January 2006 - Test - lists.nanog.org

BLS FastAccess internal tech needed
by Todd Vierling 13 Jan '06

13 Jan '06

Please contact me offlist at tv(a)pobox.com, or via the telephone number in my duh.org contacts. The support IVR and agents are ... less than helpful. (Your new SMTP port filters put in today in the Atlanta market are a step in the right direction, but they are configured incorrectly: They block outbound connections to port 25, which is good -- but they are also blocking *inbound* connections to a local SMTP receiver, which protects nothing and simply annoys those of us who have a clue.) -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com> <todd(a)vierling.name>

2 2

Re: BLS FastAccess internal tech needed
by Fergie 12 Jan '06

12 Jan '06

This is why AAA is so important. :-) - ferg -- "Steven M. Bellovin" <smb(a)cs.columbia.edu> wrote: In message <20060112.195851.1587.15308(a)webmail05.lax.untd.com>, "Fergie" writes : > >RFC2827/BCP38? > The problem is that an ISP can do all the source filtering it wants, but if it only blocks SYNs to port 25 all it takes is one unfiltered dial-up to spoof that ISP's addresses. --Steven M. Bellovin, http://www.cs.columbia.edu/~smb -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Cisco, haven't we learned anything? (technician reset)
by Gadi Evron 12 Jan '06

12 Jan '06

In this (http://blogs.securiteam.com/wp-admin/post.php?action=edit&post=207) recent Cisco advisory, the company alerts us to a security problem with Cisco MARS (Cisco Security Monitoring Analysis and Response System). The security issue is basically a user account on the system that will give you root when accessed. The account is: 1. Hidden. 2. Default. 3. With a pre-set password. In other words, this is a journey back 10 years when technicians would commonly have special keys (actual keys, electronics or passwords) to access a device if they have to troubleshoot it for anything, or say? the user lost his password. People used to trade these keys online and hidden accounts were a thing of common practice. Today people still trade commonly used default passwords but it is not as popular as it used to be, at least in the online world. On the other hand, the most common practice to hack routers today, is still to try and access the devices with the notoriously famous default login/password for Cisco devices: cisco/cisco. Cisco/cisco is the single most used default password of our time. It got more routers pwned than any exploit in history, and it still does. One would think that a company such as Cisco, especially with this history, would stay away from such ?default? accounts? but the fact that this account is hidden makes it something different. It makes it a backdoor. One much like those used by the Bad Guys. Now? if Cisco knowingly put it there, shame on them. If somebody put it there without their knowledge? well, shame on them. This is indeed a vulnerability, as in a weakness. It is not however a software coding bug that may result in say? a buffer overflow. It is a part of the design of the system. Cisco disclosing this is very nice and commendable, but perhaps they should also let us know whether this was indeed a backdoor somebody put in their system or if it was part of the design? I love eastereggs. I just don?t like surprises in system privileges or backdoors, especially not in a security monitoring and response product. I very much doubt it was anything else but a part of the design but that should be admitted to. As the advisory states: "No other Cisco products are currently known to be affected by this vulnerability." Okay, but how about other vulnerabilities of this type? Are there any more backdoors to other Cisco products? If not, why wouldn?t they just come out and say that? ?There are NO other such backdoors in our products?. I?d even be happy with: ?To our knowledge, there are no other vulnerabilities of this type in our products.? This is not a bug. One can never be sure ALL bugs are eliminated ? however hard one may try. One CAN admit to having no such features in other products, though. Once again we fall upon re-naming of a feature as a bug or a bug as a feature to make the problem sound less severe. IN this case, the judgement is plain and simple: If Cisco were Bad Guys, this is a backdoor. As Cisco are Good Guys, this is a technician reset. Terminology? What?s the difference? The difference is that Cisco are not Bad Guys. If they disclosure a problem they should do it fully, because as a client, I am now concerned. This reminds me of Ciscogate but not for obvious reasons. That was a bad event for everybody involved. It reminds me of the very issue Mike Lynn discussed: Remote exploitation for Cisco is possible, while so far Cisco disclosed all these problems as DoS vulnerabilities. I am not saying Cisco did that on purpose, but in THIS case they CAN set my mind at ease. Why don?t they? Gadi.

