RE: Goofle/Sprint having problems?

2004-11-19 Thread Sean Donelan
On Fri, 19 Nov 2004, Vandy Hamidi wrote: Yeah, a visual route just showed my trace going to AUS and then Singapore. Hmm... You think Google is going to be pissed when they find out their site was being routed to Asia? Heads will roll... (lawsuit?) NANOG recuring topic thread #4 Gee,

Diffserv service classes

2004-11-18 Thread Sean Donelan
In the continuing effort to make Diffserv useful on the Internet, the Transport Area working group has the draft: http://ietfreport.isoc.org/idref/draft-baker-diffserv-basic-classes/ The draft has a little bit for everyone. Lots of rope/flexibility for application developers. But have any

EFF whitepaper

2004-11-14 Thread Sean Donelan
http://www.eff.org/wp/?f=SpamCollateralDamage.html

Re: anycast roots

2004-11-13 Thread Sean Donelan
On Sun, 14 Nov 2004, Hank Nussbacher wrote: I think it is time to update rfc2870 and add a few new MUST paragraphs :-) Do you want a refund on your root-server bill?

Re: DNS Problems on Saturday Night?

2004-11-08 Thread Sean Donelan
On Mon, 8 Nov 2004, John Neiberger wrote: Forgive me for not having more technical information about this issue. Beginning sometime around 4:00 PM MST on Saturday, I started seeing horrible slowness on my home Internet connection through Comcast, and I also noticed that I was seeing numerous

RE: Status of FCAPS model? Useful? Obsolete?

2004-11-08 Thread Sean Donelan
On Mon, 8 Nov 2004, Hannigan, Martin wrote: Does the FCAPS model still hold currency among network managers/engineers today? What's FCAPS? I suppose that answers the question whether FCAPS holds currency among network managers/engineers. It is an ITU-T developed network management

RE: Okay, I'm just going to _assume_...

2004-10-25 Thread Sean Donelan
:...that there's some operational content somewhere in here: : :http://www.cisco.com/edu/peterpacket/ Another fine candidate for the Prelinger Archives. Cisco has Peter Packet, the Bell System had Tommy Telephone.

BCP38 making it work, solving problems

2004-10-10 Thread Sean Donelan
On Sun, 10 Oct 2004, James Baldwin wrote: I agree that BCP 38 should be implemented. I agree that BCP 38 will have a greater affect on network abuse than port 25 filtering. They both have their place and address to partially overlapping groups of abuse imho. Be conservative in what you send

Re: IGMP with ISP radius accounting

2004-10-01 Thread Sean Donelan
On Tue, 28 Sep 2004, Sean Donelan wrote: Have any ISPs (which really means vendors) looked at integrating IGMP support in edge switches with RADIUS? I'm aware of IGAP, but that involves changing the packets and identifying individual users. I was wondering about using IGMP snooping

IGMP with ISP radius accounting

2004-09-28 Thread Sean Donelan
Have any ISPs (which really means vendors) looked at integrating IGMP support in edge switches with RADIUS? I'm aware of IGAP, but that involves changing the packets and identifying individual users. I was wondering about using IGMP snooping to trigger RADIUS accounting events, e.g. join,

Photograph of damaged data center in Virginia

2004-09-20 Thread Sean Donelan
Here is a photograph of a unnamed Internet provider's data center in Virginia after the tornadoes on Friday. http://www.worldofwarcraft.com/images/misc/tornado02.jpg Although most folks will be able to figure out who it is, for whatever reason the service provider doesn't want their name used.

Beaumeade Industrial Park gas line $95 million damage?

2004-09-19 Thread Sean Donelan
As folks know, Northern Virginia has a bunch of different data centers, ISPs, telecommunication facilities, etc. And the question whether using gas or diesel for back up generators is better. The business hasn't been identified by emergency management agencies, but during the storm on Friday

Re: Tornados in Ashburn (Equinix affected)

2004-09-19 Thread Sean Donelan
On Sun, 19 Sep 2004, Robert E. Seastrom wrote: 1b) No substitute for site diversity if your project is important enough to justify the cost. And even when you have site diversity, Murphy and Mother Nature can still get you. The federal National Finance Center in New Orleans, LA shutdown due

Re: Tornados in Ashburn (Equinix affected)

