On Wednesday 10 December 2008, Markus Wild wrote:

Excuse my ignorance, since I didn't make it to last SWINOG... the description on their web site implies the system is using BGP to distribute the black list. Assuming this just distributes IP addresses of web servers hosting questionable content, by blocking those, will that not block content of ALL hostings hosted on that IP address? What about hosters who also host other services on that IP address, like perhaps DNS and mail services? I recall a time where an email RBL was implemented using BGP blackholing, and we can into exactly those problems...

As far as I understand it from my desk, the box routes traffic for listed IP to itself and screens the contents on application level. "good" traffic it left and passed on, "bad" traffic is treated in an unknown manor (dorped, rerouted *don't know*). This is why it's an absoltely moronic idea to blacklist large sites like wikipedia...

One can clearly see what hapens is you route traffic for a website hosted on several hundreds of webservers through a tiny little screening frirewall sitting on a tiny little box. *lol*

have fun, Michi

What if a whitebox is hacked, and the intruder can inject new IP addresses and get the hold of traffic content? There's a lot of things one could do with that...

----- Original Message ----

From: Fredy Kuenzler kuenzler@init7.net Cc: swinog@swinog.ch Sent: Wednesday, December 10, 2008 2:05:53 PM Subject: Re: [swinog] Netclean - news

Markus Wild schrieb:

...

Excuse my ignorance, since I didn't make it to last SWINOG... the description on their web site implies the system is using BGP to distribute the black list. Assuming this just distributes IP addresses of web servers hosting questionable content, by blocking those, will that not block content of ALL hostings hosted on that IP address? What about hosters who also host other services on that IP address, like perhaps DNS and mail services? I recall a time where an email RBL was implemented using BGP blackholing, and we can into exactly those problems...

From http://www.blogg.ch/index.php?/archives/785-Netclean-Whitebox-effektive-Meth...

...

Netclean Whitebox funktioniert zweistufig: 1. wird via BGP4 die Liste der verdächtigen IP Adressen in die Routingtabelle eingepflegt. Derzeit sind das um die 450 IP Adressen. Traffic von diesen Websites wird auf die Whitebox umgeleitet. Auf dieser erfolgt 2. die DNS resp. HTTP Inspection, und die Whitebox ist damit in der Lage, zwischen illegalem und harmlosen Inhalt zu unterscheiden, der sich zufällig an der selben IP Adresse befindet.

F.

---

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

thought the same ... imagine someone hijacking the net of the blacklist server .... maybe listing then the unloved concuring company on the server ... or ddosing the server, in my oppinion with that we lessen the security of the internet.

Roger

• on the Wed, Dec 10, 2008 at 05:17:54AM -0800, Stanislav Sinyagin wrote:

...

What if a whitebox is hacked, and the intruder can inject new IP addresses and get the hold of traffic content? There's a lot of things one could do with that...

What a nice way to implement drive-by-injections.

Cheers Seegras -- "Those who give up essential liberties for temporary safety deserve neither liberty nor safety." -- Benjamin Franklin "It's also true that those who would give up privacy for security are likely to end up with neither." -- Bruce Schneier _______________________________________________ swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Stanislav Sinyagin wrote:

What if a whitebox is hacked, and the intruder can inject new IP addresses and get the hold of traffic content? There's a lot of things one could do with that...

if it's your box, no problem. "hacking" the box will be as difficult as hacking one of your BGP speaking routers. But, it won't be your box. I think it will be one from another "anti cyber crime" company with a lot of security holes and bugs :D

----- Original Message ----

...

From: Fredy Kuenzler kuenzler@init7.net Cc: swinog@swinog.ch Sent: Wednesday, December 10, 2008 2:05:53 PM Subject: Re: [swinog] Netclean - news

Markus Wild schrieb:

...

Excuse my ignorance, since I didn't make it to last SWINOG... the description on their web site implies the system is using BGP to distribute the black list. Assuming this just distributes IP addresses of web servers hosting questionable content, by blocking those, will that not block content of ALL hostings hosted on that IP address? What about hosters who also host other services on that IP address, like perhaps DNS and mail services? I recall a time where an email RBL was implemented using BGP blackholing, and we can into exactly those problems...

