September 2008 - Test - lists.nanog.org

Re: prefix hijack by ASN 8997
by Scott Weeks 23 Sep '08

23 Sep '08

----------Scott Weeks <surfer(a)mauigateway.com> wrote: ------- > I am hoping to confirm a short-duration prefix hijack <snip> ------------------------------------- --- christian(a)broknrobot.com wrote: ------- From: "Christian Koch" <christian(a)broknrobot.com> I couldn't find any relevant data confirming the announcement of one of my /19 blocks, until a few minutes ago when i checked the route views bgplay (ripe bgplay turns up nothing) and can now see 8997 announcing and quickly withdrawing my prefix ------------------------------------- At what time did you see it? scott

2 1

XO Outage
by Justin Sharp 22 Sep '08

22 Sep '08

We are seeing some issues w/ XO/Savvis peering.. Trace from XO to Savvis IP space (64.75.10.151) Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. scrubbed 0.0% 6 0.6 0.5 0.4 0.6 0.1 2. ip65-44-114-97.z114-44-65.customer.algx.net 0.0% 6 1.3 1.3 1.2 1.4 0.1 3. ??? Trace from Savvis to XO IP space (65.44.114.97) 1. scrubbed 0.0% 38 0.4 0.4 0.3 0.5 0.1 2. 64.41.199.129 0.0% 37 1.0 24.0 0.6 330.2 80.4 3. hr1-ge-7-47.santaclarasc5.savvis.net 0.0% 37 0.7 1.4 0.6 27.3 4.4 4. er1-te-1-0-0.sanjose3equinix.savvis.net 0.0% 37 0.7 5.2 0.6 140.3 23.2 5. cr1-tenge-0-7-5-0.sanfrancisco.savvis.net 2.7% 37 2.9 4.0 2.6 16.6 2.5 6. cr2-pos-0-0-3-3.dallas.savvis.net 0.0% 37 42.6 43.1 42.3 51.4 1.4 7. dpr1-ge-4-0-0.dallasequinix.savvis.net 0.0% 37 43.1 44.8 42.9 76.9 6.7 8. er1-te-2-1.dallasequinix.savvis.net 0.0% 37 43.3 49.2 42.8 233.6 31.6 9. 208.175.175.90 0.0% 37 43.0 42.8 42.6 43.6 0.2 10. 65.106.1.102 75.0% 37 43.5 46.5 43.4 62.9 6.3 11. 65.106.1.101 0.0% 37 43.4 47.8 43.2 112.3 12.5 12. 65.106.0.41 0.0% 37 57.5 65.1 57.1 177.3 21.0 13. 65.106.1.73 0.0% 37 57.4 66.5 57.1 162.1 24.2 14. ??? Trying to call into XO and they aren't even taking calls, they mention something about network issues in Spokane. Any ideas as to what is going on/ETA to fix? --Justin

4 4

favourite XFP supplier?
by Joe Abley 22 Sep '08

22 Sep '08

Hi all, Anybody have a preferred supplier for 10GE XFPs, multimode and singlemode? These are to be installed in Force10 and Juniper hardware in Toronto, so a Canadian supplier would be fabulous although I won't hold my breath. Joe