2004-09-18 Thread Sean Donelan
On Sat, 18 Sep 2004, Robert E.Seastrom wrote: The reason that I bring this up is that I believe a report which is posted two hours after the event and glosses over potentially serious operational anomalies by stating that everything is cool (in the present tense) does not serve anyone's best

Re: Tornados in Ashburn (Equinix affected)

2004-09-18 Thread Sean Donelan
On Sat, 18 Sep 2004, Deepak Jain wrote: 3) Many new systems [say datacenters built/upgraded in the last 5 years] haven't been around long enough to really test 99.999% and above levels of availability... many new systems won't start showing problems for 5-10 years. Past performance is not a

Russian ISPs block access to Chechen rebel web site

2004-09-15 Thread Sean Donelan
BBC Mon FS1 FsuPol kt/mjm/skh Source: Ekho Moskvy radio, Moscow, in Russian 0800 gmt 14 Sep 04 Russian Internet providers block access to Chechen rebel web site It seems that Moscow has managed to close down a Chechen separatist web site. Since this morning access to the Kavkaz-Tsentr web site

Restoration after Hurricane Frances

2004-09-10 Thread Sean Donelan
In Florida after Hurricane Frances: 17 fatalities attributed to the Hurricane and its affects. Wireless companies are reporting 95% service restoration statewide. Wireline companies have restored over half of the damaged lines statewide. Bellsouth: 385,000 and Sprint: 177,000 out of service.

Re: 292 cellular towers out of service due to generator failure

2004-09-07 Thread Sean Donelan
On Tue, 7 Sep 2004, Thornton wrote: On Mon, 2004-09-06 at 15:41, Sean Donelan wrote: Due to a generator failure, 292 Sprint wireless towers in Polk, Pasco, Hillsborough, Pinellas, Manatee, Hardee, Sarasota and Charlotte counties were disrupted. There is no estimated time for restoration

Re: Spammers Skirt IP Authentication Attempts

2004-09-06 Thread Sean Donelan
Although SenderID (or whatever the final name is) is not completed yet, SPF has been around for a while and some people have been using it. But who? Do domains with SPF records have fewer phishing attacks? Fewer virus bounce-backs? Fewer spam forgiers? According to the Anti-Phishing Working

Re: Hurricane Frances impacts

2004-09-06 Thread Sean Donelan
The Florida State Emergency Response Team is no longer reporting carrier or county specific information about the impact of Hurricane Frances on the telecommunications infrastructure. Only summary information is being given out. Wire Line 205,564 customers OUT OF SERVICE in the areas

292 cellular towers out of service due to generator failure

2004-09-06 Thread Sean Donelan
Due to a generator failure, 292 Sprint wireless towers in Polk, Pasco, Hillsborough, Pinellas, Manatee, Hardee, Sarasota and Charlotte counties were disrupted. There is no estimated time for restoration of power to the Sprint switch serving the towers.

Hurricane Frances telecommunication outages

2004-09-06 Thread Sean Donelan
Florida EOC reports 1.1 million wireline customer outages state-wide. 30% cell phone coverage outage reported. Coordinating communication set up for priority T1 lines, POTS, DSL etc. Bellsouth: 775,000 customer outages statewide (13.1% without service) Palm Beach, Indian River, St.

Hurricane Frances impacts

2004-09-05 Thread Sean Donelan
Since the FCC no longer makes outage reports public, folks will have to obtain their information from other sources. The networks in Broward, Palm Beach, Martin, Brevard counties appear to be the most impacted. Cellular had problems due to wireless sites being without power. The wireless

Re: Hurricane Frances impacts

2004-09-05 Thread Sean Donelan
On Sun, 5 Sep 2004, Brian Wallingford wrote: Any details on the status of natural gas lines in FL, and approximately how many facilities use such for generator power vs diesel? Natural gas is available in most parts of Florida. Like most utilities, service continues until disrupted. Once

Re: Hurricane Frances impacts

2004-09-05 Thread Sean Donelan
Sprint reports 15,000 customers affected in its service areas (generally central florida). Bell South reports 7596 trouble reports in in its service areas (generally eastern florida). I haven't seen any numbers from Verizon yet. For comparison, after Hurricane Charley 250,000 Sprint customers

XP SP2 other than windows update

2004-09-01 Thread Sean Donelan
On Wed, 1 Sep 2004, David A. Ulevitch wrote: would provide). If anyone's that desperate, email me. I only used it after waiting a week with the Automatic Updates switched on, and nothing arriving. Microsoft isn't hiding the link:

