The good folks at Shadowserver has been giving us a feed of IPs that are hitting those DNS server since November and last month we got the last of the customers cleaned up. Not all ISPs are non-proactive. Frank -----Original Message----- From: Paul Graydon [mailto:paul@paulgraydon.co.uk] Sent: Thursday, April 26, 2012 4:48 PM To: nanog@nanog.org Subject: Re: Operation Ghost Click On 04/26/2012 11:44 AM, Andrew Latham wrote:

On Thu, Apr 26, 2012 at 5:38 PM, Jeroen van Aart<jeroen@mompl.net> wrote:

...

Excuse the horrible subject :-)

Anyone have anything insightful to say about it? Is it just lots of fuss about nothing or is it an actual substantial problem?

http://www.fbi.gov/news/stories/2011/november/malware_110911

"Update on March 12, 2012: To assist victims affected by the DNSChanger malicious software, the FBI obtained a court order authorizing the Internet Systems Consortium (ISC) to deploy and maintain temporary clean DNS servers. This solution is temporary, providing additional time for victims to clean affected computers and restore their normal DNS settings. The clean DNS servers will be turned off on July 9, 2012, and computers still impacted by DNSChanger may lose Internet connectivity at that time."

-- Earthquake Magnitude: 5.5 Date: Thursday, April 26, 2012 19:21:45 UTC Location: off the west coast of northern Sumatra Latitude: 2.6946; Longitude: 94.5307 Depth: 26.00 km

Yes its a major problem for the users unknowingly infected. To them it will look like their Internet connection is down. Expect ISPs to field lots of support calls.

Based on conversations on this list a month or so ago, ISPs were contacted with details of which of their IPs had compromised boxes behind them, but it seems the consensus is that ISP were going to just wait for users to phone support when it broke rather than be proactive about it. Paul

On Tue, May 01, 2012 at 12:26:20PM +0000, Livingood, Jason wrote:

At Comcast we have done the following: - Sent emails - Send postal mail - Left voicemail - Used automated outbound calling - Used increasingly persistent web browser notifications

This is a reply to you, but it's intended to be directed at everyone who runs a consumer network, since zombies are everywhere. Why haven't you cut these obviously-infected systems off entirely? They no longer belong to their putative owners in any meaningful sense: oh, they might be in their homes, sitting on their desktops, but they're owned, operationally, by parties unknown -- botmasters and anyone that they're renting them out to. The only use your customers are making of them is that which they are *permitted* to do by the largesse of their new owners, who of course find it convenient to maintain the illusion because it encourages the former owners to keep them switched on and plugged into your network. (And given that your customer is not using their own system any more, there's no reason to believe that its new owners will permit them to see any email you send or any web browser notifications you emit. I'm sure if these become prevalent, not just at Comcast but among other major ISPs, the botmasters will pay someone to do the coding necessary to suppress them, and then propagate that code to all their bots.) This isn't to say that what you're doing isn't well-intentioned: it is. And it's a lot more than many others are doing. But if it was going to work, it would have worked by now. ---rsk

On Tue, 01 May 2012 10:40:57 -0400, Rich Kulawiec said:

Why haven't you cut these obviously-infected systems off entirely?

There's quite likely multiple systems behind a NAT-ish router, and Comcast doesn't have any real option but to nuke *all* the systems behind the router. This can be a tad troublesome if there's one infected box behind the router, but the customer is also using VoIP of some sort from another box - you may just have nuked their 911 capability. Or if they have multiple systems, you may have killed their ability to transact basic business like contact their local government or pay their utility bills from a box that's not infected. (Hint - it's the same basic reason why 3-strikes laws for copyright infringement that turn off the subscriber suck - the unintended collateral damage tends to break things you really don't want to break...)

In a message written on Tue, May 01, 2012 at 07:41:35PM +0000, Livingood, Jason wrote:

All of this above! Plus, the remediation tools to clean up an infection are insufficient to the task right now. Better tools are needed. (See also http://tools.ietf.org/html/rfc6561#section-5.4)

Hey Jason, I'm going to put you on the spot with a crazy idea. Many customers of the major internet providers also have other services from them, like TV and Phone. Perhaps expanding the notice to those areas would be useful? Turn on your cable box and get a notice, or pick up the phone and get a notice? It might really help in cases where one member of the family (e.g. the children) are doing something bad that the bill payer (e.g. mom and dad) doesn't know about. Hit them on a medium they know more about. -- Leo Bicknell - bicknell@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/

Hey Jason, I'm going to put you on the spot with a crazy idea.

Many customers of the major internet providers also have other services from them, like TV and Phone. Perhaps expanding the notice to those areas would be useful? Turn on your cable box and get a notice, or pick up the phone and get a notice?

We did the phone thing by dropping a voicemail to our voice customers (it is IP voicemail so it kind of looks like an email server architecture). Good idea on the TV notification as well and certainly not crazy! ;-) - Jason

On Wed, 02 May 2012 12:13:56 -0700, Jeroen van Aart said:

Livingood, Jason wrote:

...

you may just have nuked their 911 capability.

Actually, I said that, not Jason. Jason just used mail software that *can't get quoting right* to reply to my message, so your quote of his message got the attribution wrong. What *is* it with you people? This is *NANOG*. In *2012*. ;) (The truly sad part is that based on the User-Agent: headers, Jason appears to have used a *different* broken mail software package than the last person. So at least 2 vendors are doing stupid stuff.) </rant> ;)

Depending on your internet connection to be able to dial 911 is a bit foolhardy, to put it nicely.

Foolhardy or not, it's probably unwise for an ISP to say "It's OK, *nobody* would be that foolhardy" and snip the service...

On Wed, May 2, 2012 at 3:13 PM, Jeroen van Aart <jeroen@mompl.net> wrote:

Livingood, Jason wrote:

...

you may just have nuked their 911 capability.

Depending on your internet connection to be able to dial 911 is a bit

<chuckle>

foolhardy, to put it nicely. It pays off to have a phone that's only powered through the phone line itself, for emergencies (and your everyday home phone calls *gasp*). Especially in a country where power outages are as frequent as full moons. The good old land line hardly ever goes down.

this is nice, but not everywhere has this capability, someplaces DID have it until the new 'we bring fiber' people showed up, and clipped the copper below the ground-level.

And you may find the audio quality is better too. While you're at it, make it a rotary phone. :-)

wow, 1990 much? are you actually just trolling today perhaps?

Regards, Jeroen

-- Earthquake Magnitude: 4.0 Date: Wednesday, May  2, 2012 12:33:29 UTC Location: Vancouver Island, Canada region Latitude: 50.6619; Longitude: -129.8861 Depth: 10.00 km

Then you'll be happy to know that most VoIP phones default to and good VoIP providers gladly support G.711, the exact same codec used in all digital trunks in the POTS network. Also, an on-the-ball VoIP carrier will be pushing G.722 "HD Voice" devices which offer about double the audio bandwidth in the same data bandwidth (64kbit/sec/stream) as G.711. If your carrier is forcing G.729 or GSM, they're a joke. --- Sean Harlow sean@seanharlow.info On May 2, 2012, at 15:52, Eric Wieling wrote:

I doubt the g729 or GSM codecs used by VoIP and Cell phones can compare to a POTS line.

