January 2006 - Test - lists.nanog.org

Re: CME-24 (BlackWorm) Users' FAQ
by Gadi Evron 30 Jan '06

30 Jan '06

> The FAQ can be found at: > http://isc.sans.org/blackworm > http://blogs.securiteam.org That's http://blogs.securiteam.com My apologies, and thanks to all those who notified me. Gadi.

1 0

CME-24 (BlackWorm) Users' FAQ
by Gadi Evron 30 Jan '06

30 Jan '06

This FAQ was authored by members of the TISF BlackWorm task force (specifically the MWP / DA groups and the SANS ISC handlers). The purpose is both to provide with a resource for concerned users and network administrators, as well as to be a level-headed myth-free source on the subject. There seems to be excessive media hype as well as some "end-of-the-world" type predictions. The end of the world is not coming and most of us will still be here after February 3rd, but this is a serious issue for those who *are* infected and we didn't manage to get to. The FAQ can be found at: http://isc.sans.org/blackworm http://blogs.securiteam.org -- "300,000 infected users worldwide is not a terribly large amount when compared to previous worms like Sober or Mydoom. However, with this worm it isn't the quantity of infected users, it is the destructive payload which is most concerning." -- Joe Stewart, LURHQ (http://www.lurhq.com/blackworm-stats.html) Gadi.

1 0

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 30 Jan '06

30 Jan '06

>the scheme that josh karlin has been advocating in pretty good bgp >involved only supressing a doubtful announcement when you have a >better, more trusted announcement. Not a doubtful announcement, a novel announcement. Not a better announcement, a more usual announcement. The trust part, like beauty, is in the eye of the beholder. Don't get me wrong - I think basing decision on some "trusted" summary of historical behavior is going to be important, unless and until we get some approach that gives a more deterministic answer. But I do believe that we need to consider carefully how this will play with dynamic, particularly unplanned, changes in who is announcing what. If there turn out to be cases where dynamic, particularly unplanned, changes get rejected by this technique in favor of stale data, then there should be consideration given to how to amend the scheme to prevent that or suggest operational practices to get around it. --Sandy

2 1

I never realized so many trains derailed until my Internet kept going out
by Sean Donelan 30 Jan '06

30 Jan '06

http://www.thedenverchannel.com/technology/6490915/detail.html It was the third multi-day outage experienced by Comcast Western Slope customers. The two previous also came as a result of train derailments. One Aspen Comcast customer told the Aspen Times that he learned a lot about train derailments as result of his service interruptions. "I never realized so many trains derailed until my Internet kept going out," said Michael McVoy.

5 5

New talks/tutorials for Dallas
by Susan Harris 29 Jan '06

29 Jan '06

We've scheduled two new presentations for NANOG36: - DNS Infrastructure Distribution Steve Gibbard, PCH - Responsive Yet Stable Traffic Engineering Srikanth Kandula, MIT The new tutorials are: - ISP Security 101 Primer Barry Greene, Cisco - L2VPN: Path to Convergence Muhammad Waris Sagheer and Syed Nawaz, Cisco More details at http://www.nanog.org/mtg-0602/topics.html

1 0

GoDaddy.com shuts down entire data center?
by Elijah Savage 28 Jan '06

28 Jan '06

Any validatity to this and if so I am suprised that our team has got no calls on not be able to get to certain websites. http://webhostingtalk.com/showthread.php?t=477562 -- http://www.digitalrage.org/ The Information Technology News Center

23 34

Current Blackworm numbers
by Fergie 28 Jan '06

28 Jan '06

Given all the noise that this issue has caused on the list, I thought I'd take a moment this afternoon and forward a URL that good folks over at LURHQ have made available with more realistic, and current, statistics on the BlackWorm cruft: http://www.lurhq.com/blackworm-stats.html Thanks to Joe Stewart at LURHQ. Cheers, - ferg -- Martin Hannigan <hannigan(a)world.std.com> wrote: [snip] The point I was trying to make before the thread went, East?, was that there is a perceived problem in the security community with approrpriate response. I'd tell you how I think that could have been avoided, but then my name would go up in the subject again. *cough full disclosure* [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

4 4

LimeLigh random Friday afternoon renumbering, anyone?
by Mike Lyon 28 Jan '06

28 Jan '06

Anyone else have LimeLight randomly decide to renumber their IP blocks on Friday afternoon without any heads up to anyone? Just curious to see who else had their connectivity go down because of it... Yay! -Mike

1 0

Re: So -- what did happen to Panix?
by sandy＠tislabs.com 28 Jan '06

28 Jan '06

Todd Underwood wrote: >you're probably right (as usual). but it seems that if you delay >acceptance of announcements with novel origination patterns, you don't >harm very many legitimate uses. in particular, ASes changing >upstreams won't be harmed at all. people moving their prefix to a new >ISP will have a fixed delay in getting their announcement propagated, >sure. but they already have this delay now. >they tell the new ISP: 'announce my prefix' and the new ISP says >'prove it's yours'. they do that for a couple of emails. then the >new ISP asks it's upstreams to accept that announcement. that takes a >little while (ranging from 4 to 72 hours in my recent experience). This is great for the planned changes, but real-time changes to respond to Internet dynamics won't work well with such delays. If you are multi-homed to provide a backup, you would like for it to respond more quickly than 4-72 hours, I'll bet. So if you have PI space but not your own AS, your backup route would look like a novel origination, but you sure wouldn't want it delayed. How common are such cases? Should the solutions cover them also? Should there be special procedures to deal with special cases? Etc. --Sandy

2 1

Wifi SIP WPA/PSK Support
by Mike Leber 28 Jan '06

28 Jan '06

I'm working on finding a Wifi SIP phone that supports WPA/PSK that we can recommended to VOIP clients. As everybody knows, currently most Wifi SIP phones support WEP which is demonstrably insecure. For banking and financial customers, or companies that are given passwords or credit cards over the phone, this is a serious security issue. We recently bought a Hitachi-Cable Wireless IPC-5000 WiFi SIP Phone from voipsupply.com after finding some web pages that said that phone supported WPA (the pages were in German), yet once we got the phone all it supported was WEP even after updating the firmware to the latest version using the website mentioned in the documentation that came with the phone. I've had a few people say that there was some sort of conspiracy to keep US citizens from using secure phones, however I found that laughable because the potential risk of terrorist or criminal interception from having all Wifi telephone conversations involving credit cards (let alone social security numbers, bank account numbers, passwords, what have you) in the clear would create an attack vector so large as to exceed all other possible attack vectors... I mean why work on cracking anything when you can just listen to everybody in the clear (well virtually in the clear with WEP). So, back in reality, could anybody in the US that bought their Wifi SIP phone in the US share a success story at getting Wifi SIP setup with WPA/PSK? What model of phone did you buy? Where did you get it? Did you have to upgrade it to any special version of firmware or what? Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

4 4