February 2023 - Test - lists.nanog.org

(IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)
by Fernando Gont 09 Feb '23

09 Feb '23

Hi, All, Recently, I happened to participate in an IPv6 deployment meeting with some large content provider, and said meeting included a discussion about how to mitigate some attacks using block-lists. These folks argued that they ban offending IPv6 addresses as /128s, following IPv4 practices. So it seemed to me that some of the implications arising from the increased IPv6 address space were non-obvious to them. -- that has been the motivation for the publication of this document. * TXT: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt * HTML: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html Comments welcome! P.S.: The document is targeted at the IETF opsec wg (https://www.ietf.org/mailman/listinfo/opsec) but I'll be happy to discuss it on this mailing-list, off-list, or at the opsec wg mailing-list... Thanks! Regards, Fernando -------- Forwarded Message -------- Subject: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt Date: Thu, 02 Feb 2023 19:48:40 -0800 From: internet-drafts(a)ietf.org To: Fernando Gont <fgont(a)si6networks.com>, Guillermo Gont <ggont(a)si6networks.com> A new version of I-D, draft-gont-opsec-ipv6-addressing-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Name: draft-gont-opsec-ipv6-addressing Revision: 00 Title: Implications of IPv6 Addressing on Security Operations Document date: 2023-02-02 Group: Individual Submission Pages: 8 URL: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt Status: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-addressing/ Htmlized: https://datatracker.ietf.org/doc/html/draft-gont-opsec-ipv6-addressing Abstract: The increased address availability provided by IPv6 has concrete implications on security operations. This document discusses such implications, and sheds some light on how existing security operations techniques and procedures might need to be modified accommodate the increased IPv6 address availability. The IETF Secretariat

5 12

Yondoo provided router, has "password" as admin pw, won't let us change it
by typhoon.notice_0a＠icloud.com 09 Feb '23

09 Feb '23

Hi, Long time lurker, first time poster. Sorry in advance if this is the wrong forum for something like this. My mom's ISP (Yondoo) seems to be providing DOCSIS 3.1 CPE (Customer Premises Equipment) with a built-in router, without providing the ability to change the admin password from "password" on it. Their customer service rep said that this is not only WAI, but also wanted to charge her $50 to have a tech come out and change it. Which is obviously less than ideal. That aside, this seems like a pretty egregious security standard which, from my understanding, can have fairly dire security implications... e.g., DNS server settings can be pointed at whatever someone wants here. My mom is elderly and had already fallen victim to a call center scammer a couple years ago. They briefly took control over her laptop before she called for backup. So I'm just a little concerned that we have no control over changing this router's admin password — from “password” — in a pinch, without waiting for a truck roll && shelling out $50. I've sent her a DOCSIS 3.1 modem that doesn't have a router built-in, in hopes that they'll let us bring our own. She does have Google Wifi, but we can't even put their router into bridge mode. So she would be double NATed and have no control over changing the admin password on the first router. Anyone have any experience with Yondoo? I've tried reaching out to them on multiple fronts, but have yet to hear back from them on this. A tech is scheduled to come out tomorrow, so the plan is to beg (bribe?) them to let us use our own modem and then take it from there. Thanks, Todd

8 8

Yondoo provided router, has "password" as admin pw, won't let us change it
by typhoon.notice_0a＠icloud.com 08 Feb '23