From http://www.blogg.ch/index.php?/archives/785-Netclean-Whitebox-effektive-Meth...

...

Netclean Whitebox funktioniert zweistufig: 1. wird via BGP4 die Liste der verdächtigen IP Adressen in die Routingtabelle eingepflegt. Derzeit sind das um die 450 IP Adressen. Traffic von diesen Websites wird auf die Whitebox umgeleitet. Auf dieser erfolgt 2. die DNS resp. HTTP Inspection, und die Whitebox ist damit in der Lage, zwischen illegalem und harmlosen Inhalt zu unterscheiden, der sich zufällig an der selben IP Adresse befindet.

F.

---

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

---

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

* on the Thu, Dec 11, 2008 at 01:48:39PM +0100, Michael Krygier wrote:

Anyone care to share their opinion on the following article about the McColo affair and the regulating of ISPs?

http://www.securityfocus.com/columnists/487

He's underestimating the level of cooperation ISPs already exert. McColo precisely got hung up upon because of that sort of cooperation.

And whereas the CNC-infrastructure of a botnet is clearly the easiest point to attack, it won't really destroy the botnet, it only will make the botnet-herders loose control over their botnet. The real problem lies elsewhere, not in ISP-space.

Cheers Seegras

Let me see... so I'm building a resiliant network with resiliant upstreams, just to have a single box as a bottleneck for a list of addresses that is not maintained by me or at least a Swiss authority following Swiss laws (and includes a country such as the UK that is infamous for being extremely conservative in all "moral" issues, and just loves to watch over its citicens with a mentality that would just create a public outcry if the government tried to do that over here, see full-scale cctv-covering of major cities). Homeland security here we come...

Also, attracting external traffic to an internal server will require some ugly hacks to actually then pass the traffic on to the real site, probably involving some odd tunneling to one of the gateways (resiliance?), reducing MTU and increasing latency. I am not thrilled...

Cheers, Markus

Zusammen,

I quote:

@ Andreas

...

...by using the AntiTerror law...

Please Pony up the clause invoked in this piece of legislation so that we can observe the context of it - if any. Whatever legislation they used is not important, it protected a large amount of municipal UK assets. I wouldn¹t want my money gone with the wind just because you don¹t think it¹s right and proper!

...

What if one day, they decide to block www.ubs.com http://www.ubs.com

because too many UK customers use it for money laundry as example?

Sounds perfectly reasonable. This is not censorship of ones¹ right to be. This is an example of criminality and the onus would be on UBS et al to negate it. And the Swiss Government would take action in all probability long before that came about.

@ Markus

...

...Homeland security here we come...

The social ill¹s seen as endemic in many cities across it (UK) are brought about by weakened schooling, a distinct lack of self-discipline and a propensity for binge-drinking, wanton vandalism, bodily harm and kebabs each and every Friday through Sunday. But recent Government (last 20 years or so) have been unable to deal with it effectively for many, many reasons.

The direct consequence of this has seen CCTV attempt to tackle the problem, rightly or wrongly. The Egg came before the Chicken in this case. But, of course, the camera¹s shall stay no matter what.

We discussed this for a while this afternoon in the SP NOC and the understanding was that many casual users of paedophilia, though not the tech-savvy harder-core, would, in all probability, be deterred by DNS re-direction to local-host or another site stating ³SRC IP logged² etc. Simple to implement and probably largely effective.

I don¹t have a problem with any technology that blocks objectionable material that is non-consensual to the overriding majority. It serves no useful purpose and does not infringe my right to be.

On 10/12/2008 15:54, "Andreas Fink" afink@list.fink.org wrote:

My Opinion:

Censuring is dangerous and legally challenging. You either do it all and take responsibility for all your decisions or you do nothing and say you are not in control. Censuring under control of someone else basically means you can be blamed for results you don't have under your control. This sounds like a ticking time bomb.

Just as an example: UK Government has confiscated assets from Icelandic banks (to protect the investment UK people have done in Icelandic savings funds which went belly up) by using the AntiTerror law as the ground of the claim! What if one day, they decide to block www.ubs.com http://www.ubs.com because too many UK customers use it for money laundry as example? It could be totally legal from a UK perspective and totally illegal from a swiss perspective and would have a severe effect for your customers.

You're playing with fire here...

On 10.12.2008, at 15:17, Markus Wild wrote:

...

Let me see... so I'm building a resiliant network with resiliant upstreams, just to have a single box as a bottleneck for a list of addresses that is not maintained by me or at least a Swiss authority following Swiss laws (and includes a country such as the UK that is infamous for being extremely conservative in all "moral" issues, and just loves to watch over its citicens with a mentality that would just create a public outcry if the government tried to do that over here, see full-scale cctv-covering of major cities). Homeland security here we come...

Also, attracting external traffic to an internal server will require some ugly hacks to actually then pass the traffic on to the real site, probably involving some odd tunneling to one of the gateways (resiliance?), reducing MTU and increasing latency. I am not thrilled...

Cheers, Markus

---

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Andreas Fink

Fink Consulting GmbH Global Networks Schweiz AG BebbiCell AG IceCell ehf

---

Tel: +41-61-6666330 Fax: +41-61-6666331 Mobile: +41-79-2457333 Address: Clarastrasse 3, 4058 Basel, Switzerland E-Mail: andreas@fink.org www.finkconsulting.com http://www.finkconsulting.com www.global-networks.ch www.bebbicell.ch

---

ICQ: 8239353 MSN: msn1@gni.ch AIM: smsrelay Skype: andreasfink Yahoo: finkconsulting SMS: +41792457333

http://a-fink.blogspot.com/ A developers view about iPhone SDK

---

swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

i remember 25 years agow i asked an ptt guy, in front of 100 listeners .. why the hell the cellphone net (a +b) is not at least a bit encrypted ? this way everyone could follow the conversation... his answer was: there is a simple solution ... its forbidden to use an receiver on those frequency, he should teach us law and regulation...

... it just came to my mind .. sorry to been offtopic

On Wednesday 10. December 2008, Chris Gravell wrote:

...

Sounds perfectly reasonable. This is not censorship of ones¹ right to be. This is an example of criminality and the onus would be on UBS et al to negate it.

What a new way of interpreting "justice". The acused has to proove its innocence...

.oO(isn't that the general appearance of censorship and totalitarian regimes?)

No further comments...

Michi

George Orwell was an optimist. _______________________________________________ swinog mailing list swinog@lists.swinog.ch http://lists.swinog.ch/cgi-bin/mailman/listinfo/swinog

Fredy Kuenzler schrieb:

From http://www.blogg.ch/index.php?/archives/785-Netclean-Whitebox-effektive-Meth...

...

Netclean Whitebox funktioniert zweistufig: 1. wird via BGP4 die Liste der verdächtigen IP Adressen in die Routingtabelle eingepflegt. Derzeit sind das um die 450 IP Adressen. Traffic von diesen Websites wird auf die Whitebox umgeleitet. Auf dieser erfolgt 2. die DNS resp. HTTP Inspection, und die Whitebox ist damit in der Lage, zwischen illegalem und harmlosen Inhalt zu unterscheiden, der sich zufällig an der selben IP Adresse befindet.

So it works kind of like eg Arbor Networks' DDoS protection mechanism (redirect some traffic using BGP, deep packet inspection after packet reassembly), coupled with data from an "uncontrollable" source (which is generally believed to be some sinister government agency infiltrated by oppressive political regimes).

It's interesting it took so long for commercial products to appear for the technically obvious solution.

It will be interesting to see how fast well-meaning politicians and paranoid pseudo police-men will want to filter all that nasty illegal music from the net. And how long it will be before such machinery is mandatory for all ISPs.

