- Test - lists.nanog.org

A request for your support of:hutzler-spamops-05.txt
by Dave Crocker 27 Jan '06

27 Jan '06

Folks, Howdy. Carl Hutzler, Pete Resnick, Robert Sanders, Eric Allman and I pulled together a BCP (Best Current Practices) draft document as a result of a number of discussions between some ASRG members and the old ASTA (antispam technical alliance) group. The latest version of the document is published on the MIP Association site and has been submitted to the IETF. We have gone through 5 drafts now with reasonable review during each stage. Document locations: http://mipassoc.org/spamops/draft-hutzler-spamops-05.txt http://ietfreport.isoc.org/all-ids/draft-hutzler-spamops-05.txt If you are not familiar with the document, the main ideas expressed are how: 1) To improve lines of *accountability* for controlling abusive uses of the Internet mail service. (when abuse happens, which party is responsible) 2) To provide recommendations for *constructive operational policies* between independent operators of email transmission services including the submission (or posting) of email into the transmission network (certainly very relevant to the deployment of DKIM and other email authentication type technologies) We are at a stage in the life cycle of this document where it would be helpful to see a renewed support from the technical community. * So how can you help? Simple! Just reply back to me or any of the authors (email addresses available in the document itself) with a couple of words of support: - how this document might help you justify doing the right thing (maybe to your management) - how this document helps establish inter-isp best practices and breakdown of responsibilities for abuse situations - how this document helps establish important operational practices in the area of Email Authentication deployment - other? We will pull together the words of support and provide them to Bert Wijnen as a way to show the level of interest in getting this thing through. (FYI, Bert Wijnen is the Operations and Management Area Director we have been working with on this final stage.) Thank you in advance, Dave (on behalf of all of the authors) -- Dave Crocker Brandenburg InternetWorking <http://bbiw.net>

1 0

RE: Wifi SIP WPA/PSK Support
by Casey Halverson 27 Jan '06

27 Jan '06

What is the list price for this device? They do not seem to have any facility for ordering. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Mike Leber > Sent: Wednesday, January 25, 2006 10:08 PM > To: Suresh Ramasubramanian > Cc: nanog(a)merit.edu > Subject: Re: Wifi SIP WPA/PSK Support > > > > Thank you! We'll order one immediately and report back. > > Mike. > > On Thu, 26 Jan 2006, Suresh Ramasubramanian wrote: > > > On 1/26/06, Mike Leber <mleber(a)he.net> wrote: > > I'm working on finding a Wifi SIP phone that supports > WPA/PSK that we > > can recommended to VOIP clients. As everybody knows, > currently most > > Wifi SIP phones support WEP which is demonstrably insecure. For > > banking and financial customers, or companies that are > given passwords > > or credit cards over the phone, this is a serious security issue. > > http://www.paesys.com/en/WIFI_wireless_phone_moimstone_Stonehe > nge_WP150.htm > > Security & Encryption > WPA-PSK AES, TKIP > 64/128 bit WEP > 802.1x certification (Optional) > > Even seems to do v6. > > -srs >

2 1

Re: BlackWorm infected IP's reporting
by Martin Hannigan 27 Jan '06

27 Jan '06

> > Hi, > > On Mi, 2006-01-25 at 03:20 -0500, Martin Hannigan wrote: > > > > > > > > > Hi. > > > > > > In the next day or so some of us will cooperate to bring to the > > > attention of all effected AS's information about infected users in their > > > net-space. > > > > That would be "affected". > > > > > This will be coordinated with several groups and organizations. Please > > > expect these emails, thanks. > > > > In other words, NANOG is a step child of these and we'll only see > > the PR? If you're going to keep the mitigations off of NANOG, it's > > probably safe to keep it all off. We all read newspapers, blogs, and > > slashdot. > > sorry, but i couldn't understand your problem. I think it's just a > usefull information, wich AS is infected by a critical worm. Also i > relay this information to people, who think this informations are > usefull, too. > > Ok, perhaps there are people to advertise themselves, but why not? When > they invest time in this work, why aren't they allowed to get some kind > of approval? Nah, we already know who those people are. It's more like if you keep predicting a blizzard and I wake up and there was a misting of rain, I keep getting less and less interested in the predictions. It costs real money to get these dances going and unless you're going to give us all the information, please don't bother. The snort SIDS were nice, but as far as I am concerned, IL-CERT is not a trusted source. The third story about this horrrible worm: http://www.commentwire.com/article_news.asp?guid=20856A5C-3952-4F2C-913A-1E… If I don't see SANS running around with their capes off, I don't really pay too much attention. The last one wasn't a big hit like they thought, but they do good work. I "trust" them more than I trust IL-CERT telling North Americans to drop our hotdogs, turn off our football, and get ready for "worms". I'd hope to see US-CERT continue making progress and telling North Americans when to worry. The work everyone is doing is fantastic, but it's pretty clear trust is being ignored and while we're ont he subject proper delivery of files with checksums etc. It ain't happening anymore. -M<