08 Feb '23

Apparently iCloud’s hide my email implementation can only be used with one recipient, so here was my reply to Josh (apologies to him for the spam), for posterity: Hi, Thanks for your reply. Double NAT tends to break things like ZeroTier. But even if that wasn’t a problem for us, I think the more pressing concern here is that the default admin password for the router is “password”, and you can’t change it without a tech coming out to change it for you, and shelling out $50. Who knows how many residential routers are in their fleet that are “password” protected; seems like a disaster waiting to happen. The model was an Evolution Digital EVO3000GW — thankfully they were able to swap it out with a non-router modem that I had sent to her over the weekend, but not without making a few phone calls, first. It didn’t seem like they could provision the new modem remotely. If anyone has a more security-focused forum they could recommend for a post like this, I’ll be happy to take my inquiry elsewhere. Cheers, Todd > On Feb 8, 2023, at 8:06 AM, Josh Luthman <josh(a)imaginenetworksllc.com <mailto:josh@imaginenetworksllc.com>> wrote: > > What's the problem with double NAT? I can't imagine an elderly mom trying to host Xbox games - which is 95% of the problem with double NAT these days (the other 5% being Ubiquiti bros having to access their Unifi router from anywhere). > > Your screenshots didn't come through, I suspect it's stripped via the mailing list, but there's no model number specified anywhere. > > NANOG really isn't the best place for this, but I don't know where else you would be able to go besides what you've already done: Yondoo support. > > On Tue, Feb 7, 2023 at 9:17 AM TACACS Macaque via NANOG <nanog(a)nanog.org <mailto:nanog@nanog.org>> wrote: >> Hi, >> >> Long time lurker, first time poster. Sorry in advance if this is the wrong forum for something like this. >> >> My mom's ISP (Yondoo) seems to be providing DOCSIS 3.1 CPE (Customer Premises Equipment) with a built-in router, without providing the ability to change the admin password from "password" on it. >> >> >> >> >> >> Their customer service rep said that this is not only WAI, but also wanted to charge her $50 to have a tech come out and change it. Which is obviously less than ideal. >> >> That aside, this seems like a pretty egregious security standard which, from my understanding, can have fairly dire security implications... e.g., DNS server settings can be pointed at whatever someone wants here. >> >> My mom is elderly and had already fallen victim to a call center scammer a couple years ago. They briefly took control over her laptop before she called for backup. So I'm just a little concerned that we have no control over changing this router's admin password — from “password” — in a pinch, without waiting for a truck roll && shelling out $50. >> >> I've sent her a DOCSIS 3.1 modem that doesn't have a router built-in, in hopes that they'll let us bring our own. She does have Google Wifi, but we can't even put their router into bridge mode. So she would be double NATed and have no control over changing the admin password on the first router. >> >> Anyone have any experience with Yondoo? I've tried reaching out to them on multiple fronts, but have yet to hear back from them on this. A tech is scheduled to come out tomorrow, so the plan is to beg (bribe?) them to let us use our own modem and then take it from there. >> >> Thanks, >> Todd

1 0

Twelve99 Contact Info
by Elijah Savage 08 Feb '23

08 Feb '23

For the past two weeks we have seen increased latency coming from Asia. On my side this is from multiple providers/AS's below is just one example. I have tried to reach out to them directly but no response as of yet. Anyone with a contact or seeing the same high latency?

1 0

LINX is down?
by Dmitry Sherman 08 Feb '23

08 Feb '23

Hello any problems with Linx? Dmitry

2 1

Lima, OH Spectrum/Charter Severe Node/Hop Latency Issues
by Austin Ayers 07 Feb '23

07 Feb '23

Hello all, One of my NetOps engineers resides in Lima, Ohio and they are receiving terrible bufferbloat, packet loss, and random disconnects. I have been pinging 24.33.160.213 (Lima, OH Spectrum/Chart Node) and it's rejecting a ton of packets. This has been going on for weeks. Node having problems: lag-1.limaohid01h.netops.charter.com NOC seems like they don't care, same with OSP in the field. There is no reason why this hop (#13) should have up to 613ms ping times. Thank you, Austin [cid:d929237e-d932-4060-9dbb-f4b99b12afa4]

4 3

Re: [EXTERNAL]INC000026031132 RE: Lima, Ohio Spectrum Hop/Node Having Severe Packet Loss
by Austin Ayers 07 Feb '23

07 Feb '23

Thank you, The IP of his gateway is 65.29.110.132 - as you can see it's having horrible ping times to go a few city blocks (56ms) in addition to the horrid drops. I believe several tickets have been opened for his address too, 1718 Leland Ave. Lima, OH 45805 Thank you! -Austin [cid:53d8905f-681a-4dfd-819e-ab68644238fd] ________________________________ From: NOC.AUS.NATL.BBN <NOC.AUS.NATL.BBN(a)charter.com> Sent: Tuesday, February 7, 2023 5:03 PM To: Austin Ayers <austin(a)coretransit.net>; nanog(a)nanog.org <nanog(a)nanog.org> Cc: NOC.AUS.NATL.BBN <NOC.AUS.NATL.BBN(a)charter.com> Subject: [EXTERNAL]INC000026031132 RE: Lima, Ohio Spectrum Hop/Node Having Severe Packet Loss All I opened INC000026031132 for our CBO-CSC team to review Thank you, James Wynn | Network Engineer III | Austin NOC 866.248.7662 option 2 option 5 [cid:image001.png@01D93B0D.995D1C10] 13620-A North FM 620, Suite 200 | Austin, TX 78717 From: Austin Ayers <austin(a)coretransit.net> Sent: Tuesday, February 7, 2023 3:53 PM To: nanog(a)nanog.org Cc: NOC.AUS.NATL.BBN <NOC.AUS.NATL.BBN(a)charter.com> Subject: [EXTERNAL] Re: Lima, Ohio Spectrum Hop/Node Having Severe Packet Loss CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. [cid:image002.jpg@01D93B0D.995D1C10] [cid:image003.png@01D93B0D.995D1C10] ________________________________ From: Austin Ayers Sent: Tuesday, February 7, 2023 4:46 PM To: nanog(a)nanog.org<mailto:nanog@nanog.org> <nanog(a)nanog.org<mailto:nanog@nanog.org>> Cc: NOC.AUS.NATL.BBN(a)charter.com<mailto:NOC.AUS.NATL.BBN@charter.com> <NOC.AUS.NATL.BBN(a)charter.com<mailto:NOC.AUS.NATL.BBN@charter.com>> Subject: Lima, Ohio Spectrum Hop/Node Having Severe Packet Loss Hello all, One of my NetOps engineers resides in Lima, Ohio and they are receiving terrible bufferbloat, packet loss, and random disconnects. I have been pinging 24.33.160.213 (Lima, OH Spectrum/Chart Node) and it's rejecting a ton of packets. This has been going on for weeks. Node having problems: lag-1.limaohid01h.netops.charter.com NOC seems like they don't care, same with OSP in the field. There is no reason why this hop (#13) should have up to 613ms ping times. Thank you, Austin [cid:image003.png@01D93B0D.995D1C10] The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