-----Original Message----- From: Christopher Morrow [mailto:morrowc.lists@gmail.com] Sent: Wednesday, May 02, 2012 3:43 PM To: Jeroen van Aart Cc: NANOG list Subject: Re: Operation Ghost Click

wow, 1990 much? are you actually just trolling today perhaps?

On Wed, 02 May 2012 13:10:28 -0700, Jeroen van Aart said:

Technical specs aside I believe you are mistaken with regards to the actual every day reality. My experience (and anyone else I talked to) calling to and from mobile phones has been 100% a bad one with regards to audio quality.

I look at my Samsung cell phone, and the tiny speaker squeezed in up over the screen at one end, and then I think of the large speakers in the handset of an old-school Bell system rotary phone. Then I think about the fact that my laptop has pretty damned good sound quality when I plug in a good pair of Kenwood KPM-410 headphones, and sounds totally crappy over the tiny built-in speakers that Dell provided. It may not be the codec that sucks...

----- Original Message -----

From: "Valdis Kletnieks" <Valdis.Kletnieks@vt.edu>

On Wed, 02 May 2012 13:10:28 -0700, Jeroen van Aart said:

...

Technical specs aside I believe you are mistaken with regards to the actual every day reality. My experience (and anyone else I talked to) calling to and from mobile phones has been 100% a bad one with regards to audio quality.

I look at my Samsung cell phone, and the tiny speaker squeezed in up over the screen at one end, and then I think of the large speakers in the handset of an old-school Bell system rotary phone. Then I think about the fact that my laptop has pretty damned good sound quality when I plug in a good pair of Kenwood KPM-410 headphones, and sounds totally crappy over the tiny built-in speakers that Dell provided.

It may not be the codec that sucks...

Right. Me and my business partner have both spent quite a number of years involved with sound reinforcement and other types of audio engineering, and we're therefore better positioned to evaluate the transmit and receive audio of various communications channels and physical interfaces there to. It is *often* the analog components and housing that make things sound suboptimal, and if you need proof of this, I call to your attention some NPR phoners which are done with gear like the JK Audio BlueDriver 3, and broadcast microphones. It's possible to get to within about 47% or so of the sampling rate of the codec using gear like that, and it's pretty easy (for a sound guy) to spot that combination in a live broadcast. It's also worth noting that even if the recording format is VHS, it's very easy to discern the difference between consumer cameras, pro SDTV, and pro HDTV, in looking at the playback signal -- the differences are subtle, but they are identifiable. Now, those codecs *are* specially tuned for spoken word -- if you try to stuff music down them, it's not gonna work very well at all... Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

Adam Atkinson <ghira@mistral.co.uk> wrote;

Jay Ashworth wrote:

...

Now, those codecs *are* specially tuned for spoken word -- if you try to stuff music down them, it's not gonna work very well at all...

It was claimed to me many years ago that the 4kHz cutoff used in POTS serves women and children less well than it does adult males. I have never been aware that I have any greater problems understanding women or children on the phone than I do men, but my hearing is not great. I can't hear the difference between G.711 and G.729, for example, but some people can.

Googling "PCM adult male voice", "4kHz adult male" and similar isn't finding me anything. Was I told nonsense?

Probably. "sort of." <grin> 'Way back when', at least in the U.S., the 'voice' passband was 300-3000Hz. Later, 300-3300Hz. For perspective, rf you know anything about music, the 'A' below "Middle C' is nominally 440Hz. 300Hz is roughly an octave below Middle C, and 3kHz is 2-1/2 octaves above it. That's the -high- end of the range for a piccolo, or coloratura Soprano. Now, absent the overtones that give a note it's 'color', one of those high-pitch sources will sound more than a little bit 'tinny' over a classical 'voice passband' channel. *HOWEVER*, the 'fundamental' frequencies for womens/childrens voices -is- higher than that of adult males. But you're talking less than an octave in 'most' cases. Less than 2 in 'extreme' (a guy with a _deep- bass voice -- "basso profundo", and a 'squeaky' female/child) cases. This mean that one does lose one to two additional 'overtones' of the fundamental on women/children, vs. men. This does, in general, *NOT* materially affect the 'intelligibility' of the voice, although it does have a measurable adverse effect on the 'identifiability' of one such higher-pitched voice vis-a-vis a different similarly-pitched voice. You lose more of the 'color' of their voices vs the lower-pitched male voice.

On Thu, 03 May 2012 11:01:01 -0400, Jay Ashworth said:

In general, though, intelligibility comes from the higher frequencies, and 3.4kHz is *usually* high enough. What might be the case is that you'd have more trouble *distinguishing* amongst women, or between women and children, because the tones necessary for that are more located above the cutoff frequency.

I have had more than a few surreal conversations on the phone with my daughter - once the 3.4kHz filter gets done, I can't distinguish her voice from her mom's (and yes, I've gotten social-engineered as a result). Life has gotten simpler since she got old enough to have her own cell phone. ;)

In general, though, intelligibility comes from the higher frequencies, and 3.4kHz is *usually* high enough. What might be the case is that you'd have more trouble *distinguishing* amongst women, or between women and children, because the tones necessary for that are more located above

I wanted to mention one other thing here. In addition to my day job I am a ham radio operator and a IMT COML. I deal with UNDERSTANDABILITY. I sympathize with you on getting bamboozled by the family, have 3 sisters and two daughters. But in the real world of communications 2.3 - 2.5 Khz filters for SSB are the norm, and some guys like it tighter. Let me be frank, spectrum space and hence bandwidth is finite. There is no silver bullet. The FCC mandated narrow banding in VHF is costing public service millions. AT&T pronouncements aside, I have heard them, there will be improvements but not quantum ones. Right now the cell cos are trying to desperately get more spectrum because they know they are about to hit the wall. They already do in places like unHappy Valley (Penn State) at game time when everyone is on the cells. One recent merger/acquisition attempt that failed was for the larger co to get the smaller one's spectrum space. They are looking at some public service spectrum to see if they can offer enough money to get it - most of that money is spent lobbying. Once it goes to cell, it isn't coming back no matter what. The Digital TV was as much about freeing spectrum space to sell it for government income as better TV signals which we didn't need and have cost every person in the US at least $1,000 (new TV's, increased ad costs which increase product prices to pay for the broadcasting equipment) and we didn't get that back for the spectrum space when it was sold. We paid for the industry to upgrade! Ralph Brandt -----Original Message----- From: Valdis.Kletnieks@vt.edu [mailto:Valdis.Kletnieks@vt.edu] Sent: Thursday, May 03, 2012 11:33 AM To: NANOG Subject: Re: Cellphones and Audio (was Ghost Click, though I got no idea why) On Thu, 03 May 2012 11:01:01 -0400, Jay Ashworth said: the

cutoff frequency.

I have had more than a few surreal conversations on the phone with my daughter - once the 3.4kHz filter gets done, I can't distinguish her voice from her mom's (and yes, I've gotten social-engineered as a result). Life has gotten simpler since she got old enough to have her own cell phone. ;)

----- Original Message -----

From: "Adam Atkinson" <ghira@mistral.co.uk>

Well, just the above seems like enough that you'd think there'd be more (justified) grumbling that thanks to a choice made many many decades ago it's harder to distinguish young or female speakers than it is adult male ones. Maybe there is and I've just not noticed it. Is this one of the things pushing adoption of higher bandwidth audio codecs? (My guess: no.)

Not directly, I don't think, no. I suspect it's merely "why not?" Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

On May 2, 2012, at 16:10, Jeroen van Aart wrote:

Technical specs aside I believe you are mistaken with regards to the actual every day reality. My experience (and anyone else I talked to) calling to and from mobile phones has been 100% a bad one with regards to audio quality. I know the bandwidth allows for better quality, but carriers don't do it, they do the opposite.

Why else would a mobile phone carrier feel the need to advertise an "HD" (shouldn't it be "HIFI"?) quality line (i.e. a quality that's standard with every land line and already suboptimal):

http://www.pcmag.com/article2/0,2817,2402598,00.asp

"Sprint Brings HD Voice Calls to U.S."

Originally, you said VoIP and cellular used bad codecs. I responded that any decent VoIP provider supports codecs equaling or beating landlines. I didn't say anything about cellular. A G.711 call over a solid internet connection will sound entirely identical to any landline telephone call that leaves the local analog facilities and a G.722 call will make G.711 and thus landlines sound like cellular by comparison. The cellular world works with less bandwidth and more loss than the VoIP world usually deals with, so while us VoIP guys sometimes use their codecs (GSM for example) they don't tend to bother with ours. That said, the article you link is talking about the same sort of improvements by doubling the sampling rate, so the end result is similar. --- Sean Harlow sean@seanharlow.info

I am not worried about the voice quality as long as it is understandable. What I am concerned about is, "Can someone who needs help get through? Ralph Brandt -----Original Message----- From: Jeroen van Aart [mailto:jeroen@mompl.net] Sent: Wednesday, May 02, 2012 7:40 PM To: NANOG list Subject: Re: VoIP/Mobile Codecs (was Re: Operation Ghost Click) Sean Harlow wrote:

Originally, you said VoIP and cellular used bad codecs.

Yeah, I overlooked that important detail, sorry.

The cellular world works with less bandwidth and more loss than the VoIP world usually deals with, so while us VoIP guys sometimes use their codecs (GSM for example) they don't tend to bother with ours.

Agreed.

That said, the article you link is talking about the same sort of improvements by doubling the sampling rate, so the end result is similar.

Yes, but it shouldn't be necessary to offer these "HD" services as an extra. It should be standard. Greetings, Jeroen -- Earthquake Magnitude: 4.0 Date: Wednesday, May 2, 2012 12:33:29 UTC Location: Vancouver Island, Canada region Latitude: 50.6619; Longitude: -129.8861 Depth: 10.00 km

On 5/2/12, Jared Mauch <jared@puck.nether.net> wrote:

Personally, I'm thinking of ditching my ISDN (gives clear dial tone at a long-distance from the CO) for something like the Verizon Home Connect box. Gives a few hours of built-in battery backup, but would fail once the tower loses power (usually 8-12 hours).

Hi Jared, Beware that the Verizon ONTs shut down all services *except* POTs when they lose AC power. Some kind of conservation mode to maximize the time 911 is available I guess. If you want Internet service (for VOIP) to continue during a power outage, you'll have to stack another UPS in front of it. Regards, Bill Herrin -- William D. Herrin ................ herrin@dirtside.com bill@herrin.us 3005 Crane Dr. ...................... Web: <http://bill.herrin.us/> Falls Church, VA 22042-3004

Jared Mauch wrote:

Regarding landline service, this can fail for many of the common reasons it does are the same reasons that IP service may fail. The failure modes can depend on a variety of circumstances from the physical layer (e.g.: audible static on the line) that cause your ear to retrain, which may cause a DSL device to comparably retrain. The same is true for shared medium such as CATV but this has other problems as well, if not well isolated, somebody can short out the segment or send garbage at the wrong channel, etc.

I don't doubt it. However my practical experience is such that 100% of the time (I lost count after 20 or so, in a decade) I experienced a power failure the phone would still work. I am sure I am not the only one. And these concern power outages in various locations, from the mountains of Coastal Oregon to the Monterey Bay Area. And from trees falling over the power lines to exploding transformers (two at once actually :-). I guess the phone companies just do a better job at keeping up their infrastructure. I don't know how often the phone cable is buried compared to where the power cables are exposed to the elements. But I would think that (more frequently) burying the phone cables is one reason it's more reliable. That's why (burying cables) in the Netherlands you would get a power outage maybe once or twice a decade as opposed to every fortnight. Greetings, Jeroen -- Earthquake Magnitude: 4.0 Date: Wednesday, May 2, 2012 12:33:29 UTC Location: Vancouver Island, Canada region Latitude: 50.6619; Longitude: -129.8861 Depth: 10.00 km

Yes, those things happen. But there are several such failure points in the POTS system and hundreds in VOIP. I support VOIP, ISDN etc. But I know all too well the failure points... Ralph Brandt -----Original Message----- From: Jay Ashworth [mailto:jra@baylink.com] Sent: Wednesday, May 02, 2012 8:25 PM To: NANOG Subject: Re: VoIP vs POTS (was Re: Operation Ghost Click) ----- Original Message -----

From: "Jeroen van Aart" <jeroen@mompl.net>

I don't doubt it. However my practical experience is such that 100% of the time (I lost count after 20 or so, in a decade) I experienced a power failure the phone would still work. I am sure I am not the only one.

Sure. (We're not really having this conversation here, are we? :-) Copper POTS service is centrally powered from a battery plant in the wire center, which is generally something like -52V nominal at 6000-8000ADC continuous. If you get a tool across those busbars uninsulated, it will flash into plasma much faster than you can blink; this happened at SPBGFLXA89H in the... mid to late 80s? I no longer remember the details, but the guy couldn't hear for several days, and the *entire* CO -- 30klines of GTD-5 and 100klines of 5E Remote -- was No Dial Tone for at least 12 hours while they cleaned it up; SPPD and PCSO were stationed on streetcorners to take emergency reports. Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

"I also am concerned about 911 service. When dialing 911 recently from my mobile, I should have dialed it from my home phone as I was routed a few times to get to the right fire dispatch team." I am a "second responder", a member of a Search and Rescue team. The reason for "second" is because we are not generally called till other agencies have tried to find the person. Hazmat falls into the same category because they are not generally called till another agency sees the situation and rolls them. I am also an COML (Communications Leader - IS-300 is a pre-req for this.) and a member of the South Central (PA) Task Force AWG. I am frightened about the availability of anything that falls into the category of "emergency services". In PA most of the fire services are volunteer. Funding for everything is being cut at almost every level. The 911 hysteria that brought massive money, some of which was squandered, is over and now it is the shoe string. Our SAR team operates on a budget of $2,700 a year, yes, TWENTY SEVEN HUNDRED DOLLARS. Our team members supply their radios, clothing, boots, etc and the gas and transportation to searches and training. Although others get significant dollars it is never enough even for the most frugal companies and quite frankly, the York, Lancaster and Lebanon Counties in PA are hard headed Dutchmen Conservatives that generally get the most out of a buck. That issue aside a second issue is rampant in the area. More and more the Emergency Operations Centers are going to VOIP. The internet is not that reliable! I am not aware of a 911 that has gone to VOIP but pricing is dictating a look at this. During a Peach Bottom (nuclear power plant - one of our two in the area - the other is Three Mile Island) several of the EOC's lost phone, FAX and radio connectivity (repeater failures) to County EOC because of thunderstorms and tornados that blew in during the drill. The ham radio operators at these EOC's and County provided communications to the sites for both the drill and live events. They happened to be on site for the drill. The site I was at was vacated except the hams, the government evaluators and the public works guy because of a fire, all of the other players in the EOC including the EMC were firemen! A lack of volunteers means people wear multiple hats. But let's get to the big item. When the bad day comes, cellular is worthless. I was at work the day of the earthquake in Virginia, a couple hundred miles south of us. The ground shook and some masonry buildings in the area sustained cracks that needed to be repaired. Ten minutes after the quake cellular was either useless or had up to fifteen minute waits to place a call. Everyone was on discussing the quake. And cellular company pronouncements aside, it isn't going to get better, even if they get more bandwidth that will be eaten up in 2-4 years. The total migration to cellular, the unlimited use, the tendency for people to yack when a bad day comes all makes for a disaster. We need solutions, not cell company hype, not government catering to special interests, but real solutions that fix problems without introducing more. One of the first things cellular companies can do is stop overselling cellular. The second is end or raise the price significantly on unlimited plans, both voice and data. Go to what the landlines called, USS, that is you pay for every minute.... Even if that charge is small, it will drive usage down. Otherwise on a bad day people will die waiting for the yackers to get off the call phone so they can call 911. Hopefully it will not be on VOIP and the internet is down. Ralph Brandt -----Original Message----- From: Jared Mauch [mailto:jared@puck.nether.net] Sent: Wednesday, May 02, 2012 4:15 PM To: Eric Wieling Cc: NANOG list Subject: VoIP vs POTS (was Re: Operation Ghost Click) On May 2, 2012, at 3:52 PM, Eric Wieling wrote:

I doubt the g729 or GSM codecs used by VoIP and Cell phones can

compare to a POTS line. This is why many people use g711ulaw or other codec. Personally I would not work with anyone that doesn't do g711ulaw (88.2kbit when IP packet overhead added in). There are other codecs such as G.722.1 & G.722.2 but the support isn't as broad as g711ulaw/alaw. Regarding landline service, this can fail for many of the common reasons it does are the same reasons that IP service may fail. The failure modes can depend on a variety of circumstances from the physical layer (e.g.: audible static on the line) that cause your ear to retrain, which may cause a DSL device to comparably retrain. The same is true for shared medium such as CATV but this has other problems as well, if not well isolated, somebody can short out the segment or send garbage at the wrong channel, etc. Personally, I'm thinking of ditching my ISDN (gives clear dial tone at a long-distance from the CO) for something like the Verizon Home Connect box. Gives a few hours of built-in battery backup, but would fail once the tower loses power (usually 8-12 hours). I also am concerned about 911 service. When dialing 911 recently from my mobile, I should have dialed it from my home phone as I was routed a few times to get to the right fire dispatch team. Oh well. - Jared

On Thu, May 3, 2012 at 8:15 AM, Tei <oscar.vives@gmail.com> wrote: ** Perhaps cell towers can be made to fail sooner, and enter some ** emergency mode where only 911 calls get service. ** ** ** ** -- Don't cell companies already provide over-ride codes to various federal agencies to obtain emergency priority access to cell service? (**** added just to piss off Valdis) -- 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

Sean, do you know anyone who has successfully used either to place a call? I think the weak spot is when the tower overloads nobody can dial anything, including the bypass.. Ralph Brandt Communications Engineer HP Enterprise Services Telephone +1 717.506.0802 FAX +1 717.506.4358 Email Ralph.Brandt@pateam.com 5095 Ritter Rd Mechanicsburg PA 17055 -----Original Message----- From: Sean Harlow [mailto:sean@seanharlow.info] Sent: Thursday, May 03, 2012 12:36 PM To: Mike Hale Cc: NANOG list Subject: Re: VoIP vs POTS (was Re: Operation Ghost Click) On May 3, 2012, at 12:26, Mike Hale wrote:

Don't cell companies already provide over-ride codes to various federal agencies to obtain emergency priority access to cell service?

That would be the Nationwide Wireless Priority Service. Authorized users can dial *272<destination> to get priority on supported wireless networks. If the landline networks are also backed up, they can make the call to (710) NCS-GETS which is the gateway number for the Government Emergency Telecommunications System which provides the same priority on POTS lines. http://en.wikipedia.org/wiki/Nationwide_Wireless_Priority_Service http://en.wikipedia.org/wiki/Government_Emergency_Telecommunications_Ser vice --- Sean Harlow sean@seanharlow.info

I spent a week in a PEMA conference last fall. One of the presentations was from two ILECS and 1 CLEC. The answer we got was, yes we do but no we can't. Got it? What I understand after grilling the 5 reps from one company and three for the other, is they have priority of who can make a call but not in who can get the system attention. SO till you get the system attention, you don't go anywhere. The ILEC is not in cell and admitted they had problems, were working on them, do not have them all solved, do not know if they can solve them all - they had some credibility. I looked at the other two as snake oil salesmen.... I was the only one who asked any questions. Ralph Brandt York PA 17055 -----Original Message----- From: Mike Hale [mailto:eyeronic.design@gmail.com] Sent: Thursday, May 03, 2012 12:26 PM To: Tei Cc: NANOG list Subject: Re: VoIP vs POTS (was Re: Operation Ghost Click) On Thu, May 3, 2012 at 8:15 AM, Tei <oscar.vives@gmail.com> wrote: ** Perhaps cell towers can be made to fail sooner, and enter some ** emergency mode where only 911 calls get service. ** ** ** ** -- Don't cell companies already provide over-ride codes to various federal agencies to obtain emergency priority access to cell service? (**** added just to piss off Valdis) -- 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

----- Original Message -----

From: "Ralph Brandt" <ralph.brandt@pateam.com>

The problem with this is, MOST 911 CALLS ARE CELLULAR or soon will be.

{citation-needed} Cheers, -- jra -- Jay R. Ashworth Baylink jra@baylink.com Designer The Things I Think RFC 2100 Ashworth & Associates http://baylink.pitas.com 2000 Land Rover DII St Petersburg FL USA http://photo.imageinc.us +1 727 647 1274

That's precisely where SatCom enters the picture. Cell companies aren't ever going to undersell their bandwidth...that simply isn't profitable. SatCom is one of the best ways to plan for communications outages during times of crisis, especially if you choose a provider that's outside of your area. Unfortunately, you're going to end up spending at least one more order of magnitude on *decent* satellite service than you would spend on cell (unless you only go with a satphone). On Thu, May 3, 2012 at 7:59 AM, Brandt, Ralph <ralph.brandt@pateam.com> wrote:

*SNIP*

During a Peach Bottom (nuclear power plant - one of our two in the area - the other is Three Mile Island) several of the EOC's lost phone, FAX and radio connectivity (repeater failures) to County EOC because of thunderstorms and tornados that blew in during the drill.  The ham radio operators at these EOC's and County provided communications to the sites for both the drill and live events. They happened to be on site for the drill. The site I was at was vacated except the hams, the government evaluators and the public works guy because of a fire, all of the other players in the EOC including the EMC were firemen!  A lack of volunteers means people wear multiple hats.

But let's get to the big item.  When the bad day comes, cellular is worthless.  I was at work the day of the earthquake in Virginia, a couple hundred miles south of us.  The ground shook and some masonry buildings in the area sustained cracks that needed to be repaired.  Ten minutes after the quake cellular was either useless or had up to fifteen minute waits to place a call.  Everyone was on discussing the quake. And cellular company pronouncements aside, it isn't going to get better, even if they get more bandwidth that will be eaten up in 2-4 years. The total migration to cellular, the unlimited use, the tendency for people to yack when a bad day comes all makes for a disaster.  We need solutions, not cell company hype, not government catering to special interests, but real solutions that fix problems without introducing more.

One of the first things cellular companies can do is stop overselling cellular.  The second is end or raise the price significantly on unlimited plans, both voice and data.  Go to what the landlines called, USS, that is you pay for every minute....  Even if that charge is small, it will drive usage down.

Otherwise on a bad day people will die waiting for the yackers to get off the call phone so they can call 911.  Hopefully it will not be on VOIP and the internet is down.

Ralph Brandt

-----Original Message----- From: Jared Mauch [mailto:jared@puck.nether.net] Sent: Wednesday, May 02, 2012 4:15 PM To: Eric Wieling Cc: NANOG list Subject: VoIP vs POTS (was Re: Operation Ghost Click)

On May 2, 2012, at 3:52 PM, Eric Wieling wrote:

...

I doubt the g729 or GSM codecs used by VoIP and Cell phones can

compare to a POTS line.

This is why many people use g711ulaw or other codec.

Personally I would not work with anyone that doesn't do g711ulaw (88.2kbit when IP packet overhead added in).

There are other codecs such as G.722.1 & G.722.2 but the support isn't as broad as g711ulaw/alaw.

Regarding landline service, this can fail for many of the common reasons it does are the same reasons that IP service may fail.  The failure modes can depend on a variety of circumstances from the physical layer (e.g.: audible static on the line) that cause your ear to retrain, which may cause a DSL device to comparably retrain.  The same is true for shared medium such as CATV but this has other problems as well, if not well isolated, somebody can short out the segment or send garbage at the wrong channel, etc.

Personally, I'm thinking of ditching my ISDN (gives clear dial tone at a long-distance from the CO) for something like the Verizon Home Connect box.  Gives a few hours of built-in battery backup, but would fail once the tower loses power (usually 8-12 hours).

I also am concerned about 911 service.  When dialing 911 recently from my mobile, I should have dialed it from my home phone as I was routed a few times to get to the right fire dispatch team.

Oh well.

- Jared

-- 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

Absolutely. Again, it depends on what service you use, what contention the provider gives you, and so forth. If you go with a quality provider and a good service plan, you will not get bumped off in favor of someone else. Of course, you're paying much more for service like that, but you really do get what you pay for, especially when it comes to satellite. On Thu, May 3, 2012 at 11:35 AM, Brandt, Ralph <ralph.brandt@pateam.com> wrote:

Satcoms are the panacea for every problem until you try them.  They too have limited numbers of channels, far lower than cell.

Check the fiasco in Haiti when sat phones were handed out and it took hours to make calls.

Sometimes two tin cans and a string are better....

Ralph Brandt

-----Original Message----- From: Mike Hale [mailto:eyeronic.design@gmail.com] Sent: Thursday, May 03, 2012 12:32 PM To: Brandt, Ralph Cc: NANOG list Subject: Re: VoIP vs POTS (was Re: Operation Ghost Click)

That's precisely where SatCom enters the picture.  Cell companies aren't ever going to undersell their bandwidth...that simply isn't profitable.  SatCom is one of the best ways to plan for communications outages during times of crisis, especially if you choose a provider that's outside of your area.  Unfortunately, you're going to end up spending at least one more order of magnitude on *decent* satellite service than you would spend on cell (unless you only go with a satphone).

On Thu, May 3, 2012 at 7:59 AM, Brandt, Ralph <ralph.brandt@pateam.com> wrote:

...

*SNIP*

During a Peach Bottom (nuclear power plant - one of our two in the area - the other is Three Mile Island) several of the EOC's lost phone, FAX and radio connectivity (repeater failures) to County EOC because of thunderstorms and tornados that blew in during the drill.  The ham radio operators at these EOC's and County provided communications to the sites for both the drill and live events. They happened to be on site for the drill. The site I was at was vacated except the hams, the government evaluators and the public works guy because of a fire, all of the other players in the EOC including the EMC were firemen!  A lack of volunteers means people wear multiple hats.

But let's get to the big item.  When the bad day comes, cellular is worthless.  I was at work the day of the earthquake in Virginia, a couple hundred miles south of us.  The ground shook and some masonry buildings in the area sustained cracks that needed to be repaired.  Ten minutes after the quake cellular was either useless or had up to fifteen minute waits to place a call.  Everyone was on discussing the quake. And cellular company pronouncements aside, it isn't going to get better, even if they get more bandwidth that will be eaten up in 2-4 years. The total migration to cellular, the unlimited use, the tendency for people to yack when a bad day comes all makes for a disaster.  We need solutions, not cell company hype, not government catering to special interests, but real solutions that fix problems without introducing more.

One of the first things cellular companies can do is stop overselling cellular.  The second is end or raise the price significantly on unlimited plans, both voice and data.  Go to what the landlines called, USS, that is you pay for every minute....  Even if that charge is small, it will drive usage down.

Otherwise on a bad day people will die waiting for the yackers to get off the call phone so they can call 911.  Hopefully it will not be on VOIP and the internet is down.

Ralph Brandt

-----Original Message----- From: Jared Mauch [mailto:jared@puck.nether.net] Sent: Wednesday, May 02, 2012 4:15 PM To: Eric Wieling Cc: NANOG list Subject: VoIP vs POTS (was Re: Operation Ghost Click)

On May 2, 2012, at 3:52 PM, Eric Wieling wrote:

...

I doubt the g729 or GSM codecs used by VoIP and Cell phones can

compare to a POTS line.

This is why many people use g711ulaw or other codec.

Personally I would not work with anyone that doesn't do g711ulaw (88.2kbit when IP packet overhead added in).

There are other codecs such as G.722.1 & G.722.2 but the support isn't as broad as g711ulaw/alaw.

Regarding landline service, this can fail for many of the common reasons it does are the same reasons that IP service may fail.  The failure modes can depend on a variety of circumstances from the physical layer (e.g.: audible static on the line) that cause your ear to retrain, which may cause a DSL device to comparably retrain.  The same is true for shared medium such as CATV but this has other problems as well, if not well isolated, somebody can short out the segment or send garbage at the wrong channel, etc.

Personally, I'm thinking of ditching my ISDN (gives clear dial tone at a long-distance from the CO) for something like the Verizon Home Connect box.  Gives a few hours of built-in battery backup, but would fail once the tower loses power (usually 8-12 hours).

I also am concerned about 911 service.  When dialing 911 recently from my mobile, I should have dialed it from my home phone as I was routed a few times to get to the right fire dispatch team.

Oh well.

- Jared

-- 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

-- 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0

On Thu, May 3, 2012 at 12:25 PM, Luke S. Crawford <lsc@prgmr.com> wrote:

On Thu, May 03, 2012 at 10:59:47AM -0400, Brandt, Ralph wrote:

...

One of the first things cellular companies can do is stop overselling cellular.  The second is end or raise the price significantly on unlimited plans, both voice and data.  Go to what the landlines called, USS, that is you pay for every minute....  Even if that charge is small, it will drive usage down.

Otherwise on a bad day people will die waiting for the yackers to get off the call phone so they can call 911.  Hopefully it will not be on VOIP and the internet is down.

A few years back, I was working late on the top floor of one of the Yahoo mission college buildings during an earthquake.  It felt really dramatic; I was on the 9th floor and the lights were swinging back and forth and yeah.   So, I went outside (who knows how bad it was)  figured out it wasn't that bad, and so before going home, I decided to call some people to tell them I was okay.  Of course, it was as you describe, I couldn't get through.

what did I do?  I sent a text message.  It got through and I got an answer back in about the usual amount of time it takes someone to respond to a sms text.

It seems like SMS might be a reasonable backup during these periods of high load.

Good point. SMSes seem pretty congestion friendly since they're usually riding control channels anyway, and can be queued up and delivered when capacity is there (no channel reservation needed). --j

Christopher Morrow wrote:

wow, 1990 much? are you actually just trolling today perhaps?

No, what is wrong with using a land line, a rotary phone and enjoying a reliable service? Plus a superior audio quality as opposed to the compressed to hell quality of mobile phones. Not withstanding that, according to you, in some places the landlines "clipped the copper below the ground-level" I believe that vast majority of the country has working copper phone lines that continue to work during a power outage. I fail to see why you must call me a troll for saying such a thing, alas, maybe it can be attributed to a bad hair day. Regards, Jeroen -- Earthquake Magnitude: 4.0 Date: Wednesday, May 2, 2012 12:33:29 UTC Location: Vancouver Island, Canada region Latitude: 50.6619; Longitude: -129.8861 Depth: 10.00 km

On Wed, May 2, 2012 at 4:02 PM, Chris Adams <cmadams@hiwaay.net> wrote:

Once upon a time, Jeroen van Aart <jeroen@mompl.net> said:

...

Not withstanding that, according to you, in some places the landlines "clipped the copper below the ground-level" I believe that vast majority of the country has working copper phone lines that continue to work during a power outage.

Not so much.  As has been pointed out here many times before, many people now get POTS lines from remote cabinets that have limited battery life and fail in a power outage lasting more than a few minutes.

yes, this. in the last 2 neighborhoods I've lived in... near/around ashburn, va (home to verizon, mci, lots of telco/bell-shaped-heads) I've always been serviced from a remote terminal, that has often failed when the power has cycled... There's a slew of places in the US where you don't actually go all the way back to the CO on a single copper pair :( never mind the places where the mini-co bundles you up on some mpls/ccc/etc link ... anyway :)

Many states have regulations regarding how long dial tone needs to last during a power outage. Iowa's PUC (the IUB) requires at least two hours of backup power. We design ours for eight hours. Frank -----Original Message----- From: Chris Adams [mailto:cmadams@hiwaay.net] Sent: Wednesday, May 02, 2012 3:03 PM To: NANOG list Subject: Re: Operation Ghost Click <snip> Not so much. As has been pointed out here many times before, many people now get POTS lines from remote cabinets that have limited battery life and fail in a power outage lasting more than a few minutes. -- Chris Adams <cmadams@hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

Connecticut has such a bill pending. My suggestion to people there, Get a ham radio license and a 2 meter transceiver with a car adapter....... Ralph Brandt York PA -----Original Message----- From: Jared Mauch [mailto:jared@puck.nether.net] Sent: Wednesday, May 02, 2012 11:29 PM To: Frank Bulk Cc: NANOG list Subject: POTS Ending (Re: Operation Ghost Click) On May 2, 2012, at 9:42 PM, Frank Bulk wrote:

Many states have regulations regarding how long dial tone needs to last during a power outage. Iowa's PUC (the IUB) requires at least two hours of backup power. We design ours for eight hours.

One thing of note that I've been tracking is this: http://www.usatoday.com/news/nation/story/2012-04-16/landline-service-be coming-obsolete/54321184/1 I'm somewhat dubious about the following claims on the part of the carrier. This is a carrier that wants to meter your cellular data but provides wifi service inferior to the cellular data to "offload" their wireless network. -- snip -- "Bill sponsors and phone companies including AT&T say deregulating land-line phone service will increase competition and allow carriers to invest in better technology rather than expand a dying service. Some consumer organizations fear the change will hurt affordable service, especially in rural areas." -- snip -- - Jared

On 2012-05-04, at 09:11, Anurag Bhatia wrote:

Curious to know if naked DSL (DSL without dialtone & POTS link) is common in North America?

It's common in Bell Canada's service region in Ontario and Québec. They still provide dial tone on each pair, though, to help techs avoid re-using apparently active pairs when they're out and about (and I think each naked pair is still run through a DMS so they can get their full set of line stats through the normal management platforms). Joe

On 04-May-12 04:11, Anurag Bhatia wrote:

Curious to know if naked DSL (DSL without dialtone & POTS link) is common in North America?

The availability of naked DSL varies from state to state within the US, depending on how successful the telcos have been at bribing^Wlobbying the various state regulators and politicians. Even where not required, some telcos have ended up offering it anyway due to competition from other service providers, eg. cable, fixed wireless or mobile wireless.

PSTN <<>> IP connectivity is banned [in India] which brings up back to GSM/CDMA and POTS option.

The naked DSL debate isn't about VoIP; it's really about the mass adoption of mobile phones. Some telcos see DSL as an opportunity to force customers to keep paying for landlines they never use anymore. This is a big deal because they have a lot of expensive equipment they're still paying for--much of it bought to handle the massive influx of dial-up modem users in the 1990s--that is generating less and less revenue every year. S -- Stephen Sprunk "God does not play dice." --Albert Einstein CCIE #3723 "God is an inveterate gambler, and He throws the K5SSS dice at every possible opportunity." --Stephen Hawking

Premature and very dangerous move, the public is at great risk, only Sat phones seem to work when there is a natural disaster. Cell phones for the most part can't even connect to 911....

tohoku quake o land voice phones did not work o mobile phone voice did not work o mobile phone text did not work o land ip worked, adsl, ftth, ... o mobile phone data worked! you could send email but not make a voice call just a data point randy

...

...

Premature and very dangerous move, the public is at great risk, only Sat phones seem to work when there is a natural disaster. Cell phones for the most part can't even connect to 911....

tohoku quake o land voice phones did not work o mobile phone voice did not work o mobile phone text did not work o land ip worked, adsl, ftth, ... o mobile phone data worked!

you could send email but not make a voice call

How will you exactly "connect to internet" during such massive downtime? I mean mobile data is dead, and with dead landline I assume cable broken - then how exactly one can send email? :)

perhaps you should read a bit more carefully. mobile data was not dead, mobile voice was. land voice was dead, land data was not. randy

Does not matter much when few people are using home landlines and even fewer own sat phones. Steven Naslund -----Original Message----- From: Henry Linneweh [mailto:hrlinneweh@sbcglobal.net] Sent: Wednesday, May 09, 2012 10:45 AM To: Stephen Sprunk; nanog@nanog.org Subject: Re: POTS Ending (Re: Operation Ghost Click) Premature and very dangerous move, the public is at great risk, only Sat phones seem to work when there is a natural disaster. Cell phones for the most part can't even connect to 911.... -henry ________________________________ From: Stephen Sprunk <stephen@sprunk.org> To: nanog@nanog.org Sent: Sunday, May 6, 2012 12:44 PM Subject: Re: POTS Ending (Re: Operation Ghost Click) On 04-May-12 04:11, Anurag Bhatia wrote:

Curious to know if naked DSL (DSL without dialtone & POTS link) is common in North America?

The availability of naked DSL varies from state to state within the US, depending on how successful the telcos have been at bribing^Wlobbying the various state regulators and politicians.  Even where not required, some telcos have ended up offering it anyway due to competition from other service providers, eg. cable, fixed wireless or mobile wireless.

PSTN <<>> IP connectivity is banned [in India] which brings up back to GSM/CDMA and POTS option.

The naked DSL debate isn't about VoIP; it's really about the mass adoption of mobile phones.  Some telcos see DSL as an opportunity to force customers to keep paying for landlines they never use anymore. This is a big deal because they have a lot of expensive equipment they're still paying for--much of it bought to handle the massive influx of dial-up modem users in the 1990s--that is generating less and less revenue every year. S -- Stephen Sprunk        "God does not play dice."  --Albert Einstein CCIE #3723        "God is an inveterate gambler, and He throws the K5SSS        dice at every possible opportunity." --Stephen Hawking

Brandt, Ralph wrote:

I am not sure who uses DSL here. I have two people I know who use it, both are dissatisfied and if they had an alternative it woud not be.

It is slow, unreliable compared to cable.

That's a rather bold statement which I find hard to believe. Do you have any data to back it up? Haven't had much problems with DSL. In fact my current service (cruzio) has been very stable. With he only notable outage in recent years being the one that was caused by some cable being cut somewhere in Southern California (rather recent actually). I think with cable you're stuck with the local monopolist aren't you? Regards, Jeroen -- Earthquake Magnitude: 4.1 Date: Monday, May 7, 2012 13:19:36 UTC Location: southern Iran Latitude: 27.0547; Longitude: 56.4356 Depth: 35.00 km

On 26 Apr 2012, at 22:47, "Andrew Latham" <lathama@gmail.com<mailto:lathama@gmail.com>> wrote: On Thu, Apr 26, 2012 at 5:38 PM, Jeroen van Aart <jeroen@mompl.net<mailto:jeroen@mompl.net>> wrote: Yes its a major problem for the users unknowingly infected. To them it will look like their Internet connection is down. Expect ISPs to field lots of support s Is there a list of these temporary servers so I can see what customers are using them (indicating infection) and head off a support call with some contact? -- Leigh ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________

http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-mal... On Apr 26, 2012 5:48 PM, "Leigh Porter" <leigh.porter@ukbroadband.com> wrote:

On 26 Apr 2012, at 22:47, "Andrew Latham" <lathama@gmail.com<mailto: lathama@gmail.com>> wrote:

On Thu, Apr 26, 2012 at 5:38 PM, Jeroen van Aart <jeroen@mompl.net<mailto: jeroen@mompl.net>> wrote:

Yes its a major problem for the users unknowingly infected. To them it will look like their Internet connection is down. Expect ISPs to field lots of support s

Is there a list of these temporary servers so I can see what customers are using them (indicating infection) and head off a support call with some contact?

-- Leigh

______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________

Thanks, Andrew. I was out and about, and couldn't remember the prefixes off-hand. They should have been in that PDF, iirc On Apr 26, 2012 6:01 PM, "Andrew Latham" <lathama@gmail.com> wrote:

On Thu, Apr 26, 2012 at 5:57 PM, Kyle Creyts <kyle.creyts@gmail.com> wrote:

...

http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-mal...

...

On Apr 26, 2012 5:48 PM, "Leigh Porter" <leigh.porter@ukbroadband.com> wrote:

...

On 26 Apr 2012, at 22:47, "Andrew Latham" <lathama@gmail.com<mailto:lathama@gmail.com>> wrote:

On Thu, Apr 26, 2012 at 5:38 PM, Jeroen van Aart <jeroen@mompl.net<mailto:jeroen@mompl.net>> wrote:

Yes its a major problem for the users unknowingly infected. To them it will look like their Internet connection is down. Expect ISPs to field lots of support s

Is there a list of these temporary servers so I can see what customers

are

...

...

using them (indicating infection) and head off a support call with some contact?

-- Leigh

85.255.112.0 through 85.255.127.255 67.210.0.0 through 67.210.15.255 93.188.160.0 through 93.188.167.255 77.67.83.0 through 77.67.83.255 213.109.64.0 through 213.109.79.255 64.28.176.0 through 64.28.191.255

-- ~ Andrew "lathama" Latham lathama@gmail.com http://lathama.net ~

On 4/26/2012 5:44 PM, Andrew Latham wrote:

Yes its a major problem for the users unknowingly infected. To them it will look like their Internet connection is down. Expect ISPs to field lots of support calls.

And what about the millions of users unknowingly infected with "something else" ?? These people need help, at least the "Ghost Click" victims will have a clue after July 9, unless we opt to extend our head-in-the-sand period. (We have enough trouble isolating/remediating issues among our relatively small user base, I'd hate to be facing a major ISP size support/remediation effort...) Does anyone have a plan? Jeff

O'Reirdan, Michael wrote:

Please look at www.dcwg.org

Thanks all for the information. It looks like the practical upshot is that computers that have been infected and not yet fixed may loose the ability to resolve names into IP addresses starting sometime after July 9, which is when the replacement nameservers are supposed to be stopped. That in and of itself is quite a nuisance for the individual as well as the ISP helldesks but it could have been worse. I would certainly not call it "Internet doomsday". Greetings, Jeroen -- Earthquake Magnitude: 4.9 Date: Friday, April 27, 2012 21:51:23 UTC Location: Prince Edward Islands region Latitude: -41.1063; Longitude: 43.4278 Depth: 10.00 km

On Fri, Apr 27, 2012 at 5:35 PM, Ameen Pishdadi <apishdadi@gmail.com> wrote:

If the user is stupid enough to be infected for that long I think it's a good thing they get cut off from the net , should be a policy of all ISPs , If your infected then you lose privilege to get online and thus you can't scan and infect other idiots or become a ddos tool for the script kiddies. I for one say turn em off!!!!

Thanks, Ameen Pishdadi

you're obviously lucky, and don't have "stupid" grandparents.

On Fri, 27 Apr 2012 19:35:51 -0500, Ameen Pishdadi said:

If the user is stupid enough to be infected for that long

And they'd know they were infected, how, exactly? (Think carefully before answering that, and keep in mind that although *you* may be the world's greatest IT specialist, the average Joe Sixpack wants to surf the web and read his e-mail, and does *not* understand (or even *want* to) very much about computer security).

On Thu, Apr 26, 2012 at 10:03:44PM -0400, Jeff Kell wrote:

And what about the millions of users unknowingly infected with "something else" ??

s/millions/hundreds of millions/ We passed the 100M zombie/bot mark years ago and nothing has happened in the interim that should/would cause the trend to reverse. (Based on what I've seen, the curve continues to monotonically increase.) Worse, even the most sophisticated measurement techniques we have are guaranteed to miss some unknown/unknowable fraction of the total population, since botmasters are known to keep reserves. And worse yet, we're now seeing infestations of portable devices/phones, systems running MacOS, etc., so while it's been, to this point, a Windows problem to about five to seven 9's, it's not anymore, and it's not going to be.

Does anyone have a plan?

No. Well, that's a bit unfair: lots of people have ideas, proposals, and such, but until/unless there's a massive, coordinated, focused effort -- which will cost a LOT of money -- those ideas and proposals can have (at best) temporary, localized effects. I would like to think that the software vendors whose products are involved would step up, but if that was going to happen, it probably would have happened by now. The most likely outcomes are: (1) that the status quo will continue: massive amounts of attention, effort, and money will be focused on mitigating the consequences (e.g., anti-spam, anti-phish, anti-DDoS, anti-malware, anti-anti-anti defenses) and almost none will be focused on addressing the root causes. (2) Those running networks which are infested on a systemic and chronic basis will continue to do so and will not be held accountable (by anyone) for their incompetence. (3) More sophisticated bot-creating software will be developed and thoroughly tested against anti-malware products before being deployed. (4) Botnet command and control mechanisms will become more resilient in the face of attacks. (5) Every now and then, some vendor and/or some government agency will have a press conference and engage in self-congratulatory chest-beating about how they've taken down a 5-million member botnet, while botmasters are busy recruiting all 5 million still-compromised systems into new botnets. (6) Once in a while, some poor unsuspecting person sitting in front of one of these systems will be stuck holding the bag when clueless prosecutors, assisted by thoroughly ignorant judges and stunningly inept "experts", decide to score some election-year points by destroying an innocent person's life: see "Julie Amero" for a canonical example. (7) Data harvested from all these systems will continue to be collated and sold to spammers, phishers, identity thieves, blackmailers, and anyone else with a passing interest in the usable contents of large numbers of systems. (8) Legislators and politicians who cannot even use computers will propose and likely pass bill after bill after bill which not only makes the situation worse, but uses it as an excuse to destroy the few remaining protections that citizens have against wholesale government snooping into their private lives. As a bonus, they'll ensure that much of this information is passed along to any private contractors who've made sufficient campaign contributions, and they in turn will be hacked by the first bored 17-year-old with an attitude that takes note of their existence. Oh. Almost forgot. At each step, the favorite phrases of people who've failed to learn from history, failed to heed warnings, failed to educate themselves, failed to listen to experts and now wish to distance themselves as far as they possibly can from the direct consequences of their own choices and actions will be used: "nobody could have predicted" and "we take this matter seriously" ---rsk

ISPs in the Netherlands have had a "botnet treaty" in effect since 2009, which calls for blocking, user notification, and inter-ISP information sharing. <http://ripe59.ripe.net/presentations/huijbregts-botnet-convenant.pdf> <http://www.darkreading.com/blog/227700601/dutch-isps-sign-anti-botnet-treaty.html> I don't have any data about how effective it's been, though. On Tue, May 1, 2012 at 8:26 AM, Livingood, Jason <Jason_Livingood@cable.comcast.com> wrote:

On 4/26/12 10:03 PM, "Jeff Kell" <jeff-kell@utc.edu> wrote:

...

And what about the millions of users unknowingly infected with "something else" ??

(We have enough trouble isolating/remediating issues among our relatively small user base, I'd hate to be facing a major ISP size support/remediation effort...)

Does anyone have a plan?

Well, there's the new botnet code of conduct think (Mike O'Reirdan can chime in with more info here). Plus ISPs like the one I work at (Comcast) have been doing bot notification and remediation for some time now. I know other ISPs have different approaches, and so different bot programs, but the majority of them are doing something (with a few exceptions).

Jason