September 2013 - Test - lists.nanog.org

Internet Surveillance and Boomerang Routing: A Call for Canadian Network Sovereignty
by Paul Ferguson 09 Sep '13

09 Sep '13

A Canadian ISP colleague of mine suggested that the NANOG constituency might be interested in this, given some recent 'revelations', so I forward it here for you perusal. "Preliminary analysis of more than 25,000 traceroutes reveals a phenomenon we call ‘boomerang routing’ whereby Canadian-to-Canadian internet transmissions are routinely routed through the United States. Canadian originated transmissions that travel to a Canadian destination via a U.S. switching centre or carrier are subject to U.S. law - including the USA Patriot Act and FISAA. As a result, these transmissions expose Canadians to potential U.S. surveillance activities – a violation of Canadian network sovereignty." http://lawprofessors.typepad.com/media_law_prof_blog/2013/09/routing-intern… Cheers, - ferg -- Paul Ferguson Vice President, Threat Intelligence Internet Identity, Tacoma, Washington USA IID --> "Connect and Collaborate" --> www.internetidentity.com

13 14

US and UK spy agencies defeat privacy and security on the internet
by Warren Bailey 09 Sep '13

09 Sep '13

Anyone else see this coming? US and UK spy agencies defeat privacy and security on the internet http://gu.com/p/3thvv Sent from my Mobile Device.

3 2

Yahoo is now recycling handles
by Jay Ashworth 09 Sep '13

09 Sep '13

Whackiness, predictably, ensues: https://medium.com/editors-picks/46b47d95b957 You can do the math how this might affect you, your services, and your users, if you have those. Will people *ever* start listening when we tell them how Bad an Idea something is? The RISKS are endless... Cheers, -- jra -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA #natog +1 727 647 1274

23 35

One block of AS Numbers allocated to the RIPE NCC
by Leo Vegoda 09 Sep '13

09 Sep '13

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of one block of 1,024 AS Numbers to the RIPE NCC in September 2013: 61952-62463 Assigned by RIPE NCC whois.ripe.net 2013-09-09 199680-200191 Assigned by RIPE NCC whois.ripe.net 2013-09-09 You can find the IANA AS Numbers registry at: http://www.iana.org/assignments/as-numbers/ Regards, Leo Vegoda ICANN IANA

1 0

Is the FBI's DNSSEC broken?
by John Levine 09 Sep '13

09 Sep '13

I don't claim to be a big DNSSEC expert, but this looks just plain wrong to me, and unbound agrees, turning it into a SERVFAIL. Here's a lookup that succeeds, an A record for mail.ic.fbi.gov: $ dig @ns1.fbi.gov mail.ic.fbi.gov a +dnssec ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7222 ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 7, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 65235 ;; QUESTION SECTION: ;mail.ic.fbi.gov. IN A ;; ANSWER SECTION: mail.ic.fbi.gov. 600 IN A 153.31.119.142 mail.ic.fbi.gov. 600 IN RRSIG A 7 4 600 20131124123847 20130826123847 32497 fbi.gov. dYs+1bPdO+8y3T5ij8qSn0BvTDv7X51wi++HV681rKzlK5SLKrZiGryV ow67iO30CWwztI3d5oCF7/6bEn3NetWq9IajeM19aorIdJMA6tAp1BQI EZMTcCsnInSIn2IRb3V2MXXOBx6r6wMt7ptNfp/Tro89h2K7q+Pgp0O2 WdU= ;; AUTHORITY SECTION: fbi.gov. 600 IN NS ns3.fbi.gov. fbi.gov. 600 IN NS ns5.fbi.gov. fbi.gov. 600 IN NS ns4.fbi.gov. fbi.gov. 600 IN NS ns2.fbi.gov. fbi.gov. 600 IN NS ns1.fbi.gov. fbi.gov. 600 IN NS ns6.fbi.gov. fbi.gov. 600 IN RRSIG NS 7 2 600 20131124123847 20130826123847 32497 fbi.gov. l/AcT+Pmr/5yosWyvP3zbFIJE7f07F+AA8eh1X3qv8ulw9FbC0DhZfSo 1f5ctD6DIb613ButzKG01PdMzIknMroraOyGyRcAq27qYXzKRE0cTqhv UWz15jLa7N7YKYccR8Hmt6GY1DJitY41EwQP7Z2Fpac9yPTRnybc4mTS 4eY= Here's a query for the same name, but for AAAA which it doesn't have: $ dig @ns1.fbi.gov mail.ic.fbi.gov aaaa +dnssec ; <<>> DiG 9.8.3-P4 <<>> @ns1.fbi.gov mail.ic.fbi.gov aaaa +dnssec ; (2 servers found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41056 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags: do; udp: 65235 ;; QUESTION SECTION: ;mail.ic.fbi.gov. IN AAAA ;; AUTHORITY SECTION: fbi.gov. 600 IN SOA ns1.fbi.gov. dns-admin.fbi.gov. 2013082601 7200 3600 2592000 43200 95RIPFTKTJC9I7J8HDAIA7CM6L279FSR.fbi.gov. 43200 IN NSEC3 1 0 10 BBAB 97S2G907NEFOJ79P721E4FEQ9LR3IT1S A RRSIG fbi.gov. 600 IN RRSIG SOA 7 2 600 20131124123847 20130826123847 32497 fbi.gov. QgsdhUT7AHic8tJv39br+994eoyJ4c8/SuQr35dRudceE/bYyZV26IPI 4qnR8Cy35WoepW12bhhhY0Ug26Qy81KWcWHYPw0Wa7g5Ig8Pw27l8gCV J7NDY6O5jTb4MMc9THTPKEvXjeX/YE4060HrbJXo1U93qhdILkGTvno7 3hA= Shouldn't there be some more stuff there in the authority section, like an NSEC3 and RRSIG for mail.ic.fbi.gov? Am I missing something, or is it broken? The server says it's from Ultradns. R's, John

