- Test - lists.nanog.org

Re: Cisco vulnerability and dangerous filtering techniques
by Michael.Dillon＠radianz.com 23 Jul '03

23 Jul '03

>> Just a handful of traceroutes would give it enough information to start >> at a major backbone and work back towards itself. >I guess all folks with Ph.D. at Akamai really are paid for nothing if a >virus could calculate that with a few traceroutes. Akamai is a business and has customers paying for its service, therefore they must attempt to get the best answer every time. But a virus can live with sub-optimal results as long as it does well enough to keep propagating and keep wreaking havoc. In fact, the virus writer might prefer that it does not shut down the entire Internet in one grand orgy of destruction because if that happens, there is too much incentive for police to identify the individuals concerned. The fact is that the idea has now been expressed in public. This almost guarantees that there are now multiple teams of virus writers working on incorporating these ideas into their creations. P.S. The only sure way of eradicating this Cisco bug from the Internet is to convert the Internet to IPv6. The bug doesn't affect Cisco's IPv6 code and older routers whose IOS cannot be upgraded also cannot do IPv6 so they cannot be used in an IPv6 Internet. Food for thought... --Michael Dillon

2 1

RE: Cisco vulnerability and dangerous filtering techniques
by Austad, Jay 23 Jul '03

23 Jul '03

It could poll different looking glasses... > -----Original Message----- > From: alex(a)yuriev.com [mailto:alex@yuriev.com] > Sent: Tuesday, July 22, 2003 4:01 PM > To: Austad, Jay > Cc: nanog(a)merit.edu > Subject: RE: Cisco vulnerability and dangerous filtering techniques > > > > I was thinking about this the other day. The most > efficient way to make > > this work would be to spread using some vulnerability (like > the Microsoft > > DCOM vulnerability released last week), and then at a > predetermined time, > > start DoS'ing routers in the IP space of major providers, > and then work your > > way towards the "edges." > > Pray tell, the virus will also get BGP feeds to determine > where the edges > are? > > Alex > >

6 7

PRTC (Puerto Rico Telephone Company)'s DNS Mistake
by Mehmet Akcin 23 Jul '03

23 Jul '03

Hello I personally don't know if there is here anyone monitoring from PRTC, but with thinking there is a possibility to have one I am letting you guys know about the mistake you have in your DNS servers, which you should fix immediately. As it has given in the example the ip 65.23.208.101 is resolving as 65-23-208-101.prtc.net , however 65-23-208-101.prtc.net is pointed to 66.23.208.101 which is resolving as 66-23-208-101.clients.speedfactory.net. * Looking up 65.23.208.101 * Resolved 65.23.208.101 to 65-23-208-101.prtc.net * Looking up 65-23-208-101.prtc.net * Resolved 65-23-208-101.prtc.net to 66.23.208.101 * Looking up 66.23.208.101 * Resolved 66.23.208.101 to 66-23-208-101.clients.speedfactory.net hope it gets fixed immediately. regards Mehmet Akcin

1 0

failure notice
by Stephen J. Wilcox 23 Jul '03

23 Jul '03

A bit harsh bearing in mind this address is your legitimate reply address from the email.. ! On Tue, 22 Jul 2003, John Palmer (NANOG Acct) wrote: > Hi. This is the TMDA program at adns.net. > I'm afraid I wasn't able to deliver your message to the following addresses. > This is a permanent error; I've given up. Sorry it didn't work out. > > This is probably because this is an internal account that no one is > supposed to be sending mail to. If you are sending it mail, you are > probably a low-life, bottom feeding scum sucking spammer who will > burn in hell. NO addresses at this domain EVER want to hear from you. > > What part of that don't you understand? > > <nanog(a)adns.net>: > Message rejected by recipient. > > --- Enclosed is a copy of your message. > > >From steve(a)telecomplete.co.uk Tue Jul 22 21:03:02 2003 > Return-path: <steve(a)telecomplete.co.uk> > Received: from mail-0.telecomplete.net ([193.0.249.4] helo=mail.telecomplete.net) > by MAIL.ADNS.NET with esmtp (Exim 3.22 #1) > id 19f822-0001mB-00 > for nanog(a)adns.net; Tue, 22 Jul 2003 21:03:02 -0400 > Received: from steve (helo=localhost) > by mail.telecomplete.net with local-esmtp (Exim 4.20) > id 19f86v-0002RH-Bp; Wed, 23 Jul 2003 02:08:05 +0100 > Date: Wed, 23 Jul 2003 02:08:05 +0100 (BST) > From: "Stephen J. Wilcox" <steve(a)telecomplete.co.uk> > X-X-Sender: steve@MrServer > To: John Palmer <nanog(a)adns.net> > cc: nanog(a)merit.edu > Subject: Re: AT&T Canada Problems ??? > In-Reply-To: <01d801c350b3$140ed3f0$8919d797@JPALMERWIN2K> > Message-ID: <Pine.LNX.4.44.0307230207450.6986-100000@MrServer> > MIME-Version: 1.0 > Content-Type: TEXT/PLAIN; charset=US-ASCII > > > On Tue, 22 Jul 2003, John Palmer wrote: > > > Cannot get to sites on AT&T Canada - Any news regarding the problem cause? > > Perhaps the Internet broke? > > > >

2 1

AT&T Canada Problems ???
by John Palmer 23 Jul '03

23 Jul '03

Cannot get to sites on AT&T Canada - Any news regarding the problem cause?

