October 2024 - Test - lists.nanog.org

The state-level attack on the SSL CA security model
by Martin Millnert 09 Oct '25

09 Oct '25

To my surprise, I did not see a mention in this community of the latest proof of the complete failure of the SSL CA model to actually do what it is supposed to: provide security, rather than a false sense of security. Essentially a state somewhere between Iraq and Pakistan snatched valid certs for: - mail.google.com - www.google.com - login.yahoo.com - login.skype.com - addons.mozilla.org - login.live.com - "global trustee" https://blog.torproject.org/blog/detecting-certificate-authority-compromise… http://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html http://www.imperialviolet.org/2011/03/18/revocation.html (on epic failure of cert revocation lists implementations in browsers, failing open (!)) http://blog.mozilla.com/security/2011/03/22/firefox-blocking-fraudulent-cer… http://www.microsoft.com/technet/security/advisory/2524375.mspx For over a week users of browsers, and the internet at large, were/was not informed by COMODO that their security was compromised. "Why not" is beyond many of us. Announcing this high and loud even before fixes were available would not have exposed more users to threats, but less. Conclusion: protecting people must not be a priority in the SSL CA model. In some places, failure of internet security means people die, and it is high time to start serious work to replace this time-and-time again proven flawed model with something that, at the very least, does not fail this tragically. DNSSEC is a good but insufficient start in this particular case. Regards, Martin

24 35

Re: NANOG NYC Event
by Fisher, Shawn 30 Jul '25

30 Jul '25

Personally I like dinosaur bbq, great malt beverages as well, and also blue smoke is great and if you like jazz, check out downstairs. -------------------------- Sent using BlackBerry -----Original Message----- From: andrew young To: Scott Brim CC: nanog(a)nanog.org Sent: Sat May 31 18:28:57 2008 Subject: Re: NANOG NYC Event Speaking of food, ill be going to the Big Apple BBQ fest next weekend: http://bigapplebbq.org/2008/ If you love to eat BBQ, this is a big MUST to cap off your stay in NYC. if you do decided to go, be sure to get the Fastpass: http://www.bigapplebbq.org/2008/index.php?s=fastpass You dont want to wait 30 mins online for food. Don't forget a bib and leave your belt at home. :-) - ------------------------------------ Andrew Young Webair Internet Development, Inc Phone: 1 866 WEBAIR 1 FAX: 516.938.5100 http://www.webair.com andrewy(a)webair.com ------------------------------------- We are interested in any feedback you might have about the service you received. Please contact our technical support consumer care manager directly at 1.866.WEBAIR1 or e-mail customercare(a)webair.com ------------------------------------- On Sat, 2008-05-31 at 18:17 -0400, Scott Brim wrote: > On 5/31/08 12:36 PM, Rod Beck allegedly wrote: > > I strongly suggest that those heading to New York visit the great > > musems, architecture (Saint Patrick's Cathedral), and restaurants. > > You have the American Museum of Natural History, which includes an > > excellent Planetarium and just on the other side of Central Park, the > > Metropolitan Museum of Art and the Guggenheim. There are excellent > > Chinese and Indian restaurants in Lower Manhattan. > > Don't forget about Brooklyn in all this Manhattan praise :-). Consider > the Brooklyn Botanic Garden. It's too late for cherries but the rose > collections will be great. And the best pizza in New York (if you can > get in) is at > http://menupages.com/restaurantdetails.asp?areaid=0&restaurantid=31402&neig… >

15 17

Ransom DDoS attack - need help!
by halp us 18 Jul '25

18 Jul '25

All, I've been a NANOG member for many years but I'm emailing from an anonymous account to reduce the chance of the attackers finding me. A company that shall remain anonymous has received a ransom DDoS note from a very well known group that has been in the news lately. Recently they've threatened to carry out a major DDoS attack if they are not paid by a deadline which is approaching. They've performed an attack of a smaller magnitude to prove that they're serious. Based on certain details that I can't reveal here, we believe the magnitude of the upcoming attack may be in the several hundred Gbps. I would really appreciate help in a few areas (primarily with certain provider contacts/intros) so we can execute our strategy (which I can't reveal here for obvious reasons). If you email me off-list with a name/email that you've previously used on-list, I will reply from my real email. Alternatively, if you can post your experiences on-list with large scale high profile ransom DDoS attacks, I'd really appreciate it! Thanks

