- Test - lists.nanog.org

RE: UUNet Offer New Protection Against DDoS
by Terranson, Alif 08 Mar '04

08 Mar '04

As long as we're doing "Me Too"... Savvis has had prefix:666 for around 18 months as well. Alif Terranson OpSec Engineering Manager Operations Security Department Savvis Communications Corporation (314) 628-7602 Voice (314) 208-2306 Pager (618) 558-5854 Cell > -----Original Message----- > From: Michael Hallgren [mailto:m.hallgren@free.fr] > Sent: Wednesday, March 03, 2004 3:45 PM > To: nanog(a)merit.edu > Subject: RE: UUNet Offer New Protection Against DDoS > > > > > > > Global Crossing has this, already in production. > > Idem, Teleglobe, > > mh > > > I was on the phone with Qwest yesterday & this was one of > > this things I asked about. Qwest indicated they are going to > > deploy this shortly. (i.e., send routes tagged with a > > community which they will set to null) > > > > > > James Edwards > > Routing and Security > > jamesh(a)cybermesa.com > > At the Santa Fe Office: Internet at Cyber Mesa Store hours: > > 9-6 Monday through Friday 505-988-9200 SIP:1(747)669-1965 > > > > > > > > >

13 27

Re: Source address validation (was Re: UUNet Offer New Protection Against DDoS)
by Paul Vixie 07 Mar '04

07 Mar '04

> ... > buying screen doors for igloos may not be the best use of resources. uRPF > doesn't actually prevent any attacks. actually, it would. universal uRPF would stop some attacks, and it would remove a "plan B" option for some attack-flowcharts. i would *much* rather play defense without facing this latent weapon available to the offense. > Would you rather ISPs spend money to > 1. Deploying S-BGP? > 2. Deploying uRPF? > 3. Respond to incident reports? "yes." and i can remember being sick and tired of competing (on price, no less) against providers who couldn't/wouldn't do #2 or #3. i'm out of the isp business at the moment, but the "race to the bottom" mentality is still a pain in my hindquarters, both present and remembered.

4 5

layered security for the modern Internet
by E.B. Dreger 07 Mar '04

07 Mar '04

Looking at last week's NANOG posts: SAV... 30% of spam from h4x0r3d boxen... bagle... It seems the original definition and ideology of layered security are outdated. Layered security now means: * Do nothing at a given layer if the problem can be solved, or partially solved, at another layer; * If a problem cannot be completely solved at a given layer, do nothing at that layer; * Approach the problem by arguing on NANOG over who has the most representative analogy. Eddy -- EverQuick Internet - http://www.everquick.net/ A division of Brotsman & Dreger, Inc. - http://www.brotsman.com/ Bandwidth, consulting, e-commerce, hosting, and network building Phone: +1 785 865 5885 Lawrence and [inter]national Phone: +1 316 794 8922 Wichita _________________________________________________________________ DO NOT send mail to the following addresses : blacklist(a)brics.com -or- alfra(a)intc.net -or- curbjmp(a)intc.net Sending mail to spambait addresses is a great way to get blocked.

2 2

Email Security Poll Results
by Jon R. Kibler 07 Mar '04

07 Mar '04

Hello all, We had 39 responses to the poll. The results follow the signature paragraph. A few words of explanation about the results. 1) For the Yes-No questions, most answers were either YES or NO. However, a few of the results were something like "yes, but not encrypted zips." For the "yes-but" answers, I counted them as a "half of a yes." 2) For the AV engines, the percentages add up to >100% because many users said they ran multiple AV engines. 3) For frequency of AV signature updates, several responded something like "update daily or as new updates become available." For answers that said they updated on a regular frequency plus more often when necessary, the frequency was counted as appropriate, plus it was also counted in the "other, plus as announced" category. A few observations and comments: 1) Subscribers to the DShield and NANOG mailing lists contributed answers. This means the answers are biased (originating from the "security aware" group of users) and probably do not reflect the general state of email security. 2) It was refreshing to find that everyone claimed to be updating their AV signatures on a regular basis. It would be interesting to know how many average users and small businesses update on such a regular basis. 3) Personally, I found it very surprising how many organizations depended solely upon their end users to perform AV screening, that none was being performed organization-wide. I was also surprised at how many organizations permit executable content to be sent by email. I hope that everyone finds these results interesting and they are put to good use! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 Please respond YES (Y), NO (N), or Not Applicable (N/A): -------------------------------------------------------- Does your organization perform any screening of email attachments? 72% YES Does your organization perform A-V checks on all email attachments? 85% YES Does your organization perform any checks on email attachment file type? 62% YES Does your organization allow users to receive executable content attachments? 49% YES Does your organization allow users to receive zip file or similar compressed attachments? 90% YES Does your organization allow users to receive MS Office and similar type files that may contain macro viruses? 95% YES Does your organization allow users to receive embedded or attached HTML email? 99% YES Does your organization allow users to receive active content attachments, such as HTML with <SCRIPT> tags? 80% YES Please respond as appropriate: ------------------------------ What AV engine do you use to screen email attachments (Symantec, NAI, FProtect, Trend, ClamAV, etc)? Symantec 53% McAfee 16% ClamAV 16% Trend 16% Kaspersky 8% AVG 8% Sophos 5% Other 5% Fsecure 3% How often does your organization update its AV signatures? every 2 hrs or more often 16% every 4 hrs 8% every 8 hrs 8% every 12 hrs 5% daily 58% only as announced 5% other, plus as announced 16% ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

3 2

Re: Source address validation (was Re: UUNet Offer New Protection Against DDoS)
by James Edwards 07 Mar '04

