- Test - lists.nanog.org

Re: Remembering history passwords may be bad, but they are getting worse
by Kevin Day 29 Jul '03

29 Jul '03

>The problem is fewer and fewer modern systems implement the other >recommendations. So password lifetime has become the primary protection >factor. > >How many systems notify the user > - the date and time of user's last login > - the location of the user at the last login > - unsuccessfull login attempts since last successful login >How many web systems control the rate of login attempts > - by source > - by userid >How many web systems notify anyone or block the account after N >unsuccessful login attempts either temporarily or permanently Sean: I run one of the larger adult websites, that has a reputation for being very difficult to acquire passwords for. The kind of attacks we see now aren't solved by any of the above. We throttled the number of login attempts per IP, then the attackers switched to using proxy servers. Tens of thousands of them at once. Our database of IP addresses that have had more than 100 bad login attempts is now around 100,000. (Most of which are all now banned completely). We also tried put rate limiting on login attemps by username. This allowed any idiot to lock any of our legit customers out of the system whenever they want, providing an easy denial of service, so this was scrapped pretty quickly. The attacks we see now are... well orchestrated. 10-50,000 proxy servers all making login attempts at once, rather slowly. 10-50 login attempts per second, each from a different proxy. Still slow enough per IP that it doesn't hit our threshold for how many bad logins per IP per hour we allow, but enough attempts that just by trying seemingly random username/password combinations they get a couple of successes a day. We've also seen people trying what appear to be known good username/password combos that were presumably acquired from other sites that were compromised in some way. We keep detailed histories of all the login attempts per IP, and can eventually weed out the exploited proxies from actual users, but this takes an incredible amount of our time, CPU time and database storage just to manage. A few weeks ago, after we tightened our login attempt limits, whoever is doing this decided to point all the proxies to a public URL that was very database intensive, and requested it over and over again(apparently to get revenge/in frustration), killing our database server for several hours until I figured out what was going on. We tried putting up something that was displayed to users showing their last login time and IP, in hopes that some would notice their account being used by others. Many ISP's force users to go through a proxy server, usually without their knowledge. We'd report the IP address that we saw (the proxy server) which would freak out many users because it didn't match their system's IP. The login time is apparently meaningless to most users, who didn't seem to keep track of when their last login in. We do have our tricks to detect when an account has been compromised, but they're not 100% accurate, so it usually comes down to having to wait until our friendly hacker and his 500 closest buddies are all sharing the account. We're taking steps to make brute force attacks like that impossible (forced random passwords, etc) but we've found that many users won't tolerate not being able to choose their own password. If forced into it, they forget their passwords very easily and the support costs from dealing with password recovery are generally higher than passwords leaking out. While the recommendations you listed are probably worthwhile to stop some attacks, they're not going to stop people determined enough to get into SOME account if they're not picky on which one. -- Kevin

4 3

Re: Hollywood plot: Attack critical infrastructure while President is in town
by Stewart, William C (Bill), RTSLS 29 Jul '03

29 Jul '03

As Vadim said, it's about display of power. However, I'm not worried about terrorists attacking infrastructure under the cover of Presidential No-Fly Zones; I'm more worried about backhoe drivers named Bubba who didn't call the "Call Before You Dig" number and weren't noticed by cable route overflights because they were grounded while Bush gets his hair cut. On the other hand, that's what diverse cable routes and rapid restoration systems are for, and even with air patrolling of cable routes, there's the occasional Bubba who's checked with the call-before-you-dig people (so the air patrols don't stop him) and makes a mistake about where to dig...