The excuse that there is no technical solution is gone - it was a lie all along the way, and most techies knew. Now it's time to face the consequences.

-- Matthias

And how long it will be before such machinery is mandatory for all ISPs.

The excuse that there is no technical solution is gone - it was a lie all along the way, and most techies knew.

Hmm it's not a lightly engineered solution. it was not an obvious one.

One thing to consider is that there are people out there who are ISP's just for a bunch of people or for people outside Switzerland. So I'm not too sure what the solution costs but I'm sure its not available for free. I assume its around 10k at least. Today this solution is easily "affordable" for the big guys but still expensive for the smaller ones (but I assume not out of reach as it was assumed).

Tomorrow they want to filter google for the search keyword "child porn" etc. Now go figure how many requests then will go through the box...!

The day after, the government thinks its smart and we should go one step further and start filtering videostreams by using a box which looks at the content. Then such a solution will start to cost 100'000's of francs (at least once its invented). And down goes the deadly spiral. Someone pays the bill. Always.

If we give in to such matters, it means we will be asked more and more because everyone thinks its so easy to do technically. But that's not the point.

Blocking the sites won't bring the effect compared to the cost to the economy. Think of this: we sure have more than 40 ISP's in Switzerland. Assuming the box costs 10'000 CHF (and thats a pure guess), the cost to the swiss economy is 400'000 CHF (someone pays for it and I believe its going to be the end user at the end). Not even including the cost of maintaining it. For that amount you can send out quite a few policemen to take down child porn sites at the other end of the world which would be way more effective.

The law doesn't allow us to wiretap and intercept. So lets not start burning our fingers with something which does exactly that . The human rights of free speech should be hold high even in the fact that "someone" might stumble on.

One thing which would be interesting to hear is how many requests do such site actively block today? How many people have been prevented from seeing nasty content? What has this saved Switzerland that those people did not see the content? Is this bigger than the cost?

Frankly, since the 15 years I'm using the internet, there has not been a single time where I stumbled on to child porn, and if I would, it would take me 0.5 seconds to realize and go away. This was probably because I was not actively looking for it. So for me (taking the hat of a a normal typical user now), such a solution would bring zero value. The value might more be negative because there's the danger that something might get blocked by mistake.

The key question is who do you want to protect and from what?

The child porn lover wont be "protected". You might make him more angry maybe, but it wont change his intention. He might even go and rape real children instead because he can't do it in virtuality. Everybody else with a normal moral sense who would see such content would either close the window immediately and/or call the police to take down the publisher.

Closing your eyes in front of a problem wont solve the problem. Its like selling sunglasses to protect your skin at the beach.

Andreas Fink

Fink Consulting GmbH Global Networks Schweiz AG BebbiCell AG IceCell ehf

--------------------------------------------------------------- Tel: +41-61-6666330 Fax: +41-61-6666331 Mobile: +41-79-2457333 Address: Clarastrasse 3, 4058 Basel, Switzerland E-Mail: andreas@fink.org www.finkconsulting.com www.global-networks.ch www.bebbicell.ch --------------------------------------------------------------- ICQ: 8239353 MSN: msn1@gni.ch AIM: smsrelay Skype: andreasfink Yahoo: finkconsulting SMS: +41792457333

http://a-fink.blogspot.com/ A developers view about iPhone SDK

I see this like another example of fighting evil at the wrong end. Of course it is important to fight such content but is filtering websites the right method ? I don't think so.

Let be realistic, how many ISPs worldwide are gonna deploy a Whitebox ? Filtering locally simply means stopping end users to access illegal sites. Ok, but the sites are still there and everybody else will still have access ! What do we wanna fight ? The access to illegal content or the publishing of them ? Just because some ISPs will filter-out those sites will not reduce the amount of kids being abused. What is worser ? Someone looking at kids being abused or someone who abuse them ?

I see already Netclean press releases claiming the big success as the list of sites will increase, as at the same time, the guys who manage those sites will not notice any decrease in hits...

The Netclean solution is better than nothing but definitely this is not gonna make the difference.

Daniele