17 26

Incorrect Reverse DNS in Verizon Fios NYC core router traceroute
by Neel Chauhan 18 Nov '24

18 Nov '24

Hi, I got Fios installed today in my NYC apartment, as I just moved back from Seattle after a 4-month stay in Connecticut. When doing a traceroute, I am noticing an incorrect Reverse DNS entry: [root@twin ~]# traceroute 1.1.1.1 traceroute to 1.1.1.1 (1.1.1.1), 30 hops max, 60 byte packets 1 _gateway (172.20.0.1) 0.145 ms 0.115 ms 0.106 ms 2 lo0-100.NYCMNY-VFTTP-372.verizon-gni.net (173.56.84.1) 2.079 ms 2.070 ms 2.061 ms 3 G0-3-4-4.PITBPA-LCR-21.verizon-gni.net (100.41.196.252) 3.751 ms T0-8-0-9.BSTNMA-LCR-21.verizon-gni.net (100.41.196.248) 4.454 ms 4.447 ms 4 * * * 5 * * * 6 162.158.61.113 (162.158.61.113) 7.246 ms 6.603 ms 162.158.61.117 (162.158.61.117) 4.944 ms 7 one.one.one.one (1.1.1.1) 6.077 ms 6.355 ms 6.346 ms [root@twin ~]# In short, hop 3 is "G0-3-4-4.PITBPA-LCR-21.verizon-gni.net (100.41.196.252)" which seems to be a Pittsburgh, PA reverse DNS entry even when I'm in NYC. While it doesn't affect the normal operation of the service, it might give the impression packets are being routed via Pittsburgh to someone less savvy. If someone works at the Verizon Fios/ILEC network engineering or sysadmin team could the 100.41.196.252 reverse DNS entry to say "G0-3-4-4.NYCMNY-LCR-21.verizon-gni.net" please get updated? Thanks! Neel Chauhan

5 4

SSH bruteforce attempts from Verizon to "AS17452 Bitstop Inc"
by Neel Chauhan 01 Nov '24

01 Nov '24

Hi, I am a customer of Verizon Fios in NYC and received a very interesting abuse complaint today from abuse(a)verizon.com. I got SSH bruteforce attempts between my IP address and this IPv4 prefix: 202.91.160.0/20 This is hosted on a network called "AS17452 Bitstop Inc". My connection runs Tor relays, but not exit relays. I doubt it's Tor since when I had Google Fiber or CenturyLink even when running Tor relays I never got those complaints. I use a MikroTik core router so maybe it got malware, although I recently updated it from 7.15.3 to 7.16.1. I decided to filter the prefix. Maybe a Windows PC on our network is infected. Maybe it's my Rocky Linux servers. Should I probably get a Supermicro/Deciso box and run an OPNsense firewall instead? But I never got complaints from Frontier or Optimum when I put MikroTik routers on both ISPs too, that for accounts not in my name. Maybe it's a false positive and just TCP forgery pretending to me be (I hope so). Just letting you know. -Neel === REDACTED COMPLAINT BELOW === Dear Verizon Online Customer, On 10-30-2024, your account was reported to have been used in an attempt to gain unauthorized access to another system, or to transmit malicious traffic to another Internet user. It is possible that a device connected to your network may have been infected by a virus or a botnet that is causing this action. Report and/or Logs: To assist you in understanding the situation, we have provided the relevant log data below, with timestamps adjusted to our GMT +8 timezone: DateTime Action AttackClass SourceIP Srcport Protocol DestinationIP DestPort 0 30-Oct-2024 13:37:21 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 1 30-Oct-2024 13:49:38 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 2 30-Oct-2024 14:00:01 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 3 30-Oct-2024 14:10:12 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 4 30-Oct-2024 15:17:15 DENIED 108.30.XXX.XXX 32769 TCP 202.91.162.17 22 5 30-Oct-2024 15:18:29 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.39 22 6 30-Oct-2024 15:23:08 DENIED 108.30.XXX.XXX 54688 TCP 202.91.163.179 22 7 30-Oct-2024 15:30:22 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.47 22 8 30-Oct-2024 15:47:32 BLOCKED attempted-recon 108.30.XXX.XXX 0 202.91.162.24 22 9 30-Oct-2024 15:58:03 DENIED 108.30.XXX.XXX 50405 TCP 202.91.163.143 22 Please immediately ensure your anti-virus and anti-malware software is properly updated. Please perform full system scans on your device(s). [Including - computers, tablets, cellular devices, network attached storage, security camera recorders (DVR or NVR), and IOT devices, where possible.] Additional information and removal guidance of detected malware may be found on the website of your scanner(s) manufacturer. It is difficult to verify the presence of an exact virus or malware infecting a device without a full system scan with up-to-date software. Installing the most recent firmware and software updates can also assist in securing your device(s). Please follow the device manufactures processes for any updates. If you are unable to take immediate action, it would be advisable to remove the device(s), which may be infected, from your network and the Internet connection until it has been properly cleaned. This may be easily done by unplugging the network cable that connects the device to the router. For wireless devices removing power from the device will keep it off it the network. Note: this information is being provided as a courtesy; you are solely responsible for any changes you make to your device(s) or network. Verizon Policy: If you do not take steps to resolve this issue, we may be forced to take further action. Actions could include the suspension or termination of your service until the issue is resolved, in order to ensure the safety of our network, and the safety of other Internet users. Please carefully review these agreements, which can be viewed at: http://www.verizon.com/about/terms/ Any future violation will result in further action being taken, up to, and including, the termination of your service. Sincerely, Verizon Global IP Abuse http://www.verizon.com/about/terms/ http://www.verizon.com/securityinfo Abuse(a)verizon.com

