- Test - lists.nanog.org

RE: IT security people sleep well
by Jason Frisvold 08 Jun '04

08 Jun '04

> -----Original Message----- > From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] > OK.. Say you can get it into the code train for 200K. What > do you do with all > those routers that have only 100K or 125K of space left in > the flash (if that), > and the flash is NOT going to get any bigger without massive > abuse of a > soldering iron because not all the needed address lines are > brought out to the > flash chip (a fine tactic dating back decades - I remember > seeing a 16K ROM > nailed to the top quarter of the 64K address space, and only > 14 address lines > brought to the chip - it was nailed to the top 16K by feeding > A14 and A15 to an > AND gate which fed the 'Chip Select' pin...) Agreed, but what are those routers used for these days? We use those routers for management (old 2511's) ... Any existing 2500's in the core network (yes, I'm ashamed to say some still exist) are ensured to have the max memory they can get ... Again, this is purely theoretical for me as management here has not deemed it appropriate to deploy ssh ... But, if ssh were added to all IOS's, it would greatly reduce the number of routers that could *not* include SSH due to flash limitations... I can say that in other networks that I consult for, I try to ensure ssh is available, as well as acl's and other security techniques... :) Jaosn Frisvold Penteledata

2 1

RE: IT security people sleep well
by Michel Py 07 Jun '04

07 Jun '04

> Henning Brauer wrote: > not seeing the problem with cleartext telnet for remote > logins in 2004, wether ACL'd or not, is just ... oh man, > I don't have words for this. I have: I encourage my competitors to do it. Michel.

2 1

EMS systems?
by Matthew Crocker 06 Jun '04

06 Jun '04

Hello, I have been looking through the archives and RFC and I can't seem to find what I'm looking for. I'm in search of an Element Management System or Inventory tracking system that can keep track of my hardware (routers, switches, SONET, patch panels) and ports (DS-1, DS-3, CDS-3, Ethernet, GigE, OC-x) and circuits (connecting two ports together). I don't need SNMP/NMS functionality per se but an add-on capability would be nice. I need a system that can track a customer circuit from their location (UNE DS1) to the Verizon CFA / circuit ID at my colo through my M13 mux into my SONET and into the router. It would be great if I could click on a customer and list all of their circuits and equipment involved with the circuits. Is there an RFC which defines such a database? Is there an open source system available to maintain the data? A database package where I can say 'I need an available DS-1 port in this CO and get a Verizon circuit ID I can use on the order'. I know the big guys have something, I'm a little guy, do I need to write it myself? -Matt

1 0

RE: Site elimination service -:) - I received offer by 's'p'a'm'
by Michel Py 06 Jun '04

06 Jun '04

> Stephen J. Wilcox wrote: > I've not had any.. perhaps its a targeted marketing > list, have you bought similar services in the past? :) Do you think there's a money back guarantee if the attacked site stays up? Michel.

1 0

Team Cymru Darknet Project
by Rob Thomas 06 Jun '04

06 Jun '04

-----BEGIN PGP SIGNED MESSAGE----- Hi, team. We are happy to at last release some documentation Darknets and the Team Cymru Darknet Project. You will find the details at the following URL: <http://www.cymru.com/Darknet/> We hope this helps you to gain greater insight into your networks and the flows on them. Comments, feedback, and coffee are always welcome! :) Thanks! Rob, for Team Cymru. - -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQL/W4VkX3QAo5sgJAQG3QQP9FT6jwkPbdLaCFBLds4ftjFaNGAjaBMM7 W9I4ver75yf2Ir8N1ytWqLrqAcAviU0ke8mcAaLRXeT/zNjHdZswyVmSjApBDHEW DSKL+hHd/5mzp7ZGHzYWVUD0XpAnpK3TTkpt35p4Z/RTXHP3hcrTE5wrLPDRZ24W l8jaboMH0tY= =Ug2l -----END PGP SIGNATURE-----

2 1

RE: Site elimination service -:) - I received offer by 's'p'a'm'
by Michel Py 06 Jun '04

06 Jun '04

> Alexei Roudnev wrote: > I received adv., in russian, saying: > Dear sirs. > We are glad to you to give qualitative service, on > elimination of sites. We can kill any site by our > attack, which have name 'DDos attack'. > The prices at us low, 60 dollars for 6 hours. This could be useful to evaluate mitigation gear: setup your own target server on a fat pipe, get the vendor to loan you the mitigation gear then pay 60 bucks to see if it really does mitigate something... You'll only see one set of zombies, but 60 bucks is pretty darn cheap. Michel.

