April 2014 - Test - lists.nanog.org

responding to DMARC breakage
by Miles Fidelman 13 Apr '14

13 Apr '14

Hi Folks, It occurs to me that Yahoo's deployment of DMARC p=reject, and the choice of several big mail operators to honor that, has created a situation not unlike a really routing table or nameserver, snafu --- someone's published information that's caused lots of things to break. At an operational level, this comes down to Yahoo publishing a DMARC record into their nameservers containing "p=reject." As a result, Yahoo, and several other very large mail systems, are bouncing huge amounts of mail. We see, and react to, routing and nameserver snafus all the time. The response is usually an immediate, cooperative response to fix the problem as quickly as possible. Sometimes an operational problem uncovers a software bug, or vulnerability, or a protocol failure mode - which triggers various responses (CERT alert, software patches, protocol revisions via the IETF). Running a mail system and providing some hosting and list services, most of the operational issues I've run into involve nameserver corruption, over-aggressive spam blockers (and, of course, ongoing barrages of spam and persistent cracking threats). In most cases, problems are easy to resolve, and all involved are cooeprative (if sometimes slow). About the closest analogy I've encountered, to the current situation, are the more aggressive of the anti-spam blocklists (remember when someone would an entire subnet, with intent, when one host on that subnet generated some spam, or the operators who would extort payment for "expedited removal?"). By and large, market pressure has largely driven the worst actors into oblivion - but there don't seem to be any measures, with teeth, for dealing with bad actors. It strikes me that this situation is analogous: - several very big players have put a protocol into production that is, charitably, immature (DMARC is an informational internet-draft, not even an RFC, much less a standards-track RFC - and its backers have pretty much ignored any input from mailing list operators) - Yahoo published a dns record that triggers a protocol mode that results in huge amounts of mail bounces and operational disruption. - Yahoo (operationally) and the DMARC authors are intentionally un-responsive (as are hotmail, comcast, a few others; gmail, I note is not bouncing mail) How do we respond as operators, beyond late-night, ad-hoc patches to list software, that only partially resolve the problem? What kind of responses are available? In the broader scope of things, what kinds of responses are typical if someone publishes corrupted information and then doesn't cooperate in fixing the situation - be that through obliviousness, incompetence, lack of resources, laziness, or active intent (criminal or not)? Miles Fidelman -- In theory, there is no difference between theory and practice. In practice, there is. .... Yogi Berra

8 13

spamassassin hole again?
by Randy Bush 13 Apr '14

13 Apr '14

massive porn spam is making it through spamassassin. new filter oops? randy, still researching

5 5

Heartbleed Bug Found in Cisco Routers, Juniper Gear
by Glen Kent 12 Apr '14

12 Apr '14

http://online.wsj.com/news/articles/SB1000142405270230387360457949396384785… Glen

5 5

Kit to split a 19" closet?
by Hank Nussbacher 12 Apr '14

12 Apr '14

Suppose you have an existing server closet. You want to split it so that two different organizations can have access to it. Separate doors and a divider in the middle. Does anyone make kit for this for hosting centers? Thanks, Hank

3 2

DNSSEC?
by Barry Shein 12 Apr '14

12 Apr '14

12 15

Fwd: [IP] Summary of what I know so far about the Linksys botnet and/or worm
by Joly MacFie 12 Apr '14