RE: Senator Diane Feinstein Wants to know about the Benefits of P2P

2004-08-30 Thread Sean Donelan
On Mon, 30 Aug 2004, Bora Akyol wrote: Traffic patterns is one thing for sure. P2P should be lopsided the other way around. More outbound, than inbound. or at best symetric. Regular browsing is asymmetric with more inbound than outbound. The Internet pre-dates the Web. In 1992, FTP was the

Knock, Knock - Its Attorney General John Ashcroft

2004-08-24 Thread Sean Donelan
Justice Dept. to Announce Cyber-Crime Crackdown Actions to Include Arrests, Subpoenas By Jonathan Krim Washington Post Staff Writer Wednesday, August 25, 2004; Page E05 The Justice Department is set to announce a major crackdown on cyber-crime that will include arrests, subpoenas and property

More telecommunication equipment thefts

2004-08-23 Thread Sean Donelan
Thieves recently stole expensive telecommunications equipment from 26 sites in the city, temporarily knocking out service to thousands of Comcast customers. BY ALAN SKOLNICK In a caper eerily similar to the the theft of $200,000 worth of ATT Broadband equipment in 2000, high-tech thieves raided

Ship seized for cutting Sri Lanka's internet link

2004-08-23 Thread Sean Donelan
Sri Lanka's high court has ordered the seizure of an Indian cargo vessel which allegedly cut a submarine cable connecting the island's telecommunications subscribers with the rest of the world. The court ordered that the vessel, State of Nagaland, be held at the Colombo port where it berthed on

Sri Lanka Internet submarine cable cut

2004-08-22 Thread Sean Donelan
In a message to it's users, SLTnet said: We have lost connectivity to global Internet due to failure in the international submarine cable system. All measures have been taken to normalise this as early as possible. An additional but limited capacity satellite uplink has been made to manage the

Public access Wi-Fi after Hurricane Charley

2004-08-20 Thread Sean Donelan
Wi-Fi emerges as emergency communications alternative in Fla. Some cellular carriers are still struggling with power outages News Story by Bob Brewin AUGUST 19, 2004 (COMPUTERWORLD) - Public access Wi-Fi hot spots have become a key communications alternative in Florida in the wake of Hurricane

Re: Phishing (Was Re: WashingtonPost computer security stories)

2004-08-17 Thread Sean Donelan
I'm thinking that Citibank will cease to be a target if they give (ok, it's a bank - sell) their subscribers a hardware token that requires presence of the ATM card when the customer wants to use online banking facilities... as several banks here in the Netherlands do. This is a social

Re: SYN flood atacks?

2004-08-17 Thread Sean Donelan
On Tue, 17 Aug 2004 [EMAIL PROTECTED] wrote: I have been hearing rumors about some SYN flood atacks on the Internet today. Anybody hear anything? You will need to be more specific. There are syn flood attacks, icmp attacks, udp attacks, tcp attacks, dns attacks, http attacks, im attacks,

WashingtonPost computer security stories

2004-08-15 Thread Sean Donelan
The Washington Post is running a group of stories this weekend about computer security and the problems a reporter went through with her Windows 98 computer. Interestingly, instead of ISPs the articles identify other sources of frustration for even technically savvy home computer user with

Re: WashingtonPost computer security stories

2004-08-15 Thread Sean Donelan
On Sun, 15 Aug 2004, Deepak Jain wrote: I agree with Mikael here. If your box is fully patched you need not worry about that much -- if you are still having problems, check your assumptions. :) Windows 2003 Web Servers are up unfiltered out there, there isn't a real reason why a Windows XP

Convention networks and viruses

2004-07-29 Thread Sean Donelan
As NANOG has experienced during the last several meetings, in any network used by a large number of people, there will be a certain percentage of people which bring infected computers into the network. http://www.nytimes.com/2004/07/29/technology/circuits/29bost.html?pagewanted=3 Wiring a

ad.doubleclick.net missing from DNS?

2004-07-27 Thread Sean Donelan
The A record for ad.doubleclick.net is missing from DNS. This is causing apparent web page slowdowns when viewing web sites containing ads linked to ad.doubleclick.net

Re: ad.doubleclick.net missing from DNS?

2004-07-27 Thread Sean Donelan
http://www.washingtonpost.com/wp-dyn/articles/A18735-2004Jul27.html DoubleClick spokeswoman Jennifer Blum said the attack targeted the company's domain name servers (DNS) -- machines that help direct Internet traffic -- causing severe service disruptions for all 900 of its customers.

Mydoom versus Google (and others)

2004-07-26 Thread Sean Donelan
It appears the latest Mydoom variant is clogging the search engines. Stop clicking on unsolicited attachements

DNC service providers

2004-07-24 Thread Sean Donelan
http://www.thebostonchannel.com/news/3561756/detail.html The event monitor gives all the agencies instant access to any event to local police, fire officials, the FBI and dozens of law enforcement representatives working with utility providers. Public safety officials from our carriers --

Follow the money - Extortion gang caught

2004-07-21 Thread Sean Donelan
Its easier to follow the money. DDOS gang arrested in Russia. http://news.bbc.co.uk/2/hi/business/3914363.stm The National High-Tech Crime Unit, which led the investigation, tracked down the racketeers by tracing money transfers between the three men and ten gang members who had been arrested

Regional differences in P2P

2004-07-15 Thread Sean Donelan
Apparently CacheLogic based most of their conclusions on data collected from a European tier 1 ISP. However, another study by Sandvine found regional differences in file sharing networks. Europe and the US don't have the same file sharing patterns, or even popular file sharing programs.

Controls are ineffective without user cooperation

2004-07-15 Thread Sean Donelan
Donn S. Parker pointed out controls are ineffective without user cooperation. According to an ATT sponsored survey, 78% of executives admitted to opening attachments from unknown senders in the last year, 29% used their own name or birthday as a secure password, 17% accessed the company network

Problems with private justice (was Re: Spyware becomes increasingly malicious)

2004-07-13 Thread Sean Donelan
I guess the big question is, is there anyone (other than those profiting directly from CWS) that would complain if a provider were to do such a thing... looks like a psi-net pink contract inherited by cogent. but since the psi-cogent rollup was an asset sale rather than a corporate

ABA to create standards for online authentication

2004-07-12 Thread Sean Donelan
On Sat, 10 Jul 2004, Scott Savage wrote: now because it is easy money and easy to get away with. I laugh every time I see those Citibank identity theft ads on TV because, as funny as they are, they speak the truth. Cell providers are the worst offenders of all. Sydney, July 12, 2004: The

Spyware becomes increasingly malicious

2004-07-11 Thread Sean Donelan
Spyware isn't the best term for what is happening, but it is quickly exceeding (or contributing) to all the other problems associated with the online (not just Internet) world. You probably need to be a paid subscriber or visit a public library

Telecom fraud on the rise

2004-07-10 Thread Sean Donelan
http://www.billingworld.com/archive-detail.cfm?archiveId=7575 Fraud continues to pound the U.S. telecom industry with little sign of letting up. Fraudulent use of networks and theft of services in all sectors of the telecom industry continue to grow between 10 percent and 12 percent annually.

Re: S.2281 Hearing (was: Justice Dept: Wiretaps...)

2004-06-21 Thread Sean Donelan
On Mon, 21 Jun 2004, John Curran wrote: With respect to enforcement, I am sure there are ways to prevent being caught involving amusing offshore logistics, but that will still prevent the vast majority of US businesses from offering non-2281 compliant services. Off-shore would be the NSA,

Re: S.2281 Hearing (was: Justice Dept: Wiretaps...)

2004-06-21 Thread Sean Donelan
On Mon, 21 Jun 2004, Christopher L. Morrow wrote: yes, agreed. moving toward the next technology of snooping is a good thing for DoJ. You can request copies of the law enforcement needs documents at http://www.askcalea.net/standards.html Packet Surveillance Fundamental Needs Document (PSFND)

Internet firms urged to sign self-discipline pact

2004-06-20 Thread Sean Donelan
'The basic principles of self-discipline for the Internet industry are patriotism, observance of the law, fairness and trustworthiness,' the official Xinhua news agency reported at the weekend. http://straitstimes.asia1.com.sg/techscience/story/0,4386,257481,00.html

Re: what's going on with yahoo and gmail lately?

2004-06-20 Thread Sean Donelan
On Sun, 20 Jun 2004, Matthew McGehrin wrote: 4 srp-8-1-ar01.verona.nj.nj01.comcast.net (68.87.47.193) 12.870 ms 9.725 ms 5 pos-7-0-cr01.plainfield.nj.core.comcast.net (68.87.19.253) 9.891 ms 8.937 ms 6 12.118.149.5 (12.118.149.5) 10.761 ms 10.216 ms Comcast offers toll-free

Re: S.2281 Hearing (was: Justice Dept: Wiretaps...)

2004-06-20 Thread Sean Donelan
On Sun, 20 Jun 2004, John Curran wrote: It's not just the US Goverment with interest in this matter. Lawful Intercept has basis in both EU directives and laws of many member states. You are aware the US Government pays for consultants to assist in the development of international and

Re: S.2281 Hearing (was: Justice Dept: Wiretaps...)

2004-06-20 Thread Sean Donelan
On Mon, 21 Jun 2004, John Curran wrote: Looks pretty clear to me: assistance requirements (i.e. the requirement to have LI capacity and mechanisms in place in advance) should apply to all providers, and in particular, that VoIP providers who do not provide direct PSTN access (e.g. FWD,

Re: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]

2004-06-19 Thread Sean Donelan
On Sat, 19 Jun 2004, Steven M. Bellovin wrote: There's a lot more to it than that -- there's also access without involving telco personnel, and possibly the ability to do many more wiretaps (have you looked at the capacity requirements lately), but funding is certainly a large part of it.

RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]

2004-06-19 Thread Sean Donelan
On Sat, 19 Jun 2004, Hannigan, Martin wrote: Sean, the capacity requirements aren't as straightforward as you are interpreting them. You are absolutely correct, they are not that straightforward. You should consult a telecommunications attorney with expertise in this area for legal advice.

RE: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]

2004-06-19 Thread Sean Donelan
On Sat, 19 Jun 2004, Cade,Marilyn S - LGCRP wrote: Jim Dempsey's testimony at Senator Sununu's hearing is very interesting, and very educational on these issues. CALEA was not written for the IP world. When CALEA was being written, the Internet, IP and information services were all debated.

Re: S.2281 Hearing (was: Justice Dept: Wiretaps...)

2004-06-19 Thread Sean Donelan
On Sat, 19 Jun 2004, John Curran wrote: S.2281 takes the middle of the road position in areas such as lawful intercept, universal service fund, and E911. At a high-level, those VoIP services which offer PSTN interconnection (and thereby look like traditional phone service in terms of

Re: [Fwd: [IP] Feds: VoIP a potential haven for terrorists]

2004-06-18 Thread Sean Donelan
On Fri, 18 Jun 2004, Stephen Sprunk wrote: I'm told that most CALEA warrants only authorize a pen register, not an CALEA and wiretaps are independent subjects. You can have CALEA obligations even if you never, ever implement a single wiretap. On the other hand you may need to implement many

Re: Default Internet Service (was: Re: Points on your Internet driver's license)

2004-06-13 Thread Sean Donelan
On Sun, 13 Jun 2004, John Curran wrote: I'll argue that we have don't effective methods of dealing with this today, and it's not the lack of abuse desk people as much as the philosophy of closing barn doors after the fact. The idea that we can leave everything wide open for automated

Re: Points on your Internet driver's license (was RE: Even you can be

2004-06-12 Thread Sean Donelan
On Sat, 12 Jun 2004, Paul Vixie wrote: in any other industry, you (the isp) would do a simple risk analysis and start treating the cause rather than the symptom. What other industry do you know where you are expected to fix products you didn't sell and didn't cause for free? Should we revoke

Re: Points on your Internet driver's license (was RE: Even you can

2004-06-12 Thread Sean Donelan
On Sun, 13 Jun 2004, Paul Vixie wrote: If you didn't do them, why do you think other people should? so you aren't going to google for chemical polluter business model, huh? I hope you also google for Nonpoint Source Pollution. ISPs don't put the pollution in the water, ISPs are trying to

Re: Default Internet Service (was: Re: Points on your Internet driver's license)

2004-06-12 Thread Sean Donelan
On Sat, 12 Jun 2004, John Curran wrote: One could imagine changing the paradigm (never easy) so that the normal Internet service was proxied for common applications and NAT'ed for everything else... This wouldn't eliminate all the problems, but would dramatically cut down the incident rate.

Re: Points on your Internet driver's license (was RE: Even you can

2004-06-12 Thread Sean Donelan
On Sat, 12 Jun 2004, Paul Vixie wrote: Send me your root passwords. Trust me. you should offer this service. most of us would urge our parents' generation to sign up for it. (i hope you weren't joking.) As you keep pointing out, a problem with current Internet security is its opt-in

Points on your Internet driver's license (was RE: Even you can be hacked)

2004-06-11 Thread Sean Donelan
On Fri, 11 Jun 2004, David Schwartz wrote: generated by a worm. The ISP had an obligation to stop this traffic with filters or customer disconnection. They may or may not have complied with their obligation. Either way, it's hard to see why the customer should pay for traffic the ISP did not

RE: Even you can be hacked

2004-06-11 Thread Sean Donelan
On Fri, 11 Jun 2004, David Schwartz wrote: So why does everyone think the ISP is almost certainly entitled to be paid? Is it because they're ISPs? Is it because it's easy to blame someone else? I notice that Webmaster's license agreement includes this clause: DISCLAIMER OF WARRANTY.

Re: Trusting COTS - What's really in the box?

2004-06-10 Thread Sean Donelan
On Mon, 7 Jun 2004, Randy Bush wrote: building from certifiable open source that has been inspected by many is the only half-credible scheme of which i am aware. More flaws foul security of open-source repository By Robert Lemos Staff Writer, CNET News.com

Re: TCP-ACK vulnerability (was RE: SSH on the router)

2004-06-10 Thread Sean Donelan
On Wed, 9 Jun 2004, Alexei Roudnev wrote: This is minor exploit - usually you set up VLAN1 interface with IP addres, which is filterd out from outside. Moreover, there is not any good way to find switch IP - it is transparent for user's devices. Yeah, port scanners are so rare on the Internet

Even you can be hacked

2004-06-10 Thread Sean Donelan
Does the water company fix your toilet if it leaks water? Or do you call a plumber? Every consumer computer has a power switch. How to stop a virus, turn off the power switch and take your computer to a repair shop.

Re: Even you can be hacked

2004-06-10 Thread Sean Donelan
On Thu, 10 Jun 2004, Laurence F. Sheldon, Jr. wrote: Does the water company fix your toilet if it leaks water? Or do you call a plumber? On the other hand, if the water company was sending pollutants in the water you bought, there was a perceived responsibility upon the water company.

Re: Even you can be hacked

2004-06-10 Thread Sean Donelan
On Thu, 10 Jun 2004, Laurence F. Sheldon, Jr. wrote: But ultimately, _you_ are responsible for your own systems. Even if the water company is sending me 85% TriChlorEthane? Which water company is sending you 85% TriChlorEthane? More than likely its your next door neighbor with a defective

Re: zero day exploit...?

2004-06-09 Thread Sean Donelan
On Wed, 9 Jun 2004, Matthew Sullivan wrote: In case you haven't seen it... http://www.computerworld.com.au/index.php?id=117316298eid=-255 The good news is Windows XP Service Pack 2 blocks the attack. The bad news is XP/SP2 is still in beta. The double-bad news is XP/SP2 is only for XP; so

TCP-ACK vulnerability (was RE: SSH on the router)

2004-06-09 Thread Sean Donelan
On Mon, 7 Jun 2004, McBurnett, Jim wrote: Aside from that, Use ACL's out the wazoo on the VTY lines and limit access to that to say 1 SSH enabled router or 1 IPSEC enabled router... It doesn't really matter if you use SSH, Telnet or HTTP; if you can send evil packets to the router/switch and

Trusting COTS - What's really in the box?

2004-06-07 Thread Sean Donelan
On Tue, 8 Jun 2004, Suresh Ramasubramanian wrote: Several third party firmwares for the linksys wrt54g wireless AP + router (which, of course, is owned by brand C) implement sshd using dropbear. For example, the ones at sveasoft, and at h.vu.wifi-box.net How do you know what you get in the

Re: Worst cast worm damage estimates: Research

2004-06-05 Thread Sean Donelan
On Fri, 4 Jun 2004, Vern Paxson wrote: Some people regularly rebuild their Windows computer a few times a year. Including recovering from a trashed BIOS? As you point out in the paper, the BIOS scrambler attack is the one with the most variation between platforms. It could have a

RE: Worst case worm damage estimates: Research

2004-06-05 Thread Sean Donelan
On Sat, 5 Jun 2004, Michel Py wrote: If your desktop support guys are half-organized, they have a replacement machine ready to install when the user calls for service, then the machine that as problem (which often is PICNIC: Problem In Chair Not In Computer) goes on the bench where the time

Worst cast worm damage estimates: Research

2004-06-04 Thread Sean Donelan
Nicholas Weaver and Vern Paxson have published a paper estimating the worst case scenario of a network worm attack from USD$52 to $103 Billion. http://www.icir.org/vern/papers/worst-case-worm.WEIS04.pdf Although it was published last month, it was quoted in a new article today. One thing the

IT security people sleep well

2004-06-02 Thread Sean Donelan
Survey: Despite dangers, IT personnel sleep well By Bill Brenner, News Writer 27 May 2004 | SearchSecurity.com Security practitioners know hackers are working overtime to attack their networks; that they're relying on outdated and unreliable security protocols. Despite it all, many still get a

Tracking the bad guys

2004-05-30 Thread Sean Donelan
Microsoft now employs 100 people with a budget of $10 million dollars (Ok, if you do the math, the average salary is a bit low if they also have benefits or any equipment) to track down people attacking Microsoft's Hotmail service, online fruad, identity theft and spyware. The Direct Marketing

Mobsters target Australians online

2004-05-27 Thread Sean Donelan
Until you actually arrest the person, it is sometimes difficult to determine where the criminals are actually based. Some people thought the Sasser author was associated with Russia, not Germany. http://www.smh.com.au/articles/2004/05/26/1085461839964.html Eastern European organised crime

Re: Spring time fiber cuts (was Re: fiber cut 19 May/PM - 20 May /AM)

2004-05-24 Thread Sean Donelan
On Mon, 24 May 2004, David Lesher wrote: (One way is contract language requiring that diversity, then demanding actual trunk # data... and pointing out the defn of fraud... In case anyone thinks otherwise, let me say you do See the filed tariff doctrine.

Qwest Utah fiber cut

2004-05-21 Thread Sean Donelan
http://www.thespectrum.com/news/stories/20040521/localnews/471985.html Businesses feel effects of communications outage By RACHEL OLSEN [EMAIL PROTECTED] ST. GEORGE -- A major disruption in a communication line caused some problems for businesses throughout Southern Utah on Thursday. Although a

Re: fiber cut 19 May/PM - 20 May/AM in Ashburn, VA (lawnmower?!)

2004-05-21 Thread Sean Donelan
On Fri, 21 May 2004 [EMAIL PROTECTED] wrote: Appears it should not be a suprise at all it was not redundant. On a related note another researcher at GMU has collected all the outage reports that were posted on the FCC website and put them in a database form, and we are going to try and run

Re: fiber cut 19 May/PM - 20 May/AM in Ashburn, VA (lawnmower?!)

2004-05-20 Thread Sean Donelan
On Thu, 20 May 2004, Robert E. Seastrom wrote: in the immediate area. Outage was likely off the radar because despite the big concentration of connectivity in the affected area, the natural cost disadvantage of the ILEC meant that few circuits of consequence were riding that fiber. It also

Spring time fiber cuts (was Re: fiber cut 19 May/PM - 20 May/AM)

2004-05-20 Thread Sean Donelan
On Thu, 20 May 2004, Dan Armstrong wrote: Forgive me, but Isn't Sonet usually deployed in a ring? Why the heck would a fiber this important not be? You are making assumptions. Large Part of Southern Utah Without 911 Service May 20 2004 http://tv.ksl.com/index.php?nid=5sid=95368 Verizon

Flash crowds and DOS on POTS

2004-05-16 Thread Sean Donelan
All networks are vulnerable to Denial of Service attacks and flash crowds. Broadcasting Cable investigates the problems with the telephone and SMS voting with the Fox television show American Idol. http://www.broadcastingcable.com/article/CA417981 The difference is when people get a busy

Antivirus firms discover Bots

2004-05-15 Thread Sean Donelan
I'm glad that anti-virus firms are noticing the growth of Bots. Unfortunately, their guestimating ability is still woefully inadequate. Even frequent updates to anti-virus software won't help. Many bots disable automatic updates and block access to the antivirus sites. By the time anti-virus

German police arrest Sasser worm suspect

2004-05-08 Thread Sean Donelan
An 18-year-old high school student has been arrested in Germany on suspicion of creating the Sasser internet worm, police say. Police say the man was arrested in the northern German town of Rotenburg. http://news.bbc.co.uk/1/hi/world/europe/3695857.stm

Why don't X care more about Y?

2004-05-07 Thread Sean Donelan
Dave Farber's interesting people list has a post by a former bank credit card officer explaining why banks don't get as excited about fraud as customers do. http://www.interesting-people.org/archives/interesting-people/200405/msg00041.html Many of the statements apply to anyone who deals with

How long before infected - Internet addresses are not uniform

2004-05-04 Thread Sean Donelan
On Mon, 3 May 2004, william(at)elan.net wrote: Similarly when settting up computers for several of my relatives (all have dsl) I've yet to see any infection before all updates are installed. The folks at CAIDA can do the math, but it turns out many of the recent worms have some interesting

Re: Infrastructure Mapping Project Website

2004-05-03 Thread Sean Donelan
On Mon, 3 May 2004 [EMAIL PROTECTED] wrote: If the work looks helpful to anyone or if you have an feedback please pass it along. But what everyone wants to know: Did the school finally decide to award you a degree for your work?

Re: Worms versus Bots

2004-05-03 Thread Sean Donelan
On Mon, 3 May 2004, Rob Thomas wrote: ] Just because a machine has a bot/worm/virus that didn't come with a ] rootkit, doesn't mean that someone else hasn't had their way with it. Agreed. Won't help. What's the first thing people do after re-installing the operating system (still have all

Don't forget physical security: Network Card Theft Causes Internet Outage

2004-05-03 Thread Sean Donelan
Network Card Theft Causes Internet Outage May 3, 2004 By Sean Gallagher A handful of corporate customers were left without e-mail and Internet access Monday after the theft of networking equipment from a New York City office late Sunday. Law enforcement officials said four DS-3 cards were

Worms versus Bots

2004-05-02 Thread Sean Donelan
The antivirus vendors are bemoaning the fact the Sasser worm has been slow to spread. On the other hand, most of the vulnerable computers seem to have already been taken over by one or more Bots days or weeks before the worms arrived. Other than the obvious, don't let a bot on get on your

THe Internet is Too Secure Already (was Re: Buying and selling root certificates)

2004-04-28 Thread Sean Donelan
On Wed, 28 Apr 2004, Steven M. Bellovin wrote: Matt Blaze said it well: A commercial CA will protect you from anyone from whom they won't take money. With current SSL implementations, you have to rely on all of the commercial CAs not taking the money. Any match wins. verification that the

Deadline Apr 27: Extending CALEA to IP-Enabled services

2004-04-26 Thread Sean Donelan
Verisign submitted a very nice presentaiton with pictures showing its proposal for monitoring all parts of the network including ISPs, hotels, cafes, universities, etc. http://gullfoss2.fcc.gov/prod/ecfs/retrieve.cgi?native_or_pdf=pdfid_document=6516088289 You can search for all other

Juniper failes to change keys (More MD5 fun: Cisco uses wrong MD5 key for old session after key change)

2004-04-24 Thread Sean Donelan
On Sat, 24 Apr 2004 [EMAIL PROTECTED] wrote: After a while I decided to change the MD5 key. The session with the new key came up and looked fine, but the old session didn't close properly. Notice the close is initiated from the Juniper side, and the first packet from the Cisco side is now

Re: Juniper failes to change keys (More MD5 fun: Cisco uses wrong MD5key for old session after key change)

2004-04-24 Thread Sean Donelan
On Sat, 24 Apr 2004 [EMAIL PROTECTED] wrote: But as long as the session *is* reset anyway, the current situation is extremely confusing - the log messages (on both Cisco and Juniper) give no indication that the invalid key in question is for an *old* BGP session, no longer active! That's why

Ordering Windows Security Update CD (was Re: Microsoft XP SP2)

2004-04-20 Thread Sean Donelan
On Mon, 19 Apr 2004, Alexei Roudnev wrote: - (1) updates are too big to be diownloaded by modem , which fail every 20 - 40 minutes (which is common in many countries); - (2) if you connect to Internet for update, you are infected by virus much faster than you install update. I saw it. Home

Re: Ordering Windows Security Update CD (was Re: Microsoft XP SP2)

2004-04-20 Thread Sean Donelan
On Mon, 19 Apr 2004, Alexei Roudnev wrote: Hmnm, if you: -- are in Russia or other East Europe country - got Windows with a computer (so it is 90% pirated one) - have not credit card how can you order this CD (of course, pirates will help -:))? The US/English Windows Security Update CD is

<    1   2   3   4   5   6   7   8   9   10   >