3 2

a new labor intensive layer 1 solution (humor?)
by Eric Kuhnke 29 Jul '03

29 Jul '03

Backhoes, natch... All you need is a camo uniform, M-16, and spool for rapid network deployment: http://www.army-technology.com/contractors/navigation/brugg/brugg5.html Repairing cables places your life at risk: http://colofinder.net/gallery/view_photo.php?set_albumName=album17&id=izd_0…

6 7

In answer to a Nanog request - How to get Free Cook Report Back Issues
by Gordon Cook 28 Jul '03

28 Jul '03

Well over a year ago someone on Nanog asked me why I didn't give away back issues. I said I planned to give them away at the Creative Commons web site. I sent a bunch to them on a CD rom but as far as I know nothing happened. OK - The wait is over and more than 10 years of back issues are now available at no cost. Two from just over a year ago instantaneously. The rest by registration. At http://cookreport.com/ you will find pointers to the following changes. 1. COOK Report Back issues available three different ways. (a) You can down load past issues from April 1992 through June July 2002 by registering and having me assign a username and password. (b) The issues of April - May and June July 2002 are instantly down loadable without registration via 2 links at the top of the home page. (c) In about 2 weeks they likely will also be available for a small charge on a CD rom through cafe.press 2. There are also some very nice endorsements. 3. There are two small forums.... one where you can make comments and a second one way mail list from me that you can sign up for. In the next 30 days I may install an actual blog - namely Greymatter http://noahgrey.com/greysoft/ I would welcome comments on what folk find. BTW I will publish an issue on license exempt wireless by about Labor Day. Between now and the end of the year one of my interests is to explore what IBM is calling pervasive computing. This, by 2010, could involve many hundreds of millions of small embedded processors using open source software and license exempt spectrum. I would appreciate pointers to people doing work in the area of pervasive computing. It is allied with grids certainly. But grids would be, I think, more of a back end. -- ============================================================= The COOK Report on Internet, 431 Greenway Ave, Ewing, NJ 08618 USA 609 882-2572 (PSTN) 703 738-6031 (Vonage) 17318 (FWD) cook(a)cookreport.com Subscription info & prices at http://cookreport.com/subscriptions.shtml Fiber & Wireless as First Mile Technology - Fiber Business Models & Architecture, July- September 2003, 130 pages available at http://cookreport.com/12.04-06.shtml =============================================================

1 0

RE: a new labor intensive layer 1 solution (humor?)
by Temkin, David 28 Jul '03

28 Jul '03

Which, ironically coincided with the time WorldCom bought UUNet. <duck> -----Original Message----- From: Christopher L. Morrow [mailto:chris@UU.NET] Sent: Monday, July 28, 2003 1:05 PM To: Robert E. Seastrom Cc: Eric Kuhnke; nanog(a)merit.edu Subject: Re: a new labor intensive layer 1 solution (humor?) On Mon, 28 Jul 2003, Robert E. Seastrom wrote: > > "Christopher L. Morrow" <chris(a)UU.NET> writes: > > > I believe thats an FN-FAL rifle, not a M-16... I wonder if telcom's > > could employ these folks to watch over their fiber lines to keep the > > backhoes away? > > It's a SIG SG550, not an FAL or an M16. well there ya go! :) I just knew it wasn't a m16 and was guessing toward the FAL due to language and stock appearances... been a few years since I spent time looking at guns.

3 2

Re: Its not just Spam and DDOS anymore (was Re: OT: Re: User negligence?)
by Peter Gray 28 Jul '03