12 Apr '14

Any comments? ---------- Forwarded message ---------- From: Dave Farber <dave(a)farber.net> Date: Fri, Apr 11, 2014 at 8:13 PM Subject: [IP] Summary of what I know so far about the Linksys botnet and/or worm To: ip <ip(a)listbox.com> ---------- Forwarded message ---------- From: *Brett Glass* <brett(a)lariat.net> Date: Wednesday, February 12, 2014 Subject: Summary of what I know so far about the Linksys botnet and/or worm To: "Eugene H. Spafford" <spaf(a)acm.org>, "dave(a)farber.net" <dave(a)farber.net> Cc: security(a)linksys.com Gene, Dave: Here is what I know so far about the Linksys router exploit that I've been observing in the wild today. * The exploit has affected Linksys E1000 and E1200 routers that have public IP addresses on our network. Those which we've shielded behind carrier-grade NAT (the majority) have not been compromised. * The routers are rapidly scanning blocks of IP addresses for Web servers on ports 80 and 8080. This choice of ports seems to indicate that they are looking for other routers of their ilk to infect. It's unclear whether, once they find a vulnerable router, they infect it themselves or report its IP address back to a botmaster for later infection. I suspect the latter, though, because infection would require flashing the router with a modified firmware image that would be model-specific and there is not room in a router for multiple images. It's also likely that a central server is coordinating the scans. * All of the E1000s that have been affected have the last version of firmware that was made for this now-discontinued model. The affected E1200s have firmware version 1.0.03 (the last one published for hardware version 1) or 2.0.04 (not the latest for hardware version 2, but close; there's now a 2.0.06. I do not know if 2.0.06 stops the exploit because we have no E1200s running it with public IPs). We have not seen any E900s infected, even though the E900 and the E1200 use the same hardware. * None of the infected routers had default or easily guessable passwords, suggesting that the backdoor or security hole through which the exploit was performed did not require guessing a password. * Re-flashing routers and resetting them to factory defaults SEEMS to clear the malware, but of course one cannot be 100% sure that it does not protect itself from re-flashing. * These routers use Broadcom chipsets and Wind River's RTOS operating system, and it wasn't swapped for a Linux-based one, so the creators of the malware must be skilled in development for this OS -- or at least sufficiently skilled to modify the firmware. At this point, it appears that those who implemented this exploit is still building an "army" and has not used it for anything yet. However, there are so many millions of these routers in the field, with so many private networks behind them, that there's no telling just how much havoc they could wreak if they were set to invasion of privacy, DoS attacks, etc. I haven't been able to get in touch with anyone at Linksys to talk about this. Their support techs are all in remote call centers in far-flung corners of the world, and I have not been able to get them to escalate. --Brett Glass Archives <https://www.listbox.com/member/archive/247/=now> <https://www.listbox.com/member/archive/rss/247/125534-14f1b966> | Modify<https://www.listbox.com/member/?member_id=125534&id_secret=125534-f26397ec>Your Subscription | Unsubscribe Now<https://www.listbox.com/unsubscribe/?member_id=125534&id_secret=125534-8937…> <http://www.listbox.com> -- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- -

2 1

Heartbleed operational details
by Larry Sheldon 12 Apr '14

12 Apr '14

FWIIW http://xkcd.com/1354/ -- Requiescas in pace o email Two identifying characteristics of System Administrators: Ex turpi causa non oritur actio Infallibility, and the ability to learn from their mistakes. (Adapted from Stephen Pinker)

1 0

Severe latency at both San Jose and Los Angeles Level3/AT&T peering
by David Sotnick 12 Apr '14

