March 2007 - Test - lists.nanog.org

Re: On-going Internet Emergency and Domain Names
by Fergie 04 Apr '07

04 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Steven M. Bellovin" <smb(a)cs.columbia.edu> wrote: >Jeff Shultz <jeffshultz(a)wvi.com> wrote: > >> >> I won't discount the assertion that there is some sort of emergency >> occurring. I would however, like to see a bit of a reference to where >> we can learn more about what is going on (I assume this is the >> javascript exploit I heard about a couple days ago). >> > >No -- it's a 0day in Internet Explorer involving animated cursors -- >and it can be spread by visiting an infected web site or even by email. > Not that I like being in the position of correcting Steve :-) but the real answer is "yes" and "no" -- or ctually just yes. While the 0-day exploit is the ANI vulnerability, there are many, many compromised websites (remember the MiamiDolhins.com embedded javascript iframe redirect?) that are using similar embedded .js redirects to malware hosted sites which fancy this exploit. And some of them have vast audiences, increasing the potential for a major "issue" -- TBD. Track with the SANS ISC -- they're doing a good job of keeping the community abreast. Cheers, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDc/4q1pz9mNUZTMRAjqiAJ0UYDDep4RbSmaJ3jUdsGssSVt7AwCgnDPV PIfR8hlav9Bh20TBXBPsUZo= =wtJu -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

