October 2010 - Test - lists.nanog.org

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Owen DeLong 04 Oct '10

04 Oct '10

> >> I'll go a step further and say that the resource holder should be >> the ONLY holder of the private key for their resources. >> >> Owen > > If you're saying that ISPs can only participate in an RPKI scheme if they > run their own Certificate Authority, then I think that would practically > ruin the chances of Certification actually ever taking off on a large > scale. > > -Alex No... I'm saying that if ISPs aren't the only entities that hold their private keys, then they aren't the only entities that can sign their resources. If you choose to delegate the CA role for signing your resources to someone else, then, obviously, you have to give them a valid private key with which to sign those resources. However, in doing that, you've created a situation where your signature is now much easier to forge. Kind of like automatic signing machines for checks. Benefit: The accounting department can sign thousands of checks and the CFO doesn't have to. Draw-back... The accounting department can sign thousands of checks without the CFO knowing they did so. Owen

1 0

RPKI Resource Certification: building features
by Alex Band 04 Oct '10

04 Oct '10

Most of the discussions around RPKI Resource Certification that have been held up to now have largely revolved around infrastructure and policy topics. I would like to move away from that here and discuss what kind of value and which features can be offered with Certification for network administrators around the world. Because in the end, the goal is to make Internet routing more robust and create a more reliable method for network operators to make routing decisions. We all know about the shortcomings of the IRR system and that just half of all prefixes on the Internet have a route object associated with them (http://bgpmon.net/blog/?p=140) However, it does mean that there is ton of valuable information in the IRRs, whereas the Certification system needs to start from scratch. Based on many discussion I've had with members and the Community, here is my idea for a Route Origin Authorisation** (ROA) wizard that retrieves IRR information, compares it to real world routing and uses that for the creation of ROA Specifications. This has a number of benefits: - Network operators don't have to create their routing policy in the Certification system from scratch - Because a comparison between is done the IRR and RIS (http://ripe.net/ris/) only accurate up-to-date information is added to the Certification system - The accuracy of the IRR is increased as a bonus, and is achieved without leaving the wizard Ideally, a network operator should be able to manage and publish their routing policy – both for the IRR and Certification – from one single interface. Here are the basic steps for the wizard after a certificate is generated: 1. Start ROA Wizard 2. Detect IRR information using the AS numbers in the Certificate, like for example: http://www.db.ripe.net/whois?searchtext=AS286&inverse_attributes=origin&for… 3: Compare results with RIS using RRCC/Netsense, like for example: http://www.ris.ripe.net/cgi-bin/rrccng/query.cgi?target=AS286 4: Allow user to flag which ROA specifications they would actually like to create, based on the IRR and RRCC/Netsense results. 5: Allow user to create additional ROA Specifications 6: Detect which maintainer is used for the route objects in the IRR 7: Allow user to specify maintainer password/pgp key, so all route objects are updated/removed/added based on the ROAs that were created. This makes sure the data in the IRR and the Certification system is consistent. 8: Save and publish ROAs and route objects Do you think there is value in creating a system like this? Are there any glaring holes that I missed, or something that could be added? I'm looking forward to your feedback. Alex Band RIPE NCC http://ripe.net/certification ** The certification system largely revolves around three main elements: (1) the Certificate, that offers validated proof of holdership of an Internet Resource, (2) the Route Orgin Authorisation Object (ROA), a standardised document that states that the holder of a certain prefix authorises a particular AS to announce that prefix and (3) the Validator, which relying parties, i.e. your peers, can use to validate certificates and ROAs.

1 2

Re: [ncc-services-wg] RPKI Resource Certification: building features
by Randy Bush 04 Oct '10

04 Oct '10

> Do you think there is value in creating a system like this? yes. though, given issues of errors and deliberate falsifications, i am not entirely comfortable with the whois/bgp combo being considered formally authoritative. but we have to do something. > Are there any glaring holes that I missed yes. the operator should be able to hold the private key to their certificate(s) or the meaning of 'private key' and the security structure of the [ripe part of the] rpki is a broken. randy

3 2

Request for participation - Arbor 2010 Worldwide Infrastructure Security Report.
by Dobbins, Roland 04 Oct '10

04 Oct '10

Request for participation - Arbor 2010 Worldwide Infrastructure Security Report. ----- Folks, We're in the process of collecting feedback for the 2010 Worldwide Infrastructure Security Report (WWISR); this is the Sixth Edition of the report, and we'd really be grateful for your participation! This is the only security-focused survey we're aware of which is specifically oriented towards those who design, build, operate, and defend public-facing network infrastructure/applications/services, and provides the opportunity to share your experiences and perspectives with your peers in the operational community, as well as to benefit from their experiences and perspectives. The 2010 Infrastructure Security Survey is up and available for your input. You can register to complete the survey via this URL, which will redirect your browser to the survey tool (the survey is accessed via http/s): <http://www.arbornetworks.com/survey/ISR2010> Once again, we've added several insightful questions from past participants. Feedback collection will end as soon as we've reached the desired number of respondents (ideally, 100+). The results will be published in the 2010 Worldwide Infrastructure Security Report in January of 2011. Also, please note that NO personally- or organizationally-identifiable information will be shared in any manner. The 2009 edition of the survey is available here (registration required): <http://www.arbornetworks.com/report> Thanks in advance! ----- ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Sell your computer and buy a guitar.

1 0

closing 'lazy mans NW research"
by bmanning＠vacation.karoshi.com 03 Oct '10

03 Oct '10

I ask: On Wed, Sep 29, 2010 at 5:47 PM, <bmanning(a)vacation.karoshi.com> wrote: > i find myself in need of a multiport (8-16) 1 Gig ethernet HUB. > or a switch smart enough to do transparant port mirroring to at least > four ports. and the following suggestions were made: http://www.datacomsystems.com/products/details.asp?prod=5&itm=1&cat=3 http://www.dual-comm.com/gigabit_port-mirroring-LAN_switch.htm http://www.netoptics.com/products/product_family_details.asp?cid=1&pid=54&S… ftp://ftp2.zyxel.com/GS-1524/user_guide/GS-1524_1.12_Ed2.pdf Of these, it looks like the datacomsystems.com tap will be a good fit. --bill

1 0

Re: NEVERMIND! (was: ARIN Fraud Reporting Form ... )
by John Curran 03 Oct '10

03 Oct '10

On Oct 3, 2010, at 7:24 AM, "Ronald F. Guilmette" <rfg(a)tristatelogic.com> wrote: > I'm sitting here looking at your NRPM 3.6 and it says: > > Unresponsive POC email addresses shall be marked as such in the database. > > OK, Fine. So do you have a problem with ``marking those in the data base'' > and specifically within the associated AS and IP block records? And if so why? There is no problem with also marking resource records which have no valid POC's (even if not specifically stated by policy). It is an operational question not a resource policy question, and we generally handle those by informing the community of the plans to change practices through the ARIN consultation and suggestion process (https://www.arin.net/participate/acsp/index.html) > And if you have a problem with that, they please explain when and why you > suddenly developed a problem with it, because clearly ARIN _was_ doing this > before, at some point. (And it sure looks like you are NOT doing it now.) > > I'd really like to know when and why ARIN stopped putting these annotations > into the AS and IP block records associated with un-contactable POCs. > > Can you just answer me that? I mean, you know, without directing my > attention to some document which also doesn't answer the question? Amazingly, you are my customer; i.e. I do indeed work for you and the rest of the community. So, I'm happy to try and address your questions (even if at times it appears more of an inquisition than constructive engagement...) The ARIN staff has been putting those notations in manually for net blocks which lack valid contacts, but doing so is not required by policy and has been resource intensive since the contact verification portion was manual. We are now looking (as a result of your fine suggestion) at automating this process of marking resource blocks with no valid contacts as an inherent part of the new automated POC verification process. /John John Curran President & CEO ARIN

2 1

AS14202 - 'jacked routes... Whoa! This is just getting silly now!
by Ronald F. Guilmette 03 Oct '10

03 Oct '10

Somebody else on another mailing list I'm on actually found the following new 'jacking incident. Count 'em... one hundred and eighty three (183) separate jacked blocks. I can't take any credit. I wanted to include, in this posting, the name of the guy who actually found this stuff, and give him full credit for finding this, but he's asked me not to. These announcements may not be around very long. We'll see. Regards, rfg P.S. If ARIN actually does want to clean up and reclaim old abandoned blocks... well... it would appear that some nice helpful fellow has already catefully surveyed both 204/8 and 205/8 for such things, on their behalf. See below. AS14202: 198.153.0.0/21 199.5.152.0/23 199.253.192.0/21 200.1.184.0/21 200.4.32.0/20 200.41.240.0/22 204.17.128.0/23 204.17.250.0/23 204.17.252.0/23 204.19.124.0/23 204.19.126.0/23 204.19.132.0/23 204.19.180.0/22 204.19.226.0/23 204.19.234.0/23 204.52.148.0/22 204.57.8.0/21 204.57.16.0/20 204.58.132.0/23 204.58.250.0/23 204.58.252.0/23 204.61.16.0/21 204.61.24.0/22 204.61.28.0/23 204.62.148.0/23 204.62.168.0/23 204.63.144.0/21 204.63.152.0/21 204.63.168.0/22 204.63.172.0/23 204.68.232.0/23 204.75.148.0/23 204.75.240.0/23 204.76.16.0/21 204.76.24.0/22 204.76.158.0/23 204.76.160.0/22 204.76.164.0/23 204.76.198.0/23 204.76.200.0/23 204.76.214.0/23 204.76.216.0/22 204.76.230.0/23 204.76.232.0/22 204.76.236.0/23 204.76.246.0/23 204.76.248.0/22 204.76.252.0/23 204.79.130.0/23 204.80.66.0/23 204.80.68.0/22 204.80.72.0/21 204.80.80.0/22 204.80.84.0/23 204.86.0.0/21 204.86.8.0/22 204.86.104.0/21 204.86.112.0/22 204.89.0.0/21 204.89.134.0/23 204.110.184.0/23 204.115.136.0/21 204.124.4.0/22 204.124.68.0/22 204.124.72.0/22 204.124.76.0/22 204.126.180.0/23 204.126.184.0/23 204.126.244.0/23 204.147.192.0/21 204.152.16.0/23 204.152.36.0/23 204.152.52.0/23 204.152.72.0/23 204.152.120.0/23 204.152.122.0/23 204.152.136.0/23 204.152.160.0/22 204.152.164.0/23 204.153.164.0/22 204.153.180.0/22 204.153.224.0/22 204.174.48.0/23 204.174.52.0/23 204.174.76.0/22 204.174.204.0/23 204.187.50.0/23 204.187.52.0/23 204.187.96.0/23 204.187.106.0/23 204.187.108.0/22 204.187.112.0/22 204.187.116.0/23 204.194.16.0/22 204.194.48.0/21 204.194.192.0/21 204.194.200.0/22 204.194.208.0/22 204.194.216.0/22 204.194.220.0/23 204.209.30.0/23 204.209.86.0/23 204.225.184.0/23 204.225.226.0/23 204.225.234.0/23 204.231.242.0/23 204.231.244.0/23 204.239.126.0/23 204.239.176.0/23 204.239.192.0/23 204.239.200.0/23 205.132.88.0/22 205.132.92.0/23 205.132.136.0/21 205.132.152.0/21 205.142.4.0/23 205.142.32.0/22 205.142.40.0/22 205.142.68.0/22 205.142.84.0/22 205.142.132.0/22 205.142.136.0/22 205.142.140.0/22 205.142.144.0/22 205.142.160.0/22 205.142.204.0/22 205.142.208.0/22 205.142.212.0/22 205.143.8.0/21 205.143.56.0/21 205.153.4.0/22 205.153.32.0/22 205.153.72.0/22 205.153.108.0/22 205.153.124.0/22 205.153.132.0/22 205.153.164.0/22 205.153.168.0/22 205.153.184.0/22 205.153.200.0/22 205.153.216.0/22 205.153.252.0/22 205.167.12.0/23 205.167.20.0/23 205.167.32.0/23 205.167.38.0/23 205.167.50.0/23 205.167.66.0/23 205.167.72.0/23 205.167.82.0/23 205.167.98.0/23 205.167.112.0/23 205.167.160.0/23 205.167.172.0/23 205.167.178.0/23 205.167.190.0/23 205.167.194.0/23 205.167.204.0/23 205.167.228.0/23 205.167.236.0/23 205.167.246.0/23 205.172.32.0/22 205.172.36.0/22 205.172.116.0/22 205.172.120.0/21 205.172.128.0/22 205.172.140.0/22 205.172.152.0/22 205.172.176.0/22 205.172.244.0/22 205.172.252.0/22 205.173.184.0/21 205.189.74.0/23 205.189.78.0/23 205.189.118.0/23 205.189.120.0/23 205.189.222.0/23 205.189.224.0/23 206.53.128.0/21 206.82.96.0/21 206.208.72.0/21 206.220.0.0/22 207.45.96.0/21

3 2

ARIN Fraud Reporting Form ... Don't waste your time
by Ronald F. Guilmette 03 Oct '10

03 Oct '10

So ARIN put up on their web site this fancy schmancy web form that allows a person to report fraud relating to ARIN number resources. Here's what the introduction to that page says, exactly as it appears on ARIN's web site: This reporting process is to be used to notify ARIN of suspected Internet number resource abuse including the submission of falsified utilization or organization information, unauthorized changes to data in ARIN's WHOIS, hijacking of number resources in ARIN's database, or fraudulent transfers. Well, that's what it says anyway. And being naive, I actually believed that the folks at ARIN might actually give a rat's ass about all these kinds of fraud that they have enumerated above. Boy was I wrong! I just received the response attached below to one of my earlier reports using that form. And I gotta tell you, its an eye opener. Apparently the fine folks at ARIN, clever bureaucrats that they are, have subtly but substantially redefined the specific kinds of ``fraud'' they care to hear about and/or investigate, so that contrary to the above, mere hijacking of ASes or IP blocks isn't actually something that they want to hear about, much less DO anything about. Nope! Apparently, ARIN's fraud reporting form is only to be used for reporting cases where somebody has fiddled one of ARIN's whois records in a fradulent way. If somebody just waltzes in and starts announcing a bunch of routes to a bunch of hijacked IP space from a hijacked ASN (or two, or three) ARIN doesn't want to hear about it. In those rare cases where the perp is considerate enough to ALSO fiddle the relevant WHOIS records in some fradulent way, THEN (apparently) ARIN will get involved, but only to the extent of re-jiggering the WHOIS record(s). Once that's been done, they will happily leave the perp to announce all of the fradulent routes and hijacked space he wants, in perpetuity. Apparently, they consider the hijacking itself as being totally out of their charter to even look at or investigate. ONLY if a WHOIS record has been fiddled will they give a damn, and then the only one thing they will give a damn about will be the WHOIS record... and the rest of the net can go to hell, because hay! Not our problem man! Now I _know_ full well that by posting this rant here, the usual assortment of knuckle-walker throwbacks who still yearn for the wonderful rule-less frontier every-man-for-himself-and-no-sherrifs fun filled days of the old 20th Century Internet, will pipe up immediately and say `Good! Goddammit we don't want no steekin' ARIN to be ``policing'' anything at all. F**k that! Total anarchy is the best of all possible systems.' You know what? I don't care. Let them come. Let them lumber around and scream and pound their fists and try to tell me that because *I* didn't get onto the Internet until 1983 (or because their router can beat up my router) that they somehow magically outrank me, and that their opinions are God and mine are worthless. That's quite obviously horse shit. How do you have a pecking order anyway in a self-avowed anarchy? Sorry, no. The two are not compatible. I've got as much right to an opinion as you do. And until proved otherwise, mine is as valid as your's. And my opinion is that this sucks. ARIN's attitude sucks. And they are apparently redefining the word ``fraud'' in a way that will insure that they will have to do minimal work, and that they'll never ever have to do anything that might be ``hard'' in the sense of possibly being the lest bit contro- versial, you know, like telling some hijacker ``Stop doing that.'' Yes, I'm sure that there are a lot of people here who will pipe up and say that it's just wonderful that ARIN is useless and that ARIN will do nothing. Their anachronistic anarchist philosophy is not a philosophy. It's merely an abdication of responsibility, and should be seen as such. It is just a lazy man's way of avoiding having to think about how a society should be organized. It is the coward's way of avoiding making rules that some members of the group might find controversial. On the net, hijacking of IP space is just about the deepest kind of violation of the commonly accepted rules of how to behave in this shared space that I can imagine. And now, the people who _issue_ the IP space assignments say that they don't care to _police_ the very assignments that they themselves have made! Well then what's the bleeping point of even having them or their whole bloody allocation system then? I say let's disband the Federal Reserve *and* ARIN, because they are all just a bunch of useless bureaucrats at this point who are serving nobody other than themselves. If we are going to have anarchy, then bring it on! Let's not have this half-assed sort of anarchy that we have now. Let's have the real thing! I'm going out tomorrow and I'm going to buy me the biggest router than I can afford. Then I'm going to get it colocated someplace, and then I'm going to start announcing all the routes I feel like, and nobody will do shit about it... because its not their job man! And some people still wonder why this planet is so f**ked up. Geeezzz. Regards, rfg P.S. It ain't as if I'm either asking or expecting anybody from ARIN to take a plane out to that place where the hunters shot down that cable, or some exchange point in Bumf**k, Idaho, and with guns drawn, physically pull the wire out of the socket. No. I'm *not* asking for that kind of ``policing''. But Christ! They could at least take a position, instead of simply standing around with their hands in their pockets. Is that really too much to ask? They could say, to everyone involved, and to the community as a whole, ``This ain't right. *We* maintain the official allocation records. In most cases, *we* made the allocations, and that guy should NOT be announcing routes to that IP space, and he shouldn't be announcing anything at all via that AS number, because these things ain't his.'' That's all. I'd just like to see them maybe take a postion. I'm quite sure that ARIN corporate counsel has advised them to never take a position on anything... kind-of like Minister Hacker in "Yes, Minister", who often hoped that the government could have NO position on anything the least bit controversial...except with respect to things that might erode their own power, you know, like the position that IP addresses are not property, which they try desperately to maintain (against all obvious facts to the contrary) as a way of keeping courts out of the business of saying who gets what, so that they can maintain their own total and absolute sovereignty over this shit, with no annoying judges to get in their way. But you know, if they won't even take a position on a bloody blatant hijacking by low life spammer slugs and/or by others who the spammers have paid Big Bucks to, to steal the space for them, they really, like I said, what's the point of even having an allocation ``authority''? (And obviously, I am using that term very very loosely here, because they clearly only care to use their ``authority'' when it makes everybody happy, and won't use it at all when it might make even one lone spammer/hijacker sad. If there is a better definition of cowardice and abdication, I don't know what it is.) ------- Forwarded Message Replied: Fri, 01 Oct 2010 00:49:08 -0700 Replied: hostmaster(a)arin.net Return-Path: hostmaster(a)arin.net Delivery-Date: Thu Sep 30 08:30:13 2010 Return-Path: <hostmaster(a)arin.net> X-Original-To: rfg(a)tristatelogic.com Delivered-To: rfg(a)tristatelogic.com Received: from smtp1.arin.net (smtp1.arin.net [192.149.252.33]) by segfault.tristatelogic.com (Postfix) with ESMTP id 389DDBDC34 for <rfg(a)tristatelogic.com>; Thu, 30 Sep 2010 08:30:13 -0700 (PDT) Received: by smtp1.arin.net (Postfix, from userid 323) id 89AD4165331; Thu, 30 Sep 2010 11:30:07 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 3.2.5-arin1 (2008-06-10) on smtp1.arin.net X-Spam-Level: X-Spam-Status: No, score=-144.2 required=5.0 tests=AWL,BAYES_00, FH_DATE_PAST_20XX,USER_IN_WHITELIST autolearn=no version=3.2.5-arin1 Received: from pgp.arin.net (pgp.arin.net [192.136.136.159]) by smtp1.arin.net (Postfix) with ESMTP id 5F592165324 for <rfg(a)tristatelogic.com>; Thu, 30 Sep 2010 11:30:07 -0400 (EDT) Received: by pgp.arin.net (Postfix, from userid 688) id 37E9F1A8069; Thu, 30 Sep 2010 11:30:07 -0400 (EDT) Received: from shell.arin.net (shell.arin.net [192.136.136.149]) by pgp.arin.net (Postfix) with ESMTP id AD3C81A8103 for <rfg(a)tristatelogic.com>; Thu, 30 Sep 2010 11:30:06 -0400 (EDT) Received: by shell.arin.net (Postfix, from userid 2006) id C6F5D8059; Thu, 30 Sep 2010 11:30:06 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by shell.arin.net (Postfix) with ESMTP id C5B0A8058; Thu, 30 Sep 2010 11:30:06 -0400 (EDT) Date: Thu, 30 Sep 2010 11:30:06 -0400 (EDT) From: hostmaster(a)arin.net X-X-Sender: jonw(a)shell.arin.net To: rfg(a)tristatelogic.com Subject: Re: [ARIN-20100928-F683] Fraud Report Confirmed In-Reply-To: <mailbox-17204-1285704731-754558(a)shell.arin.net> Message-ID: <Pine.LNX.4.64.1009301126150.20077(a)shell.arin.net> References: <mailbox-17204-1285704731-754558(a)shell.arin.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, Thanks for your report. > AS11296 appears to have been hijacked. > > Separately and additionally, all of the IPv4 blocks currently being > announced by AS11296 appear to have been hijacked also: > > 63.247.160.0/19 > 199.241.64.0/19 > 206.226.64.0/24 > 206.226.65.0/24 > 206.226.66.0/24 > 206.226.67.0/24 > 206.226.68.0/24 > 206.226.69.0/24 > 206.226.70.0/24 > 206.226.71.0/24 > 206.226.72.0/24 > 206.226.73.0/24 > 206.226.74.0/24 > 206.226.75.0/24 > 206.226.76.0/24 > 206.226.77.0/24 > 206.226.78.0/24 > 206.226.79.0/24 > 206.226.96.0/19 We've looked through these records and can't find any unauthorized changes. Do you have any further details regarding unauthorized changes to ARIN's Whois data? If not, we can't take action. We can investigate fraudulent changes to registration data, but we can't investigate fraudulent activity related to use of numbering resources (e.g. routing of resources by someone other than the registrant). If you have any further questions, comments, or concerns please respond to this message or contact me directly. Regards, Jon Worley Senior Resource Analyst ARIN Registration Services https://www.arin.net/ hostmaster(a)arin.net 703.227.0660 Are you ready for IPv6? For information on transitioning to IPv6, see: https://www.arin.net/knowledge/about_resources/v6/v6.html - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFMpKz/ZKymzxl/LaURAvVuAJsFT6DZxoZ5O13SDRKWK6Lkz1yusgCdFt01 aMTBE0O/ucnRx+8rk8+QbEE= =qqf5 - -----END PGP SIGNATURE----- ------- End of Forwarded Message

18 44

Re: AS11296 -- Hijacked?
by Robert Bonomi 03 Oct '10

03 Oct '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Fri Oct 1 16:33:09 2010 > From: John Curran <jcurran(a)arin.net> > To: George Bonser <gbonser(a)seven.com> > Date: Fri, 1 Oct 2010 17:32:47 -0400 > Subject: Re: AS11296 -- Hijacked? > Cc: "nanog(a)nanog.org" <nanog(a)nanog.org> > > George - > Full agreement; the next step is defining a deterministic process for id= > entifying these specific resources which are hijacked, That _seems_ fairly simple -- can you trace a 'continuity of ownership from the party that they were -originally- allocatd to to the party presently using them. If yes, legiitmate, if no, hijacked. With most States corporation records on-line, tracing corporate continuity is fairly straight foruard. As long as you recognize that a corpoation 'abadoned', 'dissolved' (or similar) in one state is *NOT* the 'parent' of a same-/similarly-named corporation established in another state. And that "documents" surfacing 'long after' a resource-holder has 'disappeared', puporting to show a transfer of those resources 'at the time of disappearance', are "highly suspect", and really require confirmation from someone who can be -independantly- verified as part of the 'old' organization at the time of the transfer. This isn't rocket science, it's straightforward corporate forensics, and the establishment of "provenence", or the equivalent of an 'abstract of title' for real-estate. "Somebody", either IANA, or the RIRs _should_ have been keeping track of what prefixes are announced, and _by_whom_, as a minimal check on utilization when an existing AS submits a request for additional space. A netblock (meaing an entire allocation, not just some sub-set thereof) that's been 'missing' for an extended period, and then shows up in an geographically distant locale is 'suspicious' to start with. All the more so it it was multi-homed, and now has only a single upstream.

5 5

Re: AS11296 -- Hijacked?
by Ronald F. Guilmette 02 Oct '10

02 Oct '10

I received a nice email from a very polite graduate student just now, who shall remain nameless, and I decided that I wanted to give him the reply below, but also to post this all to NANOG too, so here it is. I hope this may ally some of the concern that has been expressed about me not being more forthcomeing about the details of this case. (And if anybody gives me a hard time about being ``off topic'' then I'm going to give him or her a knucke sandwich, because I was specifically asked... indeed badgered... to provide more explanation of, and more justification for my earlier posting, as the record in the archives of this list will clearly show.) The friendly graduate student wote: >I've been quietly following NANOG's little flamewar over this. I'm >interested in what techniques you used to arrive at your conclusion >regarding AS11296. > >Unfortunately for me, I'm not a network op. Instead, I am a PhD student >interested in all matters inter-domain. I hope you feel this is enough >to make me a worthy recipient. No, actually, it isn't. If I google you can I be _sure_ that you're not playing for the other team? Probably not. But the good news is that I have decided to be a bit less cagey generally, and specifically in my public comments about these things anyway, and to give out more confirming data bits anyway. And I'll be sending this letter on to the NANOG list soon, with your name redacted, of course. What follows below is information that could be gleened (if you know how) from whois.internic.net. It's all public info. I just rearrange it and print it out in a nice pretty way. (Of course knowing where to look within the vast IPv4 address space is also quite helpful, but I'm not going to get in to that.) The bottom line here is that if you get the whois records for the domains associated with the name servers in the list attached at the end, you'll see that they are all going to be ``fishy'' in some way, e.g. ``cloaked'' (aka ``privacy protected''), or else registered to some mystery fly-by night company that may or may not actually exist, or at any rate, the domains will all be registered to something sort-of stealthy... something which is intended to make the spammer behind all this a bit harder to find. Oh yea, and the snail mail addresses given in the WHOIS records for the domains will usually/often be tracable to UPS Store rental P.O. boxes... those are standard spammer favorites, because...as they well know... us spamfighters can't find out who really controls any one of those boxes without a subpoena... unlike USPS boxes, for instance. (All this is quite well known in the dank sleezy spammer undergound already, so I'm not hardly giving away any secrets here.) And in a similar vein, the contact phone numbers given in the whois records will quite typically be 1-800 or 1-888 or 1-877 or 1-866 toll-free numbers. No, the spammers are _not_ trying to save you money when you want to call them up to bitch to them about the fact that they sent you 8,372 spams in a row. Nope, again, they use the toll-free numbers for a very specific purpose, which is again to make it more difficult for anyone trying to track them down to find their actual physical location. Non-tollfree numbers are typically associated with a specific geographic vicinity (although even that is being substantially eroded by number portability). But the toll free numbers are truly and always utterly geographically anonymous. So spammers use them a lot, primarily in domain whois records. So here you are. You've got this s**t load of highly ``fishy'' name servers, and they are all planted firmly into IP space that (a) appears to have been allocated to a reputable name brand company... such as Seiko, in this case... *and* (b) the block in question, based on the RegDate: and Updated: fields of the block's ARIN whois record, apparently hasn't been touched for years... maybe even a decade or more... thus implying that the former owners of the block either have abandoned it years ago, or else they themselves went belly up and ceased to exist, probably during the Great Dot Com Crash of 2000. Add it all up and what does it spell? No, not heartburn... Hijack. See, there actually isn't any big mystery about any of this, except the part about how I came to focus on this particular set of IP blocks and/or the particular AS that was announcing routes to them. And about that part, I have nothing to say, except to tell these spammers (who are probably listening) what I always say... that spamming is THE most public of all crimes. If you really think that you an hide and be totally invisible, even while you blast MILLIONS of total strangers with your advertising, then you need to up your lithium, because the dosage you're on now clearly isn't doing the job. Oh, and one other small thing... Even though the spammers try to hide themselves, often times, they really don't try THAT hard, probably because most folks don't care enough to really learn how to track these kinds of schmucks down, so in general, they only have to be a little stealthy... not a lot stealthy, and they know that. But using hijacked space raises the bar a little. In this context, you shouldn't really use all P.O. boxes that are on your same island, just because you are too effing lazy to take a ferry to the mainland once a month to pick up your hate mail from your anonymous UPS drop box. I can't really tell you exactly who engineered the hijacking in this case. Somebody with some network savvy obviously. What I suspect I _can_ tell you is which spammer (who runs a false-front ``affiliate marketing'' operation, just as cover story for their own snowshoe spamming... as most of the serious snowshoers do these days) most probably sub-leased the IP space from whoever actually engineered the hijacking. Look at the snail-mail addresses in the whois records for the domains listed below. Yes, they are UPS boxes, but look at the general location, Victoria, BC. So now go and google for "affiliate marketing" and "Victoria". There really aren't that many probable suspects. Victoria ain't a terribly big place. Not like, e.g. Vancouver. But then the schmuck would have to take the ferry over once a month to collect his hate mail from his mainland anonymous UPS box, and he's too effing lazy to do that. That's why he's a spammer, because he's too effing lazy and untalented to get honest work, or even to learn an honest trade, you know, like male hooker. (Hey! At least it's consensual, unlike spamming.) (Nishant? I know you're listening. Now you WILL make sure that Tobyn gets a copy of this posting, won't you? That's a good boy. Thanks. Effing assholes!) Could it possibly be that I'm jumping to the Wrong Conclusion here about who the spammer is, I mean just based on something as flimsy as geographic proximity? Sure, but not bloody likely. You see that's not hardly the only evidence that I have in front of me. I'm just not talking about the rest. (And I hope it keeps the son of a bitch up nights trying to figure out how ELSE he phuked up, in addition to being lazy and using only local UPS drop boxes.) Regards, rfg P.S. Some or all of the data presented below may still be available via whois.internic.net, even though the IP blocks are no longer even routed. Try this for example: whois -h whois.internic.net 206.226.96.2 Yup. Still there. At least for now. Probably be gone by morning. P.P.S. To all of the spammers out there reading this who think that you have learned from this e-mail how to be more stealthy still, and how to hide from me even better in the future... well... enjoy your fantasy while it lasts. I can find you now, I can find you next year, and I'll be able to find you ten years from now. And do you know why? Because I'm smarter than you are. And that's not saying much. If you had any talent... any talent at all... then you'd be able to find an HONEST job. It wouldn't pay as well, but at least you wouldn't be ashamed to tell your mother what you _actually_ do for a living. In the meantime, please hurry up and die. The world will most definitely be a better place when we no longer have to carry your dead weight on the backs of humanity. Don't flatter yourselves. You make nothing. You build nothing. You contribute nothing. You just annoy people. For money. We will make sure that that exact epitaph is engraved on your headstone, so that you will be remembered properly, once you go. ================================================================ 63.247.172.3 ns1.tooplacedomain10tht.info 63.247.172.4 ns2.tooplacedomain10tht.info 63.247.181.3 ns1.steadyvolumebandw57.info 63.247.181.4 ns2.steadyvolumebandw57.info 63.247.185.19 ns1.magnumfourcompkriel.info 63.247.185.20 ns2.magnumfourcompkriel.info 199.241.95.253 fwd1.itargetdirect.net 206.226.64.4 ns1.granadacentral.info 206.226.64.5 ns2.granadacentral.info 206.226.96.2 ns1.sandpipedream.com ns1.optinletters.com ns1.notifications-mail.com ns1.mailingdaily.com ns1.blueholster.com ns1.allowingmail.com 206.226.96.3 ns2.sandpipedream.com ns2.optinletters.com ns2.notifications-mail.com ns2.mailingdaily.com ns2.blueholster.com ns2.allowingmail.com 206.226.112.2 ns1.drainagecorner.com 206.226.112.3 ns2.drainagecorner.com 206.226.112.130 ns1.calculatingdigits.com 206.226.112.131 ns2.calculatingdigits.com 206.226.112.194 ns1.mailcreatures.com 206.226.112.195 ns2.mailcreatures.com 206.226.113.2 ns1.qualitycampaigns.com 206.226.113.3 ns2.qualitycampaigns.com 206.226.113.66 ns1.onlyinstant.com 206.226.113.67 ns2.onlyinstant.com 206.226.114.194 ns1.droppedtargets.com 206.226.114.195 ns2.droppedtargets.com 206.226.115.2 ns1.dinneroutstanding.com 206.226.115.3 ns2.dinneroutstanding.com 206.226.116.130 ns1.offersenveloped.com 206.226.116.131 ns2.offersenveloped.com 206.226.117.2 ns1.sleekrange.com 206.226.117.3 ns2.sleekrange.com 206.226.117.66 ns1.thegulfofmail.com 206.226.117.67 ns2.thegulfofmail.com 206.226.118.2 ns1.mailmammals.com 206.226.118.3 ns2.mailmammals.com 206.226.118.66 ns1.trackpreference.com 206.226.118.67 ns2.trackpreference.com 206.226.119.2 ns1.platinumpermission.com 206.226.119.3 ns2.platinumpermission.com 206.226.119.130 ns1.approvedcity.com 206.226.119.131 ns2.approvedcity.com 206.226.120.130 ns1.creaturesofmail.com 206.226.120.131 ns2.creaturesofmail.com 206.226.121.2 ns1.tonnesofmail.com 206.226.121.3 ns2.tonnesofmail.com 206.226.122.2 ns1.cancellationsanytime.com 206.226.122.3 ns2.cancellationsanytime.com 206.226.123.2 ns1.hourofman.com 206.226.123.3 ns2.hourofman.com 206.226.124.2 ns1.businessneedsfilled.com 206.226.124.3 ns2.businessneedsfilled.com 206.226.124.130 ns1.underestimatedhours.com 206.226.124.131 ns2.underestimatedhours.com 206.226.126.2 ns1.companiesthatperform.com 206.226.126.3 ns2.companiesthatperform.com 206.226.126.130 ns1.pageuppleasure.com 206.226.126.131 ns2.pageuppleasure.com 206.226.127.2 ns1.transferredtraffic.com 206.226.127.3 ns2.transferredtraffic.com

12 21