June 2012 - Test - lists.nanog.org

RE: EBAY and AMAZON
by Hal Murray 14 Jun '12

14 Jun '12

[Snip good collection of security setting suggestions. Does anybody have others or a URL?] > I could never quite understand how anyone could get "phished" by e-mail > since I have never ever seen a "phishing" or other malicious message that > was not obviously so, even when I don't have me spectacles on! Your imagination needs serious recalibration. You are a geek, not a naive, dumb, or unfortunately, typical user. Windows security sucks. Most users will pick convenience over security. What fraction of users (customers) would be happy with your suggested settings? Phishers are smart. They are willing to work for high value targets. Google for >spear phishing<. After you have read a few of those, google for > spear phishing RSA<. >From the comments section of an Arstechnica article on the RSA event: >> So why do any workplace computers in sensitive environments >> have Flash in the first place? > Because the training materials are no doubt flash based. :) If you are interested in security, the whole comments section may be worth scanning. My probably naive view is that this type of problem could easily be solved by having the serious work done on a special class of well locked down machines and making a pool of more open systems available for checking mail or facebook or whatever. I've heard stories of people filling USB slots with epoxy so idiots can't insert thumb drives found in the parking lot or brought from home. I forget the context. -- These are my opinions. I hate spam.

13 15

Patch Management - Windows & RHEL/CentOS based on Date
by Wade Peacock 14 Jun '12

14 Jun '12

Hi All, Does anyone know of a patch management system that will allow us to control the roll out of patches, specifically for Windows but Linux would be nice too, that can use a date to limit whether a patch is rolled out. Ie. Patch to date set to 2012-06-10 So all patches released up to 2012-06-10 will be offer to requesting client. Any patches released after 2012-06-10 will be hidden/not offered until the "Patch to Date" is moved forward. Wade Peacock Production IT | Vision Critical direct 604.629.9358 mobile 604.363.8137 www.visioncritical.com<http://www.visioncritical.com/> New York | London | Vancouver | Paris | Sydney | Chicago | San Francisco | Toronto | Montreal | Calgary

5 4

Re: Article: IPv6 host scanning attacks
by Fernando Gont 13 Jun '12

13 Jun '12

On 06/13/2012 03:37 PM, Dave Hart wrote: >>> "published" and "available" are misleading at best. >> >> It is not. Just scroll down the page, and you'll find the whole article. >> -- it was easy to talk crap than to do that, right? > > Yes, I'm an idiot for believing what I read on that site: > > "Requires Free Membership to View" > > Of course I should have expected that means "scroll past me and the > page of whitespace to view." I wouldn't "announce" the publication of an article that implies the hassle of a registration in order to read it. While it's certainly not "as good as it can get" to have a banner saying "require free membership to view" inserted in the middle of the article body, it's still "acceptable" for me. (Since you're not the first one to think that the article was not free, next time I'll probably make this explicit such that possible trouble is avoided]). >> I find it amazing the number of people that will talk crap when one >> publishes something when compared to the number of people that provides >> technical comments or criticism (even if it's "you're completely wrong >> because of this and that). > > The draft and the article raise valid points about the predictability > of widely-used MAC-derived IIDs, but it does not in any way justify > the headline "Analysis: Vast IPv6 address space actually enables IPv6 > attacks." Whomever wrote that should share their stash. FWIW, the headline was replaced prior to publication. Put another way: I agree with your comment regarding the headline. Cheers, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Flame virus
by Grant Ridder 13 Jun '12

13 Jun '12

Hi Everyone, I realize this is not directly network related, but i thought i would pass the article along anyways. The authors of the Flame virus have started to destroy its existence. http://spectrum.ieee.org/riskfactor/telecom/security/flame-ordered-to-flame… -Grant

1 0

Heads-up: spammer Scott Whittle/iptechlabs.com/iptechnologylabs.com hitting addresses harvested from NANOG list
by Rich Kulawiec 13 Jun '12

13 Jun '12

Spammer Scott Whittle has harvested not only email addresses from the NANOG list archives, but also Message-IDs, and is busily trying to abuse the hell out of them. I've seen 6 (edit: 11) (edit: 14) copies so far this morning, and no doubt more are on the way. He identifies himself thusly: IP Technology Labs Network Communications Simplified Scott Whittle | President | T: +1 301 570 6611 x601 | M/SMS: +1 301 339 3237 | E: scott(a)IpTechnologyLabs.com | W: http://iptechnologylabs.com Although the spam itself carries a return address of Return-Path: <scott.whittle(a)iptechlabs.com> So blocking on the latter should suffice, at least for this round. ---rsk p.s. Pro tip: proofread your spam content before sending: "I am looking contact your Product Manager/Sales Manager regarding possible distribution of our USA made and designed Plug-and-Play VPN products. We are the are a channel friendly company, can offer account protection, and ensure your margins."

