- Test - lists.nanog.org

ISP network registration virus scan
by Sean Donelan 04 Oct '03

04 Oct '03

The university netreg lists has a frequently asked question if its possible to perform a virus scan of new computers as part of the network registration process. So far, people have only been able to do a network scan (e.g. open ports), or some version of proxy check or nessus. But none of those actually tell you if there is a worm or trojan. I was wondering if anyone (or vendor) has come up with a web application which ISP's could use to check if new customers are already infected with a network worm or trojan (not a full disk scan) as part of the registration process. It seems like several of the anti-virus vendors have the parts and pieces, but none of them seem to offer such a product for ISPs. I would think an ActiveX application could check for the top 20 or so network trojans or worms (less than 1 minute to do the checks), and report the results back to the ISP (or university) network registration web site. Between universities (with new students) and ISPs (with new customers) there would seem to be a new market for such a product. But so far I haven't found an AV vendor that has put it together.

4 4

Verizon DSL issues on east coast today?
by Alex Yuriev 04 Oct '03

04 Oct '03

I am seeing rather strange behaviour on VZ DSL starting from about midnight today, corresponding with 20% or so traffic drop in a few webfarms. The troubles start around lo0-0.CORE-RTR2.SYR.verizon-gni.net (130.81.4.10), and manifest themselves with large sections of the internet (including places such as usatoday) non-resolving, while other location's generate very funny traceroutes that indicate packets are being filtered, while the ssh sessions happily stay up. Alex

1 0

VeriSign Capitulates
by Tim Wilde 04 Oct '03

04 Oct '03

http://www.washingtonpost.com/wp-dyn/articles/A40241-2003Oct3.html And they act like they're the victims. Amazing. "Without so much as a hearing, ICANN today formally asked us to shut down the Site Finder service," said VeriSign spokesman Tom Galvin. "We will accede to their request while we explore all of our options." How about a public outcry? Did you miss that part? You don't deserve a hearing. Of course, they haven't removed the wildcard yet: dig is-it-gone-yet.com. @a.gtld-servers.net. +short 64.94.110.11 -- Tim Wilde twilde(a)dyndns.org Systems Administrator Dynamic DNS Network Services http://www.dyndns.org/

18 19

Internet privacy
by Allen McRay 03 Oct '03

03 Oct '03

Apologies if this is off-topic. No chance of it ever happening, correct? =;] Allen Dear Network Solutions(R) Customer, Did you know that current rules require all domain name service providers to list the information you provide when you register a domain name in a public database known as WHOIS? To help you protect your personal information and online investment, I want to let you know that Network Solutions is campaigning for stronger privacy protection in the domain name industry. As part of this effort, we have developed a new site, www.InternetPrivacyAdvocate.org, which outlines the steps we are taking to protect your personal data. The site also offers helpful tips for what you can do to keep your private data even more secure. The Internet Corporation for Assigned Names and Numbers (ICANN) is the non-profit corporation responsible for oversight of domain name registrations and for accrediting domain name service providers. As an ICANN-accredited registrar, we are also required to request that our customers verify, and if necessary, update their WHOIS contact information. Customers are responsible for ensuring this information is current, and ICANN mandates that outdated contact information can be grounds for domain name cancellation. View the WHOIS information for the domain name(s) you have registered with Network Solutions, and if necessary, update your information. To help protect your privacy, we have added enhanced capabilities, which allow you to select the Administrative and Technical contact information you would like listed in WHOIS through your Network Solutions account. To learn how to assign WHOIS contact information and about other actions you can take to protect your personal information today, visit www.InternetPrivacyAdvocate.org. Sincerely, Brian Cute Policy Director Network Solutions, Inc. ***************************************************** This e-mail was sent from a notification-only address. Please do not reply to this message. For Network Solutions customer service inquiries, please contact: customerservice(a)networksolutions.com. Unsubscribe from certain e-mail promotions from Network Solutions. Access our Privacy Policy. Access our Service Agreement. (C) 2003 Network Solutions, Inc. All rights reserved.

13 20

"Close-knit group" responds to Verisign
by Alex Kamantauskas 03 Oct '03

03 Oct '03

In a Washington Post article, it was reported that a "close-knit group of engineers" were angered by Verisign's SiteFinder service, claiming that it caused "e-mail systems, spam blocking technology and other applications to malfunction". Verisign responded that these claims are overblown. In response, the close-knit group of engineers said, _ WILDCARD THIS! _ |_| |_| | | /^^^\ | | _| |_ (| "o" |) _| |_ _| | | | _ (_---_) _ | | | |_ | | | | |' | _| |_ | `| | | | | | | / \ | | \ / / /(. .)\ \ \ / \ / / / | . | \ \ \ / \ \/ / ||Y|| \ \/ / \__/ || || \__/ () () || || ooO Ooo -- /ak

