- Test - lists.nanog.org

Re: motivating security, was Re: Every incident...
by Alexander Harrowell 12 Feb '07

12 Feb '07

d Lewis <Ed.Lewis(a)neustar.biz> wrote: > > > I don't mean to say that the car owners or computer users are free > from blame. But holding a sentiment of just blaming users is not > helpful. OTOH, if there was something the operators could clearly do > to stop this, someone would have suggested it by now. (There are all > them laws about snooping traffic, etc.) > > I thought I had a conclusion ... but I don't. Sure. Demonising sufferers didn't stop the spread of AIDS, probably made it worse (Saudi Arabia has one of the fastest growing HIV problems, they say). But shouting at people to wear condoms/use a firewall has diminishing returns. It's complicated.

1 0

Re: motivating security, was Re: Every incident...
by Alexander Harrowell 12 Feb '07

12 Feb '07

On 2/12/07, Edward Lewis <Ed.Lewis(a)neustar.biz> wrote: > > Security is never something I should want, it is always > something I have to have. No-one wants "security", they want not-trouble. Similar to the point that no-one wants energy, they want warm rooms and cold beers. Perhaps we need a concept of "security efficiency"? Security has to resign itself to being > second-class in the hearts and minds of society. Security has to be > provided in response to it's environment and not complain about it's > lot in life. > > (I realize that this post doesn't say anything about people "dying" - > I've heard that in other contexts.) Yup >Society holds individuals accountable for many forms of irresponsible > >behaviour. > > This is true, but individuals are not held entirely accountable. A > reckless driver can cause a multi-car accident on an exit ramps and > cause a tie up for the entire morning rush. Are the "victims" of > this compensated? What about the person who loses a job offer > because of a missed interview and suffers fallout from that? > > And maybe it isn't recklessness. A failed water pump may cause a > breakdown, followed by an accident, etc. Mentioned just to spread > the analogy out. The whole logic of modern computing is that everything migrates towards users. Why shouldn't security? After all, if people didn't let the nasties in, 'twould be very hard to start a botnet.. >There's no need to make exceptions for > >computer users. Make computer-owners/users pay in full for damages > >caused by their equipment with no discount for incompetence. > > If that happened, then computer users would be the exception. I > can't think of any situation in which an accident might occur and the > one causing the accident pays in full to everyone. > [snip] True, but there are plenty of examples of either market (insurance) or government (regulation) solutions to problems where the individual's misfortune also falls on society. Arguably the bulk of the costs of malware proliferation is an externality - the benefits go to the enemy, but costs aren't restricted to the hacked. Not even close. I used to work for a gov't facility whose mission was science. They > had a serious telecommunications problem on their hands. Although it > was important to solve, they funded science first - up until all the > telecom problems became "too annoying" and money was allocated to > solve the problem. > The appropriate analogy is the Great Stink of 1858. London had been suffering from not having sewerage for years, and poor people had been dying in droves from cholera, but nobody with the power to do anything about it cared enough until the Thames got so bad the committee rooms on the river side of Whitehall stank so much nobody would go in them. Then, wham, out came the chequebook, the compulsory purchase powers, and in came Joseph Bazalgette, with the result of an infrastructure used to this day.

2 1

Re: death of the net predicted by deloitte -- film at 11
by Brandon Butterworth 12 Feb '07

12 Feb '07

> I think you're presupposing that the concept of "channels" is > something that will persist. For some time. There's quite an industry with an interest in maintaining that. It probably won't vanish until the current generations die. Channel based and discrete delivery of content (radio vs records, tv/cinema vs vhs/dvd) have coexisted for some time. If one loses ground it's not a problem unless you take sides. brandon

