June 2015 - Test - lists.nanog.org

OPM Data Breach - Whitehouse Petition - Help Wanted
by Ronald F. Guilmette 19 Jun '15

19 Jun '15

My apologies in advance to any here who might feel that this is off topic... I don't personally believe that it is. Frankly, I don't know of that many mailing lists where the subscribers are likely to care as much about network security (and/or the lack thereof) as the membership of this list does. By now, most of you will have read about the massive federal data breach at the U.S. Government's Office of Personnel Management (OPM), and also the fact that (by OPM's own preliminary estimates) this massive data breach affects at least four million federal government employees... but perhaps as many as 14 million current and former employees. However as this story is still evolving, even as we speak, you may perhaps not be familiar with the following additional important facts that have just come out: *) In addition to ordinary government personel records, including the usual kinds of frequently-hacked personal information (e.g. social security numbers), an as-yet undetermined number of highly detailed 127-page government security clearance forms (SF86) containing vast and intimate details of virtually every aspect of the lives of essentially EVERYONE who has applied for or been granted a government security clearance at any time within THE PAST 30 YEARS have also been hacked/leaked. (Experts seem to agree that this security clearance data constitutes and absolute gold mine and treasure trove of information for foreign intelligence services, opening up vast possibilities for phishing, blackmail, and on and on.) *) The Director of the Office of Personnel Management, Ms. Katherine Archueta was warned, repeatedly, and over several years, by her own department's Inspector General (IG) that many of OPM's systems were insecure and should be taken out of service. Nontheless, as reveled during congressional testimony yesterday, she overruled and ignored this advice and kept the systems online. Given the above facts, I've just started a new Whitehouse Petition, asking that the director of OPM, Ms. Archueta, be fired for gross incompetence. I _do_ understand that the likelihood of anyone ever getting fired for incompetence anywhere within the Washington D.C. Beltway is very much of a long shot, based on history, but I nontheless feel that as a U.S. citizen and taxpayer, I at least want to make my opinion of this matter known to The Powers That Be. I *really* would like some help from members of this list on this endeavor. In particular, if you agree, I'd appreciate it if you would sign my petition, and, whether you agree or not, I sure would appreciate it if you would all share the following URL widely: https://petitions.whitehouse.gov//petition/immediately-fire-office-personne… Note that Whitehouse petitions do not even get properly or completely published on the Whitehouse web site until such time as they receive at least 150 signatures. I am hoping that members of this (NANOG) mailing list will help me to get past that threshold. Thanks for your attention. Regards, rfg

17 29

Re: Anycast provider for SMTP?
by Larry Sheldon 19 Jun '15

19 Jun '15

On 6/18/2015 16:40, Jonas Björk wrote: > >> On Jun 18, 2015, at 11:29 PM, Larry Sheldon <larrysheldon(a)cox.net> wrote: >> >>> On 6/18/2015 16:25, Jonas Björk wrote: >>> >>>> Because clients will switch to unicast for renewal. Also clients will stay >>>> with the current server forever, so you might have a bad distribution of >>>> load between the servers. If one server was down everyone will switch to >>>> the other and never go back until forced. >>> >>> Why wouldn't they go back to the nearest server when it comes back online? >> >> Been awhile, but it seems like they try to "renew" the lease they have, with the server that holds it. > The clients speak unicast with one single ip-helper which address is shared by all the servers. > They can't choose which ever server to talk to. One of us is confused (and it may well be me) but I thought the ip-helper address was only useful in the initial grope-in-the-dark for a server that is not on the local Ethernet broadcast domain. Thereafter the negotiations (I thought) are between the client and the responding server and forever after until a failure-to-renew occurred. -- sed quis custodiet ipsos custodes? (Juvenal)

2 1

Re: Anycast provider for SMTP?
by Larry Sheldon 18 Jun '15

18 Jun '15

On 6/18/2015 16:25, Jonas Björk wrote: > >> Because clients will switch to unicast for renewal. Also clients will stay >> with the current server forever, so you might have a bad distribution of >> load between the servers. If one server was down everyone will switch to >> the other and never go back until forced. > > Why wouldn't they go back to the nearest server when it comes back online? Been awhile, but it seems like they try to "renew" the lease they have, with the server that holds it. -- sed quis custodiet ipsos custodes? (Juvenal)