12 Apr '14

Hi Nanog, I have a ticket open with Level 3, with whom I have 1gig pipes in Oakland, CA and Las Vegas, NV. One of our users noticed very slow file transfer/media delivery from the Bay Area to L.A., and on investigating it appears as though the peering point between Level3 and AT&T in SF was saturated and had 300ms avg. latency. 90 minutes later after receiving no call from Level3, I escalated to a P1 ticket, as the latency is now > 1000ms and we're seeing 20% packet loss. I decided to statically route to the destination via our DR cluster in Vegas, and interestingly I found the same situation where AT&T and Level3 peer in Tustin. mtr traceroutes, for those curious: Via Oakland: My traceroute [v0.71] hivemind (0.0.0.0) Fri Apr 11 15:36:08 2014 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Last Avg Best Wrst StDev 1. 138.72.xxx.xxx 0.0% 0.3 0.2 0.1 0.3 0.1 2. pan5060-ae1-401.routerland.pixar.com 0.0% 0.4 0.4 0.4 0.5 0.0 3. verge-vlan66.pixar.com 0.0% 0.6 0.7 0.6 0.9 0.1 4. ge-6-24.car1.Oakland1.Level3.net 0.0% 0.7 105.5 0.7 307.3 110.9 5. ae-5-5.ebr2.SanJose1.Level3.net 0.0% 1.7 1.7 1.6 2.8 0.4 6. ae-92-92.csw4.SanJose1.Level3.net 0.0% 1.6 1.7 1.6 3.0 0.4 7. ae-4-90.edge2.SanJose1.Level3.net 0.0% 1.6 4.6 1.6 37.1 10.2 8. 192.205.32.209 41.7% 1042. 1048. 1038. 1059. 9.1 9. cr1.sffca.ip.att.net 25.0% 1052. 1059. 1046. 1072. 10.0 10. cr1.la2ca.ip.att.net 27.3% 1043. 1060. 1043. 1071. 10.7 11. cr83.la2ca.ip.att.net 16.7% 1058. 1060. 1045. 1073. 8.8 12. gar7.la2ca.ip.att.net 16.7% 1059. 1061. 1044. 1087. 13.3 13. 12.249.143.98 33.3% 1059. 1057. 1048. 1071. 7.8 14. ??? My traceroute [v0.71] hivemind (0.0.0.0) Fri Apr 11 15:36:43 2014 Resolver: Received error response 2. (server failure)er of fields quit Packets Pings Host Loss% Last Avg Best Wrst StDev 1. 138.72.xxx.xxx 0.0% 0.2 0.1 0.1 0.2 0.0 2. pan5060-ae1-401.routerland.pixar.com 0.0% 0.4 0.4 0.3 0.6 0.1 3. cat-vegas-01-vlan66.pixar.com 0.0% 22.0 21.8 21.7 22.3 0.2 4. 205.129.21.101 0.0% 19.4 19.5 19.3 19.9 0.2 5. ae-2-5.bar1.LasVegas1.Level3.net 0.0% 19.3 21.8 19.3 40.7 5.9 6. ae-4-4.ebr1.LosAngeles1.Level3.net 0.0% 22.0 22.4 21.9 26.8 1.3 7. ae-6-6.ebr1.Tustin1.Level3.net 0.0% 20.0 20.2 19.9 21.8 0.5 8. ae-107-3507.bar2.Tustin1.Level3.net 0.0% 22.0 22.0 21.9 22.1 0.0 9. 192.205.37.145 30.8% 1052. 1063. 1048. 1072. 8.1 10. cr1.la2ca.ip.att.net 35.7% 1050. 1060. 1050. 1070. 7.3 11. cr83.la2ca.ip.att.net 28.6% 1049. 1064. 1049. 1072. 7.8 12. gar7.la2ca.ip.att.net 21.4% 1048. 1061. 1048. 1072. 6.7 13. 12.249.143.98 28.6% 1050. 1061. 1050. 1072. 7.9 14. ??? Just wanted to share in case anyone else is running into similar issues. I know, I should be on the outages list. I will add myself now. :) Regards, Dave Sotnick

2 1

Re: [[Infowarrior] - NSA Said to Have Used Heartbleed Bug for Years]
by Scott Weeks 11 Apr '14

11 Apr '14

--- mpalmer(a)hezmatt.org wrote: From: Matt Palmer <mpalmer(a)hezmatt.org> The interesting thing to me is that the article claims the NSA have been using this for "over two years", but 1.0.1 (the first vulnerable version) was only released on 14 Mar 2012. That means that either: * The NSA put it in there (still a bridge too far for me to believe without further evidence, although I can certainly understand why people could believe it) and hence were using it from day 1; ----------------------------------------------- Why is a mole in the IETF subverting things hard to believe? ;-) scott