07 Mar '04

On Sun, 2004-03-07 at 11:08, fingers wrote: > just a question > > why is DDoS the only issue mentioned wrt source address validation? uRPF, strict mode, is how I control 1000+ DSL pvc's from leaking private address space via broken NAT. Also, all other customer facing interfaces run uRPF, strict mode. It is a very powerful tool; null route some trouble causing customer space and traffic destined to this space is dropped via this null route AND traffic sourced from this space is dropped via uRPF, strict check. An AS112 NS also takes care of another facet of this problem. As to the question of DDoS'es and spoofed address space; once we close the hole of allowing DDoS'es to come from untraceable address space I feel we gain something very useful. We now know where the bad stuff is coming from. The solution to DDoS is not a black box that will go to Def Con 1 at the first sign of a port scan. You don't put out a fire with more fuel. Criminal investigation techniques are quite advanced. We cannot start to put them to use if attacks come from addresses that do not point back to the attacker. I am just as jaded as the next person with the present lack of law enforcement support in abuse issues but all of this is a quite new form of crime through a new medium. A "push back" system would give us the ability to quickly bring DDoS/DoS'es under control and complement a system to track down, gather evidence, and prosecute to persons in control of a DDoS/DoS. Based on my limited experience with all of this it seems the place for uRPF is not at the core (core in the context of the Internet backbone) but at the customer edge, where the problem starts. -- James H. Edwards Routing and Security At the Santa Fe Office: Internet at Cyber Mesa jamesh(a)cybermesa.com noc(a)cybermesa.com

1 0

looking for broadwing IP engineer
by matthew zeier 07 Mar '04

07 Mar '04

I'm having problems tracking down a Broadwing IP engineer who can help me with what appears to be a partial hijacking of my netblock. Please contact me off-list. -- matthew zeier - "Nothing in life is to be feared. It is only to be understood." - Marie Curie

1 0

RE: One hint - how to detect invected machines _post morten_... Re: dealing with w32/bagle
by McBurnett, Jim 07 Mar '04

07 Mar '04

Take a look at Kiwi-cattools. It has some great Cisco Automation ability.. Well, Cisco, Entersys, Redhat etc. www.kiwisyslog.com You can run commands on hundreds of devices on a schedule.. I use to pull config backups and certain reports I want directly from the devices.. Jim ->-----Original Message----- ->From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of ->Alexei Roudnev ->Sent: Friday, March 05, 2004 11:20 AM ->To: Sam Stickland; nanog(a)merit.edu ->Subject: One hint - how to detect invected machines _post ->morten_... Re: ->dealing with w32/bagle -> -> -> ->Just for information - may be useful for someone. -> ->Task - we determined, that few infected machines was ->connected to one of our ->offices few days ago. ->They run one of this viruses, which generated a lot of scans ->and created ->sugnificant traffic (but traffic was not ->big enough to rais alarm on outgoing gateway). Activity was short. -> ->Computers are not connected in the time of investigation. -> ->IDS system and Cisco logs was not active in this office (few ->tricks with ->Cisco ACL's and logs allows to detect many viruses instantly; good IDS ->systems can do it as well). -> ->Solution: ->- get all port statistics from switch (using SNMPGET and using simple ->'telnetting' script - we have 'RUN-cmd' tool allowing to run ->switch commands ->from shell file; ->- remove all ports with traffic less than some threshold; ->- calculate IN/OUT packets ratio for the rest of ports; ->- find ports, where IN/OUT ratio (IN - to switch) > 6; ->- in this ports, find ports with average packet size < 256 bytes; -> ->It shows all ports with infected notebooks (even if notebook ->was connected ->for a half of day). -> ->PS. Of course, after this few additional monitoring tools was ->installed, and ->we added _all_ switches and _all_ ports to 'snmpstat' ->monitoring system (it ->allows to see a traffic in real time, and analiz historical charts, ->including such things as packet size). -> -> -> -> ->

3 3

Re: SPAM Prevention/Blacklists
by Anne P. Mitchell, Esq. 07 Mar '04

07 Mar '04

>> Are there any other good lists out there that you folks have had good >> experience with? Any that we might want to consider taking a look at? >> Thanks, As a follow-up to my previous post, for those interested, the IADB (ISIPP Accreditation Database) is now officially up and running. We'll give a courtesy listing to anyone from NANOG who is *not* a commercial sender (and listings for individuals are always free). Querying is, of course, also always free. http://www.isipp.com/iadb.php Anne Anne P. Mitchell, Esq. President/CEO Institute for Spam and Internet Public Policy

1 0

"Information Warfare"
by John Bishop 07 Mar '04

07 Mar '04

Since it has the potential to make everyone's jobs here more interesting, I thought I'd bring it up and get everyone's opinion. This company claims to be developing a "security solution" that claims to "fight back" against attackers. I'm sure I'm not the only one here who thinks this is a tremendously bad idea. I'll let you guys tear it apart; take a look at their "white paper" and press release, both of which are dripping with enough war analogies and corporate bizspeak to make any self-respecting techie cringe. http://symbiot.com/ -- John Bishop -- moonwick(a)lasthome.net http://lasthome.net/~moonwick/ "When I'm working on a problem, I never think about beauty. I think only how to solve the problem. But when I have finished, if the solution is not beautiful, I know it is wrong." -- R. Buckminster Fuller

7 6

Re: How relable does the Internet need to be?
by John Curran 06 Mar '04

06 Mar '04

>The question in all cases is what is the level of service acceptable >to regulators and emergency services coordinators? Clearly there are >problems of both power and call routing which must be addressed. >It's unlikely NANOG is the forum for specifying standards in this >area. It is similarly unlikely the IETF is the appropriate body, >though it may be a place to figure out how to meet the requirements >specifications of some other body. Active discussion ongoing: <http://hraunfoss.fcc.gov/edocs_public/attachmatch/DOC-243851A1.pdf> /John

2 1