2 1

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> I _do_ understand the point you are making. But if you are charged with the safekeeping of untold millions of extraordinarily detailed personal data files, and if you don't have the resources to do your job properly, wouldn't the Right Thing To Do be to either (a) resign in protest or else (b) at the very least send a letter to members of Congress telling them just how effed up things really are, so that they will understand what is at risk? ----------------------------------------------------- As someone else said, you can't understand unless you've worked around it. From the statements you're making, it can be seen you haven't. The petition will not help and it's not just one person's fault. Try to stop continental drift. You'd have a better chance. scott

1 0

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 18 Jun '15

18 Jun '15

--- bill(a)herrin.us wrote: From: William Herrin <bill(a)herrin.us> The core problem here is that the Authority To Operate (ATO) process consumes essentially the entire activity of a USG computing project's security staff. The non-sensical compliance requirements, which if taken literally just about prevent you from ever connecting any computer to any other, get in the way of architecting systems around pragmatic and effective security. -------------------------------------------- "non-sensical compliance" Yeah, that. Pure, unmitigated insanity. scott

1 0

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Ronald F. Guilmette 18 Jun '15

18 Jun '15

Harry Hoffman hhoffman at ip-solutions.net wrote: >I think it would be great if you were to include some source links in >your petition/email so that folks unaware of the specifics can educate >themselves in a non-partisan and factual manner. Well, as regards to the petition itself, I can't because now it is cast in stone and can't be edited, I think, which is too bad, because I slightly misspelled the lady's name. It is Katherine Archuleta, not Katherine Archueta. :-( But more to the point, they only give you a VERY limited number of characters to state what your petition is asking for, so there's really not room for much in the way of links within the petition itself. But elsewise, I'll give a few good links here, but really if you just go to Google News and search for "OPM breach" you will find one hell of a lot of VERY fresh news reports. =============================================================================== Fed Agency blames giant hack on 'neglected' security systems http://www.usnews.com/news/politics/articles/2015/06/16/cybertheft-of-perso… (Executive Summary: 4.2 mellion federal personel records stolen - OPM was warned, repeatedly, FOR YEARS that systems were insecure and didn't do squat.) =============================================================================== Military clearance OPM data breach 'absolute calamity' http://www.navytimes.com/story/military/2015/06/17/sf-86-security-clearance… (Executive Summary: Literally MILLIONS of detailed security clearance files were taken... quote: "everyone's".) =============================================================================== OPM Hack Probe Hindered Because Digital Trail Has Been Erased, US Official Says http://abcnews.go.com/US/opm-hack-probe-hindered-digital-trail-erased-us/st… (Executive Summary: They don't know how long this lasted or even what really happened because they over-write their log files every 60 days) =============================================================================== Will anyone at OPM be fired for not preventing this catastrophic mega-hack by China? http://hotair.com/archives/2015/06/16/will-anyone-at-opm-be-fired-for-not-p… Nope! In fact, Whitehouse has already come out expressing confidence in the OPM Director, Katherine Archuleta: http://thehill.com/policy/cybersecurity/245294-obama-has-confidence-in-opm-… =============================================================================== Catching Up on the OPM Breach - Krebs On Security http://krebsonsecurity.com/2015/06/catching-up-on-the-opm-breach/ (Detailed timeline of the MANY screw-ups) =============================================================================== And last but by no means least, we have ArsTechnica's most recent contribution to the news coverage, it which the following UNBELIEVEABLE insanity is revealed: Encryption would not have helped" at OPM, says DHS official http://arstechnica.com/security/2015/06/encryption-would-not-have-helped-at… ... A consultant who did some work with a company contracted by OPM to manage personnel records for a number of agencies told Ars that he found the Unix systems administrator for the project "was in Argentina and his co-worker was physically located in the [People's Republic of China]. Both had direct access to every row of data in every database: they were root. Another team that worked with these databases had at its head two team members with PRC passports. I know that because I challenged them personally and revoked their privileges. From my perspective, OPM compromised this information more than three years ago and my take on the current breach is 'so what's new?'" Yea. Right. If you are trying to keep foreign nationals out of your "secure" system, then encryption quite certainly WILL NOT HELP if you have already given them root. Regards, rfg P.S. Regadless of your politics or what you think of Snowden, THIS INCIDENT is VASTLY WORSE that any leak that Snowden participated in. At least he and the reporters he worked with tried to exercise some discretion, and did not leak any personal details about any specific U.S. government employees. In the case of this massive OPM hack however, the incompetents in charge of OPM gave unknown foreign enemies EVERYTHING... enough data and personal dirt on millions of federal employees... including active service members and intelligence operatives... to allow them, our enemies, to engage in virtually unlimited blackmailing and spear-phishing of our people until the Second Coming. For those who were worriedly waiting for the much-predicted "Digital Pearl Harbor" attack on this country... well... you don't have to fret about THAT anymore, because this is it. It's already happened. And we did it to ourselves. P.P.S. Here is OPM Director Katherine Archuleta's personal biography. Executive Summary: She a long-time Democratic Party political hack with nothing other than a Master's degree in Education. (Still, isn't it comforting to know that "As a long-time public servant, she is a champion of Federal employees" ?) https://www.opm.gov/about-us/our-people-organization/senior-staff-bios/kath… P,P.P.S. Here's a nice clear explanation of how/why she got the job as the Director of the Office of Personel Management, overseeing the safety and security of millions of confidential federal government employee files and the people behind them: http://www.nationaljournal.com/decision-makers/government-operations/kather… July 18, 2013 - Even before President Obama nominated Archuleta to be director of OPM in late May, word leaked to the Washington press corps that the White House was intent on choosing a Hispanic. Both Interior Secretary Ken Salazar and Labor Secretary Hilda Solis had resigned from the Obama administration, and groups such as the National Council of La Raza had chided the president for nominating only one Hispanic to a Cabinet-level position in his second term. Enter Archuleta, who helped engineer the president's reelection win as Obama for America's national political director. Not only is she Latina, but Archuleta also hails from the swing state of Colorado, where Democrats have made inroads in recent years. If she is confirmed as OPM director, the 64-year-old will be the first Hispanic to hold that position. ...

1 0

Is it safe to use 240.0.0.0/4
by Luan Nguyen 18 Jun '15

18 Jun '15

Is that safe to use internally? Anyone using it? Just for NATTING on Cisco gears...

17 22

Re: OPM Data Breach - Whitehouse Petition - Help Wanted
by Scott Weeks 17 Jun '15

17 Jun '15

--- rfg(a)tristatelogic.com wrote: From: "Ronald F. Guilmette" <rfg(a)tristatelogic.com> *) The Director of the Office of Personnel Management, Ms. Katherine Archueta was warned, repeatedly, and over several years, by her own department's Inspector General (IG) that many of OPM's systems were insecure and should be taken out of service. Nontheless, as reveled during congressional testimony yesterday, she overruled and ignored this advice and kept the systems online. ------------------------------------------- >From personal experience (at a different level) this is SOP, unfortunately. They just don't understand the importance until catastrophic failure. scott

1 0

DMARC in education
by Matthew Black 17 Jun '15

17 Jun '15

Looking at implementing DMARC for my institution. We currently have an SPF record and use DKIM to sign a small subset of messages. Rollout recommendations for DMARC suggest initially creating a "p=none" record to gather information on how a domain is being used. The RUA tag specifies a URI of where to send daily reports. Trying to get an idea of how many reports to expect a day or two after the dust settles. Does anyone use an aggregator to process their feedback (RUA tag) and/or forensic reports (RUF tag)? DMARC information. https://dmarc.org/ See slide 38 of 93 at http://www.slideshare.net/kka7/fighting-email-abuse-with-dmarc?qid=5e90be27… Everyone's first DMARC record V=DMARC1; p=none; rua=mailto:aggregate@example.com; Cheers! matthew black information technology services california state university, long beach

5 4

Re: Google contact?
by Shawn L 17 Jun '15

17 Jun '15

I'm replying on-list since it seems like a lot of people are in the same boat. Here's a summary of what happened to us. Please feel free to jump in if you had a different experience, or have more information. Google sent us a notice in December that as of June 8 they would be discontinuing the Google for ISPs program and that we had to find a different e-mail provider. Unfortunately, they only sent this notice to the account that initially created the service, which was un-monitored. I have heard the same thing from others. They did not include a notice about the discontinuation in their monthly billing, only in e-mail and only to the account that initiated the google service. We actually found out about it some time in February. I spoke with the Google contact listed in the e-mail and was told that they were indeed cancelling the service, but wasn't given a reason. We also asked if it was possible to move to a different Google service, Google Apps for Business for example, but was told that it would be against their terms or service and would result in a cancellation of the service. After a lot of research in Google's forums, it looked like a lot of other people were in the same boat we were. We ended up talking with another e-mail provider and migrating all of our mail. Several weeks ago we asked Google for an extension because the migration was taking longer than expected. We were given until the 16th of June and told that no further extensions would be given. I have spoken to one person who was given until the end of June. Here is the original notice we received from google. I hope this helps others in the same boat December 10, 2014 [ your-domain,com ]( http://baragatelephone.com ) Subject: Notice of Non-Renewal of The Google Apps - ISP Partner Edition Agreement. Dear Administrator, Thank you for being a Google customer and for using Google Apps Partner Edition (collectively, "Partner Edition"). As part of Google's integration plans, we have elected to discontinue providing the Partner Edition Services going forward. As provided in the Agreement between Google Inc. and [ your-domain.com ]( http://baragatelephone.com ), this letter serves as your formal notice that the Services will not be renewed, and our Agreement with you will terminate on June 8, 2015. Any other Google services you have purchased (or resold, if applicable), in addition the Partner Edition product and services, will not be affected by this change. Please also note that this notice of non-renewal does not relieve you of any payment obligations you may have under the current Agreement and that you remain responsible for remitting any such owed payments in full by the applicable invoice due date for the Services. We have prepared an Administrator transition resource website ([ https://support.google.com/appstransition/go/admin ]( https://support.google.com/appstransition/go/admin )) and an End User resource website ([ https://support.google.com/appstransition ]( https://support.google.com/appstransition )) to assist you through the transition. This resource center presents some of the migration options available to you and provides instructions that you can share with your customers. We regret any inconvenience this may cause, and thank you again for your business. If you have any questions, please contact your Account Manager below. Account Manager: John Coull Phone Number: [ 212- 565-3131 ]( tel:212-%20565-3131 ) Email Address: [ johnbc(a)google.com ]( mailto:johnbc@google.com ) Sincerely, Omid Kordestani Chief Business Officer -----Original Message----- From: "Marciano Lopes" <marciano.lopes(a)gsurfnet.com> Sent: Wednesday, June 17, 2015 11:48am To: "Shawn L" <shawnl(a)up.net> Subject: Re: Google contact? Hello Shawn! They cancelled ours as well. What we can do? Thanks! Atenciosamente, Marciano Lopes GSURF Fixo (48) 3254-8700 Ramal 6272 Móvel (48) 9125-5081 Atendimento 24h 0800-644-4833 2015-06-17 12:15 GMT-03:00 Shawn L <[ shawnl(a)up.net ]( mailto:shawnl@up.net )>: Google cancelled their ISP program as of the 8th of June. Feel free to contact me off-list for more info. They cancelled ours as well. -----Original Message----- From: "Christopher Tyler" <[ chris(a)totalhighspeed.net ]( mailto:chris@totalhighspeed.net )> Sent: Wednesday, June 17, 2015 9:28am To: [ nanog(a)nanog.org ]( mailto:nanog@nanog.org ) Subject: Google contact? Need some help.. Does anyone have an email contact at Google that they are willing to pass along? All of our [ mowisp.net ]( http://mowisp.net ) Apps for ISP accounts were disabled last night at about 8-9PM without notice and we are now getting swamped with calls. Possibly several hundred users affected. -- Christopher Tyler MTCRE/MTCNA/MTCTCE/MTCWE Total Highspeed Internet Services [ 417.851.1107 ]( tel:417.851.1107 )

3 2