- Test - lists.nanog.org

New NANOG traceroute (fixes -T compromise)
by Ehud gavron 23 Jul '02

23 Jul '02

The new NANOG traceroute (also known as TrACESroute) is now available. It fixes the latest "security" compromise detailed on Bugtraq and on SUSE security focus at http://online.securityfocus.com/advisories/2740 Ehud Gavron gavron(a)wetwork.net Directory: ftp://ftp.login.com/pub/software/traceroute/beta/ Code: ftp://ftp.login.com/pub/software/traceroute/beta/traceroute.c Directions: ftp://ftp.login.com/pub/software/traceroute/beta/0_readme.txt

1 0

OT: If you thought Y2K was bad, wait until cyber-security hits
by Rowland, Alan D 23 Jul '02

23 Jul '02

(shooting self in foot...) Just eliminate tech support and proprietary software! "A list of our settings is available at www.domain.com/settings. And don't call us with tech problems. We don't do tech support." I know of at least one ISP out there already doing this. Not that they're highly successful, but imagine not having to tell someone, "Yes, your username and password are case sensitive and must be spelled exactly as supplied. And it's .net, not .com" ever again. Or alternately just require registration through a BBS system as a clue test. :) (Waiting for visit from the sales/marketing/shareholder folk...) Best regards, _________________________ Alan Rowland -----Original Message----- From: Valdis.Kletnieks(a)vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Saturday, July 20, 2002 10:03 PM To: Scott Francis Cc: nanog(a)merit.edu Subject: Re: If you thought Y2K was bad, wait until cyber-security hits Snip... I'll personally nominate for sainthood anybody who figures out how to make it work for an ISP's terms of service. ;) -- Valdis Kletnieks Computer Systems Senior Engineer Virginia Tech

21 47

debugging packet loss
by Ralph Doncaster 23 Jul '02

23 Jul '02

I'm seeing 2-5% packet loss going through a Cisco 2621 with <10mbps of traffic running at ~50% CPU. (packet loss based on ping results) Pinging another box on the same catalyst 2900 switch gives no packet loss, so it seems the 2621 is the source of the packet loss. I need help figuring out why it is dropping packets, and how to stop it. The odd thing is that the interface stats don't show any dropped packets: Full-duplex, 100Mb/s, 100BaseTX/FX ARP type: ARPA, ARP Timeout 00:01:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 00:10:16 Queueing strategy: fifo Output queue 0/40, 0 drops; input queue 1/512, 0 drops 5 minute input rate 5257000 bits/sec, 1383 packets/sec 5 minute output rate 5692000 bits/sec, 1448 packets/sec 845743 packets input, 392733148 bytes Received 403 broadcasts, 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast 0 input packets with dribble condition detected 887446 packets output, 430245866 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 22694 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out Ralph Doncaster principal, IStop.com

6 5

Level3 Fiber Cut
by German Martinez 23 Jul '02

23 Jul '02

Somebody affected by a Level3 fiber between Boston and New York ? Thanks German

2 1

password stores?
by Daniska Tomas 23 Jul '02

23 Jul '02

hi, i'm wondering how large isps offering managed cpe services manage their password databases. let's say radius/tacacs is used for normal cpe user aaa, but there is some 'backup' local user account created on the cpe for situations when the radius server is unreachable. for security reasons, this backup account (as well as snmp communities, radius key etc.) is unique per cpe to avoid frauds caused by end-users (even if one does password recovery on the cpe, they still don't have the password for other cpe's). if there are hundreds or thousands of these cpe's that could mean storing of tens thousands of password. are there any crypto-based products available or do the people use their own stuff? thanks -- Tomas Daniska systems engineer Tronet Computer Networks Plynarenska 5, 829 75 Bratislava, Slovakia tel: +421 2 58224111, fax: +421 2 58224199 A transistor protected by a fast-acting fuse will protect the fuse by blowing first.

2 1

Security of DNSBL spam block systems
by Big_Bandwidth 23 Jul '02

23 Jul '02

What are the security implications of someone hacking a DNSBL (Real-time-spam-block-list) and changing the block list to include (deny email from) some very large portion or all IPv4 space? Given that a signifigant number of the spam blocking lists seem to operate on a shoestring budget in someone's basement, how can we be assured that they have sufficient resources to secure their systems adequatley, and monitor for intrusion 24x7? Unless I am missing something, this would seem to be a real handy and centralized method for someone to interfere substantially with the proper operation of a few thousand email servers and hold up global email traffic for a few hours. -BB

2 1

Nanog traceroute format string exploit. (fwd)
by jeffrey arnold 23 Jul '02

23 Jul '02

This came through on bugtraq this afternoon. -jba __ [jba(a)analogue.net] :: analogue.networks.nyc :: http://analogue.net ---------- Forwarded message ---------- Date: Sun, 21 Jul 2002 14:09:24 +0200 From: SpaceWalker <spacewalker(a)minithins.net> To: bugtraq(a)securityfocus.com Cc: vuln-dev(a)securityfocus.com Subject: Nanog traceroute format string exploit. Hello, As the vulnerability has been published some weeks ago, and no working exploit has been released (the perl exploit was joke) I decided to release my private exploit. I do it only because -This exploit will never be used to haxor something because I never saw this traceroute used by default -This exploit find offsets "by the proper way" and doesn't place the target adresses in the format string. (and is interresting to study for beginners). Have phun, please don't haxor with it. SpaceWalker

1 0

Re: effects of NYC power outage
by Simon 22 Jul '02

22 Jul '02

I agree... I don't know why this is being discussed. I just thank -whoever- for 25bway still standing. -Simon On Mon, 22 Jul 2002 13:51:11 -0400 (EDT), Tuc wrote: >> >> >> >> >From what I recall, it failed due to a mechanical problem first... then after they fixed it >> and had it running for sometime, it ran out of fuel. >> >Hi, > > Ok, come on... That was 310 or so days ago. Exactly what happened >shouldn't be a huge concern anymore. They addressed it, fixed it, and are >making sure it doesn't happen again, thats the part we need to concentrate >on. > > Phil, you weren't even a customer then, were you? And for those >that didn't know/forgot.... I slept in the conference room the first 4 >days after it all happened... And I think given the severity and magnitude >of the event, they did a hell of a job. Only so much you can expect. > > Tuc/TTSG Internet Services, Inc. >

2 1

Anyone using Interspeed DSL gear?
by Vincent J. Bono 22 Jul '02

22 Jul '02

If anyone is using any Interspeed DSL equipment, please email me offline? Thanks, Vin

1 0

Cogent issues at AADS PVC 5.34?
by John Kristoff 22 Jul '02

22 Jul '02

We're currently experiencing significant latency through Cogent at AADS. I've heard they have some general latency issues, but nothing concrete yet as to what and where. Does anyone have any details of any problems while we're waiting for a response back from the NOC? Thanks, John

2 3