- NZNOG - lists.nznog.org

InTAC 2014
by Dean Pemberton 22 Apr '14

22 Apr '14

Morning all. InTAC conference to be held again on the 9th of July in Auckland. The participants at last years conference gave plenty of feedback as to the directions that they wanted to see the Internet within New Zealand take. Feedback was that there needed to be more focus on the following areas: . Technical issues relating to the security of the infrastructure of the New Zealand Internet . Technical mechanisms to assist in the development of more appropriate Authentication, Identity and Trust systems relating to the use of the Internet . Technical ways to ensure the Future-proofing the infrastructure of the New Zealand Internet. What I'm suggesting for InTAC this year is the following structure... Welcome 45 Min - On DNSSEC 45 Min - On RPKI Morning Tea 45 Min - On Identity and trust online 45 Min - On Authentication (federated signon, 2fa, lockers) Lunch 45 Min - On SDN 45 Min - On UFB Afternoon Tea Open discussion Networking Drinks Does anyone have any feedback before I look to secure topic speakers and make it a real thing? -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz <javascript:;> To promote the Internet's benefits and uses, and protect its potential. -- -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz To promote the Internet's benefits and uses, and protect its potential.

2 2

Re: [nznog] CARDIGAN implements RPKI - Cleanliness of prefixes onWIX
by Andrew Niteesh 21 Apr '14

21 Apr '14

Hi, I have few clarifications, the table you shown have matric, local preference, path and next hop. 1. So how you are setting up these attributes in SDN? (Or) you have an application developed for BGP? (Or) you are running SDN on top of traditional networks? 2. What is Route flow - according to my understanding it's like getting connecting a set of open flow capable switches to single controller. Please correct me if am wrong. Thanks & Regards, Andrew Niteesh University of Houston

2 1

[OT] 3g on mikrotik
by Rob McDonald 21 Apr '14

21 Apr '14

Hey all, Sorry for the OT post... Does anyone have experience with USB 3g sticks on Mikrotik routerboards? I've had quite a long look around, and without resorting to trial and error I thought someone here might be able to share their winning numbers with me. Cheers Rob *Rob McDonald | *Director Level 2 Systems Ltd *M:* +64 21 902 929 *eFax:* +64 9 974 4734 *W:* http://www.L2.co.nz <http://www.l2.co.nz/>

3 3

Message concerning Certs
by Michael Sutton 19 Apr '14

19 Apr '14

NZNOG members: My apologies but all attempts to send the text content of this PDF this morning have been blackholed until I managed to send the contents to InternetNZ PAG as a PDF which made it through filters which been stopping this content. I have had no problem send other messages etc. Your comments would be appreciated as I see this as a major issue which may require all certificates to be regenerated and then only used on patched systems whose memory and priv keys cannot read copied by external parties. Sincerely Michael S Sutton Director - Awacs Communications (NZ) Limited Transit Room The Dominion Observatory 34 Salamanca Road Kelburn Wellington +64 21 305500 Twitter & Skype: Mikiwis http://www.awacs.co.nz https://www.google.co.nz/#q=michael+sutton+nokia+patent http://www.linkedin.com/profile/view?id=16587996&trk=tab_pro

9 13

Heartleech tool
by Juha Saarinen 15 Apr '14

15 Apr '14

https://github.com/robertdavidgraham/heartleech >From the read me: A typical "heartbleed" tool. What makes this different is: autopwn most (-a) that does all the steps needed to get private key post-handshake (encrypted) heartbeats instead of during handshake evades Snort IDS rules loops making repeated requests (-l <loopcount>) dumps binary data to file (-f <filename>) IPv4 or IPv6 (-v <IPver>) full 64k heartbleeds -- Juha Saarinen twitter: juhasaarinen

4 3

Fake domain renewal invoices
by Richard Hulse 14 Apr '14

14 Apr '14

I got one of these just now from Domain Renewal Group, so beware. It was sent to someone else in our organisation, who fortunately brought it to me instead of approving and paying it.

3 2

Heartbleed - clients at risk too
by Juha Saarinen 11 Apr '14

11 Apr '14

Morning. Just saw this: http://vrt-blog.snort.org/2014/04/heartbleed-continued-openssl-client.html Which I thought might be useful to know. -- Juha Saarinen twitter: juhasaarinen

3 2

Snapchat question
by Tony Wicks 10 Apr '14

10 Apr '14

Hi all, we have had some users say they intermittently can't use this application. After downloading this app (and deciding it should go into the why the hell was that ever invented pile) it seems a bit difficult to fault find any issues. Does anyone know how this thing communicates ? Is it normally intermitttant ? Thanks all

2 1

Heartbleed OpenSSL Vulnerability
by Dean Pemberton 10 Apr '14

10 Apr '14

Hi All, NZITF (in conjunction with InternetNZ) have been endeavouring to raise awareness about this issue. We have compiled some information on our website, which may be of use to you and/or your clients. Please feel free to share this link as widely as you see fit. http://www.nzitf.org.nz/news.html The NZITF is treating this as an ongoing security issue with significant implications. As a result we are intending to monitor this situation and update our advice as required. We have tree basic messages for website owners: 1. Establish if your site's servers are vulnerable. 2. Patch the vulnerable servers. 3. Revoke/reissue keys and certificates. If you are vulnerable it is imperative that you do steps 2 AND 3. Not one, but both. You should also be encouraged to discuss this very important issue with your regular security consultants. If you have feedback or information please feel free to contact me so we can include it in the advice on the website. Regards, Dean

17 19

Re: [nznog] [PAG] Message concerning Certs
by Ewen McNeill 08 Apr '14

08 Apr '14

On 2014-04-09 22:40 , Dean Pemberton wrote: > And from the same twitter thread saying it was unlikely... > [can extract private key on vulnerable FreeBSD if it is first request] "first request after restart" is a special case too ("possible, but unlikely"). The same thread/poster also says: "[...] Does not work on Debian. [...]" (also https://twitter.com/1njected/status/453781230593769472) which implies (as noted in that thread) something about the FreeBSD malloc patterns makes it more likely/possible than Debian's malloc. Those (who were) running a vulnerable OpenSSL on FreeBSD may wish to take that into account in their assessment :-) The main thing which is certain is that it's going to be a well studied/probed bug. Ewen

1 0