- Test - lists.nanog.org

DOS attack from PANAMSAT
by Roy 06 Jul '02

06 Jul '02

I am receiving a DOS attack from multiple IP addresses in the 216.139.xx.xx range belonging to PANAMSAT (AS 19199). Upstreams seem to be QWEST, EPOCH, and UUNET. Their NOC is clueless. Anyone have a better number?

2 1

The Cidr Report
by CIDR Report 06 Jul '02

06 Jul '02

This is an auto-generated mail on Fri Jul 5 23:00:01 PDT 2002 It is not checked before it leaves my workstation. However, hopefully you will find this report interesting and will take the time to look through this to see if you can improve the amount of aggregation you perform. Check http://www.employees.org/~tbates/cidr-report.html for a daily update of this report. NEW: Check http://www.employees.org/~tbates/cidr-report-region.html for the regional version of this report. NEW: Check http://www.employees.org/~tbates/autnums.html for a complete list of autonomous system number to name mappings as used by the CIDR-Report. The report is split into sections: 0) General Status List the route table history for the last week, list any possibly bogus routes seen and give some status on ASes. 1) Gains by aggregating at the origin AS level This lists the "Top 30" players who if they decided to aggregate their announced classful prefixes at the origin AS level could make a significant difference in the reduction of the current size of the Internet routing table. This calculation does not take into account the inclusion of holes when forming an aggregate so it is possible even larger reduction should be possible. 2) Weekly Delta A summary of the last weeks changes in terms of withdrawn and added routes. Please note that this is only a snapshot but does give some indication of ASes participating in CIDR. Clearly, it is generally a good thing to see a large amount of withdrawls. 3) Interesting aggregates Interesting here means not an aggregate made as a set of classful routes. Thanks to GX Networks for giving me access to their routing tables once a day. Please send any comments about this report directly to CIDR Report <cidr-report(a)cisco.com>. ------------------------------------------------------------------------------ CIDR REPORT for 05Jul02 0) General Status Table History ------------- Date Prefixes 280602 111076 290602 111083 300602 111065 010702 111089 020702 111046 030702 110779 040702 110898 050702 110820 Check http://www.employees.org/~tbates/cidr.plot.html for a plot of the table history. Possible Bogus Routes --------------------- AS Summary ---------- Number of ASes in routing system: 13188 Number of ASes announcing only one prefix: 8046 (4527 cidr, 3519 classful) Largest number of cidr routes: 613 announced by AS701 Largest number of classful routes: 1234 announced by AS701 1) Gains by aggregating at the origin AS level --- 05Jul02 --- ASnum NetsNow NetsCIDR NetGain % Gain Description AS1221 1098 847 251 22.9% Telstra Pty Ltd AS701 1234 987 247 20.0% UUNET Technologies, Inc. AS17557 305 108 197 64.6% Pakistan Telecom AS6595 210 58 152 72.4% DoD Education Activity Network As AS852 482 352 130 27.0% Telus Advanced Communications AS7018 804 675 129 16.0% AT&T AS16473 194 76 118 60.8% Bell South AS4151 237 142 95 40.1% USDA AS19632 99 5 94 94.9% Metropolis Intercom S.A. AS1239 520 426 94 18.1% Sprint AS7303 157 69 88 56.1% Telecom Argentina Stet-France Tel AS16814 105 20 85 81.0% NSS, S.A. AS7046 313 230 83 26.5% UUNET Technologies, Inc. AS226 171 88 83 48.5% Los Nettos AS2048 180 103 77 42.8% State of Louisiana AS4755 212 136 76 35.8% Videsh Sanchar Nigam Ltd. Autonom AS577 262 190 72 27.5% Bell Advanced Communications Inc. AS4323 407 338 69 17.0% Time Warner Communications, Inc. AS724 229 161 68 29.7% DLA Systems Automation Center AS3464 163 102 61 37.4% Alabama SuperComputer Network AS19834 64 4 60 93.8% NetForce, Inc. AS10620 83 23 60 72.3% TVCABLE BOGOTA AS9498 84 27 57 67.9% BHARTI BT INTERNET LTD. AS16758 63 6 57 90.5% IKON Office Solutions AS1 441 384 57 12.9% GENUITY AS9051 82 26 56 68.3% INCONET Autonomous System AS3908 295 239 56 19.0% Supernet, Inc. AS209 309 255 54 17.5% Qwest AS6535 67 17 50 74.6% Chilesat Servicios Empresariales AS702 519 473 46 8.9% UUNET Technologies, Inc. Total 54644 42182 12462 22.8% For the rest of the previous weeks gain information please see http://www.employees.org:80/~tbates/cidr-report.html 2) Weekly Delta Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report 3) Interesting aggregates Please see http://www.employees.org:80/~tbates/cidr-report.html for this part of the report

