Fritz Adalis

@FritzAdalis@infosec.exchange
483 Followers
530 Following
23.8K Posts

Infosec Lurker | Technical Debt Collector

It's not for fun, or any sense of community.
It's just trying to dull the pain.

Pronounshe/him
@Sempf
Ah yes, the Fuckening.
@albonycal
Lol good luck with that.

This BIQU Microprobe fucking sucks, every few prints the measurements are so phenomenally off in some areas the nozzle is scraping over the plate. πŸ˜’

Is there some good extruder design for the Anycubic i3 Mega (or another i3 design I could modify easily) that features the more modern, more accurate sensors where it measures pressure on the nozzle instead of with a probe? At this point I'd rebuilt this once more, I don't want to constantly have my build plates & nozzles destroyed.
#3DPrinting

@cR0w
Thanks!

Just to clear up some misinfo circulating, a BGP hijack was not the cause of
Cloudflare DNS going down today.

At 21:51 UTC, Cloudflare (AS13335) withdrew both 1.1.1.0/24 and 1.0.0.0/24 for an unknown reason.

I suspect AS4755 was always announcing 1.1.1.0/24, when CF went away, it leaked a bit (i.e. "%2").

https://infosec.exchange/@GossiTheDog@cyberplace.social/114854023690856642

Infosec Exchange

@JessTheUnstill
Quisling? No, that's not it.
@cR0w
Is... is that what happened?
@jwarminsky @briankrebs
Weird Al Gore Rhythm

relevant items from the bill of materials for RC2014 VGA terminal:

https://rc2014.co.uk/modules/pi-pico-vga-terminal/

1 Raspberry Pi Pico (on hand)
1 RA VGA socket (purchased)

components to confirm on hand:

1 47uf 25v electrolytic
3 8k2 resistor metal
3 3k9 resistor metal
3 2k resistor metal
6 1k resistor metal
3 510 resistor metal
2 47 resistor metal
1 1N5817 Schottky Diode
1 10k resistor
1 22k resistor

Pi Pico VGA Terminal Β« RC2014

Γ—
If you’re wondering why half the internet broke tonight for a short period, TCS accidentally hijacked Cloudflare.HT @ssamulczyk
@GossiTheDog well, that explains why my traceroutes to 1.1.1.1 were ending up in Singapore.

@GossiTheDog @ssamulczyk

TCS? Is that the same...

Yes, it is.

Their contract renewals will be interesting in the next year.

@GossiTheDog @ssamulczyk every Tata company is independent, they don't really relate to each other that well
TCS Alliance | Tata Communications

Tata Communications

@GossiTheDog @ssamulczyk "alliance" does not mean that they are the same company, Tata Communications and TCS have separate CEOs, separate boards, their employees don't interface with each other

(and to be honest, most that is on their public pages is pure marketing)

@athos @GossiTheDog @ssamulczyk

Or to anyone else for that matter. πŸ˜‘

@GossiTheDog @ssamulczyk

Lately it seems we need that "It was DNS" meme to come with subscript that reads "probably due to BGP".

@GossiTheDog @ssamulczyk oh what notification site/tool do you use?
@kyhwana I used 1.1.1.1 as a dns canary on my router. It stated it is offline but the connection was alive. Started digging out of curiosity on bgp.tools and cloudflare sites… @GossiTheDog
@GossiTheDog @ssamulczyk so I rebooted my laptop for no reason then. Naturally assumed it was something I broke
@GossiTheDog TCS or a bunch of teenagers who convinced TCS help desk to change some passwords.
@GossiTheDog @ssamulczyk but but but Cloudflare "invented" RPKI so that nobody could ever BGP hijack them ever! And Tata is the finest professionals money can buy and nothing but!
Whenever I hear "Tata", I'm reminded of their landmark 2014 crash test fail: www.theguardian.com/global-devel...