11 16

RE: Wifi SIP WPA/PSK Support
by Casey Halverson 26 Jan '06

26 Jan '06

I have actually been following this as well, and I have tested several of these handsets. Others have been impossible to source. Typically startups will attempt to bring a wifi voip handset to the market, realize there is no demand, and fold. In the particular discussion of WPA: Note that the two Senaos listed claim WPA support, but this is not available in the current firmware. There also hasn't been any updates to it in a year or so -- don't expect it anytime soon. > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Frank Bulk > Sent: Thursday, January 26, 2006 12:56 PM > To: nanog(a)merit.edu > Subject: RE: Wifi SIP WPA/PSK Support > > > > I've been tracking the Wi-Fi SIP phone space for some time, > and have documented all the phones that I could find here: > http://www.mtcnet.net/~fbulk/VoWLAN.doc > It's about a 7 MB file because I've included pictures of > these devices where I could find them. > > Because we just installed a SIP proxy server on our switch I > took the opportunity to purchase and try out 4 Wi-Fi SIP phones: > - Hitachi IPC-5000 > - UTStarcom F1000 > - Pulver WiSIP/ZyXEL P-2000W v1 > - ZyXEL P-2000 v2 > > The last two offer identical user interface and functionality > but a different shell. > > The Hitachi doesn't offer WPA support, but it does do 802.1X > (specifically EAP-MD5, EAP-TLS, PEAP, and EAP-TTLS) with WEP. > That probably means it can hand out WEP keys, and perhaps > perform dynamic WEP. The only phone to support WPA from that > short list is the F1000 with 3.60 or higher firmware, and > that's only WPA-PSK. > > If you look in the Word document you'll see there are other > phones that offer WPA support, but there not are readily > available in the North American market. > > Kind regards, > > Frank > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Mike Leber > Sent: Wednesday, January 25, 2006 10:35 PM > To: nanog(a)merit.edu > Subject: Wifi SIP WPA/PSK Support > > > > I'm working on finding a Wifi SIP phone that supports WPA/PSK > that we can recommended to VOIP clients. As everybody knows, > currently most Wifi SIP phones support WEP which is > demonstrably insecure. For banking and financial customers, > or companies that are given passwords or credit cards over > the phone, this is a serious security issue. > > We recently bought a Hitachi-Cable Wireless IPC-5000 WiFi SIP > Phone from voipsupply.com after finding some web pages that > said that phone supported WPA (the pages were in German), yet > once we got the phone all it supported was WEP even after > updating the firmware to the latest version using the website > mentioned in the documentation that came with the phone. > > I've had a few people say that there was some sort of > conspiracy to keep US citizens from using secure phones, > however I found that laughable because the potential risk of > terrorist or criminal interception from having all Wifi > telephone conversations involving credit cards (let alone > social security numbers, bank account numbers, passwords, > what have you) in the clear would create an attack vector so > large as to exceed all other possible attack vectors... I > mean why work on cracking anything when you can just listen > to everybody in the clear (well virtually in the clear with WEP). > > So, back in reality, could anybody in the US that bought > their Wifi SIP phone in the US share a success story at > getting Wifi SIP setup with WPA/PSK? What model of phone did > you buy? Where did you get it? Did you have to upgrade it > to any special version of firmware or what? > > Mike. > > +----------------- H U R R I C A N E - E L E C T R I C > +-----------------+ > | Mike Leber Direct Internet Connections Voice > 510 580 4100 | > | Hurricane Electric Web Hosting Colocation Fax > 510 580 4151 | > | mleber(a)he.net > http://www.he.net | > +------------------------------------------------------------- > ----------+ > > >

