March 2018 - NLNOG - mailman3.nlnog.net

weet iemand wie deze amateurs zijn?
by Sabri Berisha 01 Feb '21

01 Feb '21

Hi, Elke 30 seconden proberen ze het opnieuw: Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: filter: RCPT from unknown[185.103.159.70]: <vsaveliev(a)openprovider.ru>: Sender address triggers FILTER smtp-amavis:[127.0.0.1]:10024; from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> Jan 1 07:50:14 mail postfix/smtpd[1243]: NOQUEUE: reject: RCPT from unknown[185.103.159.70]: 554 5.7.1 <null(a)null.nl>: from=<vsaveliev(a)openprovider.ru> to=<null(a)null.nl> proto=ESMTP helo=<mail-dev101-01.openprovider.nl> root@mail:/var/log# host 185.103.159.70 70.159.103.185.in-addr.arpa domain name pointer hosted.by.pcextreme. <--- lekker profi PTR. role: PCextreme - Global NOC address: PCextreme B.V. address: Gyroscoopweg 134 En was dat hele openprovider.nl niet van Beefje? Thanks, Sabri Jr Network Amateur

2 2

(no subject)
by TU Delft - infospoofing project 14 Mar '18

14 Mar '18

Every day, attackers exploit IP spoofing for their criminal operations. Despite being a known vulnerability for at least 25 years, IP source address spoofing still remains a popular attack method for redirection, amplification, and anonymity attacks. This situation persists partially because of the lack of visibility into which operators lack adequate anti-spoofing measures -- that is, their networks are not compliant with BCP38 and related norms. In the effort to help increase the adoption of anti-spoofing measures, researchers from TU Delft and CAIDA have been conducting measurements on which networks are compliant. We would like to engage the network operator community to reach out to non-compliant operators and instigate remediating actions. We have created an overview of our findings on networks in the Netherlands. You can see them on our website: https://www.infospoofing.com/nl/ID=68 The good news is: over 90% of Dutch operators have measures in place against IP spoofing! We would like to ask your help to get the remaining 6% on board. Feel free to share the link to our website or otherwise help mobilize the non-compliant operators. At our site, you can also find more information about anti-spoofing best practices as articulated by the MANRS initiative. Help us to make the Netherlands a spoofing-free country! Best regards, Orcun Cetin, Luigi Tuttobene, Carlos Gañán, Michel van Eeten Researchers at Delft University of Technology --- Faculteit Techniek, Bestuur en Management TU Delft Postbus 5015, 2600GA Delft +31 (0)15 27 88784

1 0

Chrome / Symantec
by Job Snijders 09 Mar '18

09 Mar '18

Hallo allen, Heads-up: https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.… ”Distrust of the Symantec PKI: Immediate action needed by site operators” Groeten, Job

1 0

Memcached server list
by niels=nlnog＠bakker.net 09 Mar '18

09 Mar '18

Hoi allemaal, Recent is een lijst met open memcached server en een simpel exploit van memcrashed gepost. Hier is de lijst, voorzien van AS-nummers: http://swm.pp.se/memcached-verbose.txt Zoek op je ASN (of op '| NL |' als je mensen kent). KPN, SURFnet, XS4ALL, AMSIO, Ziggo, Interconnect, Zeelandnet, Trueserver, We-Dare, TransIP, Caveo, Netholding, NedZone, ReasonNet, Denit, Edutel, NForce, Greenhost, Netrouting, i3D, SpeakUp, A2B, Leaseweb, Tilaa, HostNet zijn enkele voorbeelden van service providers die ik verwacht deze mailing list te lezen. Groeten, -- Niels. --

2 2

memcached UDP/11211 IOS XR ratelimit example
by Job Snijders 01 Mar '18

01 Mar '18

Dear all, As you've probably read by now, there we're facing a significant threat in the shape of the memcached UDP protocol. The current best practise is to apply rate-limits on all external facing ports and police UDP/11211 traffic down to something managable. This protects both your own infrastructure and your customers. Here are numerous pointers: http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/ I recommend adding memcached UDP/11211 to the same "exploitable ports" list as NTP, CHARGEN and SSDP. Below is a configuration example for IOS XR to rate-limit these amplification-sensitive UDP ports to 1% of of the port's capacity. ipv4 access-list exploitable-ports permit udp any eq ntp any permit udp any eq 1900 any permit udp any eq 19 any permit udp any eq 11211 any ! ipv6 access-list exploitable-ports-v6 permit udp any eq ntp any permit udp any eq 1900 any permit udp any eq 19 any permit udp any eq 11211 any ! class-map match-any exploitable-ports match access-group ipv4 exploitable-ports match access-group ipv6 exploitable-ports-v6 end-class-map ! policy-map ntt-external-in class exploitable-ports police rate percent 1 conform-action transmit exceed-action drop ! set precedence 0 set mpls experimental topmost 0 ! class class-default set mpls experimental imposition 0 set precedence 0 ! end-policy-map ! interface Bundle-Ether19 description Customer: the best customer service-policy input ntt-external-in ipv4 address xxx/x ipv6 address yyy/y ... ! interface Bundle-Ether20 service-policy input ntt-external-in ... ... etc ... Please share your own examples too! Kind regards, Job

1 0