11 17

NANOG List Statistics
by Chris Malayter 12 Jan '06

12 Jan '06

Good Evening, We are now ready to release our first of monthly list statistics. They are available at: http://www.nanog.org/liststats.html I'd like to offer a huge thanks to the staff at Merit for putting this all together: Dale Fay, Sue Joiner, Brad Robertson, and Jeff Tomaszewski I'd also like to thank the Steering Committee and Mail Admin Committee. We hope they are useful and of interest to the community as a whole! All comments can be directed to nanog-admin(a)merit.edu Regards, Chris Malayter NANOG - Mail list Administration Committee

1 0

EUSecWest papers and CanSecWest CFP
by Dragos Ruiu 12 Jan '06

12 Jan '06

url: http://eusecwest.com url: http://cansecwest.com (CanSecWest Call For Papers attached below) EUSecWest/core06 Conference --------------------------- Announcing the final selection of papers for the EUSecWest conference in London, U.K. on Feb. 20/21 at the Victoria Park Plaza Hotel. The following topics will be covered: Javier Burroni & Carlos Sarraute - Core Security Technologies Analyzing OS fingerprints using Neural Networks and Statistical Machinery van Hauser - thc Attacking the IPv6 protocol suite Yuji Ukai - eeye Exploiting Real-Time OS Based Embedded Systems Using the JTAG Emulator Nguyen Anh Quynh - Keio University XEBEK: A Next Generation Honeypot Monitoring System Fred Raynal - EADS Malicious Crypto Cesar Cerrudo - Argeniss Windows Local Shellcode Injection Andrew Cushman - Microsoft Microsoft Security Fundamentals Shreeraj Shah - Net Square Advanced Web Hacking - Attacks & Defense Justin Clarke - Ernst & Young LLP Practical Automated Web Application Attack Techniques Andy Davis - IRM PLC ColdFusion Security Tim Hurman - Pentest Ltd. ARMed combat: the fight for personal security Raffael Marty - ArcSight A Visual Approach to Security Event Management Michael Boman - KPMG Singapore Network Security Monitoring: Theory and Practice Jim DeLeskie & Danny McPherson - Teleglobe, Arbor Networks Protecting the Infrastructure Andrea Barisani - Inverse Path Lessons in Open Source Security: The Tale of a 0-Day Incident We would also like to announce the final list of Security Masters Dojo courses that will be offered on February 16th and 17th at the Victoria Park Plaza Hotel. Seats are available for all courses, but course registration is limited to only ten students each. We are considering adding additional course sessions on Feb 23/24 if demand warrants it. The hands-on courses offered will be: Gerardo Richarte - Core Security Technologies Assembly for Exploit Writing Marty Roesch - Sourcefire Advanced IDS Deployment and Optimization Maximillian Dornseif & Thorsten Holtz - Aachen University Advanced Honeypot Tactics Philippe Biondi - EADS Mastering the Network with SCAPY Renaud Deraison & Nicolas Pouvesle - Tenable Network Security Vulnerability Scanning: Advanced Nessus Usage Laurent Oudot & Nico Fischbach - rstack, COLT telecom Applied network security and advanced anomaly detection using state-of-the art honeypots and netflow/NIDS Cédric Blancher - EADS Practical 802.11 WiFi (In)Security Adam Laurie & Martin Herfurt & Marcel Holtmann - trifinite Bluetooth Technology Security Vendors Presentations for the Elevator Focus Groups will be announced shortly. Registration: --------------- Seats are available but limited for EUSecWest, and registration is open at: https://eusecwest.com/register.html Security Masters Dojo/London registration is now open at: https://eusecwest.com/courses.html Contact core06(a)eusecwest.com for registration support or corporate sponsorship inquiries. ********************************************************************* CanSecWest/core06 CALL FOR PAPERS -------------------------------- VANCOUVER, Canada -- The seventh annual CanSecWest applied technical security conference - where the eminent figures in the international security industry will get together share best practices and technology - will be held in downtown Vancouver at the the Mariott Renaissance Harbourside on April 3-7, 2006. The most significant new discoveries about computer network hack attacks and defenses, commercial security solutions, and pragmatic real world security experience will be presented in a series of informative tutorials. The CanSecWest meeting provides international researchers a relaxed, comfortable environment to learn from informative tutorials on key developments in security technology, and collaborate and socialize with their peers in one of the world's most scenic cities - a short drive away from one of North America's top skiing areas. In addition to the usual one hour tutorials, panel sessions and highly entertaining 5 minute "lightning" talks, this conference will also feature a new session called "Elevator Focus Groups". Featuring several short sessions, these commercial presentations will showcase new, significantly used, or dramatically innovative new products in the information security realm. Each selected vendor will have a short 10 minute presentation ("elevator pitch"), after which 10 minutes of audience Q&A and interactive discussion amongst the expert security practitioners attending will follow. In this session both the audience and the vendors can get valuable feedback from world leading experts and the attendees can get user evaluations and learn from sharing experiences and real world security applications about practical uses of the products - the "focus group." Hence the name: Elevator Focus Groups. The CanSecWest conference will also feature the availability of the Security Masters Dojo expert network security sensei instructors, and their advanced, and intermediate, hands-on training courses - featuring small class sizes and practical application excercises to maximize information transfer. We would like to announce the opportunity to submit papers, lightning talk proposals, and elevator focus candidate products for selection by the CanSecWest technical review committee. Please make your paper proposal submissions before January 30th, 2006. Slides for the papers must be submitted by March 15th, 2006. Some invited papers have been confirmed, but a limited number of speaking slots are still available. The conference is responsible for travel and accomodations for the speakers. If you have a proposal for a tutorial session then please email a synopsis of the material and your biography, papers and, speaking background to core06(a)cansecwest.com. Only slides will be needed for the March paper deadline, full text does not have to be submitted - but will be accepted if available. The CanSecWest/core06 conference consists of tutorials on technical details about current issues, innovative techniques and best practices in the information security realm. The audiences are a multi-national mix of professionals involved on a daily basis with security work: security product vendors, programmers, security officers, and network administrators. We give preference to technical details and new education for a technical audience. The conference itself is a single track series of presentations in a lecture theater environment. The presentations offer speakers the opportunity to showcase on-going research and collaborate with peers while educating and highlighting advancements in security products and techniques. The focus is on innovation, tutorials, and education instead of product pitches. Some commercial content is tolerated, but it needs to be backed up by a technical presenter - either giving a valuable tutorial and best practices instruction or detailing significant new technology in the products. Paper proposals should consist of the following information: 1) Presenter, and geographical location (country of origin/passport) and contact info (e-mail, postal address, phone, fax). 2) Employer and/or affiliations. 3) Brief biography, list of publications and papers. 4) Any significant presentation and educational experience/background. 5) Topic synopsis, Proposed paper title, and a one paragraph description. 6) Reason why this material is innovative or significant or an important tutorial. 7) Optionally, any samples of prepared material or outlines ready. 8) Will you have full text available or only slides? 9) Please list any other publications or conferences where this material has been or will be published/submitted. Please include the plain text version of this information in your email as well as any file, pdf, sxw, ppt, or html attachments. Please forward the above information to core06(a)cansecwest.com to be considered for placement on the speaker roster, have your lightning talk scheduled, or submit your product for inclusion in the focus groups. Advance Registration is now available for CanSecWest at http://cansecwest.com. -- World Security Pros. Cutting Edge Training, Tools, and Techniques London, U.K. February 20/21 2006 http://eusecwest.com pgpkey http://dragos.com/ kyxpgp