1 0

RE: Wifi SIP WPA/PSK Support
by Frank Bulk 26 Jan '06

26 Jan '06

I've been tracking the Wi-Fi SIP phone space for some time, and have documented all the phones that I could find here: http://www.mtcnet.net/~fbulk/VoWLAN.doc It's about a 7 MB file because I've included pictures of these devices where I could find them. Because we just installed a SIP proxy server on our switch I took the opportunity to purchase and try out 4 Wi-Fi SIP phones: - Hitachi IPC-5000 - UTStarcom F1000 - Pulver WiSIP/ZyXEL P-2000W v1 - ZyXEL P-2000 v2 The last two offer identical user interface and functionality but a different shell. The Hitachi doesn't offer WPA support, but it does do 802.1X (specifically EAP-MD5, EAP-TLS, PEAP, and EAP-TTLS) with WEP. That probably means it can hand out WEP keys, and perhaps perform dynamic WEP. The only phone to support WPA from that short list is the F1000 with 3.60 or higher firmware, and that's only WPA-PSK. If you look in the Word document you'll see there are other phones that offer WPA support, but there not are readily available in the North American market. Kind regards, Frank -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Mike Leber Sent: Wednesday, January 25, 2006 10:35 PM To: nanog(a)merit.edu Subject: Wifi SIP WPA/PSK Support I'm working on finding a Wifi SIP phone that supports WPA/PSK that we can recommended to VOIP clients. As everybody knows, currently most Wifi SIP phones support WEP which is demonstrably insecure. For banking and financial customers, or companies that are given passwords or credit cards over the phone, this is a serious security issue. We recently bought a Hitachi-Cable Wireless IPC-5000 WiFi SIP Phone from voipsupply.com after finding some web pages that said that phone supported WPA (the pages were in German), yet once we got the phone all it supported was WEP even after updating the firmware to the latest version using the website mentioned in the documentation that came with the phone. I've had a few people say that there was some sort of conspiracy to keep US citizens from using secure phones, however I found that laughable because the potential risk of terrorist or criminal interception from having all Wifi telephone conversations involving credit cards (let alone social security numbers, bank account numbers, passwords, what have you) in the clear would create an attack vector so large as to exceed all other possible attack vectors... I mean why work on cracking anything when you can just listen to everybody in the clear (well virtually in the clear with WEP). So, back in reality, could anybody in the US that bought their Wifi SIP phone in the US share a success story at getting Wifi SIP setup with WPA/PSK? What model of phone did you buy? Where did you get it? Did you have to upgrade it to any special version of firmware or what? Mike. +----------------- H U R R I C A N E - E L E C T R I C -----------------+ | Mike Leber Direct Internet Connections Voice 510 580 4100 | | Hurricane Electric Web Hosting Colocation Fax 510 580 4151 | | mleber(a)he.net http://www.he.net | +-----------------------------------------------------------------------+

1 0

VeriSign
by Martin Hannigan 26 Jan '06

26 Jan '06

Folks, Since my friend Gadi brought it up, I left VeriSign on January 3 after 3 years of solid employment. It was a good run. I was asked to move to Dulles, VA and I declined for personal reasons. I live in Boston, MA. and was a commuter to the DC area for the most part. I've taken a position at another company working to provide global stability in routing and enhance IP security. Some of you will be customers and I am looking forward to being called 'vendor'. I would like to thank all of you for your support while I worked at VeriSign. Best Regards, -M<

