July 2005 - Test - lists.nanog.org

RE: Mozilla Implements TLD Whitelist for Firefox in Response to IDN Homogr aphs Spoofing
by Jason Sloderbeck 28 Jul '05

28 Jul '05

Phil said: > Does anyone else think that it's not the job of a web browser to do this? Yes, it's recognized by Mozilla and others as the job of the Internet Architecture Board (in particular, the IAB-IDN group) to make a final decision on how to deal with homographs. However, for early adopters like Mozilla with a released software package that supports IDNs, they are taking an intermediate action until the committee comes up with a guideline. I think you're both right -- most applications can't feasibly manage their own Unicode Philosophy, but Mozilla needs to do something for the short term. -Jason -- Jason Sloderbeck Positive Networks jason @ positivenetworks . net

5 8

RE: identical-glyph homographs
by Jason Sloderbeck 28 Jul '05

28 Jul '05

> Let me repeat my other argument: Users don't use domain names > in trust assessments. I strongly disagree with this and other arguments that it's just "bad PR". I think we're off in theory-land. There are 2 critical requirements on the end-user side that make SSL work. Whether we like it or not, both require some level of intelligence: 1) Users can't ignore browser certificate warnings (i.e. look for the padlock) 2) Users have to eyeball the URL to ensure they're at the official web company site. 2a) Users have to know what the official company URL is in the first place. You may not like the existence of the above 2 rules, and we can argue about how often people pay attention to them, how feasible they are, but they are nonetheless a reality. Even the savviest of IT people can only click on the padlock, verify the cert is signed by a root authority (which it would be), check that the domain matches (it would), and hope it's secure -- this isn't just a "dumb user" issue. None of "us" could tell the difference if homographs were in place (unless you expect every application/developer to be as smart as Mozilla is). So, if you allow homographs, you have to add another rule to the chain: 3) All URLs for trusted sites must be hand-typed in the browser. All links to SSL sites are never to be trusted. You can make the case that this should be done, is acceptable, you don't mind it, etc., but it's clearly an additional link in the security architecture that wasn't previously necessary and, therefore, not just a bunch of random PR. Users are already the weak link; counting on them for yet another thing just doesn't ring true as a good idea. Bottom line: This is a real issue that reduces the *practical* security of SSL, which is why there's an IAB group dedicated to it. Counterpoints: - "But users might think 'ebay.com' and 'ebay-security.com' are the same thing." That's unrelated; it's a given that you have to know what the company URL is in the first place. There's no avoiding that existing requirement (see 2a above). - "There are lots of other browser hacks out there." So what? That doesn't justify approving a new global DNS standard that permits yet another security hole in SSL/PKI. We should be working to avoid security risks, not approving them in RFCs. - "Only the TLDs are protected." That's already the case with the way cert's are issued (e.g. you can go register "ebay.stealyourcreditcard.cx" and get a cert) ... old news. Todd Vierling's page is a great example: http://www.duh.org/homographs.cgi ... and I'm going to go join the IAB-IDN mailing list: http://lists.paf.se/cgi/listinfo/iab-idn -Jason -- Jason Sloderbeck Positive Networks jason(a)positivenetworks.net

1 0

Re: Cisco and the tobacco industry
by J. Oquendo 28 Jul '05

28 Jul '05

Re: Cisco and the tobacco industry On Thu, 28 Jul 2005, Florian Weimer wrote: > But it looks as if Cisco actually did this, and you (and Geo) just > weren't part of the elite circle of operators whose networks are > considered U.S. national critical infrastructure. Did they already do this? Highly doubtful hence Mr. Lyns resignation and decision to go public with his disclosure which brought forth Cisco's move to quash what he had to say via legal threats. When you state "Cisco already did this" what have they done other than tell someone to "shut up we're Cisco and we'll bury you with legal bills". They've done nothing but obscure the fact that they have issues with their IOS they don't want disclosed. http://quotes.nasdaq.com/asp/summaryquote.asp?symbol=CSCO%60&selected=CSCO%… Company News 07/28/2005 9:30AM Cisco Systems gets pwned at Blackhat Briefings file lawsuit to cover up swiss cheese-like holes =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

1 0

RE: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

..and of course: "Cisco Denies Router Vulnerability Claims" [snip] Cisco Systems is downplaying a news story that suggests new security flaws may have been discovered in some of its routers. [snip] http://www.varbusiness.com/components/weblogs/article.jhtml?articleId=16640… So, until the _facts_ come out, this appears to be spin vs. spin (a play on spy v. spy, for all you Alfred E. Newman fans)... - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: ...and Wired News is running this story: "Cisco Security Hole a Whopper" Excerpt: [snip] A bug discovered in an operating system that runs the majority of the world's computer networks would, if exploited, allow an attacker to bring down the nation's critical infrastructure, a computer security researcher said Wednesday against threat of a lawsuit. Michael Lynn, a former research analyst with Internet Security Solutions, quit his job at ISS Tuesday morning before disclosing the flaw at Black Hat Briefings, a conference for computer security professionals held annually here. [snip] http://www.wired.com/news/privacy/0,1848,68328,00.html - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: For what ot's worth, this story is running in the popular trade press: "Cisco nixes conference session on hacking IOS router code" http://www.networkworld.com/news/2005/072705-cisco-ios.html - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