2 1

do bogon filters still help?
by Steven M. Bellovin 12 Jan '06

12 Jan '06

Every time IANA allocates new prefixes, we're treated to complaints about sites that are not reachable because they're in the new space and some places haven't updated their bogon filters. My question is this: have we reached a point where the bogon filters are causing more pain than they're worth? The Team Cymru web page (http://www.cymru.com/Bogons/index.html) gives some justification, but I think the question should be revisited. First, as the page (and the associated presentation) note, most of the benefit comes from filtering obvious stuff -- 0/8, 127/8, and "class" D and E source addresses. Second, the study is about 5 years old, maybe more; attack patterns have changed since then. Third, considerably more address space has been allocated; this means that the percentage of address space that can be considered bogus is significantly smaller. Possibly, there are more sites doing edge filtering, but I'd hate to count on that. So -- I'd like people to re-examine the question. Does anyone have more recent data on the frequency of bogons as a percentage of attack packets? What would that number look like if you filtered just the obvious -- the ranges given above, plus the RFC 1918 prefixes? Are your defenses against non-spoofed attacks really helped by the extra filtering? --Steven M. Bellovin, http://www.cs.columbia.edu/~smb

13 21

Re: Cisco, haven't we learned anything? (technician reset)
by Fergie 12 Jan '06

12 Jan '06

Very good points, BTW. And these are certainly factors which, I'm sure, other companies are also susceptible. :-) - ferg -- Hank Nussbacher <hank(a)efes.iucc.ac.il> wrote: [re: http://www.cisco.com/en/US/products/products_security_advisory09186a00805e3…] [snip] Cisco acquired Protego in Dec 2004 and thereby acquired MARS: http://www.infoworld.com/article/04/12/20/HNciscoprotego_1.html Cisco didn't put it in there - they bought the bug for $65M. :-) [snip] I think Cisco just doesn't check the product closely enough and trusts the R&D coders and doesn't introduce an external security QA to the product being purchased. -Hank -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Sticky Bogons
by Joe Loiacono 12 Jan '06