1 0

BGP Update Report
by cidr-report＠potaroo.net 11 Apr '14

11 Apr '14

BGP Update Report Interval: 03-Apr-14 -to- 10-Apr-14 (7 days) Observation Point: BGP Peering with AS131072 TOP 20 Unstable Origin AS Rank ASN Upds % Upds/Pfx AS-Name 1 - AS36998 73697 3.1% 46.4 -- SDN-MOBITEL,SD 2 - AS9829 72918 3.0% 78.7 -- BSNL-NIB National Internet Backbone,IN 3 - AS27738 57295 2.4% 99.5 -- Ecuadortelecom S.A.,EC 4 - AS29571 41104 1.7% 384.1 -- CITelecom-AS,CI 5 - AS13188 28842 1.2% 27.4 -- BANKINFORM-AS TOV "Bank-Inform",UA 6 - AS8402 27938 1.2% 32.9 -- CORBINA-AS OJSC "Vimpelcom",RU 7 - AS56115 24373 1.0% 369.3 -- NGGL-BD Road 27 House 13 Block C2,BD 8 - AS3816 23167 1.0% 65.6 -- COLOMBIA TELECOMUNICACIONES S.A. ESP,CO 9 - AS13118 22914 1.0% 11457.0 -- ASN-YARTELECOM OJSC Rostelecom,RU 10 - AS45899 20767 0.9% 66.1 -- VNPT-AS-VN VNPT Corp,VN 11 - AS14259 20688 0.9% 157.9 -- Gtd Internet S.A.,CL 12 - AS1659 20579 0.9% 78.2 -- ERX-TANET-ASN1 Tiawan Academic Network (TANet) Information Center,TW 13 - AS41691 20470 0.9% 1137.2 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 14 - AS25184 20123 0.8% 157.2 -- AFRANET AFRANET Co. Tehran, Iran,IR 15 - AS23893 15713 0.7% 402.9 -- BPL-BD House No:03, Road no: 23/A,BD 16 - AS1785 15604 0.7% 35.3 -- AS-PAETEC-NET - PaeTec Communications, Inc.,US 17 - AS7552 15254 0.6% 47.4 -- VIETEL-AS-AP Viettel Corporation,VN 18 - AS17557 14714 0.6% 216.4 -- PKTELECOM-AS-PK Pakistan Telecommunication Company Limited,PK 19 - AS48159 14614 0.6% 74.6 -- TIC-AS Telecommunication Infrastructure Company,IR 20 - AS7029 14267 0.6% 81.1 -- WINDSTREAM - Windstream Communications Inc,US TOP 20 Unstable Origin AS (Updates per announced prefix) Rank ASN Upds % Upds/Pfx AS-Name 1 - AS13118 22914 1.0% 11457.0 -- ASN-YARTELECOM OJSC Rostelecom,RU 2 - AS18135 8939 0.4% 8939.0 -- BTV BTV Cable television,JP 3 - AS6459 7711 0.3% 7711.0 -- TRANSBEAM - I-2000, Inc.,US 4 - AS20450 13280 0.6% 6640.0 -- THL16-ASN - Trojan Hosting, LLC.,US 5 - AS54465 8401 0.3% 2800.3 -- QPM-AS-1 - QuickPlay Media Inc.,US 6 - AS58822 7262 0.3% 2420.7 -- IDNIC-UNESA-AS-ID Universitas Negeri Surabaya,ID 7 - AS6629 10536 0.4% 2107.2 -- NOAA-AS - NOAA,US 8 - AS3 1490 0.1% 1987.0 -- MIT-GATEWAYS - Massachusetts Institute of Technology,US 9 - AS41691 20470 0.9% 1137.2 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 10 - AS60345 1064 0.0% 1064.0 -- NBITI-AS Nahjol Balagheh International Research Institution,IR 11 - AS45636 972 0.0% 972.0 -- D2H-BBCL-IN Plot No. 1D, Udyog Vihar Industrial Estate,IN 12 - AS38909 2898 0.1% 966.0 -- MURAMATSU-AS-AP Muramatsu Group Inc. Transit AS,PH 13 - AS23466 828 0.0% 828.0 -- -Reserved AS-,ZZ 14 - AS23295 1623 0.1% 811.5 -- EA-01 - Extend America,US 15 - AS2 2294 0.1% 2024.0 -- UDEL-DCN - University of Delaware,US 16 - AS21973 648 0.0% 648.0 -- XPONET - Xponet,US 17 - AS33643 640 0.0% 640.0 -- JELLYBELLY - Jelly Belly Candy Company,US 18 - AS38730 3196 0.1% 639.2 -- VIETINBANK-AS-VN Vietnam Bank for Industry and Trade,VN 19 - AS57013 4455 0.2% 636.4 -- EURASIA-STAR-AS Eurasia Star Ltd.,KZ 20 - AS45900 632 0.0% 632.0 -- SBV-AS-VN The State Bank of Viet Nam,VN TOP 20 Unstable Prefixes Rank Prefix Upds % Origin AS -- AS Name 1 - 109.161.64.0/20 22906 0.9% AS13118 -- ASN-YARTELECOM OJSC Rostelecom,RU 2 - 89.221.206.0/24 20390 0.8% AS41691 -- SUMTEL-AS-RIPE Summa Telecom LLC,RU 3 - 121.52.144.0/24 14696 0.6% AS17557 -- PKTELECOM-AS-PK Pakistan Telecommunication Company Limited,PK AS45773 -- HECPERN-AS-PK PERN AS Content Servie Provider, Islamabad, Pakistan,PK 4 - 187.188.205.0/24 10667 0.4% AS17072 -- Iusacell PCS de Mexico, S.A. de C.V.,MX 5 - 192.58.232.0/24 10531 0.4% AS6629 -- NOAA-AS - NOAA,US 6 - 78.109.192.0/20 9640 0.4% AS25184 -- AFRANET AFRANET Co. Tehran, Iran,IR 7 - 42.83.48.0/20 8939 0.3% AS18135 -- BTV BTV Cable television,JP 8 - 206.152.15.0/24 8395 0.3% AS54465 -- QPM-AS-1 - QuickPlay Media Inc.,US 9 - 205.247.12.0/24 7711 0.3% AS6459 -- TRANSBEAM - I-2000, Inc.,US 10 - 65.90.49.0/24 7069 0.3% AS3356 -- LEVEL3 - Level 3 Communications, Inc.,US 11 - 66.210.60.0/24 6685 0.3% AS20450 -- THL16-ASN - Trojan Hosting, LLC.,US 12 - 74.231.237.0/24 6595 0.3% AS20450 -- THL16-ASN - Trojan Hosting, LLC.,US 13 - 199.187.118.0/24 4365 0.2% AS11054 -- LIVEPERSON - LivePerson, Inc.,US 14 - 186.211.97.0/24 4302 0.2% AS53062 -- G G NET - Telecomunicações LTDA EPP,BR 15 - 210.90.39.0/24 3625 0.1% AS4766 -- KIXS-AS-KR Korea Telecom,KR 16 - 103.242.124.0/24 3018 0.1% AS58822 -- IDNIC-UNESA-AS-ID Universitas Negeri Surabaya,ID 17 - 103.242.125.0/24 3016 0.1% AS58822 -- IDNIC-UNESA-AS-ID Universitas Negeri Surabaya,ID 18 - 2.93.235.0/24 2905 0.1% AS8402 -- CORBINA-AS OJSC "Vimpelcom",RU 19 - 210.4.14.0/24 2886 0.1% AS38909 -- MURAMATSU-AS-AP Muramatsu Group Inc. Transit AS,PH 20 - 120.28.62.0/24 2568 0.1% AS4775 -- GLOBE-TELECOM-AS Globe Telecoms,PH Details at http://bgpupdates.potaroo.net ------------------------------------ Copies of this report are mailed to: nanog(a)nanog.org eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org

1 0