3 3

N93 Registration is OPEN! Election Results Are In...+ More!
by Nanog News 31 Oct '24

31 Oct '24

*** 🎃👻 Happy Halloween from NANOG!* ------------------------------------------------------------ Stay safe, secure your network, and enjoy the treats (online and off)! 🦇💻 *** NANOG Election Results are In* ------------------------------------------------------------ *Congratulations Board Members!* Steve Feldman and Elizabeth Culley were elected to the board. Their terms will run from 01 January 2025 to 31 December 2027. We would like to thank all six candidates. *** My Favorite NANOG 92 Moment* ------------------------------------------------------------ *Community Shares the Moments that Made Our Last Meeting* *NANOG 92 (21-23, Oct.) has come and gone, but the memories will last forever.* Whether it was a conversation that shifted perspective, a Social that deepened connections, or a talk that inspired future growth, it’s clear that N92 sparked unforgettable moments for attendees. *READ MORE (https://nanog.org/stories/articles/my-favorite-nanog-92-moment/ <https://nanog.org/stories/articles/my-favorite-nanog-92-moment/>)* *** N93 Registration is OPEN!* ------------------------------------------------------------ *Join Us in Atlanta 3 - 5, Feb. 2025!* Early birds get the worm. *Don't miss out on discounted early bird pricing until 10 November!* *REGISTER NOW (https://nanog.org/events/nanog-93/ <https://nanog.org/events/nanog-93/>)* *** N93 Call For Presentations!* ------------------------------------------------------------ *Program Committee is Seeking Talk Proposals for our Next Meeting* We welcome all talk topics but are aiming to highlight presentations throughout NANOG 93 focusing on Automation. *MORE INFO (https://nanog.org/program/call-presentations/ <https://nanog.org/program/call-presentations/>)*