1 0

About emails impersonating Path Network
by Konrad Zemek 07 Feb '23

07 Feb '23

Hi Nanog, It looks like someone with an axe to grind against our company has decided to email every AS contact they could find on PeeringDB, impersonating us and sometimes spoofing our domains. We're aware of the emails and are sorry for the inconvenience. We've since added SPF records to the domains we own but don't use (the perps have since name-squatted some new ones). We're also actively working with law enforcement on the matter. Thanks Konrad Zemek CTO Path Network AS396998

7 10

Watch NANOG Hackathon, N87 Socials, + More
by Nanog News 07 Feb '23

07 Feb '23

*WATCH Hackathon Welcome Session* *Meet Project Vendors, Get Project Ideas, + More * *Hybrid NANOG 87 Hackathon kicked-off last Friday, 3 Feb. and will continue until Sunday, 12 Feb. * Watch video to meet project vendors, get ideas for potential Hackathon projects, and check out resources to ensure a successful Hackathon. *WATCH NOW* <https://www.nanog.org/events/nanog-87-hackathon/> *Connect with Old + New Friends at NANOG 87 Socials!* *Don't Miss out on NANOG 87 Social Events Next Week* *Our community is what makes NANOG special. *Connect with the phenomenal women and men that make up the heart of our mission at our NANOG Social events, taking place during NANOG 87. Check out full details below! * MORE INFO <https://www.nanog.org/events/nanog-87/socials/>* *Can't Make it to Atlanta? Still Time to Register Virtually* NANOG 87 will Kick Off Monday! There is still time to register for NANOG 87. Can't make it to Atlanta? Join us virtually! Stream presentations, participate in real-time chat forums, and enjoy the 360 camera views of NANOG 87 General Session + more! *REGISTER NOW* <https://www.nanog.org/events/nanog-87/> *What's Hot on The Mailing List? * *Participate or Find a Tech Solution in the Community Forum Mailing List * Remember, a NANOG account must be created to access the Community Forum. *Current Trending Conversations:* • Spectrum (legacy TWC) Infrastructure - Contact Off List Replies 26 <https://community.nanog.org/t/spectrum-legacy-twc-infrastructure-contact-of…> • Smaller than a /24 for BGP? Replies 32 <https://community.nanog.org/t/smaller-than-a-24-for-bgp/56993> • Typical last mile battery runtime (protecting against power cuts) Replies 31 <https://community.nanog.org/t/typical-last-mile-battery-runtime-protecting-…> • 202203071610.AYC Re: Making Use of 240/4 NetBlock Replies 338 <https://community.nanog.org/t/202203071610-ayc-re-making-use-of-240-4-netbl…> • Increasing problems with geolocation/IPv4 access Replies 13 <https://community.nanog.org/t/increasing-problems-with-geolocation-ipv4-acc…> *WHAT'S HOT* <https://community.nanog.org>

1 0

MX204 and MPC7E-MRATE EoL - REVOKED
by Aaron Gould 07 Feb '23

07 Feb '23

Did you hear? EoL was revoked December 2022... I'm so glad, I like and use the MX204 and the MPC7E-MRATE TSB69626 - 12/5/2022 - Revoke End of Life Announcement: MX204 https://supportportal.juniper.net/s/article/Revoke-End-of-Life-Announcement… <https://supportportal.juniper.net/s/article/Revoke-End-of-Life-Announcement…> TSB69631 - 12/2/2022 - Revoke End of Life Announcement: MPC7E-MRATE, MPC7E-MRATE-RTU https://supportportal.juniper.net/s/article/Revoke-End-of-Life-Announcement… <https://supportportal.juniper.net/s/article/Revoke-End-of-Life-Announcement…> -Aaron

3 3