August 2005 - Test - lists.nanog.org

Yahoo! -- A "Phisher-friendly" hosting domain?
by Fergie (Paul Ferguson) 07 Sep '05

07 Sep '05

This would probably be better posted to NSP-SEC, but since I'm not subscribed (and have tried at least once), I'll share it here. For what it's worth, I'm involved in several security and anti-malware, anti-botnet, etc. group efforts, and I personally think that this particlar situation has gained enough "badness" status as to warrant wider public disclosure. A colleague alerted me to this earlier today (with permission to reprint): [snip] My attention was drawn earlier today to yet another phishing site on Yahoo! - we're already finding extreme porn and other disreputable sites moving there now that their "abuse dept" has been dismantled and reassembled in Oregon, apparently with all staff-under-training. But it caught my eye that SOMEBODY at Yahoo! ought to be reviewing domain names like "bankofthewestupdate.com" when they are set up on their servers, if only for reasons of due diligence ... otherwise Bank of the West might possibly have grounds for a lawsuit against Yahoo! ? Have any banks ever threatened to litigate against ISPs? If ever there was an incident calling out to be made a test case ... [snip] Details can be found here: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL31214 Also: [snip] The fact that very many phishers, 419s, and spamming pornographers are flocking to Yahoo is the result of changes that Yahoo have made to their abuse processing. Also, as they run ClamAV on all mail to their "new" abuse desk in Oregon, any reports to them that contain evidence of phishing incidents are automatically rejected by the ClamAV filtering - so it is difficult to know exactly HOW Yahoo! could have been expected to take action on these cases. (Yahoo! have been told about the situation by several respected individuals but from the reactions it seems that they do not care.) [snip] A more interesting link can be found here: http://www.spamhaus.org/sbl/listings.lasso?isp=yahoo.com This is somewhat disturbing. - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

DARPA and the network
by Michael.Dillon＠btradianz.com 06 Sep '05

06 Sep '05

Since the modern military runs on networks, DARPA funds various programs to make networks better and more secure. One of these was CHATS. Here is the business case taken from the DARPA budget justification: ------ The Composable High Assurance Trusted Systems (CHATS) program is developing the tools and technology that enable the core network services to be protected from the introduction and execution of malicious code or other attack techniques and methods. These tools and technologies will provide the security services needed to achieve comprehensive-secure, highly distributed, mission-critical information systems for the DoD. A unique feature of CHATS is that these system capabilities will be developed by engaging the open-source community in security functionality for existing open-source operating systems. Additionally, DARPA will engage the open-source community in a consortium-based approach to create a ?neutral?, secure operating system architecture framework. This security architecture framework will then be used to develop techniques for composing OS capabilities to support both servers and clients in the increasing network-centric communications fabric of the DoD. In FY 2003 the CHATS program will move to project ST-24 in this program element. ------ For a time, DARPA even funded the ongoing work of the OpenBSD team but political disagreements over the Iraq war scuttled that work. In roughly the same time frame, there was a project called LSAP (Linux Security Audit Project) that attenmpted to extend the methodology of OpenBSD to Linux. This was succeeded by Sardonix which attempted to create a register of all audited open source software. For various reasons both of these projects fizzled. So why did OpenBSD succeed in their rigorous audit process? I believe it is because there was a firm hand at the helm who was able to keep them focused on their non-profit goal, namely secure operating software. Now corporations do share one characteristic with OpenBSD which should allow them to be able to succeed in the same way. They have firm hands at the helm. However, they also have the profit motive and it is often possible for corporations to avoid security issues in their systems and make profits anyway. That's where NANOG comes in. We are the customers of the router and switch manufacturers. We have the ability to tie the corporate profit motive together with a security imperative. I know that people on this list would rather talk about how to tweak the boxes and protocols to do the best with what we have available, but I think times have changed. The global community of hackers is our Al Qaeda, a leaderless mob that wants to break the network and control the network. If we want to prevent this, then we have to work as hard and as smart as the many people who are tackling Islamist terrorist cells. It's no longer good enough to just do the best we can with the boxes that vendors give us when those boxes are so easily compromised and when there is a community of people who are specifically targetting those boxes, unlike in the past. --Michael Dillon