2 1

RE: hat tip to .gov hostmasters
by Robert Bonomi 22 Sep '08

22 Sep '08

> Subject: RE: hat tip to .gov hostmasters > Date: Mon, 22 Sep 2008 11:49:50 -0400 > From: "Keith Medcalf" <kmedcalf(a)dessus.com> > > If I cannot authenticate the data myself, then it is simply untrusted and u= > ntrustworthy -- exactly the same as it is now. "Speak for yourself, John" applies. In the real world, there are cases where data that one is unable to authenticate by ones self *is* treated as fully trusted. Because someone with the authority to declare it to be that, by fiat, has done so. There may be a common "chain of command", and someone higher in the chain has declared that various inferiors "shall"(i.e. 'must') trust the work of other inferiors within the organization, for example. Or, it may be a contractually-delegated trust. Or, any of a number of other possibilities. Admittedly, in any of those scenarios, the 'strength' of trust is somewhat weaker than if it was self-verified, but it _is_ "far above" your claim of 'untrusted and untrustworthy'. > The end-stage is secure only if at that stage you also set all DNS infrastr= > ucture to refuse to talk to any DNS client/server/resolver that DOES NOT va= > lidate and enforce DNSSEC. Up until that point in time, there is NO CHANGE= > in the security posture from what we have today with no DNSSEC whatsoever. FALSE TO FACT. One does not have a _guarantee_ of 'accurate' data without end-to-end enforcement, this is true. Even _with_ end-to-end DNSSEC enforcement, one does not have such a guarantee. All it accomplishes is to make the insertion of bogus data harder. Not 'impossible', just 'harder'. If a local non-DNSSEC resolver consults _only_ a DNSSEC-aware server on an immediately adjacent network, it takes only a moderate 'extension of trust' to (a) the local network operator, (b) the adjacent network operator, and (c) the DNSSEC-aware server operator, to have a "reasonable degree" of trust in the accuracy of the data the local reslover has. This 'trust' involves the physical integrity of the networks -- that a host on -those- networks will not be allowed to spoof a source address of the DNSSEC-aware server; and the use of ingress-filtering on _source_ addresses -- to prevent any 'external' network/machine from spoofing it either. Beyond that, it is just a matter of 'trusting' a proper implementation on the server itself. _IF_ the anti-spoofing provisions are in place, and 'downstream' (non-aware) DNS resolvers (which consult -only- the 'aware' server) are under the same administrative control as the DNSSEC-aware one, *THEN* there is zero effective difference in the trust level for an answer obtained from the 'non-aware' system as one obtained from the 'aware' one. > To hold forth otherwise is to participate in deliberate fraud and misrepres= > entation of material facts. This really sounds like someone who has a financial interest in promulgating FUD. <grin>

1 0

Re: Atrivo/Intercage: NO Upstream depeer
by Emil Kacperski 22 Sep '08

22 Sep '08

Hello, It's true that David from PIE disconnected our link approx 9pm or so yesterday. Things were going perfect, no complaints for a few weeks now. The only thing I believe is that NTT gave lots of pressure to PIE. For some unknown reason when I tried to reach out to the security guy at NTT he basically said our contract is with PIE. So in a time like this you really get to know who your friends are and who should be avoided. Onward and upward! What doesn't kill you only makes you stronger ;-). Just feel bad for the customers for which I am truly sorry for right now ;-(. Thanks! Contact: Emil Kacperski Company: Intercage Inc. - Atrivo Dedicated Servers San Francisco Datacenter E-Mail: emil(a)intercage.com Phone: 925-550-3947 ICQ: 23531098

4 3

Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 21 Sep '08

21 Sep '08

Matt: I've already put this offer up. I'll be more then happy to meet up at our datacenter and take you through our space. What I find funny is, your the first one whom participated in the recent reports to actually take up and respond to us. I've emailed Garth and Jart, and both of them refused to respond. I emailed both of them requesting the same information they gave to Directi. If they were able to provide Directi with a list of 20,000+ domains from their control that were abusive, why can't they provide US directly with a single 1? Then, release a joint-statement talking about how the companies need to come together to combat the abusive activities across the net, yet when we extend our hand and open up our network, we don't even get a response! Directi went from being a "partner in crime" with us to being a great anti-abuse supporting company.. How can YOU claim that WE don't do anything, if you won't report your findings in the first place? Got recent stuff? Why are you willing to give it now that we're OFFLINE? What can we do about it NOW at this very minute? You tell me when your going to be in San Francisco, and I'll make myself available. Thank you for your time. Have a great day. --- Russell Mitchell InterCage, Inc. P.S. I just realized all my responses to earlier people like Gadi and them were direct and not cc to NANOG. Will "Reply to all" now :) ----- Original Message ---- From: Matt Jonkman <jonkman(a)jonkmans.com> To: Russell Mitchell <russm2k8(a)yahoo.com> Cc: nanog(a)nanog.org Sent: Sunday, September 21, 2008 4:02:15 PM Subject: Re: Atrivo/Intercage: NO Upstream depeer Russell Mitchell wrote: > ----- > > Matt: > It's very sad that your PROUD of you contribution to the supposed "white paper" on our company. I'd like to know, was any of your "contribution" to the report altered, or mis-represented, or are you truly unaware of how false the information you provided was? > Care to have verified it? or are you a Spamhaus admin like John Reid who has that magic stick to make a claim and attack anyone who objects to it with the truth? I'd love to, but nanog isn't the place. I'll be in san fran in the near future. Lets sit down over a beer, I'll bring the research and you can look it over yourself. That would be far more productive than this. I think a few other folks would love to meet up with you as well. Maybe Emil can join us too? It's easy to insinuate from behind a keyboard. Lets get down to facts. But take this off nanog. This is NOT the place for it. Let me know when you'l be in town, I'll schedule my travel in that direction to meet up soon. Matt -- -------------------------------------------- Matthew Jonkman Emerging Threats Phone 765-429-0398 Fax 312-264-0205 http://www.emergingthreats.net -------------------------------------------- PGP: http://www.jonkmans.com/mattjonkman.asc

