- Test - lists.nanog.org

Re: Network security on multiple levels (was Re: NYT covers China cyberthreat)
by Scott Weeks 21 Feb '13

21 Feb '13

--- smb(a)cs.columbia.edu wrote: From: Steven Bellovin <smb(a)cs.columbia.edu> An amazing percentage of "private" lines are pseudowires, and neither you nor your telco salesdroid can know or tell; even the "real" circuits are routed through DACS, ATM switches, and the like. This is what link encryptors are all about; use them. --------------------------------------------------------- I would sure be interested in hearing about hands-on operational experiences with encryptors. Recent experiences have left me with a sour taste in my mouth. blech! scott

3 2

Re: NYT covers China cyberthreat
by Scott Weeks 21 Feb '13

21 Feb '13

--- Valdis.Kletnieks(a)vt.edu wrote: On Wed, 20 Feb 2013 15:39:42 +0900, Randy Bush said: > boys and girls, all the cyber-capable countries are cyber-culpable. you > can bet that they are all snooping and attacking eachother, the united > states no less than the rest. news at eleven. The scary part is that so many things got hacked by a bunch of people who made the totally noob mistake of launching all their attacks from the same place.... ------------------------------------------------ Maybe. The report says the following, but it doesn't make clear (I'm only on page 31, so I don't know if they do later in the report) if this is a small botnet, or individuals manning the 937 C&C servers: »» APT1 controls thousands of systems in support of their computer intrusion activities. »» In the last two years we have observed APT1 establish a minimum of 937 Command and Control (C2) servers hosted on 849 distinct IP addresses in 13 countries. The majority of these 849 unique IP addresses were registered to organizations in China (709), followed by the U.S. (109). »» In the last three years we have observed APT1 use fully qualified domain names (FQDNs) resolving to 988 unique IP addresses. »» Over a two-year period (January 2011 to January 2013) we confirmed 1,905 instances of APT1 actors logging into their attack infrastructure from 832 different IP addresses with Remote Desktop, a tool that provides a remote user with an interactive graphical interface to a system. »» In the last several years we have confirmed 2,551 FQDNs attributed to APT1. »» We observed 767 separate instances in which APT1 intruders used the “HUC Packet Transmit Tool” or HTRAN to communicate between 614 distinct routable IP addresses and their victims’ systems using their attack infrastructure. scott