2 1

Focal Issues?
by Mike Callahan 26 Jan '06

26 Jan '06

Any one else experiencing packet loss on the Focal/Broadwing Network? ============================================= Target: 192.5.6.30 Date: 1/26/2006 (Thursday), 12:23:23 PM Nodes: 20 Node Data Node Net Reg IP Address Location Node Name <Private Addresses Above> 5 3 - 207.148.192.67 Warren 6 3 - 207.148.192.181 Warren 7 4 1 66.114.196.169 Detroit 66-114-196-169.focaldata.net 8 4 1 66.114.196.2 Detroit core2.dtw.focaldata.net 9 - 1 66.114.196.50 Detroit 66-114-196-50.focaldata.net 10 5 - 216.140.15.145 Chicago 11 - 2 216.140.15.18 Chicago g2-3.rp0.chcg.broadwing.net 12 6 3 157.130.109.1 Chicago gigabitethernet2-0.gw2.chi13.alter.net 13 7 3 152.63.71.218 Cleveland 0.so-2-1-0.xl2.chi13.alter.net 14 7 3 152.63.38.150 WASHINGTON D.C. 0.so-6-0-0.xl2.dca5.alter.net 15 7 3 152.63.39.65 WASHINGTON D.C. pos7-0.gw1.dca5.alter.net 16 8 3 65.207.91.246 WASHINGTON D.C. verisign-gw11.customer.alter.net 17 9 - 65.205.32.138 39.333N, 77.844W 18 10 - 65.205.32.42 39.333N, 77.844W 19 11 - 198.41.3.253 38.983N, 77.378W 20 12 4 192.5.6.30 39.333N, 77.844W a.gtld-servers.net Packet Data Node High Low Avg Tot Lost 1 0 0 0 1 0 2 6 0 1 55 0 3 32 0 2 54 0 4 32 0 1 54 0 5 171 0 58 54 0 6 157 0 3 54 0 7 37 0 4 54 0 8 35 0 4 54 0 9 231 19 28 54 0 10 74 20 46 64 10 11 203 22 31 55 3 12 48 17 25 54 2 13 49 16 23 55 3 14 77 40 51 57 6 15 76 41 54 55 6 16 175 44 59 56 6 17 255 43 64 55 5 18 ---- ---- ---- 98 98 19 150 44 65 50 2 20 87 44 74 52 4 ============================================= Target: yahoo.com Date: 1/26/2006 (Thursday), 12:24:18 PM Nodes: 19 Node Data Node Net Reg IP Address Location Node Name <Private Addresses Above> 5 3 - 207.148.192.67 Warren 6 3 - 207.148.192.181 Warren 7 4 1 66.114.196.169 Detroit 66-114-196-169.focaldata.net 8 4 1 66.114.196.2 Detroit core2.dtw.focaldata.net 9 - 1 66.114.196.50 Detroit 66-114-196-50.focaldata.net 10 5 - 216.140.15.145 Chicago 11 6 2 216.140.15.141 Indianapolis p5-0.gnwd.broadwing.net 12 7 2 216.140.15.129 Fort Worth p4-0.c0.ftwo.broadwing.net 13 8 2 216.140.4.226 Dallas s2-2-0.a1.dlls.broadwing.net 14 9 2 216.140.5.66 Austin ge-3-1.rp0.dlls.broadwing.net 15 10 - 67.99.65.2 Unknown 16 11 3 216.115.101.134 Sunnyvale so-5-1-0.pat2.pao.yahoo.com 17 11 3 216.115.106.207 San Jose ge-4-0-0-p451.msr2.scd.yahoo.com 18 12 3 66.218.82.217 San Jose ten-1-3-bas1.scd.yahoo.com 19 13 3 66.94.234.13 San Jose w2.rc.vip.scd.yahoo.com Packet Data Node High Low Avg Tot Lost 1 0 0 0 1 0 2 2 0 0 89 0 3 34 0 32 89 0 4 34 0 0 89 0 5 201 0 0 89 0 6 65 0 0 88 0 7 63 0 0 88 0 8 37 0 0 89 1 9 60 19 36 96 9 10 65 21 44 93 7 11 58 23 51 92 7 12 74 40 64 92 9 13 84 41 73 88 4 14 222 40 131 92 9 15 96 38 65 90 7 16 150 74 99 93 12 17 154 75 96 90 8 18 136 76 94 89 8 19 147 77 98 90 9

1 0

Re: BlackWorm infected IP's reporting
by Brandon Butterworth 26 Jan '06

26 Jan '06

> In addition, if anyone has any problems with the > trustworthiness of <whoever> > then they should raise that issue with the FIRST secretariat and on the > FIRST mailing lists where we can counter any claims to the otherwise. Trust is earned, it cannot be gained by shouting brandon

2 1

Blackworm hunbers [Was: Re: Martin Hannigan]
by Fergie 26 Jan '06

26 Jan '06

Well, let's hope we can watch the Super Bowl in peace -- I'm turning my pager & cell phone off anyways. :-) In any event, as Alex Eckelberry writes over on the Sunbelt Software blog, "...were now seeing infestations for the Blackworm worm (aka KamaSutra) getting close to 2 million. "Yesterday it was at close to 700k. "Of course, its possible that this URL has gotten out to the public, which would increase the count (simply hitting the website increments the count by one). However, to my knowledge, this URL is only known in the security community. "Remember that this worm has a very destructive payload. Even if you discount the number here, youre still looking at a significant number of people who will suffer potentially devastating data loss." I couldn't agree more. Cheers, - ferg ps. http://sunbeltblog.blogspot.com/2006/01/blackworm-worm-over-18-million.html -- Martin Hannigan <hannigan(a)world.std.com> wrote: > > http://isc.sans.org/blackworm > Further, our reports lead to a SANS ISC temporary URL's for each AS. The last time SANS felt something was so serious they needed all of NANOG to dance, they came out and said so. That's their handlers diary. I read it. A lot of people read it. It's well balanced and usually on target. Just like that. It's not alarmist. It seems fairly certain that as long as Symantec et. al. do their thing, we will be able to watch the superbowl in peace. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

darknet people - ddos detection
by Gadi Evron 25 Jan '06

25 Jan '06

Can we all please take a look at RCN.COM/.NET to see if they are being DDoS'd as retribution for the massive SP and LEO operations going to mitigate this risk of fast becoming millions of infected machines about to be destroyed? We'd appreciate any help given, thanks. Gadi.

1 0