Tata Nano safety under scrutin...
Tata Nano safety under scrutiny after dire crash test results

Philip Oltermann and Paige McClanahan: India's low-cost answer to the VW Beetle fails live up to 'frugal engineering' hype after receiving no stars for adult protection

The Guardian
@GossiTheDog @ssamulczyk how is this even possible? How can some "random" BGP provider claim routing for ranges that are not their own?
@DJGummikuh @ssamulczyk that’s how BGP works
@GossiTheDog @DJGummikuh @ssamulczyk
BGP is a "trust me bro" protocol.
@generalx @GossiTheDog @DJGummikuh @ssamulczyk So, a malicious actor could purposely bring down a big part of the internet? If they really wanted to?
@danielmunoz @generalx @GossiTheDog @DJGummikuh @ssamulczyk This just showed they can do that without even intending on it.
@generalx @GossiTheDog @DJGummikuh @ssamulczyk - That is not so much the case anymore. There is RPKI which solves the problem of route hijacks. It requires the owner of a prefix to sign it, and BGP-capable third-party networks have a way to validate or invalidate announcements, based on the route origin.

@DJGummikuh @GossiTheDog @ssamulczyk BGP has no real validation mechanisms for who can advertise which prefixes. There's some stuff bolted on top to help with that but none of it is mandatory, so none of it really protects those IP ranges.

It's all cooperative, basically. Runs on goodwill.

@depereo @DJGummikuh @GossiTheDog @ssamulczyk DNS to a lesser extent than BGP, but yeah. The internet used to be a peaceful utopia at least compared with modern times.
Because #RPKI still is a dream in a lot of network...
Nico's ΞΌBlog

@GossiTheDog @ssamulczyk Cloudflare DNS outage: Multiple websites on 1.1.1.1 server down, company reacts | World News - Hindustan Times https://www.hindustantimes.com/world-news/cloudflare-dns-outage-multiple-websites-on-1-1-1-1-server-down-company-reacts-101752533050143.html

@sambowne @GossiTheDog @ssamulczyk "Cloudflare said that there is an issue with the 1.1.1.1 public resolver, which resulted in many websites hosted on its server being down"

Websites hosted on a DNS resolver... (In the traditional media, anyone can write anything, even without knowing the subject.)

@GossiTheDog I used to follow the BGP sites which list changes. The funniest event was seeing China steal routes to a US business, and seeing the US military steal it back within minutes.

The cyber war is real, fierce, and a spectator sport.

@GossiTheDog @ssamulczyk I saw ping 1.1.1.1 fail due to exceeded TTL which you don't see too often.
@Victorsigmoid @GossiTheDog @ssamulczyk - That might be a routing loop, which occasionally appears. Especially with those anomalies as discussed in here.
@resingm @GossiTheDog @ssamulczyk when I saw this ping I immediately wondered, BGP? For I am knowledgeable but not skillful or hands-on experienced with this. I defer to those who are, and am grateful for the fediverse to cut thru the noise.
@GossiTheDog @ssamulczyk what time was this EST? i need to check something

@GossiTheDog @ssamulczyk Ah, the bodacious Tata's are at it again.

(ICANN had to deal with them in the domain name context when they got ticked off at the adjective I used in the prior paragraph.)

@karlauerbach thank you for bringing up this hilarity from before my time. Just read up about it!
@GossiTheDog @ssamulczyk Is someone please able to give a short explanation of what has happened here assuming reader is familiar with basic DNS, but not what BGP is or how you can "accidentally" hijack it?

@aly @GossiTheDog @ssamulczyk Sure! So Tata (insert reason X) decided to tell the world they were the way to get to 1.1.1.0/24 network, which includes the host 1.1.1.1, Cloudflare's DNS IP. And so the internet listened to Tata and starting updating everyone that they should start sending all the requests for 1.1.1.1 via Tata's network INSTEAD of Cloudflare who is the owner of that "network prefix". There are nerd knobs to turn and encryption which can prevent this, but after literal decades still hasn't been done.