2 1

Re: NYT covers China cyberthreat
by Kyle Creyts 21 Feb '13

21 Feb '13

The focus on platform here is ridiculous; can someone explain how platform of attacker or target is extremely relevant? Since when did people fail to see that we have plenty of inter-platform tools and services, and plenty of tools for either platform built with the express purpose of interaction with the other? Just because you learned to code/operate on/for/with/from a *nix doesn't mean that teams of Chinese coders can't make a tool that gets the job done on/for/with/from a Windows box. Many people write many softwares of diverse purpose and use for many platforms. Platform is, as far as I can tell, moot in this discussion. Feel free to enlighten me. Consider the US's indignation over the targeting of civillian or corporate intellectual property and the shifting of reality from preconceived expectation. I have had it explained to me as a purely ideological difference between the US and China. Simply put: just because we might find it immoral for state-sponsored espionage to feed stolen IP into the private sector, doesn't mean that China will feel the same; to some, it is perceived as nationalistic, another way the government helps to strengthen the nation. For another example of this, an acquaintance once told me about the process of getting internationally standardized technologies approved for deployment in China; the process that was described to me involved giving China the standards-based spec that had been drafted and approved, being told that for deployment, they would have to improve upon it in a laundry list of ways to bring it some 5-10 years ahead of the spec, and THEN it would be allowed to be deployed. Whenever you have enough new players, or the game goes on long enough, the rules end up changing. On Thu, Feb 21, 2013 at 12:28 AM, calin.chiorean <calin.chiorean(a)secdisk.net> wrote: > > ::This all seems to be noobie stuff. There's nothing technically cool > ::to see here > > You mean the report or the activity? > > You seem "upset" that they are using M$ only(target and source). They steal data!!! From whom to steal? From a guru that spend minimum 8 hours a day in from of *nix? > Why to put so much effort to steal information from that guy, when there are thousands of people out there with vulnerable and easy to break M$. > > They aren't looking to do something cool, but just a regular, plain old thief stuff. Targeting M$ users if easy, involve less resources and it's "business" profitable. You need to look at this action from business perspective. > > IMO, why to spend hours to break something (like *nix systems) that you don't even know if it contains valuable information. This is more like sniffing around to find something useful and not targeting exact system. > > Somebody here mentioned that this unit is not their top unit. I'm sure that it's not. Maybe it was meant to be found. > > Cheers, > Calin > > > ---- On Thu, 21 Feb 2013 01:29:48 +0100 Scott Weeks wrote ---- > >> >> >>--- Valdis.Kletnieks(a)vt.edu wrote: >>The scary part is that so many things got hacked by a bunch of people >>who made the totally noob mistake of launching all their attacks from >>the same place.... >>------------------------------------------------ >> >> >>This all seems to be noobie stuff. There's nothing technically cool >>to see here. All they do is spear phishing and, once the link is >>clicked, put in a backdoor that uses commonly available tools. As >>I suspected earlier it's M$ against M$ only. >> >>The downside is nontechnical folks in positions of power often have >>sensitive data on their computers, only know M$ and don't have the >>knowledge to don't click on that "bank" email. >> >>Technically, it was 74 pages of yawn. Don't waste your time unless >>you're interested in how they found out where the attack was >>originating from and how they tied it to the .cn gov't. >> >>scott >> >> > > -- Kyle Creyts Information Assurance Professional BSidesDetroit Organizer

