December 2015 - Test - lists.nanog.org

Staring Down the Armada Collective
by Lyndon Nerenberg 04 Dec '15

04 Dec '15

Typically, businesses hide from admitting they've been hit by drive-by attacks like Armada is trying to pull off. It has been interesting to see the public reaction from the post-Protonmail targets, many of whom are being very visible about 1) admitting they have been hit by the attacks, and 2) making it very clear the Armada crew can f*** right off as far as collecting ransom is concerned. (Also, 3) the amazing support from customers who understand why we are working on putting up defences instead of just paying, and therefore put up with the inevitable downtime as we reconfigure sometimes large chunks of our networks.) The money asked for was a pittance (around USD$6K) for the attacks I'm personally aware of. The targeted were willing to spend far in excess of that to deploy the necessary wall of DDoS protection to keep their services running. If they didn't have it there, already. What does that say for the business model of the botnet handlers? They can't up their ransom demands, because nobody is paying at the current rates. And they can't lower them, for the same reason. And if they change their targets to sites than might potentially pay a few hundred dollars at best, those sites will just shut down anyway. Are we perhaps, finally, reaching the cusp where everyone has realized that if we all, collectively, tell the rodents to f*** off, they just might? Happy Holidays! --lyndon

2 3

Re: Ransom DDoS attack - need help!
by dennis 04 Dec '15

04 Dec '15

Many online business have learned how to deal with these threats. Just recently Protonmail hit the news and found out the hard way whether to pay or NOT. Have a quick read at the log of events for yourself. http://arstechnica.com/security/2015/11/how-extorted-e-mail-provider-got-ba… Sent via the Samsung GALAXY S® 5, an AT&T 4G LTE smartphone -------- Original message -------- From: Roland Dobbins <rdobbins(a)arbor.net> Date: 12/3/2015 3:10 PM (GMT-05:00) To: NANOG <nanog(a)nanog.org> Subject: Re: Ransom DDoS attack - need help! On 3 Dec 2015, at 22:04, Josh Reynolds wrote: > None of those names you just mentioned have made the international news. Of course they have. ----------------------------------- Roland Dobbins <rdobbins(a)arbor.net>

1 0

TWC RR contact off list ?
by Brandon Applegate 04 Dec '15

04 Dec '15

Could someone from TWC RR contact me off-list ? I have an IPv6 / DNS question / request. I’m in Cincinnati, OH and this is residential if that matters. Otherwise - if anyone non-TWC on list can point me to a person/address etc that will let me leap frog frontline support that would be great. There’s no way the support folks are going to know what I’m asking or who/how to escalate. Thanks in advance. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 830B 4802 1DD4 F4F9 63FE B966 C0A7 189E 9EC0 3A74 "SH1-0151. This is the serial number, of our orbital gun."

2 1

Multi-core clamp on ammeter
by Rob Seastrom 03 Dec '15

03 Dec '15

Hi folks, I own a Megger MMC850 which will read amps in a multi-core cable, such as the 10 gauge SEOOW cable one often finds feeding rack PDUs. Datasheet here: http://www.mouser.com/ds/2/263/MMC850_DS_en_V02-15853.pdf Apparently they've been discontinued. Pity. Anyone know of a suitable replacement? I need more. -r

2 1

Re: Ransom DDoS attack - need help!
by Robban 03 Dec '15

03 Dec '15

Hi! This is my first mail to the list. Afaik, the DDoS is "only" a UDP based one (or much of the attack), you should be able to mitigate some to much of the damage caused by filled pipes by blocking incomming UDP trafic at your ISP level. //Robban > * On Thu, Dec 03, 2015 at 03:15:04AM -0500, halp us <throwaway1958251(a)gmail.com> wrote: > > All, > > > > I've been a NANOG member for many years but I'm emailing from an anonymous > > account to reduce the chance of the attackers finding me. > > > > A company that shall remain anonymous has received a ransom DDoS note from > > a very well known group that has been in the news lately. Recently they've > > threatened to carry out a major DDoS attack if they are not paid by a > > deadline which is approaching. They've performed an attack of a smaller > > magnitude to prove that they're serious. > > > > Based on certain details that I can't reveal here, we believe the magnitude > > of the upcoming attack may be in the several hundred Gbps. > > > > I would really appreciate help in a few areas (primarily with certain > > provider contacts/intros) so we can execute our strategy (which I can't > > reveal here for obvious reasons). If you email me off-list with a > > name/email that you've previously used on-list, I will reply from my real > > email. > > > > Alternatively, if you can post your experiences on-list with large scale > > high profile ransom DDoS attacks, I'd really appreciate it! > > > > Thanks -- Robert Soderlund

2 1

SevOne Monitoring
by Paul Stewart 03 Dec '15

03 Dec '15

Hey folks. Looking for feedback from actual customers on SevOne for network monitoring . anyone using them and willing to share thoughts online/offline? They have an appealing system for network monitoring and considering it as a replacement to Solarwinds. Cheers, Paul

6 7

Stewart B.C Loses Internet
by Steve Mikulasik 02 Dec '15

02 Dec '15

Interesting story about a small town in BC losing Internet once the non-profit ISP leaves town and they have no alternatives. http://www.ctvnews.ca/sci-tech/they-won-t-see-this-remote-b-c-town-loses-in…

1 0

Rob Blokzijl Dies Peacefully Aged 72
by Job Snijders 02 Dec '15

02 Dec '15

NANOG, Rob Blokzijl, one of the founding fathers of the RIPE (and by extent, internet as we know it in Europe), passed away yesterday. The links in the email below offer more insight into his life and accomplishments. Kind regards, Job ----- Forwarded message from Daniel Karrenberg <daniel.karrenberg(a)ripe.net> ----- Date: Wed, 2 Dec 2015 11:02:11 +0100 From: Daniel Karrenberg <daniel.karrenberg(a)ripe.net> To: RIPE Community <ripe-list(a)ripe.net> Subject: Rob Blokzijl Dies Peacefully Aged 72 Dear colleagues, I have the painful duty to inform you that Rob Blokzijl, RIPE Chair Emeritus died at his home in the Netherlands yesterday after a long illness. https://www.ripe.net/participate/ripe/rob-blokzijl-obituary This is a sad moment for all of us because we loose a leader whose influence permeates the RIPE community and the way we conduct our work. Rob will live on in this way. Those who wish to share their own tribute to Rob can do so here for all to see: https://labs.ripe.net/Members/mirjam/tribute-to-dr-robert-blokzij-1943-2015 I am sure Rob would wish to see positive, even somewhat lighthearted and anecdotal contributions. Daniel Karrenberg Chief Scientist RIPE NCC ----- End forwarded message -----

2 1

APC vs TrippLite metered PDU's
by Dovid Bender 02 Dec '15

02 Dec '15

Hello All, We currently use TrippLite and over all have been very happy with their metered PDU's. When we first started out we had some minor issues and their support went above and beyond. Lately the their Java web interface has been becoming a real pain. More and more browsers lock it by default and it takes a lot of work to get it working correctly. Does anyone have any experience with APC? How are is management of their devices and over all how do they operate? TIA. Dovid

9 8

strategies to mitigate DNS amplification attacks in ISP network
by Martin T 02 Dec '15

02 Dec '15

Hi, as around 40% of ASNs allow at least partial IPv4 address spoofing in their network(http://spoofer.csail.mit.edu/summary.php) and there are around 30 million open-resolvers(http://openresolverproject.org/) in the Internet, then DNS amplification traffic is daily occasion for ISPs. This in probably mainly because RPF checks and DNS RRL(https://kb.isc.org/article/AA-01000/0/A-Quick-Introduction-to-Response-… are not ubiquitously implemented, recursive requests without any ACLs in DNS servers are often allowed, it requires little effort from attackers point of view and is effective attack method. Unfortunately, there seems to be very limited number of countermeasures for ISPs. Few which I can think of: 1) higher capacity backbone links - I'm not sure if this can be considered a mitigation method, but at least it can help to affect smaller amount of customers if traffic volumes are not very high 2) rate-limit incoming DNS traffic flows on peering and uplink ports - here I mean something similar to iptables "recent" module(http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HO… which allows certain number of certain type of packets in a configured time-slot per IP. However, such functionality is probably not common on edge or backbone routers. Tracking the packet state does definitely not work because state table should be synchronized between all the routers in the network and again, this requires Internet-routers to have stateful firewall functionality. In addition, one also needs to allow new DNS connections from Internet to its network. If one simply polices incoming DNS traffic on uplink and peering ports(for example if baseline DNS traffic is 5Mbps, then policer is set to 50Mbps), then legitimate customers DNS traffic is also affected in case of actual attack occurs and policer starts to drop DNS traffic, i.e. policer has no way to distinguish between the legitimate and non-legitimate incoming DNS traffic. Am I wrong in some points? What are the common practices to mitigate DNS amplification attacks in ISP network? thanks, Martin

7 7