4 7

Re: AlbertaIX - no longer a Cybera project?
by Theo de Raadt 09 Sep '13

09 Sep '13

Mike Leber wrote: > Facility and parties willing, hopefully there will be a YYCIX switch in > Cybera. Interesting idea, how the heck did I miss that. It would depend on Cybera being open to the idea, which starts off with a reevaluation of the following "not-for-profit acting as an ISP of last resort" strategy: http://www.cybera.ca/strategic-projects/internet-buying-group http://www.cybera.ca/strategic-projects/peering/ http://www.cybera.ca/membership/membership-structure/ In Canada, the other collision preventing exchanges from showing up is the CANARIE content peering model, which by providing free content access to schools and such takes many (young bandwidth hungry) eyeballs out of the equation for IX development and growth: http://www.canarie.ca/en/cds/policy http://www.canarie.ca/en/cds/cds_content_providers Time for change?

2 1

Re: [cryptography] New NSA Slides and Details Released last night via Fantastico (BR)
by Eugen Leitl 09 Sep '13

09 Sep '13

"Based on this slide, it appears that the bandwidth providers are dumping the traffic at core routers directly to the NSA." ----- Forwarded message from David D <david(a)7tele.com> ----- Date: Mon, 9 Sep 2013 12:56:17 +0200 From: David D <david(a)7tele.com> To: 'Crypto discussion list' <cryptography(a)randombit.net> Subject: Re: [cryptography] New NSA Slides and Details Released last night via Fantastico (BR) X-Mailer: Microsoft Office Outlook 12.0 http://g1.globo.com/fantastico/noticia/2013/09/nsa-documents-show-united-sta tes-spied-brazilian-oil-giant.html No millisecond counter: 1:49 US-983 Stormbrew - Fiber connections 1:49 US-983 Stormbrew - "KEY CORPORATE PARTNER WITH ACCESS TO INTERNATIONAL CABLES, ROUTERS, AND SWITCHES". (# traceroute google.com) 2:07 - "QUERY BY CERTIFICATE META DATA" 2:07 - "Private keys of Diginotar stolen by hacker" FLYING PIG ... Launch a MITM attack. 2:08 - mail.ru and server IP: 94.100.104.14 This site has broken out some of the screenshots from the video: http://leaksource.wordpress.com/2013/09/09/economic-espionage-nsa-spies-on-b razil-oil-giant-petrobras/ "How the attack was done:" image is most interesting. http://leaksource.files.wordpress.com/2013/09/nsa-brazil-5.png Based on this slide, it appears that the bandwidth providers are dumping the traffic at core routers directly to the NSA. -----Original Message----- From: cryptography [mailto:cryptography-bounces@randombit.net] On Behalf Of David D Sent: Monday, September 09, 2013 12:07 PM To: 'Crypto discussion list' Subject: Re: [cryptography] New NSA Slides and Details Released last night via Fantastico (BR) Lots of gems in this video: http://g1.globo.com/fantastico/noticia/2013/09/nsa-documents-show-united-sta tes-spied-brazilian-oil-giant.html _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN"
by Eugen Leitl 09 Sep '13

