July 2008 - Test - lists.nanog.org

Possible prod to people to upgrade DNS
by Tuc at T-B-O-H.NET 28 Jul '08

28 Jul '08

Hi, The demo takes a while to load, goes fast, but shows how the exploit for DNS can potentially be used to get into a persons machine w/o them even being involved. Tuc/TBOH Forwarded message: > > -- ISR - Infobyte Security Research > -- | ISR-evilgrade | www.infobyte.com.ar | > > ISR-evilgrade: is a modular framework that allow us to take advantage of poor upgrade implementations by injecting fake updates. > > * How does it work? > > It works with modules, each module implements the structure needed to emulate a false update of specific applications/systems. > Evilgrade needs the manipulation of the victim dns traffic. > > Attack vectors: > --------------------- > > Internal scenary: (Internal DNS access,ARP spoofing,DNS Cache Poisoning, DHCP spoofing) > External scenary: (Internal DNS access,DNS Cache Poisoning) > > * What are the supported OS? > > The framework is multiplaform, it only depends of having the right payload for the target platform to be exploited. > > Implemented modules: > --------------------------------- > - Java plugin > - Winzip > - Winamp > - MacOS > - OpenOffices > - iTunes > - Linkedin Toolbar > - DAP [Download Accelerator] > - notepad++ > - speedbit > > ..:: DEMO > > Demo feature - (Java plugin + Dan Kaminsky�s Dns vulnerability) = remote pwned. > http://www.infobyte.com.ar/demo/evilgrade.htm > > ..:: AUTHOR > > Francisco Amato > famato+at+infobyte+dot+com+dot+ar > > ..:: DOWNLOAD > > http://www.infobyte.com.ar/developments.html > > > ..:: MORE INFORMATION > > Presentation: > http://www.infobyte.com.ar/down/Francisco-Amato-evilgrade-ENG.html > >

1 0

Re: So why don't US citizens get this?
by WWWhatsup 28 Jul '08

28 Jul '08

In http://punkcast.com/933/ (2006) Gale Brewer, chair of the NYC Council Tech Cttee talks about Verizon's initial plans for FTTH in NYC. In the city the problem was that they would have to negotiate with apartment building owners who would habg them out to dry for access to their tenants. As a result Verizon went for the suburbs. Just recently, after having gained approval to deliver cable tv like services, and thus one might imagine sufficient revenue to meet such demands, have they started in on the city. joly Jorge Amodio wrote: >I belive there are just few major cities in the US that have a comparable or >higher >concentration of people like other large cities around the world. --------------------------------------------------------------- WWWhatsup NYC http://pinstand.com - http://punkcast.com ---------------------------------------------------------------

1 0

Re: So why don't US citizens get this?
by Guy_Shields＠Stream.Com 28 Jul '08

28 Jul '08

We do its called FIOS. ----- Original Message ----- From: natalidel Sent: 07/26/2008 11:56 PM CET To: nanog(a)nanog.org Subject: So why don't US citizens get this? https://asahi-net.jp/en/service/ftth.html -- hmm?<br> -- No, this email's not real, it's http://deadfake.com

12 15

Level3 newyork - london, anyone else seeing issues?
by Drew Weaver 28 Jul '08

28 Jul '08

C:\Users\aweaver>tracert 123.237.32.1 Tracing route to 123.237.32.1 over a maximum of 30 hops 5 5 ms 5 ms 5 ms ae-2-6.bar2.Cleveland1.Level3.net [4.69.132.202] 6 5 ms 4 ms 4 ms ae-0-11.bar1.Cleveland1.Level3.net [4.69.136.185] 7 13 ms 17 ms 17 ms ae-6-6.ebr1.Washington1.Level3.net [4.69.136.190] 8 16 ms 16 ms 17 ms ae-91-91.csw4.Washington1.Level3.net [4.69.134.142] 9 15 ms 17 ms 17 ms ae-93-93.ebr3.Washington1.Level3.net [4.69.134.173] 10 22 ms 18 ms 18 ms ae-3.ebr3.NewYork1.Level3.net [4.69.132.90] 11 30 ms 18 ms 18 ms ae-63-63.csw1.NewYork1.Level3.net [4.69.134.98] 12 18 ms 19 ms 19 ms ae-13-69.car3.NewYork1.Level3.net [4.68.16.5] 13 * * * Request timed out. 14 * * * Request timed out. 15 * * * Request timed out. 16 * * * Request timed out. 17 * * * Request timed out. 18 * * * Request timed out. 19 * * * Request timed out. 20 * * * Request timed out. 21 * * * Request timed out. 22 * * * Request timed out. 23 * * * Request timed out. 24 * * * Request timed out. 25 * * * Request timed out. 26 * * * Request timed out. 27 * * * Request timed out. 28 * * * Request timed out. 29 * * * Request timed out. 30 * * * Request timed out. Looks like it began occurring around 4am. We're getting reports from some international users that they are unable to reach destinations within our network. -Drew

4 4

Anyone from Charter Communications?
by Justin Ream 28 Jul '08

28 Jul '08

Hi - I thought I'd ask here as it seems I'm not really going to get anywhere through the abuse desk. It involves a stolen laptop (company's) and certain dns requests that this certain stolen laptop would be making. -Justin

1 0

One Communications (Choice One)
by Brendan Mannella 28 Jul '08

28 Jul '08

Just wondering if anyone from the One Communications Network Group is part of this list. Please contact me offlist if so. Brendan Mannella TeraSwitch Networks Inc.