4 6

RE: Worst case worm damage estimates: Research
by Michel Py 06 Jun '04

06 Jun '04

> Sean Donelan wrote: > This is where I agree with Paxson and Weaver, there isn't > a deep supply line for replacement PCs. If 50 million PCs > fall over in a single morning, its unlikely the PC repair > people will have enough replacement machines ready instantly. I'm with you, I was trying to point out that it's a big "if". Modern BIOSes are protected against this, and as Eddy and I pointed out, it's generally not a big deal to recover a trashed BIOS. Besides, after the first million craps out, every radio and TV will be saying not to turn on your PC before you talk to your IT. > Its the supermarket effect before a big snowstorm, they run > out of milk and bread within a couple of hours. But then what > happens? People starve? or is there product substitution? Both at home and at the office I can find a week worth of overdue work that does not require a PC..... Michel.

1 0

RE: Worst case worm damage estimates: Research
by Michel Py 06 Jun '04

06 Jun '04

> Laurence F. Sheldon, Jr. > Just one question--who is paying to get the production > work done while all this is going on? I never said it was free, but nothing close to the figures mentioned earlier. Reality check guys: a desktop PC costs $500 these days, spending $800 to repair a used one does not make sense. If your desktop support guys are half-organized, they have a replacement machine ready to install when the user calls for service, then the machine that as problem (which often is PICNIC: Problem In Chair Not In Computer) goes on the bench where the time it takes to reload a fresh Windows is 5 minutes, time to plug the cables in and pop the Ghost CD in. Michel.

2 1

RE: Worst cast worm damage estimates: Research
by Michel Py 06 Jun '04

06 Jun '04

SD> That's less than $400 per defective motherboard. SD> Your paper estimates it would cost more than double SD> to replace a scrambled BIOS. > Edward B. Dreger > Definitely sounds high, especially considering the > cheap end with socketed a DIPP BIOS: Boot from > "loaner" BIOS chip. Remove loaner BIOS. Insert chip > containing scrambled BIOS. Flash. Indeed. I found out that in most cases the loaner BIOS does not even have to come from the same brand PC and in many cases it will allow to boot DOS to flash the original BIOS back even if it was for another chipset. As far as re-installing Windows, it just takes a few minutes when you have something like Symantec Ghost or Altiris client. Michel.

2 1

Re: Worst cast worm damage estimates: Research
by Sean Donelan 06 Jun '04

06 Jun '04

On Fri, 4 Jun 2004, Vern Paxson wrote: > > Some people regularly rebuild their Windows computer a few > > times a year. > > Including recovering from a trashed BIOS? As you point out in the paper, the BIOS scrambler attack is the one with the most variation between platforms. It could have a relatively low success rate. On the other hand, board and even system replacement occurs pretty frequently. Even without a superworm, computer repair depots return alot of computers to the factory instead of trying to fix them locally, especially if the computer is new/recent/under warranty. The newest computers are most likely to have a fast replacement cycle from inventory. I agree the BIOS scrambler is a particular nasty form of attack, but the current state of computer repair expertise means its not that different from the problems created by current viruses. In 2000 Intel needed to recall over one million motherboards already shipped to end-users due to a defect. Instead of fixing the defective otherboards, Intel offered to replace them with new motherboards. Analysts estimated that recall cost $300 million to $400 million dollars including the labor to replace the motherboard. That's less than $400 per defective motherboard. Your paper estimates it would cost more than double to replace a scrambled BIOS. Although some people have a personal attachment to their computers, business PCs are very fungible. If the PC was more than a few years old, the business probably has depreciated it, and may just replace it sooner than planned with newer (faster, more productive?) model. If the business has more than one computer, again the BIOS scrambler has the most variables, some of the other computers may be different vintage. The business may just use one of the working computers instead. The damaged computers don't need to be replaced with the exact same make and model, in the short term even older models may be sufficient or do all those executives and other people need their computers 24x7? On a CPU hour basis, PC's have a very low utilization. SETI@HOME may have fewer free CPU cycles to borrow because any working "personal" computers will be shared by multiple people timesharing until their own replacement computers arrive. According to the banking industry, on average 5% of the cash machines in the country aren't working on any particular day. Its even higher during a holiday weekend. What's the economic impact of 5% failure rate of cash machines? If 10% of the cach machines had their BIOS scrambled, would the impact be doubled? Instead of an economic loss, do you create a Y2K effect of companies accelerating the replacement of equipment and hiring consultants to fix problems creating a mini-economic boom. Captalism seems to make more money treating illness than preventing it.

2 1