- Test - lists.nanog.org

RE: BGP Exploit
by Smith, Donald 05 May '04

05 May '04

%tcp-6-badauth: No MD5 digest from SRC.IP.NET.HOST(portnumber) to DST.IP.NET.HOST(portnumber) Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: james [mailto:hackerwacker@cybermesa.com] > Sent: Tuesday, May 04, 2004 4:41 PM > To: Smith, Donald > Cc: nanog(a)merit.edu > Subject: Re: BGP Exploit > > > What would a Cisco log if the IP's for the BGP sessions were > attacked & MD5 was in place ? "No MD5 digest from <IP>", " > Invalid MD5 digest from <IP>" or something else ? So far, > grepping through my logs all I see for "MD5" are the the > times I set MD5 for my BGP sessions. > > -- > James H. Edwards > Routing and Security > At the Santa Fe Office: Internet at Cyber Mesa > jamesh(a)cybermesa.com noc(a)cybermesa.com > (505) 795-7101 > >

1 0

RE: "Network Card Theft Causes Internet Outage"
by Bil Herd 05 May '04

05 May '04

One time Agis (remember Agis) hired me to go down to the local Pennsauken NAP to find out what was wrong with their remote access to what was then a core router. Someone had swiped the $.10 silver satin cord for the modem. Had to be the cheapest theft with the highest consequences I have seen. Bil P.S. Damm networking business has screwed up my english, I keep wanting to type swip instead of swipe and swipped instead of swiped. -----Original Message----- From: jlewis(a)lewis.org [mailto:jlewis@lewis.org] Sent: Tuesday, May 04, 2004 10:04 AM To: nanog(a)merit.edu Subject: Re: "Network Card Theft Causes Internet Outage" On Tue, 4 May 2004, Andy Dills wrote: > http://www.eweek.com/article2/0,1759,1583347,00.asp > > "Law enforcement officials said four DS-3 cards were reported missing > from a Manhattan co-location facility owned by Verizon Communications > Inc. The theft at 240 E. 38th St. occurred just after 10:30 p.m. on > Sunday and is Is this part really surprising to anyone who's got gear in unsupervised LEC colos where everyone is in open relay racks in a large open space? > being investigated by New York City Police and members of the joint > terrorism task force, according to NYPD spokesman Lt. Brian Burke. " This seems a bit over the top. A couple years ago when we had a part stolen out of one of our routers in a WCOM colo facility, we couldn't get the local PD to do jack. A report was filed...but I think they filed it in the circular file, because nobody ever investigated, despite the fact that WCOM had just installed a card reader system to replace the simplex door locks, so in theory, they knew who was in the room when our stuff was stolen, but they refused to release the info to us. I guess we should have suggested it was an act of terrorism. > Trying to fix our terrorism problem like this is like trying to fix > the spam problem using IP-based blacklists. No...I'd say it's more like fighting the spam problem with nuclear weapons...now there's an idea. ---------------------------------------------------------------------- Jon Lewis *jlewis(a)lewis.org*| I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________

1 0

RE: Security of Equipment in poorly-secured locations.
by Williams, Jeff 05 May '04

05 May '04

Although a webcam is cheaper, Netbotz has a slick rackmount camera that does envionmentals as well. On motion detection it snaps 5 frames off to a central server which can be tied into a NMS. In this particular case, the colo being open racks (apparently), physical security was lacking a lot. But, just as with spam, the measure - counter-measure struggle goes on. "Locks only keep honest people out." Jeff 'scuse the disclaimer below. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Bruce Campbell Sent: Tuesday, May 04, 2004 2:04 PM To: North American Noise and Off-topic Gripes Subject: Security of Equipment in poorly-secured locations. On Tue, 4 May 2004, Jay Hennigan wrote: > Subject: Re: "Network Card Theft Causes Internet Outage" > Of course, it's just as likely that a Verizon employee lifted them as > a colocation customer, and either is far more likely than terrorists. So, say that your equipment, sitting in a shared facility, suffered 'tampering' of some description. What would you do to prevent that happening in the first place, or failing that, to have a positive description to hand to the local authorities? To start off, what we've done with our gear thats located in a shared facility is to change the locks on our racks so the facility rack key (which everyone has a copy of) doesn't work. The administrators of the facility have a copy of our rack key in order to do any remote hands work that we need though. What has been suggested (but not implemented) for our gear is to have a network camera on the inside of each rack activated by the racks being opened (for some vague definition of 'opened'). Easily defeated by lifting the floor tiles and disconnecting the uplink cable of course, but reasonable peace of mind against the casual equipment lifter. -- Bruce Campbell. Sysadmin/Etc. ************************************************************** This message, including any attachments, contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please contact sender immediately by reply e-mail and destroy all copies. You are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. TIAA-CREF **************************************************************

2 1

RE: FW: Worms versus Bots now religion host security vs firewall/nat/acl
by Michel Py 05 May '04

05 May '04

> Smith, Donald wrote: > Feel free to read the document and make suggestions > (within scope) for improvements. I would change the title to something like "install windows xp and all updates securely". The current title misleads the reader into thinking that (s)he could actually use the computer at the end of the first day. > " Steps outlined in this guide should be seen as > minimum due diligence to make it through the first > day of using Microsoft Windows XP." I disagree with this. Minimum due diligence _before_ using XP is IMHO something along the lines of the list I posted earlier. A Windows computer that does not have an antivirus is not ready to be used. A Windows computer that does not have a good software firewall is not ready to be used. Use != install. Michel.