45 111

On-going Internet Emergency and Domain Names
by Gadi Evron 04 Apr '07

04 Apr '07

There is a current on-going Internet emergency: a critical 0day vulnerability currently exploited in the wild threatens numerous desktop systems which are being compromised and turned into bots, and the domain names hosting it are a significant part of the reason why this attack has not yet been mitigated. This incident is currenly being handled by several operational groups. This past February, I sent an email to the Reg-Ops (Registrar Operations) mailing list. The email, which is quoted below, states how DNS abuse (not the DNS infrastructure) is the biggest unmitigated current vulnerability in day-to-day Internet security operations, not to mention abuse. While we argue about this or that TLD, there are operational issues of the highest importance that are not being addressed. The following is my original email message, elaborating on these above statements. Please note this was indeed just an email message, sent among friends. ----- Begin quoted message ----- Date: Fri, 16 Feb 2007 02:32:46 -0600 (CST) From: Gadi Evron To: reg-ops@... Subject: [reg-ops] Internet security and domain names Hi all, this is a tiny bit long. Please have patience, this is important. On this list (which we maintain as low-traffic) you guys (the registrars) have shown a lot of care and have become, on our sister mitigation and research lists (those of you who are subscribed), an integral part of our community we now call "The Internet Security Operations Community". We face problems today though, that you can not help us solve under the current setting. But only you can help us coming up with new ideas. Day-to-day, we are able to report hundreds and thousands of completely bogus phishing and other bad domains, but both policy-wise and resources-wise, registrars can't handle this. I don't blame you. In emergencies, we can only mitigate threats if one of you or yours are in control.. Just a week ago we faced the problem of the Dolphins stadium being hacked and malicious code being put on it: 1. We tracked down all the IP addresses involved and mitigated them (by we I mean also people other than me. Many were involved). 2. We helped the Dolphins Stadium IT staff take care of the malicious code on their web page - Specifically Gary Warner). 3. We coordinated with law enforcement. 4. We coordinated that no one does a press release which will hurt law enforcement. 5. We did a lot more. Including actually convincing a Chinese registrar to pull one of the domains in question. A miracle. There was another domain to be mitigated, unsuccessfully. One thing though - at a second's notice, this could all be for nothing as the DNS records could be updated with new IP addresses. There were hundreds of other sites also infected. Even if we could find the name server admin, some of these domains have as many as 40 NSs. That doesn't make life easy. Then, these could change, too. This is the weakest link online today in Internet security, which we in most cases can't mitigate, and the only mitigation route is the domain name. Every day we see two types of fast-flux attacks: 1. Those that keep changing A records by using a very low TTL. 2. Those that keep changing NS records, pretty much the same. Now, if we have a domain which can be mitigated to solve such emergencies and one of you happen to run it, that's great... However, if we end up with a domain not under the care of you and yours.. we are simply.. fucked. Sorry for the language. ICANN has a lot of policy issues as well, and the good guys there can't help. ICANN has enough trouble taking care of all those who want money for .com, .net or .xxx. All that being said, the current situation can not go on. We can no longer ignore it nor are current measures sufficient. It is imperative that we find some solutions, as limited as they may be. We need to be able to get rid of domain names, at the very least during real emergencies. I am aware how it isn't always easy to distinguish what is good and what is bad. Still, we need to find a way. Members of reg-ops: What do you think can be conceivably done? How can we make a difference which is REALLY needed on today's Internet? Please participate and let me know what you think, we simply can no longer wait for some magical change to happen. Gadi. ----- End of quoted message ----- Thousands of malicious domain names and several weeks later, we face the current crisis. The 0day vulnerability is exploited in the wild, and mitigating the IP addresses is not enough. We need to be able to "get rid" of malicious domain names. We need to be able to mitigate attacks on the weakest link - DNS, which are not necessarily solved by DNS-SEC or Anycast. On Reg-Ops and other operational groups, we came up with some imperfect ideas on what we can make happen on our own in short term which will help us reach better mitigation, as security does not seem to be on the agenda of those running DNS: 1. A system by which registrars can acknowledge confirmed bad domains (under strict guidelines) and respond to the reports according to their AUP and ICANN policy, thus "getting rid" of them in a much quicker fashion, is being set up at the ISOTF. A black list for registrars, if you will. This is far from perfect and currently slow-going. Naturally, this can not be forced on all registrars, nor do the black hat ones, care. 2. A black list for resolvers (hopefully large service providers) is also being created at the ISOTF, so that the risk of visibility of bad domains, as will be defined, can be minimized. Naturally, no provider can be forced to use this list and there are millions of unaffiliated resolvers, etc. Other options that have been raised as technically possible, but considered unlikely and indeed, bad: 3. Setting up a black list of domain names for TLD servers, for them not to respond on. 4. Creating an alternate root which we could trust. Another suggestion which was raised: 5. Apply to change the ICANN policy. We need a solution. This operational issue needs to be added as a main agenda item today so that tomorrow we will be ready to mitigate it. I blame myself to some degree for not raising this with higher echelons 2 and 3 years ago due to respect to those who have been working on DNS for many years, but what's done is done. The operational communities do not always know how to voice their needs or the difficulties they face. Nor will everyone agree on what the issues are. It is my strong belief (which is obviously my personal opinion), based on facts we see in daily security operations on the Internet that this issue is paramount, and I am sending here a call for help to the DNS experts of the world: what is our next step to be? What do we currently intend to do (not my personal opinion): We are formalizing a letter to ICANN's SSAC, as they are the top experts on DNS infrastructure security issues, coming from operational folks at the ISOTF dealing with daily usage of the DNS for abuse purposes (and specifically fastflux). Further, the ISOTF is moving forward with items #1 and #2 as mentioned above. #3 will have to remain as a contingency, #4 we have no influence to affect. #5 is currently being explored. Are we missing a possible solution? What does the larger community suggest? Gadi Evron.

22 33

RE: On-going Internet Emergency and Domain Names
by Fergie 03 Apr '07

03 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "william(at)elan.net" <william(a)elan.net> wrote: >On Sat, 31 Mar 2007, Fergie wrote: > >> Amen. >> >> The Registry policies, as they stand today, enable criminals. > >Registry or Registrar? Good question. It is my understanding that the various domain registries answer to ICANN policy -- if ICANN policy allows them to operate in a manner which is conducive to allowing criminals to manipulate the system, then the buck stops with ICANN, and ICANN needs to rectify the problems in the policy framework. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDtZwq1pz9mNUZTMRAu8KAKC/hVfAcj8iY5bnyN69kSnVFJcmFgCgmNcO ZNPLZTyYIBpUNtf84qvdKEg= =8531 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

