- Test - lists.nanog.org

[Fwd: Admin: Offtopic Political Threads]
by S. Ryan 28 Jul '08

28 Jul '08

Did you all forget this? -------- Original Message -------- Subject: Admin: Offtopic Political Threads Date: Mon, 28 Jul 2008 09:29:24 +1200 (NZST) From: Simon Lyall <simon(a)darkmere.gen.nz> To: nanog(a)nanog.org List members are reminder that the NANOG List Acceptable Use Policy states that: 6. Postings of political, philosophical, and legal nature are prohibited. The current thread on the "Free Market" and "So why don't US citizens get this?" appears to be solely political and should be moved elsewhere. Simon Lyall NANOG Mailing List Committee The above is a "reminder" regarding desired emails to the NANOG mailing list from the Mailing List Committee (MLC). While it does not constitute a "Formal Warning" it is an official correspondence from the MLC after internal consultation. Please contact admins(a)nanog.org if you have any feedback

2 1

Aid in bypassing DNS issue
by Steve Bertrand 28 Jul '08

28 Jul '08

With the time I've had, I've tried my best to keep up with every message related to the current issue upon us related to DNS. I am a small op, amongst many that I've met the last few days that may need assistance. I would like at least someone from a large operation to read what I've done, what my concerns are and what help might be provided for a scenario. If this is as big an issue as I feel it is, then perhaps those with resources can offer advice. If you will: I've: - exploited a legacy machine and hijacked the NS records - set up an NS under the phony domain - configured A, AAAA and MX records for the hijacked domain (example.com) - put in place a simple index.html file for a website - configured email accounts - you get the point...it all works Then: - made some slight changes to the latest (as of 1000hrs 080725) to the bailiwicked_domain.rb file to accept a new parameter 'RECURSCHK', that 'fixes' the problem of a consistent domain showing up in the initial TXT check that from what I can tell tests for recursion: (#set recurschk wwNN.myDdomain.com) It allows an attacker to set a lookup against a name/record that (s)he knows exists to get the ball rolling initially. This generally ensures that the first check of the exploit will always pass (at least get an affirmative response, recursive or not), but come under the radar of an expecting IDS filter. Once one host is exploited, then the rest of the names can be built/run against, well, anything of course ...unfinished, but in progress (I know Perl, never dealt with Ruby... a if/for/while would be handy). I'd like to change the initial TXT to an A, but I don't think I quite understand the ramifications on the grand scheme of things within the scope of the exploit code, unless I were to focus more time on this. Technically, I'm now on holidays... Anyway, if you've read this far, - my true, core name servers are as vulnerable as any name server that has been patched - I have clients connected to my 'upstream' (if you please) - I configured a DNS server (implementation regardless) to "FORWARD ONLY" to the 'upstream' DNS servers - We found that we are vulnerable, due to the fact that our 'upstream' DNS servers are vulnerable because they don't use port randomization - we have wholesale business clients who are directly connected to this 'upstream', and retrieve DNS server addresses via DHCP from somewhere within their access layer - the 'upstream' has made no confirmation regarding fixes after discussion My question: How to deal with this? It appears as though there are many that state "...the patching has gone down hill", but what to do when your hands are tied? Is there a network operations centre capable, able and willing to publicly claim: "if you've tried your best to tell your 'upstreams' (ISP) to fix the issue but they haven't, tell them to forget patching, ignore the work until the problem goes away, turn off recursion and forward to us, then patch later when you can afford some downtime"? Thank you to everyone who has already put so much time and determination into this issue. Steve

2 1

Re: Exploit for DNS Cache Poisoning - RELEASED
by Paul Ferguson 28 Jul '08

28 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Jared Mauch <jared(a)puck.nether.net> wrote: >If your nameservers have not been upgraded or you did >not enable the proper flags, eg: dnssec-enable and/or dnssec-validation >as applicable, I hope you will take another look. Let's hope some very large service providers get their act together real soon now. http://www.hackerfactor.com/blog/index.php?/archives/204-Poor-DNS.html - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIiAJiq1pz9mNUZTMRAiSqAJwL9t4ldzKMjHyA4KITrLz2dHvTFQCgkfuR G4SnZhKReOYYBjdSSJamVQw= =ac5p -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

