List of UDP Based Amplification Attacks and Factors

It turns out the US-CERT maintains a list of UDP based amplification attacks and their potential amplification factor (i.e. DNS vs. NTP).  It also includes the latest Memcache attacks that have been making the rounds — spoiler: memcache has the greatest potential for abuse.

Free IPv6 /48 prefix via tunneling over the existing IPv4 Internet

(I thought this posting was relevant now as ?APNIC just assigned their last block of i

Hurricane Electric offers a free IPv6 tunneling service if you would like to begin using and or experimenting with the next generation internet protocol. 

One you’re up and running check out Cool IPv6 Stuff.

The End of IPv4 FAQ

The Internet Storm Center blog has a great writeup of q+a regarding hitting the limit of IPv4 address space.

3 – A lot of IPv4 space is still unused. Why don’t we use it more effectively?
The problem is not just that we are running out of addresses, even though that is the killer issue here. Assigning addresses more effectively would mean that assignments would become smaller and routing tables would become more complex. In order to make this work, we would have to essentially “renumber” the internet, and still be out of addresses at some point.
6 – So I can just wait and do nothing?
No. What you should do tomorrow (maybe today?) is setup a test lab to familiarize yourself with IPv6. It is easy to get going. Ask your ISP if they support it (or when), or setup a tunnel with a free tunnel provider like Hurricane Electric [2] or Sixxs [3] (there are others). You need a plan on how to deal with it. Even if you don’t need IPv6, maybe your business partners start using it and you need to connect to them via IPv6.

Read the entire post here.

Preventing future internet traffic misroutes….

Remember back in April of 2010 when for 18 minutes internet traffic was mistakenly misrouted through China’s state run telecom agency?  According to this H article, the European internet registry (RIPE) who manages assignment of IP addresses along with AfriNIC, LACNIC and APNIC have implemented a PKI certificate based solution to confirm the legitimacy of internet traffic routes.

Unfortunately, ARIN who manages the internet registry for North America will not be ready to deploy this technology until Q2 of 2011.  Better late than never…

do you know where your pr0n is?

In 2008, Data Loss Prevention (DLP) was becoming the latest trend, hype, buzzword.  This slowed down in 2009 as with most technology because of everyone tightening their belt (purse strings).  I’ve been wondering how long it was going to take for an open source DLP solution to take off.  Please correct me if I’m wrong but it appears opendlp may be the first on the scene.  While still in its infancy (at a minor 0.2.1 release) it already has a web front end and a deployable agent for clients (monitoring data at rest).  It supports regular expressions which should make it flexible.  Without a WYSIWYG policy builder like you’re getting with off the shelf products you’re sacrificing ease of use vs. power and flexibility.

So far I’ve only used a pilot of Symantec’s (formerly Vontu) DLP product for my employer.  I had a blast testing it out on the network especially because of its flesh tone filter (if flesh_tone_filter then email me pr0n).  It’s a shame we may not see flesh tone filtering in opendlp any time soon; isn’t knowing where the pr0n is more important than the company’s lifeblood, intellectual property?

Podcast about ICANN, root dns servers, Chinese domination and more!

I try to catch the weekly NPR Technology podcast.  This week there’s an interesting segment about ICANN, VeriSign and their root nameservers, as well as China’s desire to wrestle control of the internet.  You can get the podcast here:

*You need to advance to 5:00minutes into the podcast for this segment (unless you want to listen about Cuban bloggers)

Pay to have your neighbor’s wireless cracked

I just found this article about a new service run by Moxie Marlinspike (from sslsniff fame).  He has created WPA Cracker which uses the cloud (his 100 cpu quad processor cluster) to crack WPA and WPA2 (PSK only) handshake captures.  So for $17 and the handshake capture you should have your password with 20 minutes.

Related: Using airodump-ng to capture the authentication handshake.