4 4

Whither Cometh BCP38?
by Jay Ashworth 13 Jun '12

13 Jun '12

Off a comment Vix made in another thread this weekend, what is the current status, to the degree to which anyone knows and is permitted to say, of the deployment of RFC 3704, BCP 38, to block IP address spoofing at the ingress edge of large consumer eyeball networks? When the BCP was first release, as I recall it, much noise was made to suggest that it was cost-ineffective and impractical to deploy it because the current state of edge devices was such that it wasn't a simple knob-turn. Is that still true (or not, as I expect), and if common edge concentrators do now support easy filtering to drop packets with improper or invalid source addresses, is this being utilized in the wide area... and if not, why the hell not? Or are spoofed-source-address attacks not, as Vix suggests, significant and trending upwards? Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

6 7

Heads up: IETF 6man poll for adoption of RA-Guard/firewalling/monitoring-related I-Ds
by Fernando Gont 13 Jun '12

13 Jun '12

Folks, Just wanted to send a heads up regarding two IETF 6man wg polls that have just been started for adoption of these documents: * draft-gont-6man-oversized-header-chain-02 (Security and Interoperability Implications of Oversized IPv6 Header Chains) * draft-gont-6man-nd-extension-headers-03 (Security Implications of the Use of IPv6 Extension Headers with IPv6 Neighbor Discovery) draft-gont-6man-oversized-header-chain-02 requires that when packets are fragmented, the first fragment must contain the entire IPv6 header chain. This is important for a number of reasons: it allows for stateless filtering (both at firewalls and at RA-Guard-like devices), prevents stateless translators from breaking, etc. The poll for this document is available at: <http://www.ietf.org/mail-archive/web/ipv6/current/msg15989.html> draft-gont-6man-nd-extension-headers-03 forbids the use of fragmentation with Neighbor Discovery. This essentially enables Neighbor Discovery monitoring in IPv6, thus providing feature parity with IPv4 (think about arpwatch and the like) -- not to mention that it obviously mitigates fragmentation-based attacks against Neighbor Discovery and SEND. The poll for this document is available at: <http://www.ietf.org/mail-archive/web/ipv6/current/msg15990.html> IMO, these two I-Ds propose small spec updates which could result in concrete operational and security benefits. Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

1 0

Re: vulnerability and popularity (was: EBAY and AMAZON)
by Astro Dog 13 Jun '12

13 Jun '12

----- Original Message ----- From: Andrew Sullivan Sent: 06/13/12 07:33 AM To: nanog(a)nanog.org Subject: vulnerability and popularity (was: EBAY and AMAZON) On Wed, Jun 13, 2012 at 07:55:37AM -0400, Rich Kulawiec wrote: > If popularity were the measure of relative OS security, then we would > expect to see infection rates proportional to deployment rates I don't buy that premise, or at least not without reservation. The OS market happens to be a superstar economy. On desktops and laptops, which still happen to be the majority of devices, the overwhelming winner is Windows. Therefore, if you are going to invest in any product for which you want ubiquitous deployment, Windows is the first platform you aim for. You only aim for the others if you're chasing a niche. There is no reason whatever to chase a niche market if your goal is spewing spam, collecting credit cards, or whatever. Perhaps fortunately, we're about to have an empirical trial of these different possibilities. If the above analysis is correct, then we should expect malware targetting iOS and Android in about equal proportions as those sorts of devices displace laptops and desktops as the majority (though there will be some bias and therefore lag in favour of Windows just because of the fact that people already have tools and techniques built around Windows). If you're right that the primary issue is the fundamental security of the target, then perhaps we will not see that pattern emerge. Best, A -- Andrew Sullivan Dyn Labs asullivan(a)dyn.com I'm not sure the iOS/Android situation provides a great emperical test, either. Where a duality exists... (or something aproximating one), the security situation may play a massive role in determining what platforms malware authors target, whereas when one platform has a massive majority, the security environment likely plays a very small role in what platforms will be targeted. An added issue is the difference in how people use mobile devices versus their "stuck to desk" counterparts. They may have less useful information or behave in ways that are easier to exploit when using a mobile device than they would on their PCs. Interestingly, from the persective of a malware author, the user-level isolation provided by the *nix variants may make much less of a difference than one might expect. Presumably, they're interested in either stealing information, or sending spam. Neither one of these activities requires administrative access. Presumably *most* users, on Windows or Linux conduct the majority of their online transactions from a single account. An exploit that gives them control of that user account is just as damaging, in as far as short term stealing your information (or opening network sockets) is concerned, as gaining root or administrative access. Considering that, combined with the fact that it's rarely Windows itself being exploited, but the applications and plugins themselves, it seems more likely that a change in dominant platform would be more likely to result in multi-platform payloads. The basic targets would probably still be the browsers, plugins, etc, which would presumably exist on most/all of the platforms involved. That being said, I've rarely seen a *nix machine trashed by malware or exploits to quite the same degree as Windows hosts. --- Harrison