9 12

cogent bgp filtering policies?
by John van Oppen 28 Jul '08

28 Jul '08

Now that I am on my third round of an email argument with cogent's support department about adding prefixes to our filters (and them not understanding why I want le 24 matches on the blocks from which we allocate subnets to multi-homed customers) I figure it would be a good idea to ask if anyone has ever gotten cogent to setup any IRR based filtering on a customer connection. We are a small-ish regional transit provider in the northwest announcing > 100 prefixes and just spent the last few days writing emails and calling trying to get cogent to accept more than 30% of the routes we were announcing. We have IRR (radb to be specific) filters set up with our other four providers which really lowered my tolerance for having to go round and round to get prefixes added. Heck, at this point I would settle for a direct email address for their engineering department just to avoid the arguments with the support monkeys. I should note that this is actually the second time I have had this issue (the last time was with one of our customers and their cogent connection) even though we only turned up our service recently. John van Oppen AS11404

3 3

Admin: Offtopic Political Threads
by Simon Lyall 28 Jul '08

28 Jul '08

List members are reminder that the NANOG List Acceptable Use Policy states that: 6. Postings of political, philosophical, and legal nature are prohibited. The current thread on the "Free Market" and "So why don't US citizens get this?" appears to be solely political and should be moved elsewhere. Simon Lyall NANOG Mailing List Committee The above is a "reminder" regarding desired emails to the NANOG mailing list from the Mailing List Committee (MLC). While it does not constitute a "Formal Warning" it is an official correspondence from the MLC after internal consultation. Please contact admins(a)nanog.org if you have any feedback

3 3

RE: So why don't US citizens get this?
by natalidel＠mailinator.com 27 Jul '08

27 Jul '08

Guy_Shields at Stream.Com <<a href="mailto:nanog%40nanog.org?Subject=So%20why%20don%27t%20US%20citizens%20get%20this%3F&In-Reply-To=" title="So why don't US citizens get this?">Guy_Shields(a)Stream.Com</a>> said at Sat Jul 26 23:00:47 UTC 2008 > We do its called FIOS. AFAIK they don't offer affordable 100mbps symmetric connections though via their fiber to house service... ;) -- No, this email's not real, it's http://deadfake.com

9 8

Deja Vu [Was: Re: So why don't US citizens get this?]
by Paul Ferguson 27 Jul '08

27 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Joe Greco <jgreco(a)ns.sol.net> wrote: >The telcos might disagree... it's a free market... they're free to >market whatever they want. And they do. Rightfully so, I suppose. I think the issue that was being discussed -- which I shouldn't probably compel -- is the fact that questionable decisions have been in the U.S. regulatory process which favor monopoly interests. Free markets have a tendency to become "un-free" when monopolistic positioning becomes entrenched -- and even preferred by government bureaucrats. But allow to me apologize now for my non-technical response, although I feel compelled myself to point out the obvious. We just don't have the competitive choices we should, as consumers. What is old, seems to be new again, unfortunately. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIjABTq1pz9mNUZTMRAjy2AKCW+hRG+VKsTLqVdv48MyecZZClmwCeNe7I BSq9TB1EtsQqJwgl5/LaRag= =8Ovk -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

So why don't US citizens get this?
by natalidel＠mailinator.com 27 Jul '08

27 Jul '08

https://asahi-net.jp/en/service/ftth.html -- hmm? -- No, this email's not real, it's http://deadfake.com

2 1

(exchange point) EP.net
by Chris Stebner 27 Jul '08

27 Jul '08

Can anyone involved with EP.net (bill?) pls contact me? Ive been trying to get a hold of someone for about two weeks now with no luck regarding an allocation and problems with it. Thanks Much, Chris

1 0

Re: Exploit for DNS Cache Poisoning - RELEASED
by Paul Ferguson 26 Jul '08

26 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- Sean Donelan <sean(a)donelan.com> wrote: >> >> Let's hope some very large service providers get their act together >> real soon now. > >There is always a tension between discovery, changing, testing and finally deployment. > Sure, I can empathize, to a certain extent. But this issue has been known for 2+ weeks now. Not sure I can be very empathic now, given the seriousness, and the proper warning ISPs have been given. $.02, - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIiBldq1pz9mNUZTMRAiLjAJ91jnOPW+nhuk0PA5qGjrwz0bH25ACgjOXS IEJTnVU4BIZ8bMfU7dB4ZKY= =sBS2 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

13 19