1 0

Reminder to Submit Presentations for NANOG 93
by Stevan Plote 31 Oct '24

31 Oct '24

NANOG Community at large, The NANOG Program Committee (PC) would like to remind you that we are now accepting proposals for in-person or live remote presentations at all sessions of NANOG 93, taking place in Atlanta, GA on February 3-5, 2025. Below is a summary of key details and dates from the Call For Presentations on the NANOG website, which can be found at https://www.nanog.org/program/call-presentations/. *Requested Topics: * We are aiming to spotlight presentations throughout NANOG 93 focusing on Automation. Topics can range from best practices, to “what I learned setting up my first automated network”, and/or a panel discussion on how ISPs, Research + Education, Enterprise and other industry sectors have implemented automation. Based on feedback from our recent surveys, we have seen numerous requests for the following topics: ● Network Automation - practical implementations, how to get started ● Kubernetes - implementation and best practices ● Future of Networking - forecast for changes in technology, design, applications ● Research & Education - what research is happening now in network operations ● Security - various protocols of, developments in, problems/solutions ● Optical Networking - technology, practices, deployment options ● Tutorials - at all skill levels, IPv6, BGP, Segment Routing, DNS, MPLS, VxLAN We are looking to schedule* 1,600 minutes of content *between General Session and Breakout Rooms for NANOG 93, and have confirmed 255 minutes to date - so don’t wait! *Presentation abstracts are welcomed now and draft slides should be submitted no later than Monday, 06 January 2025 to be considered for NANOG 93.* Presentations may cover current technologies, soon-to-be deployed technologies, and industry innovation. Vendors are welcome to submit talks which cover relevant technologies and capabilities, but presentations should not be promotional or discuss proprietary solutions. The primary speaker, moderator, or author should submit a presentation proposal and abstract via the Program Committee Tool at: https://www.nanog.org/meetings/submit-presentation/ ● Sign in with your Profile Account ● Select the type of talk you propose to present, and complete the form Timeline for submission and proposal review: ● Submitter enters abstract (and draft slides if possible) in the Program Committee Tool prior to the deadline for slide submission. ● PC performs initial review and assigns a “shepherd” to help develop the submission — typically within 2 weeks. ● Submitter develops draft slides of talk, if not already submitted with the initial proposal. Please submit initial draft slides early — the PC does not evaluate submissions until draft slides are available for review. NANOG Staff is available to assist with slide templates upon request from the submitter. ● Panel and Track submissions should provide a topic list and intended/confirmed participants in the abstract. ● PC reviews the slides and continues to work with Submitter as needed to develop the topic and content. ● *FINAL SUBMISSION DEADLINE *Draft presentation slides should be submitted prior to the published deadline for slides (06 January 2025). ● PC evaluates submissions to determine presentations for the agenda (posted on 13 January 2025). ● Submitters notified. ● Agenda assembled and posted. ● *Final presentation slides* must be submitted prior to the published deadline for slides (27 January 2025 for in person + live remote presentations). If you think you have an interesting topic but want feedback or suggestions for developing an idea into a presentation, please email the PC ( nanogpc(a)nanog.org) and a representative will respond to you in a timely manner. Otherwise, submit your talk, tutorial, track, or panel proposal to the Program Committee Tool at your earliest convenience. We look forward to reviewing your submission! *NANOG 93 Calendar of Events* *Date* *Event/Deadline* Nov. 4, 2024 CFP Reminder Announcement Dec. 2, 2024 Call for Proposals Reminder #2 Jan. 6, 2025 DRAFT Presentation Slides Due Jan. 6, 2025 Topics List Published Jan. 13, 2025 Meeting Agenda Published Jan. 27, 2025 FINAL Slides Due Feb. 2, 2025 On-Site Lightning Talk Submissions Open *Final slides for accepted presentations must be submitted by Monday, January 27, 2025.* Materials received after that date, and prior to January 31 may be accepted based on Shepherd availability, but is not guaranteed. Materials received after January 31 will not be accepted. We look forward to seeing you in February! Sincerely, Stevan Plote Program Committee Chair Sent on behalf of the NANOG Program Committee

1 0

hbo max geolocation issue
by Mehmet 30 Oct '24

30 Oct '24

hello there i am dealing with hbo max geolocation issue, is there anyone on the list from HBO team who can assist (or point me where i can look for a solution) thank you

8 9

Re: october
by Mel Beckman 29 Oct '24

29 Oct '24

Randy, My apologies, I wasn’t aware. Do you have documentation of that? They appear to still be soliciting contributions, but I see the last award was issued it back in 2012. -mel > On Oct 29, 2024, at 1:34 PM, Randy Bush <randy(a)psg.com> wrote: > >> >> There is a memorial fund for his ISOC Service Award, to which >> interested people can contribute: > > don't. the award is formally declared done. > > randy

1 0

Network and Software Skills Survey
by Cat Gurinsky 29 Oct '24

29 Oct '24

Hi folks! Anna Claiborne is the kickoff Wednesday keynote speaker for Network Automation Forum's AutoCon2 conference next month. She has put together a very brief (only 9 questions) survey for Network & Software Skills and she'd like to include the results during her presentation. If you have time, can you please do her and I a big favor and quickly complete the survey? https://forms.gle/vdXUAJAnmhVhx49S6 *"The information collected here will be used in a presentation at the Network Automation Forum in November 2024. Network engineering, software engineering, DevOps, and SRE have long been somewhat separate disciplines. The lines are becoming increasingly blurry, and it will be very helpful to know how people's job function and skill sets compare to their roles."* Thanks all! -Cat Gurinsky

1 0