- NZNOG - lists.nznog.org

Spoofer Report for NZNOG for Sep 2019
by CAIDA Spoofer Project 08 Oct '19

08 Oct '19

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within nzl. Inferred improvements during Sep 2019: ASN Name Fixed-By 55850 TRUSTPOWERLTD 2019-09-18 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Sep 2019: ASN Name First-Spoofed Last-Spoofed 4768 VFNZ-INET 2019-09-14 2019-09-14 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=nzl&no_block=1 Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

Call for Papers - NZNOG 2020 conference
by Richard Nelson 11 Sep '19

11 Sep '19

Yes it is that time again - plan your talks... The NZNOG trustees invite papers for the 17th annual NZNOG conference, to be hosted at the Rydges Latimer Hotel in central Christchurch on 30 and 31 Jan 2019. With the conference there will be a three day Workshop 27-29 Jan and a day of tutorials on 29 Jan. Conference objective: The NZNOG conference, workshops and tutorials are a once-a-year opportunity for individuals and organisations involved in Internet operations to meet and share the latest in Internet operations, technologies, practices and receive high quality training. The event is unique in New Zealand and attracts technical, skilled individuals with a genuine interest in Internet operations and Internetworking technologies. Submissions on any aspect of networking are welcome however we are particularly interested in talks that involve real world deployment experience, particularly in New Zealand. Submit a paper: Presenters are invited to submit talk proposals for consideration by Monday 28 Oct (Labour day). Please provide your talk title, a short presenter bio and an abstract of the talk. Abstracts should be no more than one page long and provide a summary of your networking related subject matter. Normally presentations 30 min long, are video streamed live and slide decks are posted to the NZNOG website. If you want a different duration or other arrangements you need to let us know at submission time. This year conference registration for accepted presenters will be free. To submit your paper please e-mail: talks(a)nznog.org Proposals will be evaluated on fit with the conference’s objective and its ability to stimulate lively discussions around the current state of New Zealand networking. This call for submissions can also be found at: http://www.nznog.org/nznog-2020/call-for-papers-2020 For more information about the conference visit www.nznog.org or contact: talks(a)nznog.org

1 0

A very interesting presentation from NLNOG
by Mark Prior 08 Sep '19

08 Sep '19

Do yourself a favour and spend some time reading this presentation. <https://nlnog.net/static/nlnogday2019/3_NLNOG_day_2019_Erik_Bais_Working_un…> Mark.

3 2

Re: A very interesting presentation from NLNOG
by Scott Weeks 06 Sep '19

06 Sep '19

--- mrp(a)mrp.net wrote: From: Mark Prior <mrp(a)mrp.net> Do yourself a favour and spend some time reading this presentation. <https://nlnog.net/static/nlnogday2019/3_NLNOG_day_2019_Erik_Bais_Working_un…> -------------------------------------------- I learned this lesson long ago. It was really important for my mental health to do what it says. Try it. scott _______________________________________________ NZNOG mailing list -- nznog(a)list.waikato.ac.nz To unsubscribe send an email to nznog-leave(a)list.waikato.ac.nz

1 0

Invitation to participate in DMARC bootcamp
by Save Vocea 02 Sep '19

02 Sep '19

Dear NZNOG list members, (Apologies for any cross-posts as I’ve shared in regional NOG lists as well) Just thought I’d share this here in case there are interested ppl/orgs from NZ that want to join. Please read below. Regards, Save Vocea (ICANN.org staff in Oceania) ---<start>--- Link for registration: https://mailchi.mp/1833debd40eb/dmarcbootcamp On September 9th, GCA will start a 6-week DMARC Bootcamp. This bootcamp will guide participants to implement a DMARC - an effective way to limit the spoofing of email from protected domains. This bootcamp will guide participants to implement policy level of “none” after becoming acquainted with DMARC within the first few weeks. By the end of the bootcamp, participants will have enough information and confidence to move to the highest DMARC policy level of “reject” immediately or within a few months. DMARC is considered the industry standard for email authentication to prevent attacks in which malicious third parties send harmful email using a counterfeit address. DMARC stops email impersonation - by implementing DMARC, domains lower the odds of their domains being spoofed and used for phishing attacks on recipients. The result of a domain not implementing any form of DMARC policy is exposing its recipients to possible phishing attacks and, unsurprisingly, 91% of all cyber-attacks begin with a phishing email. Since June 2016, the Global Cyber Alliance (GCA) has been working to accelerate adoption of DMARCthrough advocacy, by providing a set of easy-to-use tools, and campaigns to drive deployment. GCA also measured the economic impact of DMARC. In just a few short years, GCA’s DMARC initiative has resulted in more than 5,700 organizations across more than 180 countries adopting DMARC. This has led to estimated financial benefits of more than $19 Million USD in 2018 across a diverse array of industries and governments. Moreover, the $19M estimate is merely from GCA’s activity. GCA’s other partners, including nonprofit organizations, commercial vendors, governments, and enterprises are also deploying and supporting the deployment of DMARC. For these organizations, the most-affected 1% of them will save $302,000 per year solely from reducing business email compromise (BEC) through DMARC, even assuming only 1% of BEC emails lead to action. If that number grows to 5%, the loss reduction for that 1% is $1.3M per year. Adding that up across the Internet is a big number, and that is from BEC losses alone. Starting September 9, GCA will run a 6 weeks bootcamp to enable organizations to learn about DMARC and support them in its implementation. Every step of the way, GCA and partners will assist with resources and guidance, including multiple webinars and demonstrations. (Please note that the below is subject to change and additional webinars and resources may be added as needed) • Timings for Webinars: Wednesday of each week o 7am EST (12pm BST, 1pm Paris), o 12pm EST (9am PST, 5pm BST, 6pm Paris) , o 12am EST (12pm Singapore, 2pm Sydney, AU) The agenda will be as follows: Weeks 1-2: Getting Started Overview of DMARC, SPF and DKIM Weeks 3-4: Time to Implement! Demonstrations on how to implement DMARC on Windows DNS, BIND and a Cloud-based DNS Provider. Weeks 5-6: On Going Management: Analyze, Review and Adjust What to look for in DMARC reports and what needs to be adjusted before moving to an enforcement policy More details on the modules are here: Weeks One-Two: Getting Started Sept 10th - Bootcamp introduction and DMARC: An Overview (60 min) This is the first webinar of the DMARC Bootcamp series. We will provide a brief overview of the bootcamp and then an overview of DMARC. Sept 18th - What are SPF and DKIM? (60 min) In this session we will be going over SPF and DKIM. We’ll cover the basics and options of performing DKIM key generation and signing. Weeks 3-4: Time to Implement! Sept 24 and Sept 30 - DMARC Technical Details and Windows DNS (60 min) In this session we will go over each of the tags for a DMARC policy and then provide a demonstration on how to create the DNS records for SPF, DKIM and DMARC on Windows DNS. Sept 25 and Oct 2 - DMARC Technical Details and BIND (60 min) In this session we will go over each of the tags for a DMARC policy and then provide a demonstration on how to create the DNS records for SPF, DKIM and DMARC on BIND server (Linux). Sept 26 and Oct 3 - DMARC Technical Details and Cloud DNS (60 min) In this session we will go over each of the tags for a DMARC policy and then provide a demonstration on how to create the DNS records for SPF, DKIM and DMARC on Google Cloud DNS and 1&1.com<http://1.com>. Weeks 5-6: On Going Management: Analyze, Review and Adjust We will have multiple webinars from DMARC partners regarding DMARC reporting and next steps. Date and times are being set for these. Additional information and links will be forthcoming as the bootcamp advances. Please register for the bootcamp in order to receive the link for all of the webinars. Sign up to join the bootcamp and get updates about our Webinars and other resources as they become available. Please join us by registering at https://mailchi.mp/1833debd40eb/dmarcbootcamp . If you have any questions, contact gca-dmarc(a)globalcyberalliance.org<mailto:gca-dmarc(a)globalcyberalliance.org> .

1 0

[Misc] Research project on blacklists
by Anushah Hossain 16 Jul '19

16 Jul '19

Hi everyone, I'm a researcher at UC Berkeley and the International Computer Science Institute. My colleagues and I are working on evaluating and improving the accuracy of blacklists. As part of this work, we'd like to hear from you about the blacklists you currently use, what you perceive as their strengths and weaknesses, and any thoughts you have on how they might be improved. We've prepared an anonymous survey where you can share your views: https://berkeley.qualtrics.com/jfe/form/SV_200mg5hnQiAOgUl If you have five to ten minutes free today to fill it out, I would greatly appreciate your help! Thank you, and please don't hesitate to respond to me with comments or questions. (Apologies if you receive this message twice - trying to minimize cross-posting while still reaching a broad audience) Best, Anushah -- Anushah Hossain, PhD Student Energy and Resources Group, UC Berkeley

1 0

Using Cloudflare after Christchurch
by Peter Lambrechtsen 09 Jul '19

09 Jul '19

I don't think this question has been asked but I think it's worth asking. After the Christchurch attacks and the fact that Cloudflare clearly support terrorist and white supremacist sites has there been any consideration on if peering or engaging with Cloudflare is something that providers no longer wish to participate in. Or there isn't a sense of morality when it comes to the internet. Cloudflare have a LONG history of not caring about any and all vile material and have absolutely no intention to do anything about it from the engagements I have had with them post Christchurch. https://arstechnica.com/tech-policy/2017/05/cloudflare-changes-abuse-policy… https://www.theregister.co.uk/2018/12/19/cloudflare_terror_groups/ https://suespammers.net/tag/cloudflare-com-doing-nothing-about-spam-abuse/ https://krebsonsecurity.com/tag/cloudflare/ https://www.propublica.org/article/how-cloudflare-helps-serve-up-hate-on-th… To me they are clearly supportive of all sorts of vile content and have zero interest in doing anything about it while they still earn money. Has the horrific events of Christchurch given anyone pause to think if they want to engage with Cloudflare? Are morals important when running a service?. Peter

9 20

Shutting down the RPKI Validator
by Sebastian Castro 03 Jul '19

03 Jul '19

Hello, community: Back in 2014 InternetNZ (NZRS at that time) set up and made publicly available an RPKI Validator (validator.rpki.net.nz). It allows network engineers to test ROA validation in their routers without the hassle of setting up and maintaining their own. During the last five years, very little use has been given to the validator, with one registered user during that time. Currently, we are using a piece of old software that’s no longer maintained. With that in mind, we’d like to announce we’ll be shutting down validator.rpki.net.nz on 15 July 2019. We might rebuild the service if there is a need from the community using modern software, so please let us know if you would like it back. In the meantime, we appreciate the involvement of the NZNOG community with the validator, including a couple of presentations making reference to the service in the last years. Kind Regards, -- Sebastian Castro Chief Scientist @ InternetNZ desk: +64 4 495 2337 mobile: +64 21 400535

1 0

decent SOHO switches?
by Richard Hector 01 Jul '19

01 Jul '19

Hi all, I hope this isn't too far off topic. What's available in the way of managed switches (at least including 802.1q VLANs) at a suitable price for a small office? The (8-port) one I bought 4 years ago, even at the time the https ui didn't work, because browsers had stopped supporting old certs or ciphers or something. I raised it with the wholesaler, who raised it with the manufacturer - no new firmware ever came out. I couldn't load my own cert onto it either. Is there anything better around, at a reasonable price? I'm not keen on what I understand is the cisco model either, where you have to maintain a support contract to get any updates. Stretching even further - I don't suppose there's anything out there with fully Free (as in freedom) firmware? Does SDN give us that? Feel free to reply off-list if you don't want to promote (or disparage) your suppliers (or self) in public :-) Cheers, Richard

5 8

IANA AS Numbers Registry Update
by Selina Harrington 12 Jun '19

12 Jun '19

Hi, The IANA AS Numbers registry has been updated to reflect the allocation of the following blocks to APNIC: 139578-140601 Assigned by APNIC 2019-06-12 140602-141625 Assigned by APNIC 2019-06-12 You can find the registry at: https://www.iana.org/assignments/as-numbers/ The allocation was made in accordance with the Policy for Allocation of ASN Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/global-policy-asn-blocks-2010-09-21-en Best Regards, -- Selina Harrington Lead IANA Services Specialist

1 0