3 2

RE: Cisco vulnerability and dangerous filtering techniques
by Austad, Jay 22 Jul '03

22 Jul '03

I was thinking about this the other day. The most efficient way to make this work would be to spread using some vulnerability (like the Microsoft DCOM vulnerability released last week), and then at a predetermined time, start DoS'ing routers in the IP space of major providers, and then work your way towards the "edges." You can pretty much safely assume that most of your infected machines are going to basically be on the edges of the internet, so if you start with major providers, you won't kill all of your connectivity. Even more destructive would be p2p built into it, so all of the infected hosts could coordinate before the attack on what networks each one would handle. Someone is likely going to attempt something similar, it's just a matter of time before it happens. Luckily this Cisco problem didn't come out around the same time as the slammer worm. Jay > -----Original Message----- > From: jgraun(a)comcast.net [mailto:jgraun@comcast.net] > Sent: Tuesday, July 22, 2003 9:58 AM > To: Adam Maloney > Cc: nanog(a)merit.edu > Subject: Re: Cisco vulnerability and dangerous filtering techniques > > > > That is a bit paranoid, but it could happen. I have not seen > anybody do > anything that intelligent in the past couple of years. Not > to say that there > arent people out there that couldn't do that but I think many > have thought of > using one exploit to expose another, DDoS is the closest I > have seen on any of > my honeypots. I have learned many things about what most > people will try to > get into a box from the honeypots, but that is a good point. > Filtering or > patching should take place on the edge and on the most > critical spots on your > network. > > Good Luck > > > > I had a passing thought over the weekend regarding Thursday's cisco > > vulnerability and the recent Microsoft holes. > > > > The next worm taking advantage of the latest Windows' > vulnerabilities is > > more or less inevitable. Someone somewhere has to be > writing it. So why > > not include the cisco exploit in the worm payload? > > > > Based on past history, there will be plenty of vulnerable > Windows hosts to > > infect with the worm. I would also guess that there are lots of > > organizations and end-users that have cisco devices that > haven't patched > > their IOS. Furthermore, I wonder how many people have > applied filtering > > only at their border? But packets from an infected host inside the > > network wouldn't be stopped by filtering applied only to > the external > > side. > > > > Basically, if you're filtering access to your interface > IP's rather than > > upgrading IOS, remember that the internet isn't the only > source of danger > > to your network. > > > > Adam Maloney > > Systems Administrator > > Sihope Communications > > > >

3 2

RE: RADb ?
by Ejay Hire 22 Jul '03

22 Jul '03

One other option that is worth mentioning.. If you are an Arin member (i.e. you have an ASN) then you can use Arin's Route registry services. These services are currently free to members. -Ejay -----Original Message----- From: Kevin Oberman [mailto:oberman@es.net] Sent: Tuesday, July 22, 2003 1:16 PM To: mike harrison Cc: nanog(a)merit.edu Subject: Re: RADb ? > Date: Tue, 22 Jul 2003 14:25:18 -0400 (EDT) > From: mike harrison <meuon(a)highertech.net> > Sender: owner-nanog(a)merit.edu > > > > Does anyone really use the RADb ? Worth the $250 per year? > > Just wondering if it worth renewing.. Registry is worth it, but you might want to think about a free DB (if you are small) or setting up your own with the free irrd software. There is nothing more magical about the RADB than any other member of the IRR. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

5 4

The status of consumer rate-limiting?
by Owings, Curtis L [GMG] 22 Jul '03

22 Jul '03

I'm interested in an informal poll of consumer ISP's regarding application rate-limiting. For all you folks out there managing "broadband" networks to residential end-users: Are you controlling peer-to-peer traffic in some way (i.e. rate-limiting, blocking, etc)? Do you have plans to control peer-to-peer traffic? If you don't mind, can you generally describe how you have implemented any limits and how effective those solutions are? Are you imposing other total traffic download/upload limits? Are your limits imposed via "policy" (nag your abusers) or via "network" (they get blocked automatically)? Thanks! ~Curt PCS: (913) 219-8342

3 2

Cisco IOS Vulnerability
by John Timmons 22 Jul '03

22 Jul '03

i have no details regarding the ios vulnerability other than what has already been stated on-list, but the IOS matrix obtained this evening and listed at http://www.0ptical.net/cisco.html shows what versions are affected, and what to upgrade to resolve the mystery issue. not sure why psirt is keeping this under wraps, since most NSPs are publicly scheduling "emergency upgrades" to fix "network problems" that arent being detailed to customers, and those same customers can and will be affected by the same problem. thx, JT _______________________________________________ Join Excite! - http://www.excite.com The most personalized portal on the Web!

23 32

Re: RADb ?
by Kevin Oberman 22 Jul '03

22 Jul '03

> Date: Tue, 22 Jul 2003 14:25:18 -0400 (EDT) > From: mike harrison <meuon(a)highertech.net> > Sender: owner-nanog(a)merit.edu > > > > Does anyone really use the RADb ? Worth the $250 per year? > > Just wondering if it worth renewing.. Registry is worth it, but you might want to think about a free DB (if you are small) or setting up your own with the free irrd software. There is nothing more magical about the RADB than any other member of the IRR. -- R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman(a)es.net Phone: +1 510 486-8634

1 0