9 13

Cisco crapaganda
by J. Oquendo 05 Sep '05

05 Sep '05

http://www.networkworld.com/news/2005/080805-cisco-routers.html /* ARTICLE Among the developments last week: Cisco continually revised its security bulletin, adding details as to how versions of unpatched IOS software could be undermined by a "specifically crafted IPv6 packet." Sources at Cisco say testing will continue indefinitely and could include findings related to more than simply IPv6-related exploits. */ Ironic the marketing and disinformation coming out of Cisco Systems in relation to not disclosing what really occurred and labeling the vulnerability as "IPv6 based.... but" after they initially stated it as "IPv6 only!" /* ARTICLE The researcher who touched off the uproar, Michael Lynn, says he is now the subject of inquiries by FBI agents, and he continues to defend the propriety of his actions. */ Since when did the FBI decide to play "Corporation Superherosaviour" so blatantly. Mr. Lynn's disclosure while a double edged sword can possibly save the industry from a catastrophe, and while yes it can also cause one, I believe he did the right thing. /* ARTICLE Experts and users say the hole in IOS appears not to be an immediate concern based on what is public knowledge at the moment, since patches are available. But what concerns some is that Lynn's exploit techniques take router hacking to a new level, which eventually could have security implications for Cisco customers. */ This same attitude from vendors is what causes those releasing POC (proof of concept) code to release information on how things break. I recall posting here a while back information on how it would be possible to break neighbors in BGP by causing flaps. I did not post the information with the intent on anyone using that information to cause damage nor was it malicious. I did it under the impression someone in the industry would take a look at it and see what I saw and come up with a solution. To date however... It's been more or less the same: "You're an ass for doing that..." /* ARTICLE While Lynn has settled one lawsuit with Cisco and ISS, agreeing not to disclose anything he knows about the exploit, his problems don't seem to be over. The FBI is investigating him and interviewing friends and roommates, he says. */ Spin spin sugar... Looking at this current situation I'm wondering when did it become a federal offense to break a non disclosure agreement. I can look at this two possible ways now... Are the feds looking at Mr. Lynn because they have something vested in the IOS of Cisco (Carnivore, Magic Lantern), or are they going after him under the guise of "National (in)Security". If it's national (in)security, then why not go after Cisco for allowing this problem to go unresolved when they knew of it months in advance. Anyhow, sorry for the rants... The article is pseudo-worth the read if you can filter out marketing and crapaganda. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x97B43D89 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x97B43D89 To conquer the enemy without resorting to war is the most desirable. The highest form of generalship is to conquer the enemy by strategy." - Sun Tzu

9 9

RE: Katrina could inundate New Orleans
by Dave Stewart 03 Sep '05

03 Sep '05

At 12:02 AM 8/29/2005, you wrote: >Some of this is on topic. Internet access is as important as the >lights or water being on. Right, get out, but it'll be good >to see reasonable updates on what's going on utilities wise >down there when the weather shifts. Y'know... I do have to wonder whether Internet access is nearly as important as power and communications (traditional comms, such as the PTSN). Granted, it'll be interesting to see how things shake out - but I just can't buy that getting the Internet working should/will be a really high priority.

7 6

Re: Phone networks struggle in Hurricane Katrina's wake
by Fergie (Paul Ferguson) 03 Sep '05

03 Sep '05

Me? I personally never trade my POTS for VoIP... - ferg -- Iljitsch van Beijnum <iljitsch(a)muada.com> wrote: On 30-aug-2005, at 22:08, Fergie (Paul Ferguson) wrote: > "In this age of cheap commoditized consumer electronics and > advanced mobile technology, why can't all the people of a city make > contact during an emergency? Simple: it's too expensive. Keep this in mind when trading in your POTS service for VoIP service over the internet. Discounting the local loop which is often the same in both cases, POTS is extremely reliable while VoIP over the public internet, well, isn't. But apparently people that switch to VoIP don't mind the reduced likelihood of being able to make calls during the next large scale emergency.