09 Sep '13

----- Forwarded message from Gregory Perry <Gregory.Perry(a)govirtual.tv> ----- Date: Sat, 7 Sep 2013 21:14:47 +0000 From: Gregory Perry <Gregory.Perry(a)govirtual.tv> To: Phillip Hallam-Baker <hallam(a)gmail.com> Cc: "cryptography(a)metzdowd.com" <cryptography(a)metzdowd.com>, ianG <iang(a)iang.org> Subject: Re: [Cryptography] Opening Discussion: Speculation on "BULLRUN" On 09/07/2013 05:03 PM, Phillip Hallam-Baker wrote: Good theory only the CA industry tried very hard to deploy and was prevented from doing so because Randy Bush abused his position as DNSEXT chair to prevent modification of the spec to meet the deployment requirements in .com. DNSSEC would have deployed in 2003 with the DNS ATLAS upgrade had the IETF followed the clear consensus of the DNSEXT working group and approved the OPT-IN proposal. The code was written and ready to deploy. I told the IESG and the IAB that the VeriSign position was no bluff and that if OPT-IN did not get approved there would be no deployment in .com. A business is not going to spend $100million on deployment of a feature that has no proven market demand when the same job can be done for $5 million with only minor changes. And this is exactly why there is no real security on the Internet. Because the IETF and standards committees and working groups are all in reality political fiefdoms and technological monopolies aimed at lining the pockets of a select few companies deemed "worthy" of authenticating user documentation for purposes of establishing online credibility. There is no reason for any of this, and I would once again cite to Bitcoin as an example of how an entire secure online currency standard can be created and maintained in a decentralized fashion without the need for complex hierarchies of quasi-political commercial interests. Encrypting SMTP is trivial, it's all about the standard to make it happen. Encrypting IPv6 was initially a mandatory part of the spec, but then it somehow became discretionary. The nuts and bolts of strong crypto have been around for decades, but the IETF and related standards "powers to be" are more interested in creating a global police state than guaranteeing some semblance of confidential and privacy for Internet users. _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

4 3

Google support contact
by s 09 Sep '13

09 Sep '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 can someone from the Google support team please contact me off list -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (MingW32) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJSLSqeAAoJEENc8MKW+7m4xXsH/2jfHIEDJ3kKZvbkSQp2mE3s VcPm/l8qmQ89Olmu8kNmGPcBbnjn/EIu42OnuE3GHwsgyJ06KM5aiacL8X2YAVSn EmJXZvfWQMQqpWV+yaadbRr3EwEkGnh0T/dYx2edpY5M9ggltTdUjVzgHRwSmeH1 9/WheIY/rnzxDh5wFascJi+sPuHr9sga4M4jGsX6+uA/wVh9bwk3kDoyb71MXG9R UzaDnq3/AL5bS4pOt6Skl67f6NK0gwEx93Jbtgei7OpKWb9NKI/qL+vcRvlaEWp9 cIdofWBMF2eQG7nt2d1Nsl/vwG4bkBrAdFJyxIlDHs/ykkNXoGaMR/hxixFA0Q0= =5C5x -----END PGP SIGNATURE-----

1 0

Re: Internet Surveillance and Boomerang Routing: A Call for Canadian Network Sovereignty
by Paul Ferguson 08 Sep '13

08 Sep '13

Actually Roland is right when he says: > If folks are unhappy with the current state of affairs, they ought to concentrate on writing laws, not code. Randy is being his usual self and playing devils advocate, which is fine, but doesn't move the ball (or is simply self-serving). In any event, we *all* need to raise our game, because we are not as clever as we think we are. - ferg On 9/8/2013 1:12 AM, Dobbins, Roland wrote: > On Sep 8, 2013, at 2:58 PM, Randy Bush wrote: > >> >cool. then i presume you will continue to run using rc4 and rsa 1024. > The point is that no matter what crypto algorithms are developed and implemented, it's generally trivial for authorized (for whatever value of 'authorized' applies in a given situation) entities to obviate them by simply compromising the endpoints under color of law, if nothing else. > > If folks are unhappy with the current state of affairs, they ought to concentrate on writing laws, not code. -- Paul Ferguson Vice President, Threat Intelligence Internet Identity, Tacoma, Washington USA IID --> "Connect and Collaborate" --> www.internetidentity.com

1 0