1 0

XO/DTAG Contact?
by Tim Durack 13 Jun '12

13 Jun '12

Looking for a technical contact within XO and/or DTAG, preferably one who can interpret a traceroute accurately :-) Please hit me up offline. Thanks, -- Tim:>

1 0

[NANOG-announce] Board Member Replacement Process - close June 20 23:59 PDT
by Sylvie LaPerriere 13 Jun '12

13 Jun '12

*Colleagues, If you are interested in the board replacement position please read on, if not, you may stop now. Following our announcement, many of you are pinging me to serve as the replacement on the Board. Your interest in our organization is amazing and truly encouraging! The process for Board replacement is laid out in our bylaws in Section 8.7. and the intent is to keep a functioning Board running until the next elections. Per our presentation at the NANOG 55 Community meeting we have a full list of deliverables until then. So basically the replacement position is 5-8 hours/week of volunteering inclusive of regular board meetings. 8.7 Vacancies If a Board of Directors member resigns or a Board of Directors seat otherwise becomes vacant more than two months before the next election, the remaining members of the Board of Directors will appoint a replacement to serve until the next election, at which point if there is any additional time remaining in the term a member will be elected to fill the vacancy. If a vacancy occurs less than two months before an election, the seat will remain vacant until the election As we are more than 2 months away from our next elections, the Board has to appoint a replacement (a member in good standing) for the interim. The replacement will serve on the Board until the next election only. Continuance on the Board will be dependent on being properly elected next October, per our election process described in Section 8. Board of Directors. Who are we looking for? * *The short answer is ‘a good election candidate (per the below)’ plus ‘a high degree of familiarity with NANOG’. A good candidate will have experience with Internet engineering, operations, and governance organizations as well as the principles and practices which guide them. A strong candidate should have experience with NANOG through meeting attendance, meeting presentations, serving on a committee, and have been an active member of the NANOG mailing list for a minimum of 3 years. Consensus organizing, leadership, outreach and communication skills are prized, and a willingness to be engaged in the governance process is required. A board member (committee liaisons) is expected to volunteer 5 hours per week while a board officer (Chair, vice-chair, treasurer, secretary) is expected to volunteer 5-8 hours per week, all year round. How do you apply? We are reaching out to members and if you want to be a candidate for this replacement with a term of about 3 months, please write to board(a)newnog.orgbefore June 20 23:59 PDT and state your name, your affiliation and describe your readiness, your ability (check with your employer if you can afford the time!) and motivation to serve for this interim. You will have to demonstrate familiarity with our activities and be available to attend our bi-weekly Board meetings held Fridays from 14:00-15:00 EDT from June 22 to September 28. (sorry, we cannot move the time to suit your schedule - you are jumping on a cruising ship.) How is the selection made? The Board will review the candidacies and appoint. Decision will be final and announced on June 22 to nanog-announce(a)nanog.org. There is more than the replacement position. Bear in mind that the election process will be initiated in early August when we will have 3 vacant board positions to fill. Check http://www.nanog.org/governance/elections/ late July and we will communicate the elections process via nanog-announce(a)nanog.org. We trust this answers your questions about the replacement and thank you for your consideration and interest for NANOG. Sylvie* -- Sylvie LaPerriere NANOG Chair - www.nanog.org _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0