2 1

IPv6 Routes in L3
by Darton Williams 21 Feb '13

21 Feb '13

Anyone have visibility on Level 3 IPv6 routing? I'm unable to reach http://fedoraproject.org by their primary and ended up having to spoof a secondary in local DNS. Note that this is on HughesNet; multiple levels of support have been clueless or stumped. For the curious: [darton@dkw-vostro ~]$ dig -6 @google-public-dns-a.google.com -t aaaa www.fedoraproject.org ; <<>> DiG 9.9.2-P1-RedHat-9.9.2-3.P1.fc17 <<>> -6 @ google-public-dns-a.google.com -t aaaa www.fedoraproject.org ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21521 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.fedoraproject.org. IN AAAA ;; ANSWER SECTION: www.fedoraproject.org. 1200 IN CNAME wildcard.fedoraproject.org. wildcard.fedoraproject.org. 1200 IN AAAA 2607:f188::dead:beef:cafe:fed1 wildcard.fedoraproject.org. 1200 IN AAAA 2001:4178:2:1269::fed2 wildcard.fedoraproject.org. 1200 IN AAAA 2610:28:3090:3001:dead:beef:cafe:fed4 ;; Query time: 10 msec ;; SERVER: 2001:4860:4860::8888#53(2001:4860:4860::8888) ;; WHEN: Wed Feb 20 22:13:26 2013 ;; MSG SIZE rcvd: 163 Love the beefy theme there... fed2 is the only one I can't reach, and though the AAAA records are round-robin, fed2 appears to be the one to which HTTP requests get routed and tracing that takes me from Salt Lake to Munich by way of Paris before timing out: [darton@dkw-vostro ~]$ traceroute6 -N 64 fedoraproject.org traceroute to fedoraproject.org (2001:4178:2:1269::fed2), 30 hops max, 80 byte packets 1 2001:5b0:216e:9590:280:aeff:fe3f:4965 (2001:5b0:216e:9590:280:aeff:fe3f:4965) 24.672 ms 24.504 ms 24.506 ms 2 * * * 3 2001:5b0:21ff:fffa::100 (2001:5b0:21ff:fffa::100) 1079.945 ms 1237.825 ms 1290.435 ms 4 vlan122.car1.SaltLakeCity1.Level3.net (2001:1900:2100::d9d) 1341.274 ms 1409.308 ms 1411.624 ms 5 vl-11.car2.SaltLakeCity1.Level3.net (2001:1900:4:1::13e) 1489.445 ms 1508.739 ms 1733.181 ms 6 vl-4043.edge3.Denver1.Level3.net (2001:1900:4:1::142) 1578.809 ms 1639.417 ms 1641.692 ms 7 vl-4081.edge6.Denver1.Level3.net (2001:1900:4:1::32) 1641.783 ms vl-4080.edge6.Denver1.Level3.net (2001:1900:4:1::2e) 1691.372 ms vl-4081.edge6.Denver1.Level3.net (2001:1900:4:1::32) 1698.425 ms 8 vl-4042.edge1.Chicago2.Level3.net (2001:1900:4:1::36) 1745.349 ms 1745.056 ms 1744.322 ms 9 vl-4067.car1.Chicago1.Level3.net (2001:1900:4:1::1d) 1744.410 ms 1744.489 ms 1737.454 ms 10 vl-4061.car2.NewYork2.Level3.net (2001:1900:4:1::22) 1873.919 ms 1873.887 ms 1870.193 ms 11 vl-4080.car1.NewYork2.Level3.net (2001:1900:4:1::f1) 1766.868 ms 1766.506 ms 1765.284 ms 12 vl-4061.edge2.Washington1.Level3.net (2001:1900:4:1::105) 1767.345 ms 1767.463 ms 1767.493 ms 13 vl-4081.edge1.Washington1.Level3.net (2001:1900:4:1::d5) 1767.633 ms vl-4083.edge1.Washington1.Level3.net (2001:1900:4:1::dd) 1801.766 ms vl-4081.edge1.Washington1.Level3.net (2001:1900:4:1::d5) 1801.754 ms 14 vl-4086.edge3.Paris1.Level3.net (2001:1900:6:1::15) 1844.308 ms 1844.440 ms 1844.908 ms 15 vl-4081.edge4.Paris1.Level3.net (2001:1900:5:1::12e) 1844.358 ms 1844.415 ms vl-4080.edge4.Paris1.Level3.net (2001:1900:5:1::12a) 1843.473 ms 16 vl-4060.edge3.Frankfurt1.Level3.net (2001:1900:5:1::215) 1845.091 ms 1845.065 ms 1845.030 ms 17 vl-4043.car1.Munich1.Level3.net (2001:1900:5:1::25e) 1845.052 ms 1845.033 ms 1897.648 ms 18 * * * 19 * * * 20 * * * 21 * * * 22 * * * 23 * * * 24 * * * 25 * * * 26 * * * 27 * * * 28 * * * 29 * * * 30 * * * fed4 is a different route: [darton@dkw-vostro ~]$ traceroute6 2610:28:3090:3001:dead:beef:cafe:fed4 traceroute to 2610:28:3090:3001:dead:beef:cafe:fed4 (2610:28:3090:3001:dead:beef:cafe:fed4), 30 hops max, 80 byte packets 1 2001:5b0:216e:9590:280:aeff:fe3f:4965 (2001:5b0:216e:9590:280:aeff:fe3f:4965) 15.410 ms 15.337 ms 15.269 ms 2 * * * 3 2001:5b0:21ff:fffa::100 (2001:5b0:21ff:fffa::100) 897.468 ms 915.494 ms 975.368 ms 4 vlan122.car1.SaltLakeCity1.Level3.net (2001:1900:2100::d9d) 1026.481 ms 1044.762 ms 1164.987 ms 5 vl-4046.edge5.LosAngeles1.Level3.net (2001:1900:4:1::279) 1198.366 ms 1406.782 ms 1504.377 ms 6 vl-60.edge1.LosAngeles9.Level3.net (2001:1900:12:1::d) 1602.064 ms 789.763 ms 646.960 ms 7 gblx-level3-10G.LosAngeles9.Level3.net (2001:1900:4:3::276) 702.353 ms 733.689 ms 902.689 ms 8 snvang.abilene.ucaid.edu (2001:504:d::bd) 966.739 ms 1006.089 ms 1090.304 ms 9 * * * 10 xe-1-0-2.60.rtr.atla.net.internet2.edu (2001:468:1:60::1) 1260.105 ms 1342.136 ms 1386.991 ms 11 chlt7600-gw-to-chltcrs-gw.ncren.net (2610:28:10c:5::2) 1439.616 ms 1550.497 ms 1630.215 ms 12 manningkid-to-chlt7600-gw.ncren.net (2610:28:10c:7::2) 1034.366 ms 1034.401 ms 1172.668 ms 13 2610:28:3090:23::2 (2610:28:3090:23::2) 1003.700 ms 1017.225 ms * 14 2610:28:3090:3001:dead:beef:cafe:fed4 (2610:28:3090:3001:dead:beef:cafe:fed4) 921.136 ms !X 832.055 ms !X 789.599 ms !X Any ideas/comparisons/insights appreciated. This is so far the only native IPv6 connection I have, despite having access to two datacenters and FiOS, so not much to compare it with. Shameful. Regards, Darton Williams ...Yeah, that guy.