1 0

RE: Internet vulnerabilities
by Rizzo Frank 06 Jul '02

06 Jul '02

Sean Donelan wrote: > Disrupting the Internet is a matter of scale and time. Quick show of hands. How many of you recently-laid-off engineers have automated router-pampering scripts still running on your old workstations, which nobody at your ex-employer knows about? How many of you still have enable? Therein lies the real danger. Frank "Mr. Wiggles" Rizzo

2 1

Re: DNS was Re: Internet Vulnerabilities
by Paul Vixie 05 Jul '02

05 Jul '02

> ... beyond that, security and anycast don't mix well without the data > being authenticated, e.g. dnssec. i won't disagree. anycast's cost:benefit analysis is compellingly against its use in most situations. root name service may be one of them. now, if the ops community can figure out a way to secure the edge->core boundary such that packets heard by a DDoS victim will have reasonable IP source addresses, then that would be better overall. however, in the 36 hours since i last cleared the ipfw stats on c.root-servers.net, i see: packets bytes rule 938231392 60808555788 pipe 1 udp from any to any 53 in 48248328 2919355408 deny ip from 192.168.0.0/16 to any in 34199691 2254707782 deny ip from 10.0.0.0/8 to any in 16030262 1061648337 deny ip from 172.16.0.0/12 to any in and so i don't see much chance that IP source addresses will be believable any time during the working lives of anyone now reading this. i also think the likelihood of wide scale dnssec deployment within the next year or two is two orders of magnitude lower than the likelihood of a DDoS against the root server system. "more later."

1 0

Re: DNS was Re: Internet Vulnerabilities
by Randy Bush 05 Jul '02

05 Jul '02

> Now that we've seen enough years of experience from Genuity.orig, > UltraDNS, Nominum, AS112, and {F,K}.root-servers.net, we're seriously > talking about using anycast for the root server system. without dnssec, how do we differentiate this from a routing attack on the roots? the as112 anycast thingie is fine, as who cares if someone attacks reverse servers for bogus requsts. attacking bogosity is good. :-) the decade of sprint, uunet, ... running anycast caching is within an isp is risky, but they are responsible for their own security and fate. beyond that, security and anycast don't mix well without the data being authenticated, e.g. dnssec. randy

1 0

Internet vulnerabilities
by Jason Lewis 05 Jul '02

05 Jul '02

There is a lot of news lately about terrorist groups doing recon on potential targets. The stories got me thinking. What are the real threats to the global Internet? I am looking for anything that might be a potential attack point. I don't want to start a flame war, but any interesting or even way out there idea is welcome. Is it feasible that a coordinated attack could shutdown the entire net? I am not talking DDoS. What if someone actually had the skills to disrupt BGP on a widescale? jas

17 25

BGP Pollution
by Phil Rosenthal 05 Jul '02

05 Jul '02

Network Next Hop Metric LocPrf Weight Path *>i203.168.78.0 66.230.128.97 40 100 0 2914 6453 4755 4755 4755 4755 4755 4755 17632 17632 17632 17632 17632 17632 17632 17632 17632 17632 17632 i *>i217.220.42.0 66.230.128.97 40 100 0 2914 1239 1267 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 21164 I Is there any possible excuse for such ugly looking as-paths? (these are the worst offenders, but there are plenty more that are still really bad...) --Phil

3 4

Re: Internet vulnerabilities
by Paul Vixie 05 Jul '02

05 Jul '02

> Is this the anycast based on MSDP ? no.

1 0

Re: Internet vulnerabilities
by Miquel van Smoorenburg 04 Jul '02

04 Jul '02

In article <cistron.20020704210707.GS99199(a)overlord.e-gerbil.net>, Richard A Steenbergen <ras(a)e-gerbil.net> wrote: >Besides, if someone actually did get the IOS code (laugh) You'd be surprised.. >AND manage to >compile images out of that cruft Ah, so you *have* seen it ;) Mike.

1 0

RE: Internet vulnerabilities
by jnelson 04 Jul '02

04 Jul '02

Ah... "More info ?" When all else fails RTFM. Thanks (non-disgruntled DE?), J -----Original Message----- From: Richard E. Perlotto II [mailto:rperlott@cisco.com] Sent: Thursday, July 04, 2002 3:28 PM To: 'jnelson'; 'batz'; 'Jason Lewis' Cc: nanog(a)merit.edu Subject: RE: Internet vulnerabilities Actually all the Cisco images have a MD5 hash included on the download page. You can check all of your images verses what is on the web. The 12.2.8T train also has a built in MD5 checksum for validation. We are doing what we can to help. Richard > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of jnelson > Sent: Thursday, July 04, 2002 12:47 PM > To: 'batz'; 'Jason Lewis' > Cc: nanog(a)merit.edu > Subject: RE: Internet vulnerabilities > > > How about this: > ISP X had its tftp server compromised by a wily hacker who evaded > tripwire and covered his track well, uploaded some cracked Cisco code > (the current release for their GSRs). This code was designed to corrupt > the directories and shut down the router at date XX:XX:XX. Each of these > affected GSRs, 7-five new roll-outs and 2 upgrades--went down at the > same time (save one who's time was no set correctly). Each site had to > driven to, flashcards replaced. ISP X severely crippled for 6 hours. The > hacker could have gone the extra leg to have the tftp server expunge the > backup configs at the same time--extra couple hours--but did not. > > We all download code from Cisco/Juniper/Bay in good faith... when's the > last time you saw a signature attached to any of those? Most security > breeches happen from within anyway. A disgruntled DE.... > > Just a wicked thought. > j > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > batz > Sent: Thursday, July 04, 2002 2:17 PM > To: Jason Lewis > Cc: nanog(a)merit.edu > Subject: Re: Internet vulnerabilities > > > On Thu, 4 Jul 2002, Jason Lewis wrote: > >:What are the real threats to the global Internet? > > I realize this seems like nitpicking, but asking what the real risks > are > might be a more useful question. The reason I mention this is because > the > washington post report the other day about threats to SCADA systems was > blown out of proportion, because it equated the seriousness of the > threats > with their associated risks. Yes, most ASN.1 implementations have > serious > vulnerabilities, welcome to 1988. > > The ASN.1 vulnerabilities being talked about right now are serious > threats, > but lower risk than say, millions of unpatched IIS and apache servers, > public exploits and a worm on the loose. Application level > vulnerabilities > that have to be patched on a host by host basis, cause a greater risk > than > say, SNMP vulnerabilities that can be filtered at the gateway, which > protects from opportunistic external attacks. > > When you talk about threats to the global Internet, there are hundreds > of > equally serious vulnerabilities of varying risk. Also, the "global > Internet" > has many different meanings. It can mean "the ability to send and > recieve > packets on layer 3" or "people being able to conduct business > electronically, > with some reasonable expectation of the confidentiality, integrity and > reliability of their transactions." > > So, it all depends on what you mean by the Internet:) I think this is > an extremely important discussion to have on the list, I just think > it should be framed in terms of real risks, root causes, and > potential solutions. > > >:I am looking for anything that might be a potential attack point. I > don't >:want to start a flame war, but any interesting or even way out there > idea >:is welcome. >: >:Is it feasible that a coordinated attack could shutdown the entire net? > I >:am not talking DDoS. What if someone actually had the skills to > disrupt >:BGP on a widescale? > > Once you start thinking about the Internet from a security perspective, > you realize there is no "entire net" subject to the sum of its parts in > any practical sense. It is a network of networks that serves a continuum > > of interests, bounded by economics, and driven by porn. ;) > > The attack point is anywhere you think will do the most harm to the > people you dislike. If you just want to break something, find serious, > easy to exploit, security design limitations in BGP, MPLS, BIND and > drive a major global backbone like UUNet into insolvency. > > ..What? Oh ...Too late. > > -- > batz >

1 0