This kind of thing happens much less than the past, but the effects are much larger as the internet is much larger now. Malicious actors like to do it for profit.

For more technical details, this article does a good job explaining: https://www.kentik.com/kentipedia/bgp-hijacking/

BGP Hijacking: Understanding Threats to Internet Routing

Dive into BGP Hijacking: understanding its workings, exploring real cases, and learning protection strategies for a secure network.

Kentik
@pauliehedron @GossiTheDog @ssamulczyk Well this wasn't a very comforting read. πŸ˜…
@aly I’m still puzzled how you can do that by accident (at least so they claim)β€¦πŸ€£ @pauliehedron @GossiTheDog

@GossiTheDog @ssamulczyk

The irony behind this Cloudflare site is too much: https://isbgpsafeyet.com/

Is BGP safe yet? Β· Cloudflare

On the Internet, network devices exchange routes via a protocol called BGP (Border Gateway Protocol). Unfortunately, issues with BGP have led to malicious actors being able to hijack and misconfigure devices leading to security problems which have the potential to cause widespread problems. BGP security can be greatly improved by using technologies such as RPKI to sign Internet routes. This page attempts to track the progress of major Internet players (ISPs, transit operators, and content providers) in their progress to adopt RPKI and other technologies.

@jonw @GossiTheDog @ssamulczyk "Your ISP implements BGP safely. It correctly drops invalid prefixes."

Yay!

@jonw @GossiTheDog @ssamulczyk have to laugh, they say Tata is "safe" but the point the finger at them for this outage...
@Offbeatmammal @GossiTheDog @ssamulczyk Tata could not have done this if everyone was dropping invalid prefixes. So while Tata caused this, it only succeeded because so many other providers don't use RPKI. A provider can be totally safe and still hijack traffic because doing so has very little to do with itself.
@GossiTheDog @ssamulczyk My AppleTV uses 1.1.1.1 as an "internet health check", but then works anyway even if it fails, it just shows a message on the screen.
@GossiTheDog @ssamulczyk TCS (TATA Consultancy Services) is different from TATA Communications!!
Different company, different business but same brand just like TATA Steel.

@GossiTheDog @ssamulczyk 1. TATA COMM and TCS are separate companies.
2. Cloudflare withdrew both 1.1.1.0/24 and 1.0.0.0/24 announcements due to an unknown reason. So its THEIR fault.

3. The BGP hijack you see is most likely due to a downstream customer of AS4755. Again the outage **isn't caused by TATA** it is caused by Cloudflare themselves.

4. TATA's Tier1 ASN AS6453 filters invalid ROAs but their domestic AS4755 doesn't.

@GossiTheDog @ssamulczyk This is like blaming TCS if you get poor quality TATA salt.
@GossiTheDog @ssamulczyk Also take a look at that screenshot, "peers observed: 2%" the leak didn't propagate far.
@albonycal @ssamulczyk if Tata announced the prefix, it’s on them.
@GossiTheDog @ssamulczyk The outage was caused by Cloudflare WITHDRAWING the announcement. Read that correctly.
@albonycal @ssamulczyk Tata hijacking the Cloudflare prefix matters. You might disagree, and that’s okay.
@GossiTheDog @ssamulczyk Your post says the outage was BECAUSE of TATA, which is blatantly incorrect. I agree that TATA"s domestic ASN should implement proper filtering like their AS6453, not disagreeing with that. But get your facts right.
@GossiTheDog @ssamulczyk Either delete your post or edit it with correct facts.
@albonycal
Lol good luck with that.
@FritzAdalis He has spread misinformation about BGP hijacks before this aswell, I forgot when exactly. Is it that hard to not talk about things you don't understand.
@GossiTheDog @ssamulczyk The TATA's leaked route propagated because there was no route to cloudflare DNS In the routing table. And that leak didn't propagate that far.