1 0

[Fwd: Admin: Offtopic Political Threads]
by S. Ryan 28 Jul '08

28 Jul '08

Did you all forget this? -------- Original Message -------- Subject: Admin: Offtopic Political Threads Date: Mon, 28 Jul 2008 09:29:24 +1200 (NZST) From: Simon Lyall <simon(a)darkmere.gen.nz> To: nanog(a)nanog.org List members are reminder that the NANOG List Acceptable Use Policy states that: 6. Postings of political, philosophical, and legal nature are prohibited. The current thread on the "Free Market" and "So why don't US citizens get this?" appears to be solely political and should be moved elsewhere. Simon Lyall NANOG Mailing List Committee The above is a "reminder" regarding desired emails to the NANOG mailing list from the Mailing List Committee (MLC). While it does not constitute a "Formal Warning" it is an official correspondence from the MLC after internal consultation. Please contact admins(a)nanog.org if you have any feedback

2 1

Aid in bypassing DNS issue
by Steve Bertrand 28 Jul '08

28 Jul '08

With the time I've had, I've tried my best to keep up with every message related to the current issue upon us related to DNS. I am a small op, amongst many that I've met the last few days that may need assistance. I would like at least someone from a large operation to read what I've done, what my concerns are and what help might be provided for a scenario. If this is as big an issue as I feel it is, then perhaps those with resources can offer advice. If you will: I've: - exploited a legacy machine and hijacked the NS records - set up an NS under the phony domain - configured A, AAAA and MX records for the hijacked domain (example.com) - put in place a simple index.html file for a website - configured email accounts - you get the point...it all works Then: - made some slight changes to the latest (as of 1000hrs 080725) to the bailiwicked_domain.rb file to accept a new parameter 'RECURSCHK', that 'fixes' the problem of a consistent domain showing up in the initial TXT check that from what I can tell tests for recursion: (#set recurschk wwNN.myDdomain.com) It allows an attacker to set a lookup against a name/record that (s)he knows exists to get the ball rolling initially. This generally ensures that the first check of the exploit will always pass (at least get an affirmative response, recursive or not), but come under the radar of an expecting IDS filter. Once one host is exploited, then the rest of the names can be built/run against, well, anything of course ...unfinished, but in progress (I know Perl, never dealt with Ruby... a if/for/while would be handy). I'd like to change the initial TXT to an A, but I don't think I quite understand the ramifications on the grand scheme of things within the scope of the exploit code, unless I were to focus more time on this. Technically, I'm now on holidays... Anyway, if you've read this far, - my true, core name servers are as vulnerable as any name server that has been patched - I have clients connected to my 'upstream' (if you please) - I configured a DNS server (implementation regardless) to "FORWARD ONLY" to the 'upstream' DNS servers - We found that we are vulnerable, due to the fact that our 'upstream' DNS servers are vulnerable because they don't use port randomization - we have wholesale business clients who are directly connected to this 'upstream', and retrieve DNS server addresses via DHCP from somewhere within their access layer - the 'upstream' has made no confirmation regarding fixes after discussion My question: How to deal with this? It appears as though there are many that state "...the patching has gone down hill", but what to do when your hands are tied? Is there a network operations centre capable, able and willing to publicly claim: "if you've tried your best to tell your 'upstreams' (ISP) to fix the issue but they haven't, tell them to forget patching, ignore the work until the problem goes away, turn off recursion and forward to us, then patch later when you can afford some downtime"? Thank you to everyone who has already put so much time and determination into this issue. Steve

2 1

Re: Exploit for DNS Cache Poisoning - RELEASED
by Paul Ferguson 28 Jul '08

28 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Jared Mauch <jared(a)puck.nether.net> wrote: >If your nameservers have not been upgraded or you did >not enable the proper flags, eg: dnssec-enable and/or dnssec-validation >as applicable, I hope you will take another look. Let's hope some very large service providers get their act together real soon now. http://www.hackerfactor.com/blog/index.php?/archives/204-Poor-DNS.html - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIiAJiq1pz9mNUZTMRAiSqAJwL9t4ldzKMjHyA4KITrLz2dHvTFQCgkfuR G4SnZhKReOYYBjdSSJamVQw= =ac5p -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

9 12

cogent bgp filtering policies?
by John van Oppen 28 Jul '08

28 Jul '08

Now that I am on my third round of an email argument with cogent's support department about adding prefixes to our filters (and them not understanding why I want le 24 matches on the blocks from which we allocate subnets to multi-homed customers) I figure it would be a good idea to ask if anyone has ever gotten cogent to setup any IRR based filtering on a customer connection. We are a small-ish regional transit provider in the northwest announcing > 100 prefixes and just spent the last few days writing emails and calling trying to get cogent to accept more than 30% of the routes we were announcing. We have IRR (radb to be specific) filters set up with our other four providers which really lowered my tolerance for having to go round and round to get prefixes added. Heck, at this point I would settle for a direct email address for their engineering department just to avoid the arguments with the support monkeys. I should note that this is actually the second time I have had this issue (the last time was with one of our customers and their cogent connection) even though we only turned up our service recently. John van Oppen AS11404

3 3