February 2010 - Test - lists.nanog.org

Re: lawful intercept/IOS at BlackHat DC, bypassing and recommendations
by andrew.wallace 08 Feb '10

08 Feb '10

On Thu, Feb 4, 2010 at 8:19 PM, Gadi Evron <ge(a)linuxbox.org> wrote: > "That peer-review is the basic purpose of my Blackhat talk and the > associated paper. I plan to review Cisco’s architecture for lawful intercept > and explain the approach a bad guy would take to getting access without > authorization. I’ll identify several aspects of the design and > implementation of the Lawful Intercept (LI) and Simple Network Management > Protocol Version 3 (SNMPv3) protocols that can be exploited to gain access > to the interface, and provide recommendations for mitigating those > vulnerabilities in design, implementation, and deployment." > > More here: > http://blogs.iss.net/archive/blackhatlitalk.html > > Gadi. For the sake of clarity and transparency, Gadi Evron has absolutely no connection to this research whatsoever. He is famous in the security community for piggybacking off other peoples research. We are frustrated with him as much as we are annoyed. Andrew Security consultant

2 2

Adopt‐an‐Haitian‐Internet‐technician‐or‐facility
by Eric Brunner-Williams 08 Feb '10

08 Feb '10

All, Attached is a project description by Reynold Guerrier, Network Engineer and Treasurer of the Association Haïtienne pour le développement des technologies de l’Information et de la Communication (AHTIC). I know many have helped and many have offered to help, and kit and people have been sent, and are continuing to be sent, however there is an unmet need, the continuation of the "fuel, food, families" trio that kept the Boutilliers NAP powered and its surviving technical team intact. And the most effective aid is cash, which enables the recipients to prioritize according to their needs, and the bulk purchases of aid recipients proximal to them. The budget and resources for this project is as follows: o $100,000 for  salaries  to  support  technicians  and  their  family  to  get  them  back on track  o 5  content  production  units  o Production  software  o Management  software   o 10  data  center  in  a  box  The data centers in a box resource was identified by Reynold on the 19th, a week after the quake, when he wrote to NANOG: > We would like to provide to the haitian government a UC systems with several branches: > > o President office: 10 endpoints > o Prime Minister office: 10 endpoints > o 12 mayor city hall offices: 3 for each: 36 endpoints > o Ministries (9 differents locations 3 for each): 27 endpoints > o Communications Center: 20 endpoints > o emergency Clusters: 14 ednpoints > > Total: 117 endpoints > > So if someone can provide recommendations, equipment, skilled technician for that it would be fine. There is wire transfer information in the attached pdf, and if anyone finds that cumbersome drop me a note and we'll work something out. Yes, there are a lot of aid dollars going to Haiti, but dollars given to AHTIC will go specifically to re-build the network infrastructure and keep the families of the surviving engineers and technicians fed and their basic needs met. Thanks in advance, Eric

7 9

Re: Adopt‐an‐Haitian‐Internet‐technician‐or‐facility
by a.harrowell＠gmail.com 08 Feb '10

08 Feb '10

-original message- Subject: Re: Adopt‐an‐Haitian‐Internet‐technician‐or‐facility From: Steven Bellovin <smb(a)cs.columbia.edu> Date: 08/02/2010 5:47 pm As a matter of form, how might one check out the legitimacy of requests like this? (No, I don't think this one is fake...) As a start, web of trust. This one was introduced to the list by Eric Brunner-Williams originally, a member in good standing.

4 4

Wireshark Developer and User Conference
by Janice Spampinato 08 Feb '10

08 Feb '10

CACE Technologies hosts the third annual Wireshark Developer and User Conference at Stanford in June and extends an invitation to the NANOG community to participate in 3 days of knowledge-transfer with the Wireshark Developer Group, learning about, and helping to direct, product futures for the world’s most widely-deployed packet and network analyzer. http://www.cacetech.com/sharkfest.10/

1 0

NANOG newbie
by James Jones 08 Feb '10

08 Feb '10

Greetings, Hi, I have just recently returned to the United States from New Zealand. I have spent a bit of time down their working as a network designer for ALU and was a member of NZNOG. The infrastructure demands and designs are completely different here in U.S. I am currently working for a VoIP company in Springfield, MA. I was wondering if their might be someone in the area that might be able to help me get my bearings and might be able to give some insight into the BMI project in the area offlist? Thanks for your time. -- James Jones +1-413-667-9199 james(a)freedomnet.co.nz

2 2

Small Network Equipment Shipping boxes
by Andrew Konkol 07 Feb '10

07 Feb '10

Gurus, Where I work we ship our own gear. That being said, we've run out of 1U shipping boxes for cisco gear. I've searched the list archives, uline, as well as a few other shipping material websites and cannot find an acceptable shipping box with foam inserts. I would like a corrugated cardboard box with foam supports for shipping 1U cisco gear (3550s, 4948s, etc..) I was wondering if anyone has sourced a good shipping box? I apologize if this topic has been brought up before and my search didn't find the thread. Thanks, -a

4 3

How polluted is 1/8?
by Mirjam Kuehne 07 Feb '10

07 Feb '10

Hello, After 1/8 was allocated to APNIC last week, the RIPE NCC did some measurements to find out how "polluted" this block really is. See some surprising results on RIPE Labs: http://labs.ripe.net/content/pollution-18 Please also note the call for feedback at the bottom of the article. Kind Regards, Mirjam Kuehne RIPE NCC

11 12

How common are wide open SIP gateways?
by Drew Weaver 06 Feb '10

06 Feb '10

Heya, Has anyone done any research or have any anecdotal numbers related to how common it is to have a SIP gateway sitting out on the Internet with no ACL or authentication? Recently we have noticed a couple of instances where we get abuse complaints from companies who claim that one of our hosting clients 'stole SIP service' from them. This reminds me somewhat of the 'SMTP open relay' days. We obviously take action and shut the offending user down but I can't help but wonder how common this practice is. Usually I just ask the company why their system allows anyone to use their SIP gateway and they usually say something like "We can't predict what IP our users will come in from... etc" I am just wondering if anyone else has noticed this trend. -Drew

9 10

Insecure Cable networks ?
by Jorge Amodio 06 Feb '10

06 Feb '10

Is it a common practice on cable network providers to leave access to the cable modem/router management web UI wide open ? Here is the scoop. I heard about it but didn't experienced it hands on or seen myself until recently when I was testing one of the embedded TCP/IP boards I produce which as many other IP gadgets has a mini HTTP server which I access just typing the IP address of the thing. In my home lab an IPv4 address on 10/8, not very uncommon I screwed up and made a typo on the IP address and ended on a different device web UI, an Ambit cable modem Hmmm my modem is from Toshiba, I tried the default factory password, it worked !!, not only that, this thing is several cities hundreds of miles away from here .. ehhh ? fired nmap, tried several 10/24 networks and just playing by hand found hundreds of devices and every single one I tried default password it worked, not only modems, also modem/routers and some with integrated VoIP where if I wanted I would have been able to change provisioning configuration, channel scanning, browse through the call manager logs and see who's calling or being called, etc. Isn't this a huge security hole ? It wont take much for a kiddie to write a very simple script to drive crazy the noc guys taking down pieces of the network here and there ... If a grownup from TWC/RR wants to get more specifics feel free to contact me. Regards

4 4

Re: Regular Expression for IPv6 addresses
by Richard.E.Brown＠DARTWARE.COM 06 Feb '10

06 Feb '10

Folks, Thanks for all the comments on the IPv6 regex... ----- > Jeroen Massar <jeroen(a)unfix.org> wrote: > > The only proper way of "testing" if an address is a valid IPv6 address > is to feed it to getaddrinfo() and then use it through that API. Good point. One of the reasons to do this was for environments where getaddrinfo() might not be availble. (For example, in a Javascript - see the page on the InterMapper site: http://intermapper.com/ipv6validator ) > Of course, there should be only limited places where a user can enter or > see IP addresses in the first place. There is this great thing called > DNS which is what most people should be using. Another good point. But look at Seiichi's note (below)... ----- > Seiichi Kawamura <kawamucho(a)mesh.ad.jp> also> wrote: > This might be of some interest to you. > > http://tools.ietf.org/html/draft-ietf-6man-text-addr-representation-04 We believe this correctly recognizes all the cases specified by RFC4291. But it's a great idea to update the Javascript page above to reformat to this recommendation. ----- > Carsten Bormann <cabo(a)tzi.org> > > I was looking at this regexp for my Ruby course as a great example of "how not > to use Regexps". > > But thank you for this textbook example! > And, of course, an error did creep in. You're quite welcome! :-) But seriously... Do you have an example of an address that causes the RE to fail? > If you really need an RE, the right approach here is to write a small program >to > generate the RE. Absolutely. The Perl program cited includes code much like your example. Rich Brown richard.e.brown(a)dartware.com Dartware, LLC http://www.dartware.com 66-7 Benning Street Telephone: 603-643-9600 West Lebanon, NH 03784-3407 Fax: 603-643-2289 PS Dartware is sponsoring a table displaying our InterMapper network monitoring software at the NANOG48 Beer 'n Gear. Please come by to introduce yourself and take a look...

1 0