28 Jul '03

On the subject of host security issues and spam, try doing a search of the Usenet archive for '"Net Access Corporation" spam'. You get 328 results. And those are just the spams which people have traced to NAC, never mind the millions of untraced ones.... >From: Sean Donelan <sean(a)donelan.com> >To: Alex Rubenstein <alex(a)nac.net> >CC: nanog(a)merit.edu >Subject: Its not just Spam and DDOS anymore (was Re: OT: Re: User >negligence?) >Date: Sun, 27 Jul 2003 02:39:31 -0400 (EDT) >MIME-Version: 1.0 >Received: from mc4-f40.law16.hotmail.com ([65.54.237.175]) by >mc4-s7.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Sat, 26 Jul >2003 23:41:26 -0700 >Received: from trapdoor.merit.edu ([198.108.1.26]) by >mc4-f40.law16.hotmail.com with Microsoft SMTPSVC(5.0.2195.5600); Sat, 26 >Jul 2003 23:40:45 -0700 >Received: by trapdoor.merit.edu (Postfix)id 997F191229; Sun, 27 Jul 2003 >02:39:35 -0400 (EDT) >Received: by trapdoor.merit.edu (Postfix, from userid 56)id 6B69C9122B; >Sun, 27 Jul 2003 02:39:35 -0400 (EDT) >Received: from segue.merit.edu (segue.merit.edu [198.108.1.41])by >trapdoor.merit.edu (Postfix) with ESMTP id 90F4B91229for ><nanog(a)trapdoor.merit.edu>; Sun, 27 Jul 2003 02:39:32 -0400 (EDT) >Received: by segue.merit.edu (Postfix)id 6BA575DF03; Sun, 27 Jul 2003 >02:39:32 -0400 (EDT) >Received: from clifden.donelan.com (clifden.donelan.com [199.34.53.180])by >segue.merit.edu (Postfix) with ESMTP id 4DCDC5DEE1for <nanog(a)merit.edu>; >Sun, 27 Jul 2003 02:39:32 -0400 (EDT) >Received: from sean (helo=localhost)by clifden.donelan.com with local-esmtp >(Exim 3.34 #3)id 19gfBr-00044I-00; Sun, 27 Jul 2003 02:39:31 -0400 >X-Message-Info: MxAodtZPLiQ6HPHOc8rBiXjgUFkT69DC >Delivered-To: nanog-outgoing(a)trapdoor.merit.edu >Delivered-To: nanog(a)trapdoor.merit.edu >Delivered-To: nanog(a)merit.edu >In-Reply-To: <Pine.WNT.4.43.0307270146050.200-100000(a)TEMPEST.hq.nac.net> >Message-ID: <Pine.GSO.4.44.0307270218570.15622-100000(a)clifden.donelan.com> >Sender: owner-nanog(a)merit.edu >Precedence: bulk >Errors-To: owner-nanog-outgoing(a)merit.edu >X-Loop: nanog >Return-Path: owner-nanog(a)merit.edu >X-OriginalArrivalTime: 27 Jul 2003 06:40:45.0882 (UTC) >FILETIME=[0223E9A0:01C3540A] > > >On Sun, 27 Jul 2003, Alex Rubenstein wrote: > > I think there is confusion here. >Yep. No problem, I think we've cleared it up. > > > The banks are making the claim, that, if you the user, has an infected >PC, > > that is compromised by an 3lit3 h4x0r, and your password to your bank > > account is compromised, then the bank is not responsible. > > > > That is what you are saying, Sean? > >I posted the dots, but failed to explicitly connect them. > >People have been talking about DDOS, spammers and the underground economy. > >Folks, its not underground any more. The criminals are using trojans >to steal real money from real people now. > >Firewalls can't stop it, ISPs can't stop it. Its a *HOST* security issue. > >For most home users the choices are get Microsoft to fix its software, or >buy a Macintosh (hide Unix under the hood). For an extra $20 Dell will >pre-configure the system security settings for business purchasers; but >home users are still on their own. > > _________________________________________________________________ Sign-up for a FREE BT Broadband connection today! http://www.msn.co.uk/specials/btbroadband

2 1

User negligence?
by Sean Donelan 28 Jul '03

28 Jul '03

Unfortunately there are a lot, and growing number, of self-infected PCs on the net. As the banks point out, this is not a breach of the bank's security. Nor is it a breach of the ISP's security. The user infects his PC with a trojan and then the criminal uses the PC to transfer money from the user's account, with the user's own password. http://www.iol.co.za/index.php?click_id=13&art_id=qw1059039360281B215&set_i… "The fact that hackers got access to bank customer's accounts was not due to inadequate security at the bank, but due to "user negligence", an e-commerce company said on Thursday. [...] "Consumers should be vigilant when opening emails. If they receive strange emails, or emails from people or companies they do not know, it is better not to open the mail - especially attachments. These intrusions were clearly not a result of any vulnerability in Absa's Internet security."