12 Jan '06

a little help ... ----- Forwarded by Joe Loiacono/CIV/CSC on 01/11/2006 10:51 AM ----- "Dong Yan" <dongyan @cnnic.cn> Sent by: apnic-talk-bounces 01/09/2006 10:17 PM To: <apnic-talk(a)apnic.net>, <apnic-announce(a)lists.apnic.net> cc: Chen Tao <chentao(a)cnnic.cn>, Xiangjian Li <lixiangjian(a)cnnic.cn> Subject: Re: [apnic-talk] [Apnic-announce] APNIC new IPv4 addresses (121/8and122/7) The same issue from China. One of our member got a block /17 from 125/8, this block caused many web-accessing problems, which annoyed our member very much. This time, when they came back for subsequent IPv4 application, they pointed out clearly they do not want to get any block in 125/8 or even newer /8. Any doable suggestion and action from APNIC and all members in AP region will be helpfull. Dong Yan CNNIC > ----- Original Message ----- > From: "Skeeve Stevens" <skeeve(a)skeeve.org> > To: <apnic-talk(a)apnic.net>; <apnic-announce(a)lists.apnic.net> > Cc: <apops(a)apops.net>; <sanog(a)sanog.org> > Sent: Monday, January 09, 2006 5:08 PM > Subject: RE: [apnic-talk] [Apnic-announce] APNIC new IPv4 addresses (121/8and122/7) > > > > > > Just an opinion... But as someone who is currently experiencing the pain of > > using a /19 in 125/8 at present and have our customers suffering greatly, I > > think APNIC needs to do something better to be approaching the bogon list > > managers and perhaps giving notice of 6 months or some such that these > > ranges will be used so the pain will be a lot less. > > > > ..Skeeve > > > > -----Original Message----- > > From: apnic-talk-bounces(a)lists.apnic.net > > [mailto:apnic-talk-bounces@lists.apnic.net] On Behalf Of John Tran > > Sent: Monday, 9 January 2006 3:15 PM > > To: apnic-announce(a)lists.apnic.net > > Cc: apops(a)apops.net; sanog(a)sanog.org > > Subject: [apnic-talk] [Apnic-announce] APNIC new IPv4 addresses (121/8 > > and122/7) > > > > > > Dear colleagues > > > > APNIC received IPv4 address blocks 121/8 and 122/7 from IANA in January > > 2006 and will be making allocations from these ranges in the near future. > > > > This announcement is being made for the information of the Internet > > community so that network configurations such as routing filters may be > > updated as appropriate. > > > > For more information on the resources administered by APNIC, see: > > > > http://www.apnic.net/db/ranges.html > > > > For information on the minimum allocation sizes within address ranges > > administered by APNIC, see: > > > > http://www.apnic.net/db/min-alloc.html > > > > > > Kind regards > > > > Son > > > > ____________________________________________________________________ > > Resources Services Manager <Son(a)apnic.net> > > Asia Pacific Network Information Centre phone: +61 7 3858 3100 > > http://www.apnic.net fax: +61 7 3858 3199 > > Helpdesk phone: +61 7 3858 3188 > > email: helpdesk(a)apnic.net > > Please send Internet Resource Requests to <hostmaster(a)apnic.net> > > _____________________________________________________________________ > > > > > > _______________________________________________ > > Apnic-announce mailing list > > Apnic-announce(a)lists.apnic.net > > http://mailman.apnic.net/mailman/listinfo/apnic-announce > > _______________________________________________ > > apnic-talk mailing list > > apnic-talk(a)lists.apnic.net > > http://mailman.apnic.net/mailman/listinfo/apnic-talk > > > > ======================================================================== > > iBurst Wireless Broadband from $34.95/month www.platformnetworks.net > > Forward undetected SPAM to: spam(a)mailsecurity.net.au > > ======================================================================== > > > > _______________________________________________ > > apnic-talk mailing list > > apnic-talk(a)lists.apnic.net > > http://mailman.apnic.net/mailman/listinfo/apnic-talk _______________________________________________ apnic-talk mailing list apnic-talk(a)lists.apnic.net http://mailman.apnic.net/mailman/listinfo/apnic-talk

4 3

Broadwing IRR maintainer contact.
by Stephen Fulton 12 Jan '06

12 Jan '06

If someone from Broadwing reponsible for maintaining routing registry entries, or who could direct me to the correct person, would contact me off-list, I'd appreciate. I need Broadwing to remove stale RR information for our prefixes, and I have not received any responses to queries sent to dnscc(a)broadwing.com. Thanks, -- Stephen.

1 0

workhorse of the future...
by bmanning＠vacation.karoshi.com 11 Jan '06

11 Jan '06

first it was the vitalinks, then the bridge gear, then proteon, then cisco AGS, then 7600VXR, then 7301s.... looking to find the next-gen workhorse ... looking for 4-6yr life expectancy. pointers(private are ok) are appreciated - as well as -why- you think the suggested boxen are likely candidates. --bill

6 6