1 1

T-Mobile Debuts Novel Network Management with GoSmart
by Jay Ashworth 21 Feb '13

21 Feb '13

Check this out. Cheers, -- jra http://www.phonescoop.com/articles/article.php?a=11956 This email was sent via Phone Scoop (www.phonescoop.com) The sender thought you might be interested in the page linked above.

1 0

FCC Commits to Opening Up More 5GHz Airwaves
by Jay Ashworth 21 Feb '13

21 Feb '13

Might this solve the "10MB problem" discussed on NANOG? Cheers, -- jra http://www.phonescoop.com/articles/article.php?a=11953 This email was sent via Phone Scoop (www.phonescoop.com) The sender thought you might be interested in the page linked above.

3 5

Re: NYT covers China cyberthreat
by Scott Weeks 21 Feb '13

21 Feb '13

Be sure to read the source: intelreport.mandiant.com/Mandiant_APT1_Report.pdf I'm only part way through, but I find it hard to believe that only micro$loth computers are used as the attack OS. Maybe I haven't gotten far enough through report to find the part where they use the *nix boxes? scott

3 2

TelePacific a good choice?
by Jeff Harper 20 Feb '13

20 Feb '13

Hiya, We're looking at TelePacific as a possible solution for some of our transit needs. If you have an honest experience with them, positive or negative, I'd like to hear from you. Simply email me off line with your experiences, thanks! Jeff Harper, CCIE (W) | www.well.com ip access-list extended jeff permit tcp any any eq intelligence deny tcp any any eq stupid-people

4 3

Re: NYT covers China cyberthreat
by Scott Weeks 20 Feb '13

20 Feb '13

>I'm only part way through, but I find it hard to believe that >only micro$loth computers are used as the attack OS. Maybe I --- calin.chiorean(a)secdisk.net wrote: From: "calin.chiorean" <calin.chiorean(a)secdisk.net> <snipped> :: when all tools are available for windows os, you just have to compile them. <sniped out the rest> ------------------------------------------------- From: Scott Weeks <surfer(a)mauigateway.com> ::: They're not all available for m$. --- wbailey(a)satelliteintelligencegroup.com wrote: From: Warren Bailey <wbailey(a)satelliteintelligencegroup.com> They are when you have a college full of programmers. -------------------------------------------------- Please elaborate. I didn't follow that. scott

5 4

Check this out T-Mobile Launches GoSmart Prepaid Service Nationally on Phone Scoop
by Jay Ashworth 20 Feb '13

20 Feb '13

Check this out: http://www.phonescoop.com/articles/article.php?a=11946 This email was sent via Phone Scoop (www.phonescoop.com) The sender thought you might be interested in the page linked above.

8 8