Thank you. I compared one by one; your photos show few additional slides: about why he was doing it, two green font views of cisco console and one slide about him looking for job. Other than that (and lack of jpgs on each slide in pdf), the circulating presentation seems to be the exactly same. p. PS I took the liberty of mirroring it at 42.pl/lynn/ -- Beware of he who would deny you access to information, for in his heart he dreams himself your master. -- Commissioner Pravin Lal

2 1

Re: More info on the Exploit from Black Hat conference
by Brad Knowles 31 Jul '05

31 Jul '05

At 9:18 PM -0400 2005-07-30, Robert Guess wrote: > I took pictures of the slides but may have missed one or two. Grab them > here: > > http://164.106.251.250/docs/netsec/defcon13/7-27-05.zip Not there anymore. Got another URL? -- Brad Knowles, <brad(a)stop.mail-abuse.org> "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." -- Benjamin Franklin (1706-1790), reply of the Pennsylvania Assembly to the Governor, November 11, 1755 SAGE member since 1995. See <http://www.sage.org/> for more info.

1 0

Cisco and the tobacco industry
by J. Oquendo 31 Jul '05

31 Jul '05

Subject : RE: Cisco IOS Exploit Cover Up On Thu, 28 Jul 2005, Geo. wrote: > I think there is also a LOT concern about all the unpatched routers that > remain unpatched simply because the admins don't feel like spending a week > running the cisco gauntlet to get patches when you don't have a support > contract with cisco. Its like cisco doesn't want you to patch or they would > make it easy. > > Geo. This is oh so true - contracts in order to patch your equipment. Normally I would never mention the need for an authority to intervene on things related to the Internet but how long will it be before the term "Digital Pearl Harbor" is a reality. Maybe it is time an authority figure steps in and makes some form of rules for vendors to distribute fixes under some form of law. If this flaw of Cisco's could lead to the kind of severe damage as Mr. Lynn claims, shouldn't it fall on the shoulders of Cisco to get their act together and provide a fix as opposed to sending in the hounds (legal shmoes via lawsuit) to quash their problems. I'm sort of taking a look at it from the tobacco company lawsuit stance where the tobacco bigwigs would bury the truth in legal trash as opposed to making things right. It's rather irresponsible behaviour on the part of Cisco to avoid coming clean on this issue. On matters of a public exploit and or the skill level necessary to create an attack via whatever flaw Mr. Lynn spoke of: It is only a matter of time before something is out there, so for some to criticize Mr. Lynn for being a whistleblower, shame on you. I think he did a courageous thing. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo sil @ infiltrated . net | http://www.infiltrated.net GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

16 28

RE: Cisco and the tobacco industry
by Jim McBurnett 31 Jul '05

31 Jul '05

QUOTE From: Ivan Groenewald [mailto:ivang@xtrahost.co.uk] IMHO IOS should be completely modular. ie SNMP/QOS/BGP etc should be a loadable module etc. In the event of you patching a service specific bug, you'd only upload the new modules and insmod them. I'd be very happy if the Cisco router fairy would write and backport such an IOS. That should end this idiotic router rebooting nonsense that the internet is plagued with, for the most part. /QUOTE If I remember correctly, This Exactly where Cisco has said they are going... With the IOS XR Just as the beginning.. Does anyone else remember this? Jim

5 4

More info on the Exploit from Black Hat conference
by Church, Chuck 31 Jul '05

31 Jul '05

http://www.tomsnetworking.com/Sections-article131.php Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 864-266-3978 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D

5 4