12 25

Month of NANOG Bugs
by Team Whiner 02 Apr '07

02 Apr '07

Month of NANOG Bugs Team NANOG Whiners present the Month of Nanog Bugs Every day for the next month, the NANOG Whiners Group will introduce a new exploit and post this exploit to the greatest networking list on this side of planet Google Earth. With a special thanks to Vint Cerf for being the ambassador of planet Google Earth. Our focus is short, effective, simple, and to the point: To eliminate possible unforseen future bugs in the methods NANOG registrants post messages to what is supposed to be a moderated list. This month will be the time to cease posting the kinds of messages that some on the list view as harmful to the NANOG environment. No more posting about viruses, worms and malware. This is not relevant to NANOG as viruses, worms and malware do not traverse any known networks, routers, serial interfaces, ethernet, FDDI, token ring, FE, GE and ATM interfaces. Conversations on malicious traffic should be re-directed to Microsoft.com's servers in hopes they can address issues with their operating system No more talk about contacting the admin of Network X Extrememly irrelevant. Just because the administrators of Network X are on the NANOG mailing list, Team NANOG Whiners prohibits other engineers from acquiring the relevant information on contacting said engineers in hopes to mitigate and resolve network issues that affect hundreds perhaps thousands of users worldwide. No more talk about networking in general Team NANOG Whiners is asking the NANOG community to cease and desist posting informational clues as to how to route, filter, and other operational topics to the list. This ensures that no one on the NANOG list receives any helpful information throughout the course of the business day. No more messages from the following individuals: Steve Bellovin Fred Baker Michael Dillon Randy Bush Sean Donelan Anyone from Cisco.com While we've appreciated their insight and relevant information throughout the years, it is Team NANOG Whiners' view that they have flooded our inboxes for far too long with the kind of information one would need a PhD in either electrical engineering, computer science, a CCIE in Routing and Switching, and or a CISSP CCNP CEH MCSE (combined). This is not productive to us and interferes with our time allocated to Youtube, IRC, Jennycam. Team NANOG Whiners is committed to providing irrelevant uninformational threads on the NANOG mailing list so as to not affect the quality time of other engineers around the world. Time is the most valuable substance on the planet and allocation of this time is crucial in the every day course of business. Team NANOG Whiners is committed to ensuring that the only postings that make it through to the NANOG list are postings that ensure that engineers around the world can dissect the information in realtime, and use time the saved as unproductively as possible. Team NANOG Whiners is committed to providing the individuals that make this world a better place with a pedestal so they can showcase their talents that only they and only they possess. These talents include pretending their from the ghetto which has been mastered by the gracious bisexual transvestite Prex. The "I_KNOW_EVERYTHING_IN_DA_WURLD" mastered by Anton Kapela, and all other sorts of unheard of talents including setting modes +kb #nanog and #cisco on the EFNET. Thank you and Happy April Fools.

2 1

RE: On-going Internet Emergency and Domain Names
by dlr＠bungi.com 02 Apr '07

02 Apr '07

[In the message entitled "RE: On-going Internet Emergency and Domain Names" on Mar 31, 15:26, Matt Ghali writes:] > > On Sat, 31 Mar 2007, Fergie wrote: > > > So very clever. > > > > If you're not part of the solution... etc. > > I feel so worthless standing next to you, the Solver. > Guys. We *all* (everyone reading this) have a role to play in dealing with problems on the Internet. There is *no* "one true solution" to what amounts to criminal activity - not on the Internet, and not in real life. We, collectively, have enabled a new frontier of civilization. The Internet is ever growing and changing, and we, collectively, need to address problems as they come up. The dominant OS vendor is currently part of the issue, certainly. But if that dominant OS vendor were (insert your favorite UNIX OS vendor), the same problems would exist. We are not fighting technology. We are dealing with very well organized, smart, and well-funded people. We need to focus on solutions that we can deploy, which will address the problems at hand, as we discover them. That means we will deploy things that do not solve underlying prolems, but address the symptoms as best we can, to prevent the entire mess from falling down. That means that we must look at short-range solutions to address things in near-real-time, and we need to look at changing the legal system to catch up. We also need to look at the policies which enable people to abuse the systems we have deployed. And we need to look at user education. And fixing the operating systems. And improving infrastructure, so we can deal with 15 Gbps attacks. And... There is no "one true solution" to this. That means you, as network operators, need to look at what makes sense *today*, and *DEPLOY IT*. "Someone else" isn't going to solve these issues, and waiting for them is folly. Do what you can, today, to address the problems you know about. Do what you can, today, to protect your users. Do what you can, today, to stop malicious behaviour from leaving your network. Do what you can, today, to improve your internal organization to ensure that these task can be done without a 6 month delay. Please - we all need to work on this together. But we need to do it now. --

8 10

RE: On-going Internet Emergency and Domain Names
by Fergie 01 Apr '07

01 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Douglas Otis <dotis(a)mail-abuse.org> wrote: >On Sat, 2007-03-31 at 16:47 -0500, Frank Bulk wrote: >> For some operations or situations 24 hours would be too long a time to >> wait. There would need to be some mechanism where the delay could be >> bypassed. > >What operation requires a new domain be published within 24 hours? Even >banks require several days before honoring checks as protection against >fraud. A slight delay allows preemptive enforcement measures. It seems >most if not all operations could factor in this delay into their planning. > Doug and I completely agree on this issue. So again, I ask: When does a policy breakdown become an operational issue? I would posit that it does when criminals are able to abuse the system. Would love to arguments to the contrary. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDvB3q1pz9mNUZTMRAo1VAJ9rOisFN1xm4PjJsqUOeuSIWjy+OwCgpLQm gU76B10LtNBWYrE9/JjiQ+U= =vxKU -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

RE: On-going Internet Emergency and Domain Names
by Fergie 01 Apr '07

01 Apr '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Douglas Otis <dotis(a)mail-abuse.org> wrote: >The financial damage caused by crime taking advantage of DNS features to >then dance rapidly over the globe should justify rather minor changes to >the current mode of registry operations. > Amen. The Registry policies, as they stand today, enable criminals. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj4DBQFGDtNqq1pz9mNUZTMRAkcSAJd9o4g/6QjPciucwmDm+y3F03T1AJ0XCQyj X/n9+C6XfOfZi+f6M6IllQ== =IMb/ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

5 5

Re: On-going Internet Emergency and Domain Names
by Fergie 31 Mar '07

31 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Stephen Satchell <list(a)satchell.net> wrote: >Gadi Evron wrote: >> >> Amen. Really. >> >> I'd honestly like more ideas. > >What did IETF and ICANN say when you approached them through their public-comment channels? > The IETF does not deal with registry policy issues. ICANN, from what I can tell, had this issue (doamin tasting) on their agenda as a discussion iten in Lisbon last week, but i am unaware of the discussion outcome. Having said that, if this particular policy issue can be measured by ICANN's proclivity with other domain policy issues, I think we're talking years here. And that's kind of sobering, from a policy perspective. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDtf3q1pz9mNUZTMRAvgoAKCRgrGta2dtbGCLowMMtJf4htwGqwCg3BXm nw7SEgMDEvMU3F4w8801Yos= =IPRQ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: On-going Internet Emergency and Domain Names
by Fergie 31 Mar '07

31 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gordon Cook <cook(a)cookreport.com> wrote: >ICANN it is said would like to move to switzerland. I doubt that they much care about any of this stuff > If that is indeed the case, then this boils down to nothing less than _strictly_ an operational issue. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDuEcq1pz9mNUZTMRAoLXAJ9IhniqK47nxJk60PWYorta8B3F/ACgyHCQ 1tmX7pbPC8vrjV7Yxf7oGfA= =3iuZ -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

RE: On-going Internet Emergency and Domain Names
by Fergie 31 Mar '07

31 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Matt Ghali <matt(a)snark.net> wrote: >On Sat, 31 Mar 2007, Fergie wrote: > >> So very clever. >> >> If you're not part of the solution... etc. > >I feel so worthless standing next to you, the Solver. Sounds like a personal problem. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.0 (Build 214) wj8DBQFGDuCIq1pz9mNUZTMRAj/VAKDPwS6aJhLwlro7/JJfpTo8fD0SiACgxXBV u5LwUMFRu5TJgfbwbXdP62A= =+eLD -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0