20 27

Network Solutions responsible for theft of lucrative "Sex.com'' domain name
by Andrea Abrahamsen 28 Jul '03

28 Jul '03

Not sure if this has been posted yet, but in case it hasn't... (07-26) 00:07 PDT SAN JOSE, Calif. (AP) -- "A federal appellate court ruled against Web registry Network Solutions Inc., comparing Internet domain names to property such as homes and cars, and saying that the Web registry could be liable for damages after a convicted forger purloined ownership of www.sex.com from an e-commerce entrepreneur." [...] "But the judge and plaintiff questioned why NSI would switch the domain name registry without so much as a phone call to Kremen. They also questioned why NSI administrators weren't suspicious of Cohen's letter, which requested that NSI not send e-mail to anyone at Kremen's company because it didn't have Internet access -- despite being named Online Classifieds." http://www.sfgate.com/cgi-bin/article.cgi?file=/news/archive/2003/07/26/fin… -- Andrea Abrahamsen Software Engineer, Intelligent Network Services Cisco Systems

1 0

Re: Its not just Spam and DDOS anymore (was Re: OT: Re: User
by Paul Vixie 28 Jul '03

28 Jul '03

> > ... but so far they've only succeeded in making it worse. > > Computers are absolutely capable of this, but as with security in > general the problem lies with the people that are controlling what > they do... i agree, but we may mean different things. most people have no control over what their computer does. see popunders for example, which the commercial version of netscape doesn't have a way to disable, while the free "mozilla" version does. (and of course msie has no way to turn it off.) see the dmca and riaa govern what can and cannot be done with content. try and uninstall macromedia on a windows machine. amuse yourself by studying the doomsday weapon presently called "palladium". so while i think you mean "one of the reasons computers are subtracting from rather than adding to the average user's privacy is because the average user doesn't want to perform the difficult acts of mental focus and usage discipline that would be required by such a privacy benefit". and i agree. however, the bigger reason is that privacy is not a benefit in the eyes of the people who are truly in control of the world's computers. so, if it's going to happen, it's going to have to be a grass roots thing.

2 1

Re: User negligence?
by Jamie Reid 28 Jul '03

28 Jul '03

I wonder if this could just be solved by selling fraud insurance? It could be another ridiculous bank surcharge or service, but would negate the need for byzantine technology infrastructures to support it. All that user end security devices do is put more non-repudiable onus on the user, so that when it fails, the service provider is protected, and the user is cryptographically guaranteed to be SOL. Biometrics are an excellent example of this. They are a single factor authentication technology, maybe two factor if there is a PIN, and when the database gets compromised, nobody will believe that the user isn't responsible, because "The System is Perfect". Many security technologies are based upon the risk avoidance paradigm of government/military organizations, instead of the more practical risk management perspective of more nimble organizations. This is partially why alot of technologies aren't getting adopted. They are Perfect, but a burden. The solution that balances security and accessability will be the one that incorporates an acceptable loss expectancy and enables the company to leverage the convenience of that risk. Building massive security structures does little to decrease the actual risk, they just push it out to the edges, that is, to customers. The ubiquity of personal computers as general information appliances has made them more of an interface to the economy than the tools that we are used to using them as. Since these interfaces are as diversely designed as wallets (M$ turned our machines into wallets), we can either demand better wallet security devices, or we can mitigate risks to their contents through insurance. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> "Christopher L. Morrow" <chris(a)UU.NET> 07/27/03 03:39pm >>> On Sun, 27 Jul 2003, JC Dill wrote: > > At 07:21 AM 7/27/2003, David Lesher wrote: > > >Strip <http://www.zetetic.net/index.html> is your helper here. > > I have strip. Unfortunately, I don't always have my Palm at hand when I > want to login to my bank, and I didn't have it at hand the *last* time, > when I had to change the password, so the new password didn't get entered > into strip. But that's beside the point, using strip on a pda (to help > remember passwords) is a solution that only works for some people, in some > circumstances. It would be much better to have a policy that just WORKED. > or a 10 dollar key fob that always had a code you could combine with your 'pin' for a password... why is a solution like RSA/ACE so difficult for people to accept on a wide scale? Afterall, banks charge you for checks, why not for the FOB, and make you purchase the replacement when you lose it? -Chris

2 1