2 1

Re: Atrivo/Intercage: NO Upstream depeer
by Andrew D Kirch 21 Sep '08

21 Sep '08

Russell Mitchell wrote: > Andrew: > If you have seen how Spamhaus handles our resolved SBL Listings, you > would know. > Those 6 listings have been resolved for a week now. John Reid and > his goons only provide swift LISTINGS, _NOT_ delistings. > Possibly why they're so widely used. > > In the past 12 months, I have received not 1 report of a botnet on our > network. Your e-mail is broken, or you're a liar, or both > Phishing pages are always nullrouted at the time of the report. The > "40 page report" you keep referring to is a complete farse. it's 'farce' but that couldn't matter less. > But, undoubtably, you truly believe that there is an "Atrivo" and > InterCage is a "partner in crime" to Atrivo huh? Results *1* - *10* of about *26,900* for atrivo. Results *1* - *10* of about *2,390* for *atrivo crime <http://www.google.com/url?q=http://www.answers.com/crime&r=67&sa=X&oi=dict&…>*. Results *1* - *10* of about *1,880* for *atrivo fraud <http://www.google.com/url?q=http://www.answers.com/fraud&r=67&sa=X&oi=dict&…>*. Results *1* - *10* of about *1,100* for *atrivo phish*. It seems that at least 26,900 people join me in the first fantasy, and 6000 or so join me in the second. Cult meetings are on Thrusday, we'll sacrifice a spammer. > Anything else you'd like to throw at me here on NANOG? Sure, but I havn't figured out how to hit someone with a two-by-four over the Internet. > I truly feel that there are very FEW in the anti-abuse community > that smelling fresh air. If you knew where you head was, and where it > should be, maybe this conversation and the happenings in the recent > week would have actually gave benefit to the internet in whole. Atrivo/Intercage is off the Internet. That sounds like Mission Accomplished to me. I'm done now, there's clearly nothing I can do to impart a clue here. Andrew

1 0

Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 21 Sep '08

21 Sep '08

William: To date, I have never heard of the "DroneBL". I have NEVER received any report from any entity referring to that. The last report for a bot on our network was an EggDrop bot a week or so ago. The report was from the IRC Network Operator, and asked to have it removed from his network because it seemed to be 'forgotten'. It was sitting in a dead channel that hasn't had any activity for months. He did NOT claim any abuse. I'll be more then happy to monitor DroneBL, or have digests or reports from them in regards to our network. ----- Matt: It's very sad that your PROUD of you contribution to the supposed "white paper" on our company. I'd like to know, was any of your "contribution" to the report altered, or mis-represented, or are you truly unaware of how false the information you provided was? Care to have verified it? or are you a Spamhaus admin like John Reid who has that magic stick to make a claim and attack anyone who objects to it with the truth? If you want to see REAL Cyber Crime, take a look at what you caused Matt. Take a good look at Spamhaus, and tell me that they're entirely legitimate with their business. Oh, I forgot, they're a "Not-for-profit organization" that DOESN'T do business in the USA, nor has any clientel in the USA. ----- There is absolutely no sense in arguing and biquering over all this crap that you guys have caused with your misinformation and false claims. I don't know how to make this any simpler: If you see abuse from our network, report it to US. If you report it to an upstream, they'll just drop it back down to us. Obviously, we can't do anything right now with our network being OFFLINE.. But I'm dying to see who comes up with some abuse that originated from our network in this downtime! Who will be first!? Spamhaus? Thanks again for all your time and comments. Hopefully, you all will straighten up your act, cause clearly and truthfully, we've been straight the entire time. --- Russell Mitchell InterCage, Inc.