2 1

NXDOMAIN signs (was VeriSign Capitulates)
by Marc MERLIN 03 Oct '03

03 Oct '03

We could almost pretend it was because of the NXDOMAIN signs that got plastered on their HQ :) From http://slashdot.org/article.pl?sid=03/10/01/212231&mode=nocomment&tid=126&t… wednesday: ---------------------------------------------------------------------------- Verisign seems to have issues with returning proper response packets for DNS queries on unused domains, so we thought we would give them a quick reminder in case they forgot what the right answer was. You can find pictures here ( http://irc.sh.nu/download/ ) (This was on their building in Mountain View, and the signs said 'Verisign/Netsol, as if people didn't hate you enough already... How greedy/stupid are you? [Made with figlet/vim/a2ps/poster.c] ) ---------------------------------------------------------------------------- I thought it was hilarious :) Marc -- "A mouse is a device used to point at the xterm you want to type in" - A.S.R. Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key

1 0

DHCP / PPP host route
by Jay Greenberg 03 Oct '03

03 Oct '03

>From a service provider perspective, does anyone know if there is a way to make a cisco router that is acting as a dhcp relay agent install a /32 host route for the assigned IP address? I'm looking for a way to assign static IP addresses from the same pool independant of the router that is acting as the relay agent to the dhcp server. Thanks, -- Jason Greenberg, CCIE #11021 Network Administrator Execulink, Inc. <jg(a)execulink.com>

1 0

NTP, possible solutions, and best implementation
by Ariel Biener 03 Oct '03

03 Oct '03

Hi, Assuming one wanted to provide a high profile (say, at the TLD level) NTP service, how would you go about it ? The possibilities I encountered are diverse, the problem is not the back-end device (be it a GPS based NTP source + atomic clock backup, based on cesium or similar), but the front end to the network. Such a time service is something that is considered a trusted stratum 1 server, and assuring that no tampering with the time is possible is of very high priority, if not top priority. There are a few NTP servers solutions, I like the following comparison between one company's products (Datum, merged into Symmetricom): http://www.ntp-systems.com/product_comparison.asp However, when you put such a device on a network, you want to have some kind of clue about the investment made in that product when security comes to mind, and also the turnaround time for bug fixes should such security bug become public. Here is the problem, or actually, my problem with these devices. I know that if I use a Unix machine or a Cisco router as front end to the network for this back-end device, then if a bug in NTP occurs, Cisco or the Unix vendor will fix it quickly. BUT!, if I want to put the device itself on the network, as this is what a NTP device was built for, I feel that I have no real sense of how secure the device really is, and how long it would take for the vendor to actually fix the bug, should such be discovered. It's a black box, and I am supposed to provide a secure time source based on ... "what ?" This is my dillema. While I don't want to put a NTP front end, which becomes a stratum 2 in this case, but to provide direct stratum 1 service to stratum 2 servers in the TLD in question, I do not know how can I safely trust a device that I have no experience with how the vendor deals with bugs, and also, I have no idea what is the underlying software (although it's safe to assume that it is an implementation of xntpd, in one form or the other). Did any of you have to create/run/maintain such a service, and does any of you have experience with vendors/products that can be trusted when security is concerned (including the vendor and the products I specified above). thanks for your time, --Ariel -- Ariel Biener e-mail: ariel(a)post.tau.ac.il PGP(6.5.8) public key http://www.tau.ac.il/~ariel/pgp.html

5 5

the gauntlet is thrown
by Scott Bradner 03 Oct '03

03 Oct '03

http://www.icann.org/correspondence/twomey-to-lewis-03oct03.htm

7 7

Re: NTP, possible solutions, and best implementation
by Michael.Dillon＠radianz.com 03 Oct '03

03 Oct '03

> Assuming one wanted to provide a high profile (say, at the TLD level) NTP >service, how would you go about it ? First of all, NTP should be done at the geographical level, not the TLD level. Generally, unless political reasons prevent it, you should try to implement an NTP service that covers a region roughly as large as Europe to avoid too much fate sharing caused by proximity. > The possibilities I encountered are diverse, the problem is not the >back-end device (be it a GPS based NTP source + atomic clock backup, based on >cesium or similar), Beware the single point of failure. If all your clocks come from GPS, then GPS is the SPOF. If they all come fram brand X manufacturer then that is the SPOF. A commercial service should be robust and use a combination of atomic clocks, GPS, radio time services, CDMA/GSM clocks combined with a sanity checker to watch all the clocks and detect bad timekeepers. > However, when you put such a device on a network, you want to have some >kind of clue about the investment made in that product when security comes to >mind, Indeed. Hide this clock behind a packet filtering firewall or else use udprelay and an application layer gateway on UNIX to block everything except NTP. In fact, if this is a commercial service you should hack udprelay so that it knows about the NTP protocol and can block non-customer traffic or malformed traffic or high volumes of traffic. That way, the UNIX server/firewall in between the NTP device and the net protects it from abuse, but since this UNIX server is a pass-through device from the point of view of NTP, it does not change the stratum level of the service any more than an IP router does. --Michael Dillon

13 14