16 23

Re: Phone networks struggle in Hurricane Katrina's wake
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

And via Slashdot: [snip] "In this age of cheap commoditized consumer electronics and advanced mobile technology, why can't all the people of a city make contact during an emergency? Cell phone circuits filled up during 9/11 attacks and in the wake of hurricane Katrina very few victims can make contact with their families, despite the fact that they have all those mobile phones. The Red Cross is looking to deploy satellite equipment From the article: to restore communications in affected areas." "Katrina made landfall in Louisiana early this morning with sustained winds of 145 mph, but veered just enough to the east to spare New Orleans a direct blow. Even so, flooding, power outages and heavy damage to structures were reported throughout the region. The Red Cross tomorrow expects to begin deploying a host of systems it will need, including satellite telephones, portable satellite dishes, specially equipped communications trucks, high- and low-band radio systems, and generator-powered wireless computer networks, said Jason Wiltrout, a Red Cross network engineer." [snip] http://www.computerworld.com/securitytopics/security/recovery/story/0,10801… - ferg -- "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> wrote: Via Reuters. [snip] Telephone companies struggled to restore service and measure the damage to their networks in Louisiana and Mississippi on Tuesday after Hurricane Katrina cut power and triggered severe flooding. A spokesman for BellSouth Corp., the largest local telephone company in the region, said while the company estimated about 53,000 lines were out in the two states, the actual numbers were likely to be higher. Cingular Wireless and Sprint Nextel Corp. said cellular service in the area had been affected as well. All three companies said power losses were the main threat to further service failures, but that flooding was hampering their efforts to reach network equipment. Entergy Corp. reported more than a million customers without power in Louisiana and Mississippi, and warned customers to expect a long and difficult restoration that could take weeks. New Orleans Mayor Ray Nagin told television station WWL that 80 percent of the city was under water, and authorities declared martial law in some areas. [snip] http://go.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=9512696 - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

8 8

Cisco as a "First Responder"?
by Fergie (Paul Ferguson) 01 Sep '05

01 Sep '05

Interestingly enough, there's an article on MSNBC: http://www.msnbc.msn.com/id/9131498/ ...that talks about all of the "gee whiz" tech stuff that is getting deployed to assist in the aftermath of Katrina: [snip] Among the first high-tech responders was Cisco Systems, which is setting up mobile communication kits and wiki-based networks to deal with Katrina's information overload. "Just wanted you to know that we will have 'feet on the wet street,'" Cisco's Lori Bush reported in a posting to fellow members of the National Institute for Urban Search and Rescue. Some of the equipment, like the Cisco kits, can fit into a search-and-rescue effort instantly. Other gadgets are being put into service on the fly, in hopes of boosting the communication systems currently being used. And still others aren't yet ready for prime time but will be tested in real-world conditions. [snip] - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

9 13

now it's really serious in New Orleans
by Fred Heutte 01 Sep '05

01 Sep '05

In an running on WWL TV right now, Mayor Ray Nagin says that a planned sandbag drop to stop the levee breach near pump #6 at the 17th St. Canal didn't happen and the pump has failed, so the probability is that the "bowl will now be filled," meaning water will flood the majority of the city including the Garden District, French Quarter and CBD. If unabated the water will go to the level of Lake Pontchartrain, about 3 feet ASL, which means, for example, 9 feet of water on St Charles Street. The mayor called the missed opportunity a "blunder" and said this would unfold over the next 12-15 hours. Now it's time to really worry. fh

4 4

This fall in LA
by Susan Harris 01 Sep '05

01 Sep '05

Greetings everyone - registration is now open for the fall NANOG meeting, to be held Oct. 23-25 in Los Angeles. This is our fourth back-to-back meeting with ARIN - a joint venture that's proven very successful at giving operators direct access to the all-important folks who hand out IP addresses and ASNs in North America. ARIN meets just after NANOG, from Oct. 26-28. NEW THIS FALL: an in-depth "Getting Started With IPv6" workshop, to be held Sunday from 9am-4:30 p.m. Workshop info and registration is here: http://www.arin.net/ARIN-XVI/ipv6_workshop.html NANOG registration is here: https://www.merit.edu/nanog/registration.form.html See you in Los Angeles!

2 2

Boing Boing: Clearinghouse for Katrina tech assistance contacts
by Fergie (Paul Ferguson) 31 Aug '05

31 Aug '05

Since gripes here on the list about opsts regarding the Hurricane Katrina aftermath issues, I just wanted to point out that Bong Boing has seemingly become the clearinghouse for much tech info on efforts to provide some sort tech and communications assistance in the Gulf Coast region. So, I'd stay tuned over on Boing Boing if you want to stay in the loop on that particular issue: http://boingboing.net/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1