On Wed, 18 Sep 2002, Jared Mauch wrote:

...

And BGP should be more secure. What is the problem we should be trying to fix here? There is a "Secure BGP" draft: http://www.ir.bbn.com/projects/sbgp/draft-clynn-s-bgp-protocol-00a.txt

I think the problem that people are attempting to address is the fact that most interprovider bgp sessions are unfiltered and this can cause significant problems if someone starts leaking improper routes or decides to do something malicious.

Authentication of routing announcements is seen as better than "just letting it all slosh around".

It does. But the problem is that what you can know to be good is very likely to be a lot less than what is actually good. So if you simply start requiring authentication, you're going to break reachability in some places.

...

I read solutions (well, avenues for possible solutions) without a good indication of what the problem is. (That goes for both the Secure Cyberspace and S-BGP drafts.)

Well, there are significant problems today with router architecture that prevent s-bgp and other things from being deployed. Namely start looking at those still using 2500/4500/4700 for bgp in their networks (yes people still do this) and then ask it to do some major cryptograhic authentication... The hardware is not designed for this.

The protocols aren't designed for it either. This is a good thing, because every router can run the necessary protocols autonomously. But it also means a huge duplication of effort. It seems pretty ridiculous to me to have each and every router do strong crypto on each and every BGP update. This kind of stuff should run on centralized servers with adequate disk capacity to cache results. The hard part is integrating such a solution into what we have now. I'm thinking of a protocol that enables BGP routers to consult "policy servers" about the updates they receive. When very strict security is required, the router waits for the PS to clear the update before allowing it, but in a less strict setup the router could process updates and remove the routes later if the PS doesn't like them. In this case, loss of the PS doesn't break the network. So we still have autonomy and implementing new security features becomes much easier because only the policy servers have to know about them.

When "W" goes surfing the net at night to shop for things on ebay and can't get there because someone is improperly announcing a /24 to hijack/DoS them,

Announcing a /24 you have no business announcing is a VERY hard thing to do. The overwheling majority of all ISPs has strict filtering on BGP announcements from customers. Now if the same were true for source address filtering for IP packets, it would be possible to adequately filter DoS traffic (unless massively distributed in nature).

these are the things that they will suggest down that there needs to be authentication and centralized routing data created.

Actually this particular BGP weakness isn't that hard to address: you only need to verify the first few AS numbers in the path and the prefix using a routing registry. You don't even need any crypto (in BGP, at least) for that. And if you want to make it really secure you can add a signature attribute at the source. That costs extra memory in routers, but it's doable. My problems are with the assumption in the S-BGP draft that information in BGP must be protected against modification by routers it passes legitimately. I think some reasonable level of trust is necessary. After all, we trust others to prepare our food, stop for a red light when we cross the road and so on. Or maybe we can all promise to password protect our BGP sessions?

From a security perspective, the recommendations in this report are

On Wed, 18 Sep 2002, Sean Donelan wrote: :Is the telephone security model better than the Internet security model? :It depends on who you ask. They both have interesting security issues. :Unfortunately, a lot of it is based on perception on both sides, and only :a little on fact. Indeed, I am currently trying to retrofit security features onto a routed network designed by people who evidently have a better understanding of switching. It is no coincidence that they just happen to be telco network architects. (I can't believe I am still describing the importance of DNS to people in 2002, but I digress..) IMHO, the telco model is based on the notion of delivering services from a set of tiered providers instead of the facilitating the interconnection of relatively autonomous networks. It's pretty much a difference of philisophical worldviews. While there is some conceptual overlap between them, they are not particularly isometric. the same things that have been advocated for the last decade. In fact it looks like many of these recommendations could have been culled from the various vulnerability assessment report templates I have seen and even used over the years. I don't mean to undermine the importance of the strategy, but I think its impact will be through adding weight to us Cassandras in the security industry. Maybe they'll legislate Cisco's SAFE architecture on us all? ;) :I can draw Internet security architectures until my fingers fall off, but :they won't have the impact of industry consensus. Well, I think the consensus was just handed to you in the form of a national mandate. In fact, I think this looks like an excellent premise for a business plan for a security consulting and managed services firm. Got Capital? Cheers, -- batz

On Thu, 19 Sep 2002, batz wrote:

From a security perspective, the recommendations in this report are the same things that have been advocated for the last decade. In fact it looks like many of these recommendations could have been culled from the various vulnerability assessment report templates I have seen and even used over the years. I don't mean to undermine the importance of the strategy, but I think its impact will be through adding weight to us Cassandras in the security industry.

People expecting the government to wave a magic wand and make us all safe will be disappointed. Security consulting firms probably aren't going to get a windfall from the publication of the national strategy. But if you had more modest goals, the strategy did accomplish some things. Despite the daily drumbeat of vulnerability announcements, there really aren't any new fundamental causes of security problems. The National Academies of Sciences published a report last year recapping 10 years of computer and network security studies. http://www.nap.edu/catalog/10274.html The particular instance may change, but the classes of security problems are unchanging. Although the security problems are the same, the solutions can change. In the 1980's I had a Multics/Dockmaster account. Multics may have been secure, but the system sucked. Perimeter firewalls may not be the security solution for the next decade. Would anti-virus software become obsolete with a better kernel? Are the same password rules we had for our one mainframe account applicable in today's web with dozens of "logons"? I think we need to re-evaluate our best solutions for our security problems. That National Cybersecurity Strategy did a nice job of collecting the problems from all groups into one document, and showing an interdependence between the groups. Simply securing one industry, company or home user isn't enough to solve the problem. I especially pleased that at least part of the US government now seems to recognize that security is more than just secrecy. Could the government move faster? It took over 15 years from the introduction of seat belts on an American car until they became "standard" items in American cars. The government only "mandated" seat belts after most car makers were already offering them. There were a lot of studies along the way. A democratic government can't get too far out in front of the public. American Seat Belt History (http://www.lemurzone.com/airbag/belts.htm) 1947 The first time seat belts were offered in a American car was the Tucker. The state of the art then were Lap belts. 1956 Ford introduces seat belts in American cars 1964 Seatbelts became a "standard" feature in American cars 1966 Rear Seatbelts became Standard 1967 Front Seatbelts became Mandatory 1968 Shoulder Belts became Mandatory Nevertheless, seat belts won't help unless the driver buckles up.

On Sat, 21 Sep 2002, Iljitsch van Beijnum wrote:

Anyway, in our efforts to see security weaknesses everywhere, we might be going too far. For instance, nearly all our current protocols are completely vulnerable to a man-in-the-middle attack. If someone digs up a fiber, intercepts packets and changes the content before letting them continue to their destination, maybe the layer 1 guys will notice, but not any of us IP people.

I'm waiting for one of the professional security consulting firms to issue their weekly press release screaming "Network Operator Meeting Fails Security Test." The wireless networks at NANOG meetings never follow what the security professionals say are mandatory, essential security practices. The NANOG wireless network doesn't use any authentication, enables broadcast SSID, has a trivial to guess SSID, doesn't use WEP, doesn't have any perimeter firewalls, etc, etc, etc. At the last NANOG meeting IIRC over 400 stations were active on the network. Are network operators really that clueless about security, or perhaps we need to step back and re-think. What are we really trying to protect? Banks are mostly concerned about people defrauding the bank, not the bank's customers. Banks rarely check the signature on a check. Is security just perception?

On Sat, Sep 21, 2002 at 05:46:27PM -0400, Sean Donelan wrote:

I'm waiting for one of the professional security consulting firms to issue their weekly press release screaming "Network Operator Meeting Fails Security Test."

The wireless networks at NANOG meetings never follow what the security professionals say are mandatory, essential security practices. The NANOG wireless network doesn't use any authentication, enables broadcast SSID, has a trivial to guess SSID, doesn't use WEP, doesn't have any perimeter firewalls, etc, etc, etc. At the last NANOG meeting IIRC over 400 stations were active on the network.

What do you mean "trivial to guess", its started at www.nanog.org. :) I'm not aware of any wireless networks setup at conventions with the purpose of sharing confidential data and keeping people out. It is there as a "public service", for everyone to use. I'm certain that the company providing the bandwidth doen't put it inside their corporate firewalls. Would WEP solve anything other than keeping the casual person on the street who doesn't know what NANOG is from getting free bandwidth for a couple days? I don't think so.

Are network operators really that clueless about security, or perhaps we need to step back and re-think. What are we really trying to protect?

If I sit down at a crowded presentation with a Windows laptop, I'm sure to get an infrared connection to at least 3 people within 10 minutes. If I set my wireless to ad-hoc mode, I can find at least 10 people in any given room with open shares. And if you ever fire up a sniffer, you'll get a good laugh. Hundreds of plaintext passwords, plaintext mails, people irc'ing, hell there are even warez transfers. There are also people ssh'ing to personal and corporate machines from the terminal room where the root password is given out or easily available. Clearly *SOME* NANOG participants aren't terribly security conscious. But are these the experienced network operators, or just the people who show up because someone at their company thinks its a network training camp? That's what the password board is for I guess. -- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

On Sun, Sep 22, 2002 at 01:11:07PM +0200, Iljitsch van Beijnum wrote:

...

There are also people ssh'ing to personal and corporate machines from the terminal room where the root password is given out or easily available.

Are you saying people shouldn't SSH?

I've seen far too many people get into trouble because they have some flawed thinking that "ssh == always secure", even against compromises of one of the endpoints. If root is available, a reasonable person should ASSUME that some bored individual (like Bandy Rush) has taken 30 seconds and recompiled the ssh binaries with a password logger. Heck even if it isn't available, you couldn't pay me enough money to trust public access terminals to log into something which doesn't use a one-time password. -- Richard A Steenbergen <ras@e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

On Sun, Sep 22, 2002 at 01:37:22PM +0200, Iljitsch van Beijnum wrote:

On Sun, 22 Sep 2002, Richard A Steenbergen wrote:

...

I've seen far too many people get into trouble because they have some flawed thinking that "ssh == always secure", even against compromises of one of the endpoints. If root is available, a reasonable person should ASSUME that some bored individual (like Bandy Rush) has taken 30 seconds and recompiled the ssh binaries with a password logger.

Excellent point. Fortunately, this doesn't apply to running SSH from your laptop over the wireless network.

There are server-origin attacks to consider as well, beyond the more obvious password capture, etc. Consider agent and X11 forwarding, for which we've recently added some discussion to OpenSSH ssh_config(5): ForwardAgent Specifies whether the connection to the authentication agent (if any) will be forwarded to the remote machine. The argument must be ``yes'' or ``no''. The default is ``no''. Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent's Unix-domain socket) can access the local agent through the forwarded connection. An attacker cannot obtain key material from the agent, however they can perform operations on the keys that enable them to authenticate using the identities loaded into the agent. ForwardX11 Specifies whether X11 connections will be automatically redirect- ed over the secure channel and DISPLAY set. The argument must be ``yes'' or ``no''. The default is ``no''. X11 forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the user's X authorization database) can access the local X11 display through the forwarded connection. An attacker may then be able to perform activities such as keystroke monitoring.

The trouble is that not using WEP looks like you're not bothering with the low level of security that's available in wireless. The fact that WEP only adds a 15 second - 15 minute delay to full access to the network both for legitimate and not-so-legitimate users means it offers more annoyance than security, but that doesn't alter the perception.

but it adds annoyance for the intended users. in the case of non- techs, considerable annoyance. and it gives negligible privacy.

...

There are also people ssh'ing to personal and corporate machines from the terminal room where the root password is given out or easily available. Are you saying people shouldn't SSH?

a prudent user does not ssh _from_ a machine they don't control or strongly trust whover controls it. and a public machine should be presumed to be dangerous. i don't ssh from the laptop of a friend to whom i would not give root access to all of my machines. the common attacks at nanog/ietf/... are o intentional from the outside. one should be very prudent with measures on servers etc, and install and monitor an ids such as bro. this is bog standard net and system adminstration. o intentional over the wireless. - the users need to be told how to operate more safely, use end-to-end authentication and privacy, etc. it's a matter of education. and the education will stand them in good stead when they use 802.11 at starbucks, airports, etc. we do this at ietf, but it is not allowed at nanog. - users need to be told when they're operating unwisely. we post passwords or other embarrassing, but not revealing, data. we will do this at the atlanta ietf, but it is not allowed at nanog. - and we need to monitor the air traffic to detect when users are actually being exploited. this is an ops/research area, but is being played with at ietf, but is not allowed at nanog. o unintentional dos of the wireless. this is caused by users' mis-configurations of various kinds, win/mac configured as access points, ad hoc mode, ... detecting and dousing these are still an ops/research araa. as far as i can determine, the reason standard education and defenses are not allowed at nanog is because we fear the nanog net operators monitoring traffic. i.e. we would rather have users raped than have prudent folk notice them in their skivvies. hear no evil, see no evil, speak no evil. it's a comfortable feeling. randy

Based on information at MERIT's website, its tolate to submit a resentation. In addition such presentations must be finalized and the slides approved by Merit no later than 30-Sep. Its important to note that the second requirement isn't publicly stated. I did receive email from Dr. Harris, that my two approved presentations Flotsam and Jetsam of the Net, a study at junk on the net. and IANA Running a IRR for IANA-Reserved space (a presentation supported by the IANA) have now been canceled because of this unknown 30-Sep requirement. I've appealed to Dr. Harris's management on the issue. They should have published the schedules better. I should know more soon. Merit handles NANOG meetings, like it handles network security. On Sun, Sep 22, 2002 at 05:06:27PM -0400, Sean Donelan wrote:

On Sun, 22 Sep 2002, Randy Bush wrote:

...

- the users need to be told how to operate more safely, use end-to-end authentication and privacy, etc. it's a matter of education. and the education will stand them in good stead when they use 802.11 at starbucks, airports, etc. we do this at ietf, but it is not allowed at nanog.

Sunday afternoon is full of tutorials on lots of different subjects. Has anyone volunteed to conduct a Sunday tutorial on wireless security for users of "public" wireless networks?

Although I think it is a mistake to think a wireless network security is different than using any other network you don't control. Most wireless security tutorials tend to concentrate on "securing" the wireless network instead of how to communicate over an untrusted network.

On Sun, Sep 22, 2002 at 04:49:08AM -0700, Randy Bush wrote:

a prudent user does not ssh _from_ a machine they don't control or

prudent users don't get hacked. non-prudent users hopefully learn or darwin happens.

Same bug-ridden stuff, just better understanding, staying up with patches, and understanding the human engineering side of things. so maybe my absolute statement should have been.. s/prudent users don't get hacked/prudent users get hacked much less often On Mon, Sep 23, 2002 at 12:27:52AM +0200, Iljitsch van Beijnum wrote:

On Sun, 22 Sep 2002, John M. Brown wrote:

...

...

a prudent user does not ssh _from_ a machine they don't control or

...

prudent users don't get hacked.

Really? Care to list the bulletproof hardware and software these god-like creatures use, rather than the bug-ridden stuff we lesser folk have to make due with?

...

a prudent user does not ssh _from_ a machine they don't control or prudent users don't get hacked.

as easily

On Sun, 22 Sep 2002, William Allen Simpson wrote:

...

but it adds annoyance for the intended users. in the case of non- techs, considerable annoyance. and it gives negligible privacy.

Randy has the best of intentions. But I'm tired of the old saw that security adds annoyance. I long ago gave up on a WG at the IETF when the members wanted to add security, but with *NO* configuration.

Well, if that's a possibility, then it sounds like the way to go.

Sorry, any security requires a *SECRET*.

No way. If you have to depend on some information to remain secret in order to reach your security goals, you can start counting down until your security is breached because it will happen each and every time. Confidentiality in itself is only one goal.

I will agree that the security in WEP is almost useless, and have personally campaigned to change it for years. But, it is still the only Access Control widely available. So, it should be used, in addition to the better methods.

In this particular instance, the gain is incredibly small (you only keep out non-participants for 15 minutes or so) and the annoyance is rather large. Also, if you use WEP people may be under the misguided impression their data isn't completely open to public scruteny. If you really want the wireless network at a convention to be safe, simply filter all clear-text protocols. That is much more inconvenient than having to find the right WEP key, but at least it really helps.

PPS. I'm really really amazed at how people can consider any opaque system truthworthy. Most computer users naively trust their secrets to effectively every one of thousands of Microsoft engineers who can easily plant trapdoors. The same goes for trusting Intel. How hard it is for a CPU designer to plant an obscure bug causing switch to a privileged mode? It is hard _not_ to create trapdoors like that by mistake, even in much simpler designs (check the 30-year old report on Multics security).

I think it's even worse. Having traveled quite a lot in my previous job, I on one airplane realized that the person sitting next to me was working on the sales budget for one of our largest competitors..... I once (also on an airplane actually) learned that most investment banks have a ban on their employees to use their laptops or in other ways work on airplanes. Make sense to me. But I keep breaching it. - kurtis - / (...as I am sitting in the air somewhere over northern Germany)

Access control should be used when you need access control. Sometimes engineers need to step back from solving the problem, and look at whether the problem needs to be solved.

Yes...

What access control do you need for a public drinking fountain?

Today, none, that was different in recent past.

What access control do you need for a public wireless access point?

Depends on the network. If you are a provider of public wireless for a fee, then you want to make sure you can charge the user. Thus you need to beable to identify the user so you can charge them. You need to also prevent theft of service, via false id's or bypassing the id method, etc. For events like a NANOG, et al, given the large number of "different and ad-hoc" systems, identificaion is more a pain. It needs to be balanced between the "cost, hassle factor" and the life of the network. I'd say that mostly this is a rat hole thread. Short lived conference networks will be insecure. Those attending should be told, and expect it. They should prepare accordingly. Show ops should have plans incase someone steals bandwidth, or causes other problems with the "important show net stuff" like multicast feeds. The cost and management requirements to deploy a reasonably secured network for a show are higher than the benifits.... I don't see conferences giving out USB dongles to people with their ID stored, or SecureID cards anytime soon :)

WEP won't keep people from hacking other laptops at Nanog meetings, and won't stop people from sniffing plain-text passwords. Everyone at the meeting will have the key, and a secret shared with 500 people won't stay secret for even two days. For a network with no other access control, what purpose does WEP serve?

As long as we are all on a shared layer two network, we are vulnerable. john brown

At 06:41 PM 9/22/2002 -0400, William Allen Simpson wrote:

...

... But, it is still the only Access Control widely available. So, it should be used, in addition to the better methods.

Using a supposed security mechanism that is known to be essentially useless does nothing but lull people into a false sense of security.

Rubbish. There are only two or three types of locks that cannot be picked from the outside by a lockpicker within 10-15 minutes. None of those locks is on your outside door. Why do you bother to lock your house? There is only one class of door designs that cannot be broken through in 10-15 minutes. None of the doors of that class is in your house. Why do you have a door on your house? Alex

...

Rubbish.

There are only two or three types of locks that cannot be picked from the outside by a lockpicker within 10-15 minutes. None of those locks is on your outside door. Why do you bother to lock your house?

But in the case of public WLAN, who is the one that you�re trying to keep out?

That is not the point that was responded to [1].

You don�t give the keys to your house to 500 people so your analogy sucks.

Again that was not the point that was responded to. In a case of public wireless LAN or any other public line you by *definition* do not care about protecting public. Can someone please explain to me why (apart from relative ease of mounting those attacks) do we care about attacks mounted via wireless LANs more than attacks mounted over any other medium? Alex [1] The point that the original poster made was that since the WEP is rather trivial to break, one should not use WEP at all.

Someone stood at your front door with lock picking tools for more than a couple of minutes is going to arouse suspicion, and hopefully cause someone to call the police.

Someone sat in the hotel lobby with a powerful laptop isn't going to cause anyone to look twice, at a NANOG conference.

Neither would someone standing in front of your door with lockpicks on a busy streeet. You would be amazed how small those tools are. The point of the post was that knowledge of the limitations of tools that we use to protect access does not justify not using those tools at all. Alex

10-15 minutes. None of the doors of that class is in your house. Why do you have a door on your house?

It keeps honest people honest, and opportunists from taking advantage of easy opportunity.

...

...

10-15 minutes. None of the doors of that class is in your house. Why do you have a door on your house?

It keeps honest people honest, and opportunists from taking advantage of easy opportunity.

Thank you. Why is it different from putting even rudimentary security in place on the wireless LAN?

I think it does exactly the same thing... And... I just opened up the wireless network at the local convention center for a convention. Placards at the entrance advertise it's presence, and that it is not secure. Reccomendations include NOT using plain POP e-mail.. etc..

"That [WEB] will give people a false sense of security." IMHO those 'people' are a group that is a subset of folk that will do 'unwise' things no matter what level of scurity is in place. Move along, nothing to see here... Internet != secure, period. Best regards, _________________________ Alan Rowland -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Chris Adams Sent: Sunday, September 22, 2002 11:51 PM To: nanog@merit.edu Subject: Re: Wireless insecurity at NANOG meetings On Sunday, Sep 22, 2002, at 15:41 US/Pacific, William Allen Simpson wrote:

I will agree that the security in WEP is almost useless, and have personally campaigned to change it for years. But, it is still the only Access Control widely available. So, it should be used, in addition to the better methods.

That will give people a false sense of security. Wouldn't it be better to use an approach like NetReg to give every user a warning when they first connect to the network? That doesn't require any arcane software config and would give an accurate indication of how secure the network is. Chris

Date: Sat, 21 Sep 2002 17:46:27 -0400 (EDT) From: Sean Donelan <sean@donelan.com> Sender: owner-nanog@merit.edu

On Sat, 21 Sep 2002, Iljitsch van Beijnum wrote:

...

Anyway, in our efforts to see security weaknesses everywhere, we might be going too far. For instance, nearly all our current protocols are completely vulnerable to a man-in-the-middle attack. If someone digs up a fiber, intercepts packets and changes the content before letting them continue to their destination, maybe the layer 1 guys will notice, but not any of us IP people.

I'm waiting for one of the professional security consulting firms to issue their weekly press release screaming "Network Operator Meeting Fails Security Test."

The wireless networks at NANOG meetings never follow what the security professionals say are mandatory, essential security practices. The NANOG wireless network doesn't use any authentication, enables broadcast SSID, has a trivial to guess SSID, doesn't use WEP, doesn't have any perimeter firewalls, etc, etc, etc. At the last NANOG meeting IIRC over 400 stations were active on the network.

Are network operators really that clueless about security, or perhaps we need to step back and re-think. What are we really trying to protect?

Banks are mostly concerned about people defrauding the bank, not the bank's customers. Banks rarely check the signature on a check. Is security just perception?

I agre security is sadly lacking, but it is probably impossible to implement in a conference environment. What is inexcusable is that the NANOG management does not make LOUD noises about the risks and run an IDS to be able to warn people about "bad things".. I work a large computer trade show every year that has an open wireless network of very large size. Covers the entire exhibit hall, all meting rooms, the lobby, with antennas pointed at larger hotels near the conference. No WEP and no closed SSID because WEP is not practical in such an environment and a closed SSID is too trivial to hack to make it worth the number of complaints we would have. We do have large security advisories that the network is wide open in all conference materials and run a really impressive IDS (multiple systems running Vern Paxon's BRO to monitor the DS-3 and as much of th4e various OC-192s an OC-48s as possible. With several OC-192s, it seems that some packets will have to be dropped this year, but we will be watching. We tried displaying passwords last year, but several folks thought it was fun to telnet to some system and enter something unprintable as the password to watch it appear on the screen. It's not an easy problem, less so for a conference/show that involves lots of non-network people. I believe the key is warning attendees that the net is subject to sniffing and clear-text passwords should not be used. Couple that with a good IDS and make sure that things like Code Red and nimda infections are isolated quickly is about all you can do. Sort of like waring people that they need to keep a close sys on laptops, keep a close eye on the network. Last year slashdot even carried a note that the net was open at the Denver Convention Center and we survived with minimal problems. R. Kevin Oberman, Network Engineer Energy Sciences Network (ESnet) Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab) E-mail: oberman@es.net Phone: +1 510 486-8634

On Sat, 21 Sep 2002, Martin J. Levy wrote:

...

I agre security is sadly lacking, but it is probably impossible to implement in a conference environment.

Look this is a very simple issue. Sean's first post really pointed out that it's "bad form" for a set of operators to run an insecure network. I would believe that it's "good form" to at least try. It was stated that the network was not run by the "operators". OK, I accept that, but it's run by people with great (actually fantastic) connections to real operators (ie: us).

I feel like a Rorschach Test. Is the Nanog confernce network really insecure for its purpose? Some security experts may claim it is, but I'm not certain they are correct. Do you put a biometric reader and armed guard next to a public drinking fountain? What is the risk of someone stealing the water? Its possible, even likely, an unauthorized person will take a drink but what is the loss versus the cost of more security for the drinking fountain? Yes, some security consulting firm issuing press releases about the dangers of war-chalking, war-driving, war-pr may claim the network is insecure. Its great for generating publicity. The Nanog conference wireless network a semi-public, unauthenticated network used by several hundred competitors for a few days. It is about as secure as the wired network, the hotel in-room cable, cellular telephones or most other available means of communication at a convention center. Users can take appropriate measures to secure their communications based on their risk acceptance. I don't see much of a need to rely on a volunteer network operator to provide what I think is the appropriate level of security for my communications. Heck, even if Nanog used the latest, greatest network security whiz-bang gadgets to secure the network; I still wouldn't rely on it.

WEP may not be a good protocol, but it's better than nothing. If people thing it's hard to configure, then run two networks.. one without WEP and one with WEP.

Link-layer encryption always sounds like a "simple" security solution. But when using other people's networks, you are usually better off with a different security solution. How many people use modems with encryption to dial into their local ISP? How many use link-layer encryption with their NIC cards on their wired networks?

Security is a relative thing... Normally security at the door to the nanog conference hall is "low", but that does not seem to bother many people. (Hence security at a "wired" locations within the conference is "low" making the WEP issue mute).

ICANN had armed guards at its meeting to keep the rif-raff out. I don't think NANOG requires that level of security (yet). We still run the network cable down the hallways, and "hide" the wireless access points in the potted palms next to the bar.

On Sat, 21 Sep 2002, Sean Donelan wrote: ...

Are network operators really that clueless about security, or perhaps we need to step back and re-think. What are we really trying to protect?

This is often something that gets forgotten.. people are so hyped up about network security they can easily end up with ultra secure systems that really arent worth it for the data thats there..

Banks are mostly concerned about people defrauding the bank, not the bank's customers. Banks rarely check the signature on a check. Is security just perception?

This is a case of your only as good as the weakest link.. I point this sort of abstract thing out too. My usual examples are the office computers which tend to be laptops kept overnight in empty unlocked rooms with no password on them; people spend so much time getting secure VPNs and secure email setup they forget if someone really wanted the data they'd just walk right in and remove the hardware. Doesnt mean we shouldnt maintain a high level of security and be vigilent, but it does mean we should make sure we cover all angles. I like your cheque example, again I pick on credit cards.. the banks get so paranoid on internet shopping and yet its very common for fraud to occur because of who sees your card when you're out shopping at the local store... Think big picture! Steve

Having been a past host of 2 NANOG's I would state the following: 1. There should be CLEARLY POSTED SIGNS that state this is a conference network, access is permitted only to registered attendee's, and that all traffic on this network is subject to monitoring. 2. The wireless or wired networks do not need additional layers of security. Is it the "show net's" responsiblilty to PROTECT YOUR DATA. I think not. If you have data you do not want others to see, then LOCK YOUR MACHINE DOWN. I've forgotten to turn off OS features that shouldn't be on at a show net, so have other "famous, clued and well respected people on this list". I now run tunnels for all external communications, including IM's and chat programs. (Trillian has blowfish for ICQ as an example) 3. The NANOG show.net isn't a "production network" 4. MERIT SHOULD ALLOW Randy to post his password list. Its comical at times, and helps re-enforce the need for security on mobile machines. Manditory security practices are good for a "production network" I don't consider NANOG networks "production" They are short lived, ad-hoc nets provided as a convience to the attendees and as a way to stream data to those that can't attend. If you want security, then unplug. NANOG is operated by non-operational people, its quality has suffered because of that. john brown On Sat, Sep 21, 2002 at 05:46:27PM -0400, Sean Donelan wrote:

On Sat, 21 Sep 2002, Iljitsch van Beijnum wrote:

...

Anyway, in our efforts to see security weaknesses everywhere, we might be going too far. For instance, nearly all our current protocols are completely vulnerable to a man-in-the-middle attack. If someone digs up a fiber, intercepts packets and changes the content before letting them continue to their destination, maybe the layer 1 guys will notice, but not any of us IP people.

I'm waiting for one of the professional security consulting firms to issue their weekly press release screaming "Network Operator Meeting Fails Security Test."

The wireless networks at NANOG meetings never follow what the security professionals say are mandatory, essential security practices. The NANOG wireless network doesn't use any authentication, enables broadcast SSID, has a trivial to guess SSID, doesn't use WEP, doesn't have any perimeter firewalls, etc, etc, etc. At the last NANOG meeting IIRC over 400 stations were active on the network.

Are network operators really that clueless about security, or perhaps we need to step back and re-think. What are we really trying to protect?

Banks are mostly concerned about people defrauding the bank, not the bank's customers. Banks rarely check the signature on a check. Is security just perception?

Actually, from a legal standpoint, you put locks on the door same reason as u would on the wireless. Otherwise an invitation could be implied. It's hard for someone to argue that they were invited if they had to use breakin tools. Otherwise I dont think anyone would have a case, public area, public use lan.... If I was walking through a hotel and found an open LAN I would assume it was there for a perk of the hotel. I still dont see the problem with either side of this discussion. If we had a minor amount of security, I think the nanog goers could easily figure it out. If not, a little friendly assistance from the person sitting next to you and you might just have made a friend. Payoff with a simple beer later would suffice. Actually I believe it was Bill Woodcock that sent me mac drivers back in 1997 for the wireless. I may still owe him a beer though. dave At 9:04 -0500 9/23/02, Stephen Sprunk wrote:

Thus spake "Sean Donelan" <sean@donelan.com>

...

The wireless networks at NANOG meetings never follow what the security professionals say are mandatory, essential security practices. The NANOG wireless network doesn't use any authentication, enables broadcast SSID, has a trivial to guess SSID, doesn't use WEP, doesn't have any perimeter firewalls, etc, etc, etc. At the last NANOG meeting IIRC over 400 stations were active on the network.

There is no useful security mechanism that can be applied to NANOG wireless.

WEP assumes a black-and-white security model, just like most VPNs: if a user is on the "inside", they're fully trusted. This is somewhat reasonable in the corporate world, where all of the users are employees who are responsible to a common entity, but it has no application to NANOG or other public events where none of the users are responsible to the operator, much less have any trust for each other. There is no sense giving people the illusion of security here.

Many corporations are going to open access-points "outside" their firewall and requiring per-user VPNs to access any data-center resources. This is the simplest (and cheapest) solution to deploy and offers security folks the best options for AAA besides.

I can't say without a sniffer, but I'd bet that most NANOG participants are doing the same: SSH or IPsec VPN's back to home (wherever that is). Anyone who isn't is begging to be hacked, WEP or not. Anyone interested in hacking NANOG attendees' networks is likely a NANOG attendee himself. Caveat attendor.

S

-- David Diaz dave@smoton.net [Email] pagedave@smoton.net [Pager] Smotons (Smart Photons) trump dumb photons