2 1

Web Server Botnets and Server Farms as Attack Platforms
by Gadi Evron 12 Feb '07

12 Feb '07

Are file inclusion vulnerabilitiess equivalent to remote code execution? Are servers (both Linux and Windows) now the lower hanging fruit rather than desktop systems? In the February edition of the Virus Bulletin magazine, we (Kfir Damari, Noam Rathaus and Gadi Evron (me) of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we describe how these are taken to the next level with live attacks and operational problems service providers deal with daily. We discuss how these attacks work using (mainly) file inclusion vulnerabilities (RFI) and (mainly) PHP shells. Further, we discuss how ISPs and hosting farms suffer tremendously from this, and what can be done to combat the threat. I'd like to write more on this here, and ask for the community's feedback on what others see in this field and how you deal with similar issues. Malware is often built to operate within a certain OS environment. Web server malware is completely cross-platform (as long as a web daemon which supports scripting can be found such as IIS, Apache, etc.). These malware attack the web application first, and only then further compromise takes place platform by platform, using the web server's privileges. Most web servers are being compromised by these attacks as a result of an insecure web application written in PHP, although attacks for other scripting languages such as Perl and ASP are also in-the-wild. The main reason for this is that many different PHP applications are available online, and often freely as open source, which makes them a popular selection for use on many web sites. Another reason for the popularity of attacks against PHP applications is that writing securely in PHP is very difficult, which makes most of these PHP applications vulnerable to multiple attacks, with hundreds of new vulnerabilities released publicly every month. While in the past botnets used to be composed of mainly broadband end users running Windows, today we can see more and more server botnets we can refer to as "IIS botnets" or "Linux botnets" as a direct result of these attacks. One of the conclusions we reached was that although the technologies used are not new (RFI, PHP shells, etc.) the sheer scale of the problem is what's interesting. In our research as detailed in the Virus Bulletin article we recognize that vulnerabilities such as file inclusion, as simple as they may be, are equivalent to remote code execution in effect. Although escalation wars, which are reactive in nature, are a solution we hate and are stuck with on botnets, spam, fraud and many other fronts, this front of web server attacks stands completely unopposed and controlled by the bad guys. In our research we detail how over-time, when aggregated, most attacks come from the same IP addresses without these ever getting blocked. ISPs and hosting farms selling low-cost hosting services can not cope with this threat, especially where an attack against one user running such an application can compromise a server running 3000 other sites. Another issue discussed was the formation of the Web Honeynet Task Force ( http://www.webhoneynet.net/ renamed from the Web Honeynet Project to avoid confusion with the honeynet project). I write more about this and host the paper on my blog at SecuriTeam ( http://blogs.securiteam.com/index.php/archives/815 ). All rights for the article itself belong to the Virus Bulletin magazine. Gadi Evron.

1 0

Re: death of the net predicted by deloitte -- film at 11
by Brandon Butterworth 12 Feb '07

12 Feb '07

> Multicast isn't going to help the phoneco atm network. Indeed, people keep quoting that but it's a bogus argument as nothing will help the phoneco atm network running out of bandwidth other than upgrading it That is happening, unicast/p2p/multicast/whatever, as all this content is raising average user bandwidth > But if you accept that the average user only watches 3-6 hours of HDTV per > day, you can spread the load out over 24 hours, the effects on available > bandwidth can be reduced. The TIVO model appears to have an advantage for > the viewer (a large archive to select from) and for the phoneco's and ISP's > at the customer end. When people have their akamai@home box that'll help for some cases. To say it's a universal fix is a bogus as saying multicast will fix all problems. brandon

1 0

Re: death of the net predicted by deloitte -- film at 11
by Frank Coluccio 12 Feb '07

