- Test - lists.nanog.org

ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 28 Apr '00

28 Apr '00

> > I guess by now everyone knows what happened. Paul, can you share some info > > with the rest of us about what the vulnerability was so we can "plug the > > hole"? > > "Plug the hole" was a figure of speech. You pretty much all know that if > MFN/Abovenet suspected a way in which other providers were vulnerable, we'd > have shared that information with you (privately) by now. > -- > Paul Vixie <vixie(a)mibh.net> > SVP for Internet Services, MFNX HAHAHA the reason no other provider is vulnerable is because no other provider with half a clue has the same simple login and enable "p4ssw0rds" on all their switches, and internal machines in their sjc facilities on hubs. What does one expect will happen when their switch passwords become public knowledge? The funny thing is the passwords were originally sniffed by MafiaBoy. There's no need to "privately" share a fix/hole in this case. The ENTIRE problem here, is above's total inability to secure their own switches. And it SHOULD be public. People who control literally MILLIONS OF DOLLARS of other people's data per second NEED to learn, that CORE NETWORKS NEED TO BE PROTECTED. (i.e. CHANGING PASSWORDS, NOT PERMITTING "COMMON PASSWORDS") I hope we ALL learn a lesson from this. __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

1 0

Getting a "pop" from your IPO
by Sean Donelan 28 Apr '00

28 Apr '00

If folks were a bit late getting to their NOCs in San Jose this morning http://www.mercurycenter.com/breaking/headline2/014614.htm

1 0

Re: ICQ & AOL
by Omachonu Ogali 28 Apr '00

28 Apr '00

On Fri, 28 Apr 2000 dhudes(a)hudes.org wrote: > The breakin attempts on my server have come from Taiwan and Korea when > using portmap-based breakins; a number of US-based (@home etc.) have tried > to abuse samba. I have tried to notify the Taiwan and Korean networks > involved to no avail. I am in process of creating auto-counterattack tools > that will determine the allocation range and, assuming I have at least as > much or more bandwidth (presumably I'm dealing with an ISP serving dialup > customers), launch floods of packets at the offending netblock (and > hopefully find and attack the NAS by sending stuff to the RADIUS ports) > and any other counterattacks to make life miserable so the offending ISP > has a motive to fix things (i.e. beat them on the head until they behave). > Every good set of tools needs overall purpose, this will result in > enhanced WHOIS tools and probably a web page on security tools. Uhhhh, floods? I guess it's time to flood UUnet, Qwest, Sprint, or any other misconfigured network out there. :) > The samba breakins I have to create a script to peel out the breakins and > send notifications. Much better... > > > On Fri, 28 Apr 2000, Omachonu Ogali wrote: > > > > > So pretty much, you wish to create many different Internet 'islands' by > > isolating networks that are assigned address space from APNIC and RIPE? > > > > By doing so you threaten e-commerce and the businesses of many who receive > > their international customers via the Internet and yet this is effective. > > > > As communication overseas advances in the physical world, you'd further > > hinder the advancement of the Internet, give ISP's no other choice than > > cutting their many trans-Atlantic fiber links, and those who wish to keep > > their links up have to rely on the other side to not be angered and pull > > the plug on their side, yet this is effective. > > > > Take a look at Attrition.org's defacement archive, the majority of the > > defacers are from the United States, and a lesser crowd from APNIC/RIPE > > networks, I can't speak on credit card fraud, but should we in turn go > > around segregating the ARIN networks due to internal misuse, would that be > > 'effective' to you? > > > > On Thu, 27 Apr 2000, Universal Rundle wrote: > > > > > > > > I'd venture to say that this is the result of the following phenomena: > > > > > > Block all APNIC and RIPE assigned networks at the border and all of the > > > sudden, hack attempts and CC fraud disappear. > > > > > > It's fan-%^&#ing-tasticly simple to do and so very effective. > > > > > > > > > >From: "Igor V. Vorontsov" <iv(a)akcecc.net> > > > >To: nanog(a)merit.edu > > > >Subject: ICQ & AOL > > > >Date: Thu, 27 Apr 2000 13:35:10 +0300 (EEST) > > > > > > > > > > > >Hello colleque, > > > > > > > >Sorry my English. > > > > > > > >If engeneers from AOL or ICQ is present here... > > > > > > > >Many pople from Russia and Ukraine can't connect to your service. > > > >Your engeeners was closed many networks from Russia and Ukraine. > > > >But why? Many people from our country was usable service ICQ, but now > > > >this service is closed for them. > > > > > > > >Please open for your service our networks and resolve this problem. > > > >One of them - network 193.227.207.0/24 > > > > > > > > > > > > > > > >Igor V. Vorontsov > > > >IV144-RIPE > > > > > > ________________________________________________________________________ > > > Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com > > > > > > > > > > > > > > > -- +-------------------------------------------------------------------------+ | Omachonu Ogali oogali(a)intranova.net | | Intranova Networking Group http://tribune.intranova.net | | PGP Key ID: 0xBFE60839 | | PGP Fingerprint: C8 51 14 FD 2A 87 53 D1 E3 AA 12 12 01 93 BD 34 | +-------------------------------------------------------------------------+

2 1

Re: DSL problems (PacBell and Covad)
by Sean Donelan 28 Apr '00

28 Apr '00

If only certified techs are allowed to touch the line, and they only work 9-4 on weekdays, who cut the line? Do the certified techs cut the lines before they walk at the door at 4pm on Friday? On Thu, 27 April 2000, John Hall wrote: > Yikes! And I thought out US West service was bad! US(eless) West is > notorious for DLS service that stays up while the phone line is > down! It's happened to me three times for a total of 78 hours! The > great thing is that they allow only "certified" technicians to touch > these circuits, so even if the tech at the CO can see that the phone > line has been cut on the telco side of the DSL modem at the CO, he > can't touch it! And of course all the "certified" techs only work > 9am-4pm weekdays (at least the residential DSL ones). > > Once when I got through to their tech. support call center, the guy > on the phone was almost in tears, he'd had to tell that to so many > pissed off customers.

5 4

Re: ICQ & AOL
by Richard Colella 28 Apr '00

28 Apr '00

Did you try trouble(a)aol.net? If not, give it a shot. --Richard > Delivered-To: nanog-outgoing(a)merit.edu > Date: Thu, 27 Apr 2000 13:35:10 +0300 (EEST) > From: "Igor V. Vorontsov" <iv(a)akcecc.net> > X-Sender: iv(a)roll.akcecc.kiev.ua > To: nanog(a)merit.edu > Subject: ICQ & AOL > MIME-Version: 1.0 > X-Loop: nanog > > > Hello colleque, > > Sorry my English. > > If engeneers from AOL or ICQ is present here... > > Many pople from Russia and Ukraine can't connect to your service. > Your engeeners was closed many networks from Russia and Ukraine. > But why? Many people from our country was usable service ICQ, but now > this service is closed for them. > > Please open for your service our networks and resolve this problem. > One of them - network 193.227.207.0/24 > > > > Igor V. Vorontsov > IV144-RIPE > >

3 2

DSL problems (PacBell and Covad)
by Sean Donelan 28 Apr '00

28 Apr '00

InternetNews had an article about DSL problems at PacBell and COVAD. http://www.internetnews.com/isp-news/article/0,2171,8_347841,00.html It appears COVAD blames their problems on AT&T and Qwest cable outages, which did happen. But I have reports from half-a-dozen different people reporting several different outages due to switch failures, switch limits being exceeded, code upgrade failures, including one upgrade where the code crashed at one office one night, and the next night COVAD loaded it on the next office which also crashed. PacBell's DSL outage was reportedly due to a switch failure, although PacBell couldn't tell or wouldn't tell, how many customers were affected by it. Is this simply a case of different providers having switch problems at the same time? Typical problems of deploying bleeding edge technology?

7 6

Re: wow, Internet fiction must really sell. (abovenet)
by Scott Bradner 28 Apr '00

28 Apr '00

>Fear-mongering in the name of marketing with an ever-so convenient >omission (or, more accurately, a blatant lack) of empirical evidence to >offer? This should be criminal. might be a tech hard on the average politician so I kinda don't think such a rule will show up Scot

1 0

wow, Internet fiction must really sell. (abovenet)
by k claffy 28 Apr '00

28 Apr '00

iDEFENSE should sell the hallucinogens they're in clear possession/consumption of rather than the keystrokes they type while peaking. reckon the profit margin would be much higher f%^&ng ridiculous. the `i' must stand for imaginary >From: Jerry Irvine <JIrvine(a)iDefense.com> >To: >Subject: iDEFENSE iALERT: AboveNet Update, Evolved DDoS Tool Used >Date: Wed, 26 Apr 2000 17:18:43 -0400 >Importance: high >X-Priority: 1 > >Evolved Version of DDoS Tool Poses Significant New Threat to Business >Operations > >iDEFENSE Intelligence Services >April 26, 2000 >5:10 pm (EST) > >iDEFENSE believes that the behavior of the attack against AboveNet is an >example of the logical progression of distributed denial of service tools. >The devastating potential of this evolved tool was demonstrated during >Tuesday's attack against AboveNet which took down one of the world's leading >ISPs, for five hours, affecting companies such as eBay and Everyone.net. >AboveNet also hosts sites for AOL and numerous other high profile companies. >The extent of the disruption against these sites is not clear at this point. > >The evolved tool can attack with a speed and viciousness not even seen >during the attacks in early Feb. It appears to have a significantly enhanced >ability to communicate with an army of drones which can then in turn talk to >other drones at a significantly greater speed than what could be done by >other DDoS tools earlier in the year. These older tools operated by sending >one command from a master out to numerous zombies, the evolved version >allows the attack to reach critical mass instantaneously and may prove >significantly more difficult for investigators to identify the suspect. > >In light of this new development, companies need to immediately review their >incident response procedures in order to make sure they are adequate to >manage this threat. Having redundancies and multi-homing built into their >systems are key to minimizing the impact of an attack such as this. > >While the motive for the attack is unclear at this point, the potential for >future strikes in the coming weeks against AboveNet and/or other major ISPs >and Web sites cannot be ruled out. > >------------+------------------------+--------- > >iALERT delivers daily monitoring and analysis of cyberthreats, >vulnerabilities, and incidents to iDEFENSE's clients. > >This e-mail is delivered to journalists covering the information security >field. > >For more information or comment please contact Jerry Irvine at 703.898.8283 ><mailto:jirvine@idefense.com> > >------------+------------------------+--------- > >iDEFENSE - The Power of Intelligence > >Visit the iDEFENSE Web site for additional information: ><http://www.idefense.com> > >Copyright 2000 Infrastructure Defense Inc. (iDEFENSE)

3 2

Re: ICQ & AOL
by Richard Colella 27 Apr '00

27 Apr '00

> I'd venture to say that this is the result of the following phenomena: > > Block all APNIC and RIPE assigned networks at the border and all of the > sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. Nope, it's not. --Richard

1 0

Re: ICQ & AOL
by Martin Cooper 27 Apr '00

27 Apr '00

Universal Rundle <u_rundle(a)hotmail.com> wrote: > Block all APNIC and RIPE assigned networks at the border and > all of the sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. /me wonders if everyone's UU peering troubles would disappear if lots of them did that to its netblocks all at once... ;-) M.

1 0