6 5

Re: Cisco cover up
by Scott Altman 28 Jul '05

28 Jul '05

On Thu, 28 Jul 2005, Mark Owen wrote: > Cisco had the exploit fixed in April and no longer offers the exploitable OS for download on their site. To summarize a couple points: 1. Cisco fixes exploit in April 2. IOS Simplification occurs in April, effectively removing all old versions of code from their website. 3. IOS Simplication is explained (in macro terms) as a way to help customers navigate available versions; in micro terms, they were helping their litigation issues around NetFlow Acceleration So... did IOS simplification also give them a convienent / coincidental method of patching the vuln. that Lynn used in his exploit presentation? Or to put in another way: What else got fixed with IOS Simplification that we don't know about. One could speculate that the events listed above lead you to a good stake in the ground as to whether or not your code is vulnerable, if it's currently downloadable... it must be good! <snicker> Another observation: Given the audience of Black Hat (well-connected network types with a penchant for distributing information ahead of the curve) why is there so little factual information about what was presented? - Scott

2 1

AT&T Internet service goes down in several Western states
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

Conspiracy theorists beware. Doesn't "...equipment that routes data over it's network" sure sounds like a router to me. Actually, the AP article does go onto to identify the source of the problem as a "problematic router". Via The Mercury News (obnoxious, but free, registration required), reports: [snip] Subscribers to AT&T Corp.'s DSL Internet service in several Western states lost their connections for several hours Thursday after the telecommunications company experienced a problem with equipment that routes data over its network. The service went down about before 7 a.m. PDT, and some customers were being restored about four hours later, said AT&T spokesman Andy Backover. The company confirmed homes and businesses in California and "a couple other Western states" were affected, but it would not confirm the total number of subscribers who lost service. Backover said AT&T has received about 1,000 reports of trouble. "We're working as hard as we can to restore the service," he said. "We're very apologetic to any customers who were inconvenienced." Backover added the problem stemmed from a problematic router that's been identified and was being repaired. But he did not know when all affected customers would be restored. The outage only affected Digital Subscriber Line, or DSL, customers, not the large data network that is maintained by the telecommunications company. [snip] http://www.mercurynews.com/mld/mercurynews/business/technology/12246752.htm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: Cisco IOS Exploit Cover Up
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

For what ot's worth, this story is running in the popular trade press: "Cisco nixes conference session on hacking IOS router code" http://www.networkworld.com/news/2005/072705-cisco-ios.html - ferg -- "Hannigan, Martin" <hannigan(a)verisign.com> wrote: > > For those who like to keep abreast of security issues, there are > interesting developments happening at BlackHat with regards to Cisco > IOS and its vulnerability to arbitrary code executions. > > I apologize for the article itself being brief and lean on technical > details, but allow me to say that it does represent a real problem > (as in practical and confirmed): > > http://blogs.washingtonpost.com/securityfix/2005/07/mending_a_ > hole_.html > Yes, practical _and_ confirmed, but you'll never get $vendor to admit it, which is the problem to begin with. -M< -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

14 16

RE: Cisco IOS Exploit Cover Up
by Buhrmaster, Gary 28 Jul '05

28 Jul '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of James Baldwin > Sent: Thursday, July 28, 2005 10:36 AM > To: swm(a)emanon.com > Cc: nanog(a)merit.edu > Subject: Re: Cisco IOS Exploit Cover Up > > > > Lynn developed this information based on publicly available IOS > images. Well, there is this long legal license "agreement" you have to click to agree to before you download the images (and I think it is included with the hardware you unpack too). In there somewhere you do agree not to reverse engineer the images (I actually read it all once a long time ago). As to whether that is enforceable, that is for a court to decide. > There were no illegal acts committed in gaining this > information nor was any proprietary information provided for its > development. Reverse engineering, specifically for security testing > has an exemption from the DMCA (http://cyber.law.harvard.edu/openlaw/ > DVD/1201.html). As I understand it, it is still unsettled case law as to how that clause should be interpreted. It is generally considered a good idea to avoid being the test case for such lawsuits (unless you have deep pockets to afford the best lawyers money can buy, or at least better than what your opposition can buy). > That being said, what information is he not supposed to have? > All the > information he had is available to anyone with a > disassembler, an IOS > image, and an understanding of PPC assembly. Perhaps, as in at least some companies interpretations of the DMCA, these are software equivalent of the crime of "Possession of burglary tools"? The US legal system is not as clean nor clear as one might like to hope. But the process will be followed, and we will see what happens. And if the result is "bad", we can change the laws. Gary

2 1

RE: Cisco cover up
by Olsen, Jason 28 Jul '05

28 Jul '05

From: James Baldwin > This had _nothing_ to do with the source code that was > stolen. I have dealt with Lynn professionally on many > occasions and he has shown himself to have more than a fair > share of integrity. It is uncalled for to take to disparate > events and place them together in a way which smudges the > name of a respected researcher. I don't see any smearing of anybody's name. What I do see is speculation, which is to say, "reasoning based on inconclusive evidence; conjecture or supposition." In otherwords, J offered a "guess" that the two might be related and certainly wasn't pointing fingers as if that was the definitive reason. It sometimes happens that seemingly disparate events are actually linked, so it was not an entirely illogical guess. -JFO Jason "Feren" Olsen DeVry, Inc. Senior Network Engineer One Tower Lane Em: jolsen(a)devry.com Oakbrook Terrace, IL 60181-4624 Ph: 630.645.1607 INOC-DBA: 19258*526 Fx: 630.382.2929

4 4

FrSIRT: Cisco IOS Unspecified Remote Heap Overflow Vulnerability
by Fergie (Paul Ferguson) 28 Jul '05

28 Jul '05

..and this showed up at FrSIRT/K-Otik: http://www.frsirt.com/english/advisories/2005/1248 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0