Subject: RE: Palladium (TCP/MS)

From: "Sean Jones" <[email-masked]>
Date: Wed, 23 Oct 2002 09:37:44 +0100

Good Morning Valdis

Thank you for your prompt reply. Perhaps I did not phrase my question properly. 

I know what PTR records are, I know how TCP/IP works & etc (I've done a routed IP network or two, and worked at an ISP for a while) so please let me re-phrase my question.

Why is a PTR (or DNS) record with MS TCP different from the standard TCP/IP record? 

(Perhaps it is me in my ignorance, or lack of understanding :o) )

Regards

Sean

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: 22 October 2002 18:39
> To: Sean Jones
> Cc: [email-masked]
> Subject: Re: Palladium (TCP/MS) 
> 
> 
> On Tue, 22 Oct 2002 16:42:03 BST, Sean Jones said:
> > Forgive my ignorance, but what the heck do you mean?
> 
> % dig -x 207.46.230.218
> 
> ;;  ANSWER SECTION:
> 218.230.46.207.in-addr.arpa. 2665 IN    PTR     microsoft.com.
> 218.230.46.207.in-addr.arpa. 2665 IN    PTR     microsoft.net.
> 218.230.46.207.in-addr.arpa. 2665 IN    PTR     
> www.domestic.microsoft.com.
> 218.230.46.207.in-addr.arpa. 2665 IN    PTR     www.us.microsoft.com.
> 
> Of course, it isn't that simple - those 4 PTR entries each 
> point back at a
> multihomed host. I was about ready to throw a yellow flag and a 5-yard
> procedural penalty until I double-checked RFC2181, section 
> 10.2 - that's legal.
> 
> Gonna need a lot longer ACL on that Cisco to actually make it 
> work (don't
> forget all their msft.net servers.
> 
> Bringing it back to IETF territory now:  Is there a need for 
> an RFC for
> "best practices" in securing the download of software updates (DNSSEC,
> PGP signatures, etc)?  The two scariest things about online 
> updates (at least
> while wearing my security hat) are the MITM attack (as 
> demonstrated against
> Apple) and the hacked download attack (as has hit 
> windowsupdate, openssh,
> sendmail, and others).  If it's WG fodder, I'd specifically 
> declare the
> question of whether the patch *works* as off-topic - the task 
> is merely
> verifying that the bits are the correct bits, and from the 
> correct vendor.
> -- 
> 				Valdis Kletnieks
> 				Computer Systems Senior Engineer
> 				Virginia Tech
> 
>

---

From: [email-masked]
Date: Wed, 23 Oct 2002 14:02:13 -0400

> (Perhaps it is me in my ignorance, or lack of understanding :o) )

It's not different.  Or in any case, it's not sufficiently different to
cause an interoperation problem in this case.

The reference to RFC2821, section 10.2 was regarding the fact that having
multiple PTR records for one address *IS* legal, despite widespread belief
to the contrary.  The original point was that you'll need a router ACL to
block a lot more than one address, and keep the list of addresses up to date.

And anyhow, using a router block is a bad idea in this case.  There's two
cases - either you still have machines using that vendor's software, and you
WANT them to reach the servers so they can update, or you don't have the
software installed, in which case you don't really care if the server is
reachable.. 
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: "Bill Strahm" <[email-masked]>
Date: Wed, 23 Oct 2002 11:16:51 -0700

Well the first thing you have to realize is that there is no such thing
as TCP/MS, and there for any answer you get would be highly speculative
at best.

This is a huge red herring, based on speculation that for some unknown
reason, Microsoft will Embrace/Extend/Extinguish the IP protocol and
successfully be able to put their own protocol (MS) onto the internet in
such a way that you will be required to use a MS product to use the
internet...

I don't know about you but I find the whole scenario dubious at best,
and this whole thread is becoming a massive troll

Bill
(Who is getting ready to take his lunch and eat it rather than feeding
trolls)

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sean
Jones
Sent: Wednesday, October 23, 2002 1:38 AM
To: [email-masked]
Subject: RE: Palladium (TCP/MS) 

Good Morning Valdis

Thank you for your prompt reply. Perhaps I did not phrase my question
properly. 

I know what PTR records are, I know how TCP/IP works & etc (I've done a
routed IP network or two, and worked at an ISP for a while) so please
let me re-phrase my question.

Why is a PTR (or DNS) record with MS TCP different from the standard
TCP/IP record? 

Regards

Sean

---

From: John Stracke <[email-masked]>
Date: Wed, 23 Oct 2002 15:00:51 -0400

[email-masked] wrote:

>WANT them to reach the servers so they can update,
>  
>
That doesn't necessarily follow.  I read a report (*) today that the 
EULA for XP/SP1 and 2000/SP3 states that, if you use automatic updates, 
you grant MS, and its designated agents, access to your "software 
information"--which is vague enough to include any data on your system. 
 That's probably not what they intended, but the possibility is bad 
enough that financial and medical institutions in the US (and, probably, 
all companies in Europe) cannot legally use the automatic update 
systems, because they would be violating privacy laws.  So a company 
might decide that they had to ban autoupdate, and do all updates 
manually, in which case it would be reasonable for them to block access 
to the update servers.

(*) http://cin.earthweb.com/article/1,3555,10493_1485861,00.html

-- 
/===============================================================\
|John Stracke      [email-masked]                      |
|Principal Engineer|http://www.centivinc.com                    |
|Centiv            |My opinions are my own.                     |
|===============================================================|
|If you're going to walk on thin ice, you might as well *dance*!|
\===============================================================/

---

From: [email-masked]
Date: Thu, 24 Oct 2002 08:58:41 -0400

> information"--which is vague enough to include any data on your system. 

So don't accept the EULA, and don't install SP/1 or SP/3.  (Yes, I'm fully
aware that failing to install patches has it's own set of issues, which
I wholeheartedly invite you to discuss with the vendor, in detail).

If you find that you "have to" run software such that you have to ban the
machines from being able to contact the vendor's machines, it may be time to
re-evaluate the choice of software.

And my original point still stands - there's more than one IP address for
the update servers, and if you're trying to block access to them, you'll have
to check the DNS on a regular basis (at least once per TTL). At the moment,
*my* view of 'windowsupdate.microsoft.com' is a CNAME that as of right now
is a CNAME to windowsupdate.microsoft.nsatc.net, which has an IP address
without a PTR entry somewhere in a hotmail.com zone.  By the time you read
this, it will likely be elsewhere.
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech