Google's Schmidt on Iran supposedly hijacking GOOG'd .dk traffic

2011-12-21 Thread Gadi Evron
Video at: http://edition.cnn.com/video/#/video/bestoftv/2011/12/13/erin-schmidt-on-iran.cnn Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: general badness AS-based reputation system

2011-09-26 Thread Gadi Evron
On 9/26/11 2:31 AM, Jimmy Hess wrote: Sorry... what makes you think the problem with use of a AS-reputation systems is social and not technical? IP packets are not stamped with the numbers of any of the AS they transitted to reach your network. The IP protocol simply does not expose AS number

Re: general badness AS-based reputation system

2011-09-26 Thread Gadi Evron
We tried to outline some of the challenges of building such a system in our NANOG52 presentation: http://www.merit.edu/networkresearch/papers/pdf/2011/NANOG52_reputation-nanog.pdf In particular see slide 4. where we tried to lay down what we think the requirements are for a socially

general badness AS-based reputation system

2011-09-25 Thread Gadi Evron
Having run one of these in the past, when take-downs of CCs was still semi-useful, my ethos on this is problematic, however, I am as of yet undecided as to this one. An AS-based reputation system for all sorts of badness: http://bgpranking.circl.lu/ In my opinion, third-party security based

UN declares Internet access a human right

2011-06-05 Thread Gadi Evron
The title is misleading, as this is more about denying access. But this is still quite interesting. I don't think this has *any* operational implications, but every operator to see this was immediately worried. I figure it warrants a discussion.

(wikileaks) Fwd: [funsec] And Google becomes a DNS..

2010-12-05 Thread Gadi Evron
I withhold comment... discuss amongst yourselves. Best, Gadi. Original Message Subject:[funsec] And Google becomes a DNS.. Date: Sun, 5 Dec 2010 17:34:50 +0200 From: Imri Goldberg lorgan...@gmail.com To: funsec fun...@linuxbox.org Found on reddit:

Re: (wikileaks) Fwd: [funsec] And Google becomes a DNS..

2010-12-05 Thread Gadi Evron
On 12/5/10 5:50 PM, Gadi Evron wrote: I withhold comment... discuss amongst yourselves. Found on reddit: http:/ Not sure why the URL didn't go through... http://i.imgur.com/Q5SVu.png Enjoy. Gadi.

Re: Who controlls the Internet?

2010-07-26 Thread Gadi Evron
On 7/25/10 8:24 PM, Tarig Yassin wrote: I would like to issue a question here, who controls this Internet? Vix does, who else? :) Gadi.

Finland makes broadband access a legal right

2010-07-01 Thread Gadi Evron
http://edition.cnn.com/2010/TECH/web/07/01/finland.broadband/index.html?hpt=T2 Interesting...

The Economist, cyber war issue

2010-07-01 Thread Gadi Evron
The upcoming issue will be about cyber war. Check out the front page image: http://sphotos.ak.fbcdn.net/hphotos-ak-snc3/hs488.snc3/26668_410367784059_6013004059_4296972_499550_n.jpg Gadi.

Recommendation in Australia for ISPs to force user security?

2010-06-22 Thread Gadi Evron
http://www.zdnet.com.au/make-zombie-code-mandatory-govt-report-339304001.htm A government report into cybercrime has recommended that internet service providers (ISPs) force customers to use antivirus and firewall software or risk being disconnected. security Committee chair Belinda Neal

Re: Nato warns of strike against cyber attackers

2010-06-08 Thread Gadi Evron
Gadi. -- Gadi Evron, http://gadievron.com/

Re: Nato warns of strike against cyber attackers

2010-06-08 Thread Gadi Evron
is what they have in mind. Gadi. -- Gadi Evron, http://gadievron.com/

Re: Books for the NOC guys...

2010-05-09 Thread Gadi Evron
On 4/3/10 1:52 PM, Adrian Chadd wrote: On Fri, Apr 02, 2010, Robert E. Seastrom wrote: So, what are you having your up-and-coming NOC staff read? Since I thought this was worthwhile summarising, I've dumped it on the mail topics page in the Wiki:

Re: [only half OT] A socio-psychological analysis of the first internetwar (Estonia)

2010-04-30 Thread Gadi Evron
. Gadi. -Original Message- From: Gadi Evron [mailto:g...@linuxbox.org] Sent: Wednesday, April 28, 2010 11:51 PM To: NANOG Subject: [only half OT] A socio-psychological analysis of the first internetwar (Estonia) Hi, In the past year I have been working in collaboration

[only half OT] A socio-psychological analysis of the first internet war (Estonia)

2010-04-28 Thread Gadi Evron
comments appreciated. If on psychology, please do it off-list, though. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Email Portability Approved by Knesset Committee

2010-02-23 Thread Gadi Evron
On 2/22/10 7:28 PM, Joe Abley wrote: On 2010-02-22, at 10:09, Gadi Evron wrote: The email portability bill has just been approved by the Knesset's committee for legislation, sending it on its way for the full legislation process of the Israeli parliament. While many users own a free email

Re: Security Guideance

2010-02-23 Thread Gadi Evron
, are you able to provide with a packet dump of the DoS? Might help us pinpoint the relevant botnet and/or bot. As to web server botnets, you may be interested in this 2007 article from me on the subject: http://gadievron.com/publications/GadiEvron_VBFeb07.pdf Good luck, Gadi. -- Gadi

Chuck Norris Botnet and Broadband Routers

2010-02-22 Thread Gadi Evron
Last week Czech researchers released information on a new worm which exploits CPE devices (broadband routers) by means such as default passwords, constructing a large DDoS botnet. Today this story hit international news. Original Czech:

Email Portability Approved by Knesset Committee

2010-02-22 Thread Gadi Evron
The email portability bill has just been approved by the Knesset's committee for legislation, sending it on its way for the full legislation process of the Israeli parliament. While many users own a free email account, many in Israel still make use of their ISP's email service. According to

Re: Chuck Norris Botnet and Broadband Routers

2010-02-22 Thread Gadi Evron
On 2/22/10 5:17 PM, William Pitcock wrote: On Mon, 2010-02-22 at 16:21 +0200, Gadi Evron wrote: Last week Czech researchers released information on a new worm which exploits CPE devices (broadband routers) by means such as default passwords, constructing a large DDoS botnet. Today this story

lawful intercept/IOS at BlackHat DC, bypassing and recommendations

2010-02-04 Thread Gadi Evron
/archive/blackhatlitalk.html Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Anyone see a game changer here?

2010-01-24 Thread Gadi Evron
-- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Anyone see a game changer here?

2010-01-23 Thread Gadi Evron
On 1/24/10 6:37 AM, Damian Menscher wrote: So... you're taking incomplete information hyped up by tech reporters operating based on leaks from people tangential to an investigation as fact, and deciding that if Google doesn't tell you the details of an ongoing criminal investigation that you'll

Re: Anyone see a game changer here?

2010-01-23 Thread Gadi Evron
On 1/24/10 7:20 AM, Gadi Evron wrote: On 1/24/10 6:37 AM, Damian Menscher wrote: So... you're taking incomplete information hyped up by tech reporters operating based on leaks from people tangential to an investigation as fact, and deciding that if Google doesn't tell you the details

Re: Anyone see a game changer here?

2010-01-22 Thread Gadi Evron
complacent with the PR nightmare of full disclosure a decade behind them, with most vulnerabilities now sold to them directly or indirectly by the security industry. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Anyone see a game changer here?

2010-01-15 Thread Gadi Evron
On 1/15/10 4:07 PM, Bruce Williams wrote: As if the old threat models weren't bad enough... The old threat models were simply not up to date. Gadi. Bruce -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Anyone see a game changer here?

2010-01-15 Thread Gadi Evron
On 1/15/10 4:32 PM, Sachs, Marcus Hans (Marc) wrote: The APT is the new game. Old rules, new game. I don't see why it's new just because suddenly people know what's going on around them. A bit like with botnets before 2004. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http

Re: Anyone see a game changer here?

2010-01-15 Thread Gadi Evron
/2009/03/german_intellig.html Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Anyone see a game changer here?

2010-01-15 Thread Gadi Evron
On 1/15/10 5:23 PM, Sachs, Marcus Hans (Marc) wrote: The botnet concept is one of the old rules. The way the APT works and what it is used for is the new game. Perhaps for talking about, but it is far from new. Come on Marc. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http

Re: Anyone see a game changer here?

2010-01-15 Thread Gadi Evron
On 1/15/10 10:15 PM, Fred Baker wrote: On Jan 15, 2010, at 8:13 AM, Gadi Evron wrote: 1. Unlike GhostNet, which showed an interesting attack but jumped to conclusions without evidence that it was China behind them -- based on Ethos alone I'd like to think that when Google says China did

Re: more news from Google

2010-01-15 Thread Gadi Evron
of time. Gadi --Steve Bellovin, http://www.cs.columbia.edu/~smb -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: I got a live one! - Spam source

2009-11-24 Thread Gadi Evron
? As to the intricate web of who they are and where their resources lie, these are usually cases where the more you dig, the more you find -- ad infinitum. Me? I'd just kick them after verifying they are not victims themselves. I hope this helps, Gadi. -- Gadi Evron, g...@linuxbox.org. Blog

Announcement: Critical Internet Infrastructure WG is now open to public participation

2009-11-18 Thread Gadi Evron
is hosted by the ISOTF, but is governed by members. Note: SCADA, network operations, and other related issues should be discussed in the appropriate forums, elsewhere. This group deals with the internet. To subscribe: http://isotf.org/mailman/listinfo/cii Gadi Evron for ISOTF-CII-WG.

Re: Announcement: Critical Internet Infrastructure WG is now open to public participation

2009-11-18 Thread Gadi Evron
Simon Lockhart wrote: On Wed Nov 18, 2009 at 07:08:31PM +0200, Gadi Evron wrote: ISOTF Critical Internet Infrastructure WG is now open to public participation. Sorry, who is ISOTF? I tried looking on the website, but the About ISOTF page is blank... http://www.isotf.org/?page_value

Re: Announcement: Critical Internet Infrastructure WG is now open to public participation

2009-11-18 Thread Gadi Evron
back: http://www.reddit.com/r/reddit.com/comments/6a32u/please_enter_the_first_1178_digits_of_pi_wait/ As to if it's a joke... one way to find out. :) Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Announcement: Critical Internet Infrastructure WG is now open to public participation

2009-11-18 Thread Gadi Evron
ISOI 6 was hosted by the University of Texas, Dallas, and supported by Baylor University. http://isotf.org/isoi6.html ISOI 7 was hosted by Websense and ESET, and supported by Facebook and Softlayer: http://isotf.org/isoi7.html Gadi. Regards Jorge -- Gadi Evron, g...@linuxbox.org

Re: Announcement: Critical Internet Infrastructure WG is now open to public participation

2009-11-18 Thread Gadi Evron
Gadi Evron wrote: I can share personal examples of past uses relating to NANOG, which are public: Oh, duh! The outages mailing list is part of the ISOTF, although clearly its own entity. Gadi.

Re: kaspersky anti-virus tech, with a clue?

2009-11-14 Thread Gadi Evron
Jim Mercer wrote: can anyone point me at a Kaspersky tech with a clue? maybe we can re-craft our login url to not offend the Kaspersky suite. Forwarding. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Dutch ISPs to collaborate and take responsibility for bottedclients

2009-10-06 Thread Gadi Evron
Eugeniu Patrascu wrote: Gadi Evron wrote: Barton F Bruce wrote: Stopping the abuse is fine, but cutting service to the point that a family using VOIP only for their phone service can't call 911 and several children burn to death could bring all sorts of undesirable regulation let alone

Re: [Nanog-futures] OT: iPhone Problems

2009-10-04 Thread Gadi Evron
Shrdlu wrote: Clue Store wrote: Mine's rebooted at leat 3 times a day sine the upgrade :( What ever happened to quality control http://discussions.apple.com/thread.jspa?threadID=2152619tstart=0 At the risk of sounding too much like the cranky retiree that I am, I would like to see

Re: Dutch ISPs to collaborate and take responsibility for botted clients

2009-10-04 Thread Gadi Evron
Christopher Morrow wrote: I would also point out that Qwest does this walled-garden approach for their customers (have been for at least 5 years now? d...@qwest could clarify) and they've seen success with it. Aliant in .ca also has some fairly aggressive anti-malware works installed. There are

Dutch ISPs to collaborate and take responsibility for botted clients

2009-10-03 Thread Gadi Evron
The story is covered by PC mag: --- ... major Dutch ISPs have agreed to share information and establish a common set of rules for responding to users infected with malware, especially those in botnets. The agreement, called a treaty by locals, involves 14 ISPs covering 98% of the market.

ruling: liability for providers who don't act on clients' illegal activities?

2009-09-07 Thread Gadi Evron
Jury Exacts $32M Penalty From ISPs For Supporting Criminal Websites http://darkreading.com/securityservices/security/cybercrime/showArticle.jhtml 'Landmark case' indicates that ISPs may be held liable if they know about criminal activity on their customers' Websites and fail to act A federal

Re: ruling: liability for providers who don't act on clients' illegal activities?

2009-09-07 Thread Gadi Evron
Gadi Evron wrote: Jury Exacts $32M Penalty From ISPs For Supporting Criminal Websites http://darkreading.com/securityservices/security/cybercrime/showArticle.jhtml Corrected URL: http://darkreading.com/securityservices/security/cybercrime/showArticle.jhtml;jsessionid

Re: ruling: liability for providers who don't act on clients' illegal activities?

2009-09-07 Thread Gadi Evron
jamie wrote: FYI, This was discussed in the already-OT thread Beware : a very bad precedent set a week ago. Ah. I apologize. It happens. On Mon, Sep 7, 2009 at 11:59 AM, Gadi Evron g...@linuxbox.org mailto:g...@linuxbox.org wrote: Gadi Evron wrote: Jury Exacts $32M Penalty

Re: [Nanog-futures] Updates to the MLC warning process

2009-08-09 Thread Gadi Evron
Simon Lyall wrote: On Fri, 7 Aug 2009, Gadi Evron wrote: Beg pardon, but does this include a message to the list itself or only to the offender? When the thread is first moderated a message will be sent to the list ( at least for now ). Each message sent to a moderated thread will receive

Re: [Nanog-futures] Updates to the MLC warning process

2009-08-07 Thread Gadi Evron
on this. -- Kris on behalf of the MLC ___ Nanog-futures mailing list Nanog-futures@nanog.org http://mailman.nanog.org/mailman/listinfo/nanog-futures -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com

Re: DOS in progress ?

2009-08-06 Thread Gadi Evron
feeling inside. Off topic, I found it hilarious how all the tweets came back to facebook and set statuses about twitter. :o) Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/

Re: Are you an unpaid volunteer?

2009-07-22 Thread Gadi Evron
. Don't shoot the messenger though! And it wasn't really NANOG that did or does much of what he describes, but NANOG is a good enough representative name for the community of people who do, when we our definition to network operations. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog

[Fwd: [ GLSA 200907-15 ] Nagios: Execution of arbitrary code]

2009-07-20 Thread Gadi Evron
While this is the Gentoo advisory, it's generic enough. Gadi. -- Gadi Evron, g...@linuxbox.org. Blog: http://gevron.livejournal.com/ ---BeginMessage--- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory

Re: YES I'VE TRIED MANY VENUES looking for mail admin @ nist.gov

2009-07-10 Thread Gadi Evron
J. Oquendo wrote: (press 3) - rerouted to an APNIC block (outsourced!): Velcome is here to en eye esh tee dish is John I'm having trouble with mail.. vell have you tried reboot? vat vershun of vindows are you use? *ducks http://www.youtube.com/watch?v=QpmLrz_lSuE The IT Crowd, one of

Re: ftc shuts down a colo and ip provider

2009-06-05 Thread Gadi Evron
Christopher Morrow wrote: On Fri, Jun 5, 2009 at 1:44 AM, Deepak Jaindee...@ai.net wrote: What does it say about these providers AUP that the FTC needed to go to court to turn them off? I hate to re-start the atrivo/intercage/mccolo thread(s) but, often what happens is there just arent any

Re: [Nanog-futures] spam-l list

2009-05-15 Thread Gadi Evron
Jim Popovitch wrote: On Fri, May 15, 2009 at 02:29, Jo Rhett jrh...@netconsonance.com wrote: That's funny, given that Mailman is the source of significant amounts of backscatter. Mailman is neither an MTA nor a MUA. Something before or after Mailman is backscattering. -Jim P. Mailing

Re: [Nanog-futures] Draft Policy re individual sites

2009-05-01 Thread Gadi Evron
Joel Jaeggli wrote: Simon Lyall wrote: On Thu, 30 Apr 2009, Martin Hannigan wrote: Not such a great idea. A down search engine is an operational problem whether its application or network. It makes lots of phones ring and finger pointing at our networks. This costs us money. Same for major

one shot remote root for linux?

2009-04-28 Thread Gadi Evron
This is one of them mysterious and rare cases where a non router OS vulnerability may affect network operations. Sometimes news finds us in mysterious yet obvious ways. HD Moore (respected security researcher) set a status which I noticed on my twitter: @hdmoore reading through

Re: [Nanog-futures] Fwd: ADMIN: Reminder on off-topic threads

2009-04-23 Thread Gadi Evron
Robert E. Seastrom wrote: No, let's not. To steal a line from rbush, we tried that three years ago and it didn't work then. Good point, but the situation is very different than what it was three years ago. We have a moderation team, we have nanog-futures for meta discussion, etc. Further,

Re: [Nanog-futures] Fwd: ADMIN: Reminder on off-topic threads

2009-04-23 Thread Gadi Evron
Cat Okita wrote: On Thu, 23 Apr 2009, Gadi Evron wrote: facts need to be aligned. What we are not happy with is how moderation works. Speak for yourself ; I'm quite sure that I'm not a part of the 'we' you mention here. Indeed! ;) To be clear, we includes me and others who spoke here who

Re: Fiber cut in SF area

2009-04-09 Thread Gadi Evron
Jorge Amodio wrote: On Thu, Apr 9, 2009 at 1:20 PM, Christopher Morrow morrowc.li...@gmail.com wrote: isn't there a mailing list for this sort of thing? outages@ I think it is? Jared put together long time ago outages at outages.org seems to still be active and receiving reports about this

Re: [Nanog-futures] MLC transparency issues

2009-04-07 Thread Gadi Evron
kris foster wrote: Hi everyone I am going to preface this by saying that the MLC appreciates that transparency is of the most importance to the community, and that we have not lived up to this as completely as we should have. We have recently been experimenting with thread moderation.

[Nanog-futures] issues with heavy-handed thread moderation and visibility

2009-04-06 Thread Gadi Evron
Fellow NANOG-ers. I am very happy eith the recent revival of traffic on NANOG on relevant subjects, as I am sure we all are. My email is about traffic we don't see and unless I am missing something, don't know gets filtered. due to what I believe is very heavy-handed moderation by the admin

Re: [Nanog-futures] issues with heavy-handed thread moderation and visibility

2009-04-06 Thread Gadi Evron
Christopher Morrow wrote: do you have a link to this thread? (I don't actually see it in my box, so I fear I missed it for other reasons) oops, sorry... I did get the original message + ~6 followups. I just hadn't read them :( The follow-ups on-list were not extremely operational, the

Re: [Nanog-futures] issues with heavy-handed thread moderation and visibility

2009-04-06 Thread Gadi Evron
Joe Provo wrote: Gadi, Some valid points are raised. While additional discussion from interested folks here is encouraged, suffice to say that the topic will be on the SC call tomorrow, as we are the folks whom receive escalation appeals of MLC actions. Thank you Joe. I appreciate your

The Confiker Virus hype and measures

2009-03-30 Thread Gadi Evron
Joe Blanchard wrote: Anyone have a copy of this? Would like to analyze it and understand its propagation. Thanks -Joe I'm sure someone sent you a sample by now. As to the malware itself... I haven't personally been following conficker as I've been busy with other issues (as much as

phishing attacks against ISPs (also with Google translations)

2009-03-25 Thread Gadi Evron
In this email message I'd like to discuss two subjects: a. Phishing against ISPs. b. Phishing in different languages against ISPs as soon as Google adds a new translation module. [My apologies to those who receive this email more than once. I am approaching several different industries on this

Re: phishing attacks against ISPs (also with Google translations)

2009-03-25 Thread Gadi Evron
William Allen Simpson wrote: I've not recently seen an ISP account phish here. The last one I remember was circa 2003. It was a dictionary attack, arriving at my was@ account (long since rendered useless by spam volume and terminated). However, I don't save phish/spam anymore. I used to save

Re: wires mess thread

2009-03-13 Thread Gadi Evron
This came across my RSS feed today from gizmodo: http://www.reddit.com/r/technology/comments/845v3/this_data_center_has_got_its_shit_together/

[ MDVSA-2009:054 ] nagios (fwd)

2009-02-25 Thread Gadi Evron
-- Forwarded message -- Date: Wed, 25 Feb 2009 01:05:01 +0100 From: secur...@mandriva.com Reply-To: xsecur...@mandriva.com To: bugt...@securityfocus.com Subject: [ MDVSA-2009:054 ] nagios -BEGIN PGP SIGNED MESSAGE- Hash: SHA1

Re: [ MDVSA-2009:054 ] nagios (fwd)

2009-02-25 Thread Gadi Evron
On Wed, 25 Feb 2009, Eric Gearhart wrote: I hate to be pedantic but is this something that should get forwarded to NANOG? I guess the relevance is justified because a lot of network folks run Nagios...? As long as network operators related vulns don't start showing up every couple of months

Re: Great outage of 1997 - Does anyone recall?

2009-02-23 Thread Gadi Evron
On Sun, 22 Feb 2009, Danny McPherson wrote: On Feb 22, 2009, at 10:10 PM, Christopher Morrow wrote: On Mon, Feb 23, 2009 at 12:06 AM, Paul Wall pauldotw...@gmail.com wrote: On Sun, Feb 22, 2009 at 2:57 AM, Gadi Evron g...@linuxbox.org wrote: What was that story with an African routes some

Re: Are we really this helpless? (Re: isprime DOS in progress)

2009-01-23 Thread Gadi Evron
On Fri, 23 Jan 2009, Jeffrey Lyon wrote: I respectfully disagree. Network engineers have to keep up with many tasks and preventing DoS/DDoS should be the responsibility of everyone. I see more folks worried about spam than they are actual security. Because non of us wantsto spend the next two

Re: Cogent haiku

2009-01-09 Thread Gadi Evron
hehe On Fri, 9 Jan 2009, neal rauhauser wrote: Cogent drops packets. Angry customers call. Twice. Admin writes haiku.

RE: Cogent haiku

2009-01-09 Thread Gadi Evron
On Fri, 9 Jan 2009, Steve Fischer wrote: That is too funny! He cheated by adding periods :P -Original Message- From: neal rauhauser [mailto:nrauhau...@gmail.com] Sent: Friday, January 09, 2009 3:06 PM To: nanog@nanog.org Subject: Cogent haiku Cogent drops packets. Angry customers

Re: Ethical DDoS drone network

2009-01-04 Thread Gadi Evron
On Sun, 4 Jan 2009, John Kristoff wrote: On Sun, 4 Jan 2009 21:06:34 -0500 Jeffrey Lyon jeffrey.l...@blacklotus.net wrote: Say for instance one wanted to create an ethical botnet, how would this be done in a manner that is legal, non-abusive toward other networks, and unquestionably used for

Re: Ethical DDoS drone network

2009-01-04 Thread Gadi Evron
On Mon, 5 Jan 2009, Patrick W. Gilmore wrote: On Jan 5, 2009, at 1:33 AM, Roland Dobbins wrote: On Jan 5, 2009, at 2:08 PM, Patrick W. Gilmore wrote: You want to 'attack' yourself, I do not see any problems. And I see lots of possible benefits. This can be done internally using various

Re: Security team successfully cracks SSL using 200 PS3's and MD5 flaw.

2009-01-02 Thread Gadi Evron
On Fri, 2 Jan 2009, Joe Abley wrote: On 2009-01-02, at 09:04, Rodrick Brown wrote: A team of security researchers and academics has broken a core piece of Internet technology. They made their work public at the 25th Chaos Communication Congress in Berlin today. The team was able to create a

Re: Security team successfully cracks SSL using 200 PS3's and MD5

2009-01-02 Thread Gadi Evron
On Fri, 2 Jan 2009, Dragos Ruiu wrote: www.win.tue.nl/hashclash/rogue-ca/; classtype: policy-violation; sid:101;) You can't really use any snort rule to detect SHA-1 certs created by a fake authority created using the MD5 issue. Yes, this is a serious matter, but it hardly has any

reliable IOS exploitation

2008-12-29 Thread Gadi Evron
FX has given a comprehensive talk about IOS exploitation (including even TCL scripts operators leave behind when they moved jobs to retain access). He has shown effective and ineffective ways of detecting compromise in IOS. Then, he has shown how reliable exploitation of IOS routers works.

Attacking a critical Internet infrastructure

2008-12-27 Thread Gadi Evron
Hi folks and happy new year! I am emailing to spam about a talk about to be given at the CCC conference (25c3). I apologize for the cross-posting. At the 4th day of CCC (30th), there is an interesting as-of-yet no details disclosed talk by a couple of good people.

[USN-698-1] Nagios vulnerability (fwd)

2008-12-22 Thread Gadi Evron
-- Forwarded message -- Date: Mon, 22 Dec 2008 09:35:54 -0500 From: Marc Deslauriers marc.deslauri...@canonical.com To: ubuntu-security-annou...@lists.ubuntu.com Cc: bugt...@securityfocus.com, full-disclos...@lists.grok.org.uk Subject: [USN-698-1] Nagios vulnerability

Re: Security Intelligence [Was: Re: Netblock reassigned from Chile to US ISP...]

2008-12-15 Thread Gadi Evron
On Sun, 14 Dec 2008, Christopher Morrow wrote: On Sun, Dec 14, 2008 at 8:44 PM, Gadi Evron g...@linuxbox.org wrote: On Sun, 14 Dec 2008, Rich Kulawiec wrote: On Sat, Dec 13, 2008 at 05:51:13PM +0900, Randy Bush wrote: but you need to be much more specific about what you want from medium

Re: Security Intelligence [Was: Re: Netblock reassigned from Chile to US ISP...]

2008-12-14 Thread Gadi Evron
On Sun, 14 Dec 2008, Rich Kulawiec wrote: On Sat, Dec 13, 2008 at 05:51:13PM +0900, Randy Bush wrote: but you need to be much more specific about what you want from medium and smaller isps, and what the immediate payoffs (cf. the financial secions of the newpaper) will be to them to justify the

RE: an over-the-top data center

2008-11-28 Thread Gadi Evron
On Fri, 28 Nov 2008, Howard C. Berkowitz wrote: It seems that all these cases are more under the bottom than over the top. Every couple of years there is a story about some anti virus company, data center, or whatever running out of an old nuclear bunker/military base/middle of no where.

Re: [funsec] McColo: Major Source of Online Scams and Spams Knocked Offline (fwd)

2008-11-12 Thread Gadi Evron
On Wed, 12 Nov 2008, Kee Hinckley wrote: After reading this, and the (Washington Post I believe--I'm away from my laptop right now) article on this, two things are bothering me. The article expressed a good deal of frustration with the (lack of) speed with which law enforcement has been

[funsec] McColo: Major Source of Online Scams and Spams Knocked Offline (fwd)

2008-11-11 Thread Gadi Evron
-- Forwarded message -- Date: Tue, 11 Nov 2008 18:22:42 -0800 From: Paul Ferguson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [funsec] McColo: Major Source of Online Scams and Spams Knocked Offline -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Via Security Fix. [snip] A

[funsec] ICANN Terminates EstDomains' Registrar Accreditation (fwd)

2008-10-29 Thread Gadi Evron
-- Forwarded message -- Date: Tue, 28 Oct 2008 20:47:48 -0700 From: Paul Ferguson [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: [funsec] ICANN Terminates EstDomains' Registrar Accreditation -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Mr. Tsastsin, Be advised that

Re: Current subscribe address for outages list?

2008-10-29 Thread Gadi Evron
On Wed, 29 Oct 2008, Gadi Evron wrote: actually nobody has posted any info about this other than what you just posted, no details/carrier/location etc. Jared was kind enough to take the hosting load, and the list is now hosted there. Also, following discussions on nanog-futures I

Re: Fwd: cnn.com - Homeland Security seeks cyber counterattack system(Einstein 3.0)

2008-10-07 Thread Gadi Evron
On Tue, 7 Oct 2008, Steven M. Bellovin wrote: On Tue, 7 Oct 2008 14:07:04 -0400 (EDT) Sean Donelan [EMAIL PROTECTED] wrote: On Tue, 7 Oct 2008, [EMAIL PROTECTED] wrote: On Tue, 07 Oct 2008 11:30:11 CDT, J. Oquendo said: What about exceeding the minimum requirements for a change. (I think

Re: [Nanog-futures] NANOG-L, Paging, and the AUP

2008-10-05 Thread Gadi Evron
On Sun, 5 Oct 2008, Gadi Evron wrote: The question is IF given that we ensure these folks really did all they can on their own, AND only then asked for help: Is the end of line place to ask for that help NANOG, or somewhere else? Gadi. [replying to self] A good example just hit NANOG

Re: Hey ISC, thanks for providing free wifi to intercage!

2008-10-01 Thread Gadi Evron
I do believe the wireless is provided for 200 Paul and everyone hosted there. But if gloating in an inflamatory fashion ... oh, fake email address. What a surprise. Gadi. On Wed, 1 Oct 2008, intercage blows wrote: * RussM ([EMAIL PROTECTED]) has joined #dronebl * RussM *pokes*

Re: [Nanog-futures] Can we stop the Intercage discussion mess now?

2008-09-26 Thread Gadi Evron
On Fri, 26 Sep 2008, Rich Kulawiec wrote: On Thu, Sep 25, 2008 at 02:58:36PM -0400, Brian Raaen wrote: Agreed... Mailman has a feature for emergency moderation of all post, created just for flame wars like this. chuckle I rate this one a 2 on a 10 scale of toastiness. But I think I probably

Estonian Cyber Security Strategy document -- now available online

2008-09-26 Thread Gadi Evron
of the Estonian economy. Those who wish to download the document: http://www.mod.gov.ee/?op=bodyid=518 My contact there specified she'd be happy to answer any questions. To avoid spam of her inbox, email me for her address. Gadi Evron.

Re: Internet Filtering Lobby ?

2008-09-26 Thread Gadi Evron
On Fri, 26 Sep 2008, Marshall Eubanks wrote: Does anyone know what this group is really about and how it might actually impact real networks ? Reminds me of something Fergie said at ISOI 5 just a couple of weeks ago: if only the records industry was interested in folks like Atrivo and RBN

Re: [Nanog-futures] Can we stop the Intercage discussion mess now?

2008-09-25 Thread Gadi Evron
On Thu, 25 Sep 2008, Brian Raaen wrote: Agreed... Mailman has a feature for emergency moderation of all post, created just for flame wars like this. I don't think it's a flame war, just an active discussion most have something to say about. I still think it should stop at this point but while

Re: DDoS from theplanet.com

2008-09-25 Thread Gadi Evron
On Fri, 26 Sep 2008, Term wrote: Hi, Is there anyone on this list that can give me a noc/security contact for someone at theplanet.com I have been getting a DDos from servers hosted with them for the past 60 hours and they seem to have the care factor of 0 There are some good security

Re: YAY! Re: Atrivo/Intercage: NO Upstream depeer

2008-09-24 Thread Gadi Evron
On Wed, 24 Sep 2008, Russell Mitchell wrote: Hello Mark, What's YOUR motivation to consistantly attack my company? I don't know this Mark, but it seems like he is copying your strategy of stay up last and you win as you both make little sense. Gadi. What's my motivation to

Re: the Intercage mess

2008-09-24 Thread Gadi Evron
On Wed, 24 Sep 2008, *Hobbit* wrote: While it's good to see some community effort going toward slapping a lid on misbehaving sources, how about a little consistency in the bigger picture? Consider this sort of scenario: An ISP allows its infrastructure to emit spam and host compromised

Re: Renesys Blog Article [Was: Re: the Intercage mess]

2008-09-24 Thread Gadi Evron
On Wed, 24 Sep 2008, Paul Ferguson wrote: Just a side-note: Rensys has an interesting blog article up today on this Atrivo/Intercage mess: http://www.renesys.com/blog/2008/09/internet_vigilantism_1.shtml FYI, I have but one comment. There is a difference between Vigilantism as it is

Re: Atrivo/Intercage

2008-09-24 Thread Gadi Evron
On Wed, 24 Sep 2008, William Pitcock wrote: No, but others have, and it isn't helpful towards resolving this problem. Ultimately, neither is forcing them off the internet. Well, in actuality, that resolves part of the problem, but I suspect that a lot of the affected cybercrime has moved to

Re: Atrivo/Intercage

2008-09-23 Thread Gadi Evron
http://www.giantitp.com/comics/oots0595.html I think that sums up this thread. On Tue, 23 Sep 2008, Joe Greco wrote: On Sep 22, 2008, at 4:33 PM, Tom Sparks (Applied Operations) wrote: Intercage is not a big shop, there are very few people involved in running it I have no dog in this

  1   2   >