1 0

Dial up goes boom
by J. Oquendo 05 May '04

05 May '04

Sorry for the premature message of: "Once, twice, three times... an outtage. TNT's just went bonkers" Anyone else in NYC, Westchester having issues? =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net 'Everything we hear is an opinion, not a fact. Everything we see is a perspective, not the truth.' -- Marcus Aurelius

1 0

Dial up goes boom
by J. Oquendo 05 May '04

05 May '04

Once, twice, three times... an outtage. TNT's just went bonkers =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net 'Everything we hear is an opinion, not a fact. Everything we see is a perspective, not the truth.' -- Marcus Aurelius

1 1

RE: FW: Worms versus Bots now religion host security vs firewall/nat/acl
by Smith, Donald 04 May '04

04 May '04

The goal of the document is clearly stated below. Feel free to read the document and make suggestions (within scope) for improvements. The document is not intended to take the place of hardening XP documents. Today I learned from Sean that the firewall portion of XP sp1 comes up after services are enabled. I will request that information be added to the pdf. I am NOT arguing against firewalls. I like them, I use them, their grrrrrrrrrrrrrrrrrr8! Security in depth is a good idea, one that I support, encourage and practice. Donald.Smith(a)qwest.com GCIA http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xAF00EDCC pgpFingerPrint:9CE4 227B B9B3 601F B500 D076 43F1 0767 AF00 EDCC kill -13 111.2 > -----Original Message----- > From: Rob Nelson [mailto:ronelson@vt.edu] > Sent: Tuesday, May 04, 2004 4:26 PM > To: Smith, Donald; Daniel Senie; Sean Donelan > Cc: nanog(a)merit.edu > Subject: RE: FW: Worms versus Bots > > > > >The goal of this document is help new XP users survive long > enough to > >do their updates. Many of them cant/wont put up > acls/nat/firewalls ... > >but if they follow the steps listed they have a better chance of > >successfully downloading and updating their new machine then > they will > >have with OUT these steps. > >It is not meant as a complete XP hardening document. There > are lots of > >documents that discuss in detail how to harden > >windows (xp,nt,2k...). > > If the person doesn't continue to do acls/nat/firewalls, > they'll just get > infected after the next hole is discovered. And yes, there > are plenty of > holes that a firewall/nat box won't fix. Still, better than > the user only > doing Windows Update on the day of install and never having a > firewall... > > Rob Nelson > ronelson(a)vt.edu > >

1 0

Verizon TLS ?
by Deepak Jain 04 May '04

04 May '04

Does anyone have any positive/negative experiences to share with Verizon TLS service (At the Gigabit level)? thanks, DJ

1 0

"Network Card Theft Causes Internet Outage"
by Andy Dills 04 May '04

04 May '04

Just in case any of you don't read slashdot: http://www.eweek.com/article2/0,1759,1583347,00.asp "Law enforcement officials said four DS-3 cards were reported missing from a Manhattan co-location facility owned by Verizon Communications Inc. The theft at 240 E. 38th St. occurred just after 10:30 p.m. on Sunday and is being investigated by New York City Police and members of the joint terrorism task force, according to NYPD spokesman Lt. Brian Burke. " 4 DS3 cards and the joint terrorism task force is called in? Aren't there enough gas tanks being stolen around the country for the joint terrorism task force to be kept busy? Trying to fix our terrorism problem like this is like trying to fix the spam problem using IP-based blacklists. Anyway, late in the article a spokesman for Sprint is quoted: "Fleckenstein said that the outage was "not major," and not large enough to require a report to the Federal Communications Commission." I just thought it was hilarious that a this outage is major enough to suspect terrorist motives and involve the appropriate agency, but not major enough to warrant reporting to the FCC. Sure, it didn't knock down the service of 50,000 customers, but doesn't it seem sad that an entire mid-sized city must lose service before the FCC gets to know about it? I think every fricking trouble ticket generated at an ILEC should be recorded at the FCC. It's not like they don't have the means and technology. It would be near-trivial, in fact, given their capabilities when properly motivated. Andy --- Andy Dills Xecunet, Inc. www.xecu.net 301-682-9972 ---

9 10

BGP Exploit
by kwallace＠pcconnection.com 04 May '04

04 May '04

Now that the firestorm over implementing Md5 has quieted down a bit, is anybody aware of whether the exploit has been used? Feel free to reply off list. Thanks, Keith Wallace Director, Telecommunications PC Connection Services

4 3