- Test - lists.nanog.org

VPN Filter: botnet of routers
by Scott Weeks 24 May '18

24 May '18

Kaboom! https://www.thedailybeast.com/exclusive-fbi-seizes-control-of-russian-botnet "FBI agents armed with a court order have seized control of a key server in the Kremlin’s global botnet of 500,000 hacked routers..." "The FBI counter-operation goes after “VPN Filter,” a piece of sophisticated malware linked to the same Russian hacking group, known as Fancy Bear, that breached the Democratic National Committee and the Hillary Clinton campaign during the 2016 election." https://blog.talosintelligence.com/2018/05/VPNFilter.html "The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues. The behavior of this malware on networking equipment is particularly concerning, as components of the VPNFilter malware allows for theft of website credentials and monitoring of Modbus SCADA protocols." scott

1 0

Re: Whois vs GDPR, latest news
by Owen DeLong 23 May '18

23 May '18

How is it false? If you don’t do business in the EU or with EU persons, then you are not included in the class of organizations which GDPR says are subject to GDPR. Owen > On May 23, 2018, at 4:36 PM, K. Scott Helms <kscott.helms(a)gmail.com> wrote: > > Owen, > > That's false, please don't spread misinformation. > > Scott Helms > > On Wed, May 23, 2018, 7:34 PM Owen DeLong <owen(a)delong.com <mailto:owen@delong.com>> wrote: > > > > On May 23, 2018, at 9:29 AM, Anne P. Mitchell Esq. <amitchell(a)isipp.com <mailto:amitchell@isipp.com>> wrote: > > > > > > > >> On May 23, 2018, at 10:21 AM, Daniel Brisson <dbrisson(a)uvm.edu <mailto:dbrisson@uvm.edu>> wrote: > >> > >>> Also, don't forget the private right of action. Anyone can file anything in the U.S. courts... you may get it dismissed (although then again you may not) but either way, it's going to be time and money out of your pocket fighting it. MUCH better to just get compliant than to end up a test case. > >> > >> Isn't "better" a factor of how much it costs to become compliant with GPDR? I'm no expert, but some of the things I've heard sounded not trivial to implement (read potentially BIG investment). > >> > >> -dan > > > > In our experience, orgs that are already following all industry best practices are, generally, at least 70% of the way to becoming compliant already. Where it can get expensive for the ones who aren't is in hardening their systems to provide for better security/privacy. U.S. companies are used to being able to drink at the firehose of data that is collected here in the U.S., and use it however they want.. this is the real major change. I suppose you could say it's expensive in that it is reducing the ways they can monetize that data. > > Of course a perfectly valid alternative is to refuse to do business with EU persons. Then GDPR compliance becomes entirely unnecessary. > > Owen > > > > > Anne > > > > Anne P. Mitchell, > > Attorney at Law > > CEO/President, > > SuretyMail Email Reputation Certification and Inbox Delivery Assistance > > GDPR Compliance Consultant > > GDPR Compliance Certification > > http://www.SuretyMail.com/ <http://www.suretymail.com/> > > http://www.SuretyMail.eu/ <http://www.suretymail.eu/> > > > > Attorney at Law / Legislative Consultant > > Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law) > > Author: The Email Deliverability Handbook > > Legal Counsel: The CyberGreen Institute > > Legal Counsel: The Earth Law Center > > Member, California Bar Cyberspace Law Committee > > Member, Colorado Cybersecurity Consortium > > Member, Board of Directors, Asilomar Microcomputer Workshop > > Member, Advisory Board, Cause for Awareness > > Member, Elevations Credit Union Member Council > > Former Chair, Asilomar Microcomputer Workshop > > Ret. Professor of Law, Lincoln Law School of San Jose > > > > Available for consultations by special arrangement. > > amitchell(a)isipp.com <mailto:amitchell@isipp.com> | @AnnePMitchell > > Facebook/AnnePMitchell | LinkedIn/in/annemitchell > > >

1 0

Geolocation issue with a twist
by Clay Stewart 23 May '18

23 May '18

Can someone point me for help with the following issue? I purchased a /24 late last year on auction which was originally owned by Cox communications in Europe. It had Geolocation in a lot of bad places, and Cox got it 'cleared' up for me. But there is still one issue, an ISP in Spain has it in a Geo database which is pointed to my correct location, but because it is a Spain ISP, the block has lots of issues in block apps and redirects to spam sites. Attach is a snapshot with the incorrect ISP highlight and Geo database. I cannot get any info from the Geo database. I am new to this list, so I hope this is an appropriate question.

4 6

Curiosity about AS3356 L3/CenturyLink network resiliency (in general)
by David Hubbard 23 May '18

23 May '18

I’m curious if anyone who’s used 3356 for transit has found shortcomings in how their peering and redundancy is configured, or what a normal expectation to have is. The Tampa Bay market has been completely down for 3356 IP services twice so far this year, each for what I’d consider an unacceptable period of time (many hours). I’m learning that the entire market is served by just two fiber routes, through cities hundreds of miles away in either direction. So, basically two fiber cuts, potentially 1000+ miles apart, takes the entire region down. The most recent occurrence was a week or so ago when a Miami-area cut and an Orange, Texas cut (1287 driving miles apart) took IP services down for hours. It did not take point to point circuits to out of market locations down, so that suggests they even have the ability to be more redundant and simply choose not to. I feel like it’s not unreasonable to expect more redundancy, or a much smaller attack surface given a disgruntled lineman who knows the routes could take an entire region down with a planned cut four states apart. Maybe other regions are better designed? Or are my expectations unreasonable? I carry three peers in that market, so it hasn’t been outage-causing, but I use 3356 in other markets too, and have plans for more, but it makes me wonder if I just haven't had the pleasure of similar outages elsewhere yet and I should factor that expectation into the design. It creates a problem for me in one location where I can only get them and Cogent, since Cogent can't be relied on for IPv6 service, which I need. Thanks

16 26

Re: Whois vs GDPR, latest news
by Roger Marquis 23 May '18

23 May '18

Dan Hollis wrote: > How about the ones with broken contact data - deliberately or not? > A whois blacklist sounds good to me. DNS WBL? Many sites are already doing this locally. It's just a matter of time before Spamhaus or an up-and-coming entity has an RBL for it. The data is perhaps not precise enough for a blacklist but obfuscated whois records are certainly useful in calculating the reputation of ingress/egress SMTP, HTTP and other services. This is not a new idea and similar to the (unmaintained?) whois.abuse.net contact lookup service, razor/pyzor, and other useful SIEM and Spamassassin inputs. Roger Marquis

1 0

IX's and DC's in Denver
by Emily Scarlett 23 May '18

23 May '18

Hey all, We're currently looking at expanding our presence in H5 in Denver, one question on our mind is what our options are for IX connectivity around the area, and if anyone has any experience dealing with them. Any info is useful, thanks! -- ~ Em

2 1

How to leak aggregate/generated routes into another VRF
by Joe Yabuki 23 May '18

23 May '18

Hey all, Is there a method of leaking aggregate/generated routes to other VRFs so that the next-hop is modified to actually point to table where the agg/gen routes where created ? One way to do this, is to create a Null0 route and redistribute it into the BGP VRF process, but I would like to know if there is another way to do this ? Many thanks, Joe

2 1

DirecTV Now contact
by Michael Crapse 23 May '18

23 May '18

Our eyeball network is consistently having some streaming issues(buffering) with DirecTV now. Our main recourse is to sell them on youtube TV and netflix. fixes the issue, no more complaints from our customers. Issues mainly occur during peak times and even on 300+mbps low latency/jitter customers. However, if someone from DirecTV could contact me off list and we can debug this issue so that we don't have to keep pulling people to other services that would be great. Alternatively, if anyone could suggest with whom to peer to reduce the impact of this issue, that would be great. A solution that would be even better is if someone from Youtube TV would contact us off list and we can set up something commissioned based for all the good things we say about your service, and of course give our tech support people a reason to not be frustrated with the calls we receive for this issue.

5 4

NANOG 73 Agenda is Published
by Ryan Woolley 22 May '18

22 May '18

NANOG Community, The NANOG 73 Agenda is published at http://www.cvent.com/d/ttqv1z/16K and available as an iCal feed at https://pc.nanog.org/static/published/meetings/NANOG73/agenda.ics The Program Committee has worked closely with our speakers to develop a first-rate program, and we encourage all attendees to enjoy the whole conference. As we review submitted content, minor changes to the agenda are possible and will be reflected in the online feed. Thank you to the many members of our community who submitted interesting content for NANOG 73! Close to 500 attendees have registered and the NANOG family looks forward to welcoming all of you to Denver. Useful Information: - NANOG 73 General Information and Registration: http://www.cvent.com/d/ttqv1z - Hotel Room Block(s) Information: http://www.cvent.com/d/ttqv1z/8K - There are a few remaining spots to register for the NANOG 73 Hackathon: http://www.cvent.com/d/ttqv1z/4K - A welcome message that will be sent to registered NANOG 73 attendees shortly will provide more information on scheduled events and applications to help you to make the most of your time in Denver - Register to attend NANOG On The Road Washington, DC, taking place in September at http://www.cvent.com/d/ygqk8s/4W Safe travels and see you in Denver. Sincerely, Ryan Woolley, on behalf of the NANOG Program Committee

1 0

[NANOG-announce] NANOG 73 Agenda is Published
by Ryan Woolley via NANOG-announce 22 May '18

22 May '18

This message has been wrapped due to the DMARC policy setting to prevent NANOG subscribers from being unsubscribed due to bounces. _______________________________________________ NANOG-announce mailing list NANOG-announce(a)nanog.org https://mailman.nanog.org/mailman/listinfo/nanog-announce

1 0