February 2000 - NZNOG - lists.nznog.org

Re: Media announcement on free webmail. -Reply
by Geoff Thompson 21 Feb '00

21 Feb '00

Keith Davidson wrote: > > > They've presumably been trawling the list archive web pages. I've changed > the list config only to accept postings from subscribers. (Two years without > having had to do that surprises me.) I'll wait and see whether that creates > any problems. > > > > Donald Neal > > Donald, > > Certainly not a trawl of the list archive. I only subscribed to this list > this morning. > > My first message - spam! :-( > > Keith Davidson Guys (and Gals), To add my two penith worth... Both myself and Andrew Donkin here at Waikato have been hit. I was contemplating the fact that they may have just crawled over 'waikato.ac.nz', but then there have been a quite a few people down my corridor that haven't been hit. I'm not sure what source (or part of source) that they've used, but it looks like I'm tending towards it being only the list server, rather than our whole site. Our headers were : From: reply(a)webmail.net.nz Received: from shiraz.x.co.nz (210-55-40-205.adsl.xtra.co.nz [210.55.40.205]) by mailserv.waikato.ac.nz (8.9.3/8.9.0) with ESMTP id NAA13378 for <geofft(a)waikato.ac.nz>; Tue, 22 Feb 2000 13:08:27 +1300 Received: from www.webmail.net.nz ([192.168.0.106]) by shiraz.x.co.nz (8.9.3/8.9.3) with SMTP id MAA27843 for <geofft(a)waikato.ac.nz>; Tue, 22 Feb 2000 12:27:41 +1300 if that helps track down the culprit. The domain 'webmail.co.nz' is owned by 'Andrew Prast <andrew(a)prast.net>', and seems to be registered via ICONZ (using their nameservers). As for 'x.co.nz', we are also talking ownership by Andrew Prast, but this time with the email address of 'andrew(a)nz.com'. This domain seems to be registered via WebNZ Ltd. And yet there's an Xtra ADSL dialup connection in the mix. Does this gel with the messages that you received? Geoff. ---------------------------------- Geoff Thompson <geofft(a)waikato.ac.nz> University of Waikato, Hamilton, New Zealand Ph: (07) 838 4748 Random Quote of the Minute : And now for something completely the same. ---------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Media announcement on free webmail. -Reply
by Donald Neal 21 Feb '00

21 Feb '00

>>> "Chris Wedgwood" <chris.wedgwood(a)clear.co.nz> 22/February/2000 01:49pm >>> > These guys win today's prize for the least clue displayed in a public > forum. I have tried to think of a more moronic way for them to advertise > their product, and I have failed. They've presumably been trawling the list archive web pages. I've changed the list config only to accept postings from subscribers. (Two years without having had to do that surprises me.) I'll wait and see whether that creates any problems. Donald Neal List Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

More on DDOS attacks
by Arron Scott 21 Feb '00

21 Feb '00

>From Cisco, for any one who hasn't seen it already. Title: Distributed Denial of Service (DDoS) News Flash URL: http://www.cisco.com/warp/public/707/newsflash.html Posted: February 9, 2000 Summary: This Security Advisory talks about Distributed Denial of Service (DDoS). More specificvally, it will help you: 1) Recognize programs used to facilitate DDoS attacks 2) Apply measures to prevent the attacks 3) Gather forensic information if you suspect an attack 4) Learn more about host security I have recently had the opportunity to try the "ip verify unicast reverse-path" command in a lab environment, it works with CEF on Cisco IOS 12.0. It seems relatively effective with about a 30% increase in distributed CPU utilisation (ie. 10% becomes 13%, not 40%). We had every packet flooding an interface with bogus source addresses, it happily discarded them all. And yes, it even forwarded the packets with valid source addresses ;-) It seems best suited to run at the edge of the network in from your downstream customers. There is no point running it on links in from upstream providers in most cases. We also lab tested Turbo Access-Lists, and found them very effective on long access-lists, the worst case the CPU increased loading on a VIP by about 40%, as opposed to a 200 entry non-Turbo Access-list which increased distributed CPU utilisation by as much as 95%. Arron Scott Telecom NZ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 6

Media announcement on free webmail.
by reply＠webmail.net.nz 21 Feb '00

21 Feb '00

Show Off New Zealand announces the launch of its free web-based Email service Webmail.net.nz in conjunction with American Email giant Commtouch. Webmail.net.nz introduces leading edge Email technology that is user friendly, feature rich and fun to use. Moreover, Webmail allows you to access all of your Email, (including old fashioned pop Email), from any web browser in the world. Web-based Email with its easy graphics interface is rapidly overtaking FAX for instant business communication. Find out why for yourself. We cordially invite you to secure your business name, private name, or alias , while there is still good name availability. To check out the service click here http://www.webmail.net.nz Best wishes Billy Brown --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Large Scale Internet Attacks - Technical article.
by Roger De Salis 20 Feb '00

20 Feb '00

Gentlefolk (are there any women on this list????) I thought this sufficiently interesting to post to the NOG, so that it may help anyone who is considering how to avoid these attacks in the future. I have removed all the sales guff (I hope). I hope this is of use. ==================================================================== At one account they were all Cisco. They were blown up by a massive amount of spoofed SYN flood attacks. The PIX did stop the SYN floods it did see, however most of traffic never reached the PIX because the egress router had a of overflow of traffic. I have personal experience with the account. We had recommended they put anti-spoofing filters and CAR filtering for ICMP on the egress routers. They told us they would not put any filters on the routers because they did not want to lose any performance. The attacks were designed to take advantage of a specific flaw in the network design of the target. This discovered by using an automated tool that tries literality hundreds of different exploits till it finds a successful avenue of attack. Since the hackers tools try over hundred types of exploits, it is possible that if the customer had implemented the egress filtering that we had recommend than the hackers would have been able to crash them with some other attack. However, a continual theme is that there are a large number of sites on the Internet, and the well defended sites tend to get ignored by this type of attack. Since these criminals don't tend to be very clever, in fact they seem downright lazy, they only go after sites that can be assaulted with off the shelf tools. In the case of one web portal, the attack was a BSD UNIX specific attack that rides on port 80 like any other HTTP traffic. It went thought the Cisco router and a Checkpoint firewall, just like it is supposed to do. Had the network administrator patched their Web servers with against this known type of attack, then the exploit would have done not worked at all. In one of the e commerce sites, they were blown up by a Smurf attack. However, the attack was against the upstream ISP, not the e commerce site itself. Had the target insisted the ISP put the "no ip directed broadcast" command on the outgoing line from the ISP to the target, then the Smurf would have not worked. ======================================================================== -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L3, 117 Customhouse Qy /) +64 4 473 4912 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 10

RE: Large Scale Internet Attacks - Technical article.
by Dennis Su 14 Feb '00

14 Feb '00

Oops, I simply assumed that most of people here own a C or B with a subnet mask 24 bit. So the filter should really take the way you do subnetting into account. Regards, Dennis > -----Original Message----- > From: Chris Wedgwood [mailto:chris.wedgwood(a)clