February 2012 - Test - lists.nanog.org

antisocial security
by Randy Bush 02 Feb '12

02 Feb '12

from a stateside host psg.com:/usr/home/randy> dig ssa.gov. ns ; <<>> DiG 9.4.3-P2 <<>> ssa.gov. ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37734 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4 ;; QUESTION SECTION: ;ssa.gov. IN NS ;; ANSWER SECTION: ssa.gov. 24370 IN NS dns1.ssa.gov. ssa.gov. 24370 IN NS dns6.ssa.gov. ssa.gov. 24370 IN NS dns5.ssa.gov. ssa.gov. 24370 IN NS dns2.ssa.gov. ;; ADDITIONAL SECTION: dns1.ssa.gov. 34072 IN A 199.173.231.82 dns2.ssa.gov. 34073 IN A 199.173.231.83 dns5.ssa.gov. 34073 IN A 137.200.4.30 dns6.ssa.gov. 34074 IN A 137.200.4.31 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Thu Feb 2 03:45:15 2012 ;; MSG SIZE rcvd: 165 psg.com:/usr/home/randy> dig +short @199.173.231.82 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> dig +short @199.173.231.83 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> dig +short @137.200.4.30 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> dig +short @137.200.4.31 www.ssa.gov. any www.socialsecurity.gov. CNAME 7 3 60 20120224201936 20120125195419 21905 ssa.gov. XSnBe3L3rTcD2FO778x43NOJaVf2OeMoSN8hBOSJFqfUfXAyH9qE5X1Q +tuRgigLs4qE7Fr40GI7SANxkltYdICJbEfvYikKMDW/hi8wp8mKHYQP SmXRGZz3ZizUaLb1DNTTWePIJDCrwEkZ5oVSEqoaV5xjDnWQ0twwILve I3Q= psg.com:/usr/home/randy> traceroute 199.173.231.82 traceroute to 199.173.231.82 (199.173.231.82), 64 hops max, 40 byte packets 1 r0.sea.rg.net (147.28.0.4) 0.314 ms 1.224 ms 0.202 ms 2 r1.sea.rg.net (147.28.0.5) 0.340 ms 0.306 ms 0.349 ms 3 sl-gw20-sea-3-2-1.sprintlink.net (144.232.9.61) 0.355 ms 0.305 ms 0.228 ms 4 144.232.3.126 (144.232.3.126) 0.352 ms 0.379 ms 0.353 ms 5 0.xe-11-3-0.BR2.SEA7.ALTER.NET (204.255.168.217) 14.365 ms 1.081 ms 1.075 ms 6 0.ge-2-3-0.XT2.SEA7.ALTER.NET (152.63.104.21) 1.097 ms 1.127 ms 1.082 ms 7 0.ge-1-2-0.XT2.DCA6.ALTER.NET (152.63.40.46) 73.575 ms 73.635 ms 73.528 ms 8 GigabitEthernet7-0-0.GW8.DCA6.ALTER.NET (152.63.40.81) 75.535 ms 75.595 ms 75.545 ms 9 ssa-gw.customer.alter.net (152.179.9.34) 76.652 ms 76.522 ms 76.671 ms 10 * *^C psg.com:/usr/home/randy> traceroute 137.200.4.30 traceroute to 137.200.4.30 (137.200.4.30), 64 hops max, 40 byte packets 1 r0.sea.rg.net (147.28.0.4) 0.378 ms 0.253 ms 0.332 ms 2 r1.sea.rg.net (147.28.0.5) 0.340 ms 0.394 ms 0.339 ms 3 sl-gw20-sea-3-2-1.sprintlink.net (144.232.9.61) 0.348 ms 0.263 ms 0.214 ms 4 144.232.3.126 (144.232.3.126) 66.830 ms 0.345 ms 0.323 ms 5 0.xe-11-3-0.BR2.SEA7.ALTER.NET (204.255.168.217) 0.977 ms 1.006 ms 1.100 ms 6 0.ge-2-3-0.XT2.SEA7.ALTER.NET (152.63.104.21) 26.587 ms 1.173 ms 1.086 ms 7 0.ge-7-0-0.XL2.RDU1.ALTER.NET (152.63.33.38) 86.052 ms 86.084 ms 86.024 ms 8 POS7-0.GW5.RDU1.ALTER.NET (152.63.35.177) 83.282 ms 83.371 ms 83.145 ms 9 157.130.212.98 (157.130.212.98) 85.254 ms 84.998 ms 85.170 ms 10 137.200.1.123 (137.200.1.123) 92.646 ms 92.727 ms 92.762 ms 11 *^C so they have a firewall, but i can get there. but from tokyo rair.psg.com:/Users/randy> dig +short @199.173.231.82 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> dig +short @199.173.231.83 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> dig +short @137.200.4.30 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> dig +short @137.200.4.31 www.ssa.gov. any ;; connection timed out; no servers could be reached rair.psg.com:/Users/randy> traceroute 199.173.231.82 traceroute to 199.173.231.82 (199.173.231.82), 64 hops max, 52 byte packets 1 192.168.0.1 (192.168.0.1) 5.528 ms 2.325 ms 2.504 ms 2 tokyo10-f01.flets.2iij.net (210.149.34.66) 6.912 ms 9.912 ms 11.519 ms 3 tokyo10-ntteast1.flets.2iij.net (210.149.34.113) 5.684 ms 5.820 ms 5.621 ms 4 tky001lip21.iij.net (210.149.34.101) 8.553 ms 6.054 ms 6.600 ms 5 tky001bb10.iij.net (58.138.100.217) 5.350 ms 5.412 ms 5.058 ms 6 tky001bf00.iij.net (58.138.80.1) 11.748 ms tky001bf01.iij.net (58.138.80.5) 5.268 ms 7.389 ms 7 sjc002bf01.iij.net (216.98.96.62) 104.972 ms sjc002bf02.iij.net (206.132.169.109) 106.686 ms sjc002bf01.iij.net (216.98.96.62) 105.618 ms 8 sjc002bb10.iij.net (206.132.169.2) 126.691 ms sjc002bb10.iij.net (206.132.169.6) 134.246 ms sjc002bb10.iij.net (206.132.169.10) 108.460 ms 9 gigabitethernet1-1.gw2.sjc7.alter.net (152.179.48.1) 110.772 ms 109.116 ms 114.488 ms 10 0.so-0-0-1.xl4.sjc7.alter.net (152.63.51.50) 102.308 ms 106.149 ms 109.410 ms 11 0.so-7-3-0.xt2.dca6.alter.net (152.63.0.245) 187.469 ms 183.993 ms 194.484 ms 12 gigabitethernet7-0-0.gw8.dca6.alter.net (152.63.40.81) 259.830 ms 234.873 ms 186.634 ms 13 * * * ^C rair.psg.com:/Users/randy> traceroute 137.200.4.30 traceroute to 137.200.4.30 (137.200.4.30), 64 hops max, 52 byte packets 1 192.168.0.1 (192.168.0.1) 10.197 ms 1.979 ms 4.218 ms 2 tokyo10-f01.flets.2iij.net (210.149.34.66) 9.268 ms 6.284 ms 6.184 ms 3 tokyo10-ntteast1.flets.2iij.net (210.149.34.113) 5.913 ms 10.127 ms 6.532 ms 4 tky001lip21.iij.net (210.149.34.101) 7.983 ms 6.036 ms 6.199 ms 5 tky001bb10.iij.net (58.138.100.217) 5.774 ms 21.691 ms 7.265 ms 6 tky001bf01.iij.net (58.138.80.5) 9.906 ms tky008bf00.iij.net (58.138.80.9) 8.371 ms tky001bf01.iij.net (58.138.80.5) 5.930 ms 7 sjc002bf00.iij.net (216.98.96.186) 117.184 ms 113.652 ms sjc002bf01.iij.net (216.98.96.62) 104.728 ms 8 sjc002bb10.iij.net (206.132.169.10) 114.864 ms sjc002bb10.iij.net (206.132.169.6) 111.701 ms sjc002bb10.iij.net (206.132.169.10) 142.274 ms 9 gigabitethernet1-1.gw2.sjc7.alter.net (152.179.48.1) 123.611 ms 115.159 ms 112.298 ms 10 0.so-0-0-1.xl4.sjc7.alter.net (152.63.51.50) 111.010 ms 104.429 ms 108.738 ms 11 0.so-1-2-0.xl2.rdu1.alter.net (152.63.27.38) 349.150 ms 209.448 ms 207.871 ms 12 pos7-0.gw5.rdu1.alter.net (152.63.35.177) 222.413 ms 208.135 ms 269.150 ms 13 * *^C and, i noticed the problem because i can not get to the web site at http://www.ssa.gov/ from tokyo. randy

6 6

Re: US DOJ victim letter
by Jay Hennigan 02 Feb '12

02 Feb '12

On 1/19/12 1:01 PM, Dave Ellis wrote: > I've also received the emails, I assumed they were fake as our normal > contacts haven't mentioned anything. The body of the email indeed reads like a poorly-executed phish including elements such as "null" and "<personalized code here>" but headers seem legit. -- Jay Hennigan - CCIE #7880 - Network Engineering - jay(a)impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV

25 30

Fwd: IPv6 RA-Guard: Advice on the implementation (feedback requested)
by Fernando Gont 02 Feb '12

02 Feb '12

Folks, Not sure if I had posted on this list about RA-Guard evasion issues. Anyway...nowadays most implementations remain vulnerable. If you care to get this fixed, please provide feedback about this I-D on the IETF *v6ops* mailing-list <v6ops(a)ietf.org>, and CC me if possible (please see below). Thanks! Best regards, Fernando -------- Original Message -------- Subject: RA-Guard: Advice on the implementation (feedback requested) Date: Wed, 01 Feb 2012 21:44:29 -0300 From: Fernando Gont <fgont(a)si6networks.com> Organization: SI6 Networks To: IPv6 Operations <v6ops(a)ietf.org> Folks, We have just published a revision of our I-D "Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard)" <http://tools.ietf.org/id/draft-gont-v6ops-ra-guard-implementation-01.txt>. In essence, this is the problem statement, and what this I-D is about: * RA-Guard is essential to have feature parity with IPv4. * Most (all?) existing RA-Guard implementations can be trivially evaded: if the attacker includes extension headers in his packets, the RA-Guard devices fail to identify the Router Advertisement messages. -- For instance, THC's "IPv6 attack suite" (<http://www.thc.org/thc-ipv6/>) contains tools that can evade RA-Guard as indicated. * The I-D discusses this problem, and provides advice on how to implement RA-Guard, such that the aforementioned vulnerabilities are eliminated, we have an effective RA-Guard device, and hence feature-parity with IPv4. We'd like feedback on this I-D, including high-level comments on whether you support the proposal in this I-D. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

AS8300 - Swisscom hijacking.. Just what are you testing?
by Schiller, Heather A 02 Feb '12

02 Feb '12

AS8300 started announcing one of the Rove Digital dns changer IP ranges. (The IP ranges the FBI is sending 'you are infected' letters about) Swisscom's announcement is less specific than the prefixes being announced by ISC during the remediation effort, so it's not impacting traffic... But AS8300 seems to announce less specifics a lot. Last fall they announced 63/8 and half of that is allocated to 701. AFAIK, we weren't notified they were going to announce a less specific of our space. As long as folks have pullup routes, and don't have an outage that withdraws their announcements, then Swisscom should only be getting darknet traffic. The record for AS8300 says 'Test' and the entry for it in CIDR report says "This AS is not currently used to announce prefixes in the global routing table, nor is it used as a visible transit AS." .. But their announcements certainly do show up in the global routing table, whether they are transiting for someone or not, they could get traffic for anything that doesn't have a more specific. Given the recent YAHT (yet another hijack thread) it's worth pointing out that hijacking more specifics is bad, but less specifics can be bad as well. (Not suggesting that is the case here..) I searched around and couldn't find any mention of what they might be testing. Anyone know? route-views>sh ip bgp 85.255.112.0/20 BGP routing table entry for 85.255.112.0/20, version 2177063753 Paths: (11 available, no best path) Not advertised to any peer 6079 3303 8300 (history entry) 207.172.6.20 from 207.172.6.20 (207.172.6.20) Origin IGP, metric 85, localpref 100, external Dampinfo: penalty 495, flapped 2 times in 00:24:37 3277 3267 174 3303 8300 (history entry) 194.85.102.33 from 194.85.102.33 (194.85.4.4) Origin IGP, localpref 100, external Community: 3277:3267 3277:65321 3277:65323 3277:65330 Dampinfo: penalty 501, flapped 2 times in 00:24:22 .... --Heather

5 5

Extra Westin reservation
by Patrick W. Gilmore 01 Feb '12

01 Feb '12

Apparently I accidentally made two hotel reservations for the Westin Gas Lamp. Made one, then thought I changed it, but just got confirmation I have two. I have until 6 PM to cancel. If you want it, ping me before 5 PM PST. -- TTFN, patrick

1 1

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)
by Hal Murray 01 Feb '12

01 Feb '12

>> Where is Milo Medin when we need him? > how would he be helping? He would have pulled the plug. The story is from the very early days of the internet, probably long before NANOG existed. Milo worked at NASA and found a cracker from Finland on one of NASAs machines. The link from Finland to the rest of the world went through Norway to NASA. (That's THE link, there was only one link connecting all of Scandinavia to the rest of the net.) So Milo called the guy in Finland and said "Please fix it". The reply was "We can't do anything. We respect civil liberties." Soon he got the message because he wasn't connected to the net any more. If anybody has a good URL for the story, please let me know. I found one reference in google-books that said 1988. ----- > AFAIK there's no law covering the use of what party X considers their 32 bit > numbers (assigned by party A) by party Y. Do contracts cover that? I'd expect that the paperwork for peer-peer, customer-ISP and ISP-backbone links would include some nice broad legalese about not doing nasty things. > Besides, how would that work? Say ARIN assigns US company X (operating only > in the US) a block, but German company Y (with no US operations) starts > announcing the same block. How are US or German laws going to help, when > the parties have no common jurisdiction? The law could be written to apply to the company bringing the bogus announcements across the US border. -- These are my opinions, not necessarily my employer's. I hate spam.

1 0

Console Server Recommendation
by Ray Soucy 01 Feb '12

01 Feb '12

What are people using for console servers these days? We've historically used retired routers with ASYNC ports, but it's time for an upgrade. OpenGear seems to have some nice stuff, anyone else? -- Ray Soucy Epic Communications Specialist Phone: +1 (207) 561-3526 Networkmaine, a Unit of the University of Maine System http://www.networkmaine.net/

26 35

ATT, IPv6 and 6RD
by Bill Merriam 01 Feb '12

01 Feb '12

I now have ATT IPv6 over their residential ADSL broadband. They deployed using 6RD which means every time your IPv4 address changes your IPv6 address changes also. Does anybody have a clue why they chose to use 6RD instead of the much more fully-assed TR-187 for their deployment? Saying they're dimwits doesn't count. Bill

2 1

Fiber outage in Miami
by Jimmy Changa 01 Feb '12

01 Feb '12

Was anyone impacted by a botched fiber move in Miami this weekend? I lost 2 pieces of dark fiber for over almost 24 hours due to a fiber move being performed by FiberLight. I'm curious if anyone else was impacted. Sent from mobile device

6 12

Re: [#135346] Unauthorized BGP Announcements (follow up to Hijacked Networks)
by Hal Murray 01 Feb '12

01 Feb '12

I'm not a lawyer nor an operator. > Imagine that instead of www.google.com, it was www.whitehouse.gov > At some point, I suspect that this gets service to get it fixed RIGHT NOW. > At some point, the guys informing you it's RIGHT NOW show up with badges. Where is Milo Medin when we need him? > The question is, when is it badges? It can be construed as a denial of > service attack on the addresses' rightful owners. They will respond to any > major government site being hijacked. Probably to Apple or Google. Likely > to a Tier-1 ISPs internal infrastructure. How long should it take to fix a problem like this? Why didn't one of the players upstream from the bad guy pull their plug or drop the bogus announcement? Why didn't any of the players between the first upstream and the tier 1s apply pressure? Do existing contracts cover this case? If not, what needs to be fixed? Is a RFC needed so the lawyers have something to reference? Would a session to discuss this at a NANOG gathering help? > a) law enforcement doesn't understand the problem. and b) the law moves > very slowly. It might be a good idea to make sure that somebody in law enforcement does understands what happened here so they can think about what who needs to do what the next time something like this happens. (Make sure that operators know how to get in touch with somebody who knows.) -- These are my opinions, not necessarily my employer's. I hate spam.

2 1