12 Feb '07

I believe that the element that has been missing in this discussion thus far has been the source (content) players, and where they are hiding. CDNs, a la Akamai, Limelight, etc., will take up some of the slack and mitigate much of the backbone burden where legitimate ISPs are concerned, as will hierarchical caching for the newbie carriers-that-came-to-be-called "ISPs" -i.e., the MSOs and Telcos. Playing the Pareto, the higher the demand (95/5) for a title, the closer it will be stored to the user community, and the longer the tail (5/95) of a title, the farther its storage from the user community. My point is, CDNs and hierarchical cache must be inserted into the calculus, because one, they are already being used, and two, their use will only increase with time, fwiw. Frank ps - I've had some issues with my email editor of late. If anyone notices any artifacts or extraneous characters in the delivery of this message, kindly email me off list and I shall be indebted to you, tia. On Sun Feb 11 19:22 , "Geo." sent: > > >> do what google is presumably doing (lots of fiber), or would they put >> some capital and preorder into IDMR? > >IDMR is great if you're a broadcaster or a backbone, but how does it help >the last 2 miles, the phoneco ATM network or the ISP network where you have >10k different users watching 10k different channels? I'm not sure if it >would help with a multinode replication network like what google is probably >up to either (which explains why they want dedicated bandwidth, internode >replication solves the backup problems as well). > >Also forgetting that bandwidth issue for a moment, where is the draw that >makes IPTV better than cable or satellite? I mean come on guys, if the >world had started out with IPTV live broadcasts over the internet and then >someone developed cable, satellite, or over the air broadcasting, any of >those would have been considered an improvement. IPTV needs something the >others don't have and a simple advantage is that of an archive instead of >broadcast medium. The model has to be different from the broadcast model or >it's never going to fly. > >TIVO type setup with a massive archive of every show so you can not only >watch this weeks episode but you can tivo download any show from the last 6 >years worth of your favorite series is one heck of a draw over cable or >satellite and might be enough to motivate the public to move to a different >service. A better tivo than tivo. As for making money, just stick a >commercial on the front of every download. How many movies are claimed >downloaded on the fileshare networks every week? > >Geo. >

2 1

RE: Question about SLAs
by michael.dillon＠bt.com 11 Feb '07

11 Feb '07

> An SLA is a contract. > > A contract is... a contract. Does that mean you can take them to small claims court if they don't pay you the agreed SLA credits? --Michael Dillon

6 5

Any NANOGers going to 3GSM World Congress?
by Alexander Harrowell 11 Feb '07

11 Feb '07

For the mobile maniacs among us..if you're coming to Barcelona, and flying Iberia, BA or Lufthansa via Heathrow, beware that your aircraft will come in at Terminal A but your checked baggage will be sent to Terminal B. Do NOT pass through the doors to the baggage reclaim in Terminal A because you won't be able to get back through, and will have to pass through the security checkpoint in Terminal B Departures to recover your bags. This will be problematic for non-Spanish speakers and impossible for anyone who has thrown away their ticket stub. That is, of course, if any NANOG users actually *have* checked baggage.

1 0

an RBL for virus alert senders?
by Mark Jeftovic 10 Feb '07

10 Feb '07

Is there an RBL for mail servers run by brain dead "postmasters" that insist on running anti-viral software that sends out less-than-useless "virus alerts", "virus in your email", "banned attachment" spewage to the guaranteed-to-be-forged "From" address in the message headers? I wouldn't mind never receiving another piece of email from servers like that again. Ever. Bueller? Bueller? -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder & President, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(866) 273-2892

2 1

Question about SLAs
by Barry Shein 09 Feb '07

09 Feb '07

Other than "give them the bum's rush!" what do you do when a vendor is a PITA about SLAs for outages? Obviously there's not enough on the table to get lawyers involved, but it's aggravating when first they act like they lost your SLA request, then claim their logs don't match your logs in some significant way, then try to avoid returning calls to find out what got decided about disputes I guess hoping you'll give up, etc. It's lousy "game theory" if the vendor just wants to insist their logs are very different than the customer's (highly detailed logs), for example, short of bolting, which there might be other reasons to not want to do except as a last resort, like the cost would be a lot more than the SLAs in question. But where's the leverage? I hope this is operational enough for this list, if not feel free point me somewhere else. -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

5 6