2 1

Re: Atrivo/Intercage: NO Upstream depeer
by Russell Mitchell 21 Sep '08

21 Sep '08

Hello all, Andrew: It is truly enlightening, to say the least, that you want to talk about all of the SBL Listings, all of the DNSBL Listings, and all of the abuse on our network has never had action taken. ----- In Spamhaus' article, they did a history of more then ?350? SBL Listings for our company. Today, we have 6 ACTIVE Listings in the SBL. If we haven't acted on abuse claims, why do those numbers not match up? So, sometime over the weekend, Spamhaus listed our ONLY Upstream's /22 IP Block.. There's NO Evidence of any abuse from PIE for the listing. How can they be labeled as a SPAM or Abuse Supporter after routing us for such a short time? That's ethical, legitimate, and reasonable to you? We have ALL of our IP Space listed with Spamhaus because we have a Reseller named Esthost. While their customer track record may not be a straight arrow, they've ALWAYS taken action on abuse we've received for machines leased to them (Just like every other customer we have!). We enacted a zero tolerance policy in light of the community delivering false information and giving false reports to news media. What did that do? It gave us the opportunity to cancel service on EVERY Machine that an abuse was reported on. What happened shortly after? No more reports, no more abuse. Esthost's Registrar entity, EstDomains launched a great campaign to work with the public and take in reports against Malware Customers, as that is what the news media was reporting was the issue. Over 20,000 Domains get suspended by EstDomains in a period of about a week. Your going to come back and say, "Well Directi did it in about 2 days!". Yeah? Directi had it placed right on their desk! They didn't have to launch any campaign or go out and ask the COMMUNITY for it. The people behind those false reports on our company gave them a set of Data to allow them to act that fast. So, we see Esthost turning a corner and going out to the community with an outreach program. Community is giving support for it. We enact a zero tolerance policy for our entire network, this isn't made public aside to a GOOD and TRUTHFUL Editor from TheRegister, Dan Goodin. We gave ourselves 1 month to see what is going to happen between the community, and Esthost. In the final stretch of that 1 month, we get blind-sided by Spamhaus. So now, an apparently level-headed James Thomas brings the happenings from last night into the light, and here we are. All of the claims about us being the RBN, Emil being some Russian named "Igor", and "Atrivo" being the epicenter with such partners like InterCage. Did you forget? Emil has a split-personality, that's how they got their claim of InterCage being partnered with Atrivo. As though they're 2 seperate entities! Good Research Matt, Jart, Garth, and all the others who've written about us recently! Thank you all for your time and responses. Good or bad, we're reading them. Have a great day. --- Russell Mitchell InterCage, Inc. - An un-orgranized eCrime ring based out of San Francisco, CA. We would only be so lucky!

4 4

Re: Atrivo/Intercage: NO Upstream depeered at 2:25am est
by Paul Ferguson 21 Sep '08

21 Sep '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Gadi Evron <ge(a)linuxbox.org> wrote: >>> >>> http://cidr-report.org/cgi-bin/as-report?as=AS27595&v=4&view=2.0 >>> >> >> While this is 'good' news, don't be foooled -- many of these prefixes >> have been migrated elsewhere, much the same way criminal activity >> was shifted to other hosting providers after the 'disappearance' >> of AS40989 last year). >> >> For example, see: >> >> http://www.cidr-report.org/cgi-bin/as-report?as=as36445&view=2.0 >> > Tiscali in the only upstream for Cernel... > >Are they all moving to Cernel as predicted, or are some of the prefixes >coming from elsewhere? The only prefixes that were being originated by AS27595 which are now being originated elsewhere (at least that I've seen) are: AS27595: - 85.255.113.0/24 Withdrawn - 85.255.114.0/23 Withdrawn - 85.255.116.0/22 Withdrawn - 85.255.120.0/23 Withdrawn - 85.255.122.0/24 Withdrawn AS36445: Prefix AS Path 85.255.112.0/20 12654 3257 36445 - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFI1suyq1pz9mNUZTMRAhvOAJ9VKLoPtrQ8QYJTJlAspxoiKgooeACgtdGT AuaBR6QAkHlvrplNjEppamc= =wYt3 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0