April 2008 - Test - lists.nanog.org

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 16 Apr '08

16 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Valdis.Kletnieks(a)vt.edu wrote: > So what sort of response did you actually *want*? Actually, I'm more concerned with alerting you that someone inserted a nasty .js or iFrame on one of your websites and I'd like to you to clean it up, thanks. ;-) I'm not so concerned about alerting you to botted student computers... that's another issue entirely. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBj/nq1pz9mNUZTMRAmlKAJ4v/KIvHlKvO1MDF97Ed1T9RkpnjgCgvvRC CLUNjfK4mZcQOga42UgY9og= =7OPB -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 16 Apr '08

16 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Frank Bulk - iNAME" <frnkblk(a)iname.com> wrote: >72 hours to respond to e-mail sent to the abuse account? That's much too long -- it should be at least a 4 hour response time during business hours, and for service providers and operators large enough to staff their network 24x7 for other reasons, 4 hour response time all the time. > Right. You're dreaming. As I mentioned in my presentation at NANOG 42 in San Jose, the biggest barrier we face in shrinking the "time-to-exploit" window with regards to contacting people responsible for assisting in mitigating malicious issues is finding someone to actually respond. I'd personally jump for joy if I could count on 72 hours, or less. Unfortunately, most abuse requests/inquiries fall into a black-hole, or bounce. Very rarely do I find a helpful individual at the end of an abuse address, and that is truly unfortunate. Me, I have pretty much given up on any domain-related avenues, since they generally end up in disappointment, and found more successes in going directly to the owners of the IP allocation, and upstream ISP, a regional/national CERT/CSIRT, or law enforcement. Mow, this has no bearing on the original subject (which I have now forgotten what it is -- oh yeah, something about Yahoo! mail), but it should be additional proof that the Bad Guys know how to manipulate the system, the system is broken, and the Bad Guys are now making much more money than we are. :-) - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBDMNq1pz9mNUZTMRAtuVAJ9dP9ptygn/OrEWu7XsrffzorB5NACgz6dg vGCfQkUgbyB3QMfcR076VO0= =0fOY -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

8 7

Other folks who use the Route Science/Avaya CNA products?
by Drew Weaver 16 Apr '08

16 Apr '08

As the install base for these products is most likely too small to have a mailing list, I was wondering if there was any interest in forming a user-group (or possibly a small mailing list) the newer (ANS 4) software appears to have its fair share of quirks and some have expressed it might be helpful to have a place for users to discuss this, any opinions from others who use this product? Off-list is fine. I apologize if this is not the correct place for something like this but it seems like the best way to reach the correct folks. Thanks, -Drew

1 0

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Brandon Butterworth 16 Apr '08

16 Apr '08

> Abuse desk is a $0 revenue operation. Is it not obvious what the issue is? They're too busy spamming and phishing to respond to abuse reports? brandon

1 0

Calling TeliaSonera - time to implement prefix filtering
by sthaug＠nethelp.no 15 Apr '08

15 Apr '08

We're currently receiving the following prefix from TeliaSonera on one of our IP transit links in Oslo: 62.0.0.0/8 *[BGP/170] 4d 22:23:07, localpref 100 AS path: 1299 29049 I AS 29049 is: aut-num: AS29049 as-name: Delta-Telecom-AS descr: Delta Telecom LTD. descr: International Communication Operator descr: Azerbaijan Republic and *of course* they don't own 62.0.0.0/8. TeliaSonera: It's about time you started implementing prefix filtering on your customer links. Our other transit providers do this. Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

6 8

enterprise change/configuration management and compliance software?
by jamie 15 Apr '08

15 Apr '08

` Gentlemen (and Ren!): ;-) I'm currently investigating options w.r.t. enterprise-wide (over 250 device, and by 'device' i mean router and/or switch) configuration management (and (ideally) compliance-auditing_and_assurance) software. We currently use Voyence (now EMC) and are looking into other options for various reasons, support being in the top-3 ... So, I pose: To you operators of multi-hundred-device networks : what do you use for such purposes(*) ? (*)see subject This topic seemed to spark lively debate on efnet, so i thought it appropriate to ask here. Feel free to respond privately (and I will post summaries to the list), or direct. In any case, for the benefit of all, I will post in any case my/our findings. Thanks in advance, jamie rishaw

6 6

ARIN to Issue from 173 /8 and 174 /8
by Member Services 15 Apr '08

15 Apr '08

Hello- ARIN was issued the IPv4 address blocks 173 /8 and 174 /8 by the IANA on 4 February 2008. ARIN will be issuing /20 and shorter prefixes from these blocks to customers within the next 2 weeks. Network operators may wish to adjust any filters in place accordingly. For informational purposes, a list of ARIN's currently administered IP blocks can be found at: http://www.arin.net/reference/ip_blocks.html Regards, Leslie Nobile Director, Registration Services American Registry for Internet Numbers (ARIN)

1 0

Re: Problems sending mail from .mumble
by Robert Bonomi 15 Apr '08

15 Apr '08

> Date: Mon, 14 Apr 2008 16:07:22 -0700 (PDT) > From: Duane Wessels <wessels(a)packet-pushers.com> > Subject: Re: Problems sending mail from .mumble > > FWIW I was able to find one application, the text browser 'links,' > which accepts either filename or hostnames as its commandline > argument. From what I can tell its algorithm is something like > this: > > - if tld/extension has two letters --> URL > - if less than two letters --> File > - if tld/extension is in list of known gTLDs --> URL > - else --> File > The web browser "Lynx" does something very similar. One addendum to the above logic is that if the DNS look-up fails, it tries to use the string as a local file path. Typo the FQDN in a URL to something that returns NXDOMAIN, and you get an error message to the effect that lynx 'couldn't access start *FILE* "foo'" (emphasis added.)

2 1

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 15 Apr '08

15 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Joe Provo <nanog-post(a)rsuc.gweep.net> wrote: >It cannot be understated that even packet pushers and code grinders who care get stranded in companies where abuse handling is deemed by management to be a cost center that only saps resources. Paul, you are doing a serious disservice to those folks in specific, and working around such suit-induced damage in general, by dismissing any steps involving automation. > Well, I did not intend to do disservice to anyone's efforts, but the point I am trying to make is that there still is no good way for people to report malicious activity to the legitimate owners of the content or the netblock. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBMyPq1pz9mNUZTMRAoiwAKDrdTSosQIT0r1BeRh2tvIQ5+at1QCgmS5W gdgRZ+CokBXlcfCehWtJKQg= =QDXi -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Abuse Reporting (non-SMTP Abuse)
by Jim Popovitch 15 Apr '08

15 Apr '08

On Tue, Apr 15, 2008 at 3:39 AM, <michael.dillon(a)bt.com> wrote: > > http://xml.coverpages.org/iodef.html SO, is it generally accepted to use IODEF to report non-SMTP abuse (web/port scans, etc)? Everyone seems to be on the SMTP bandwagon this week, what about the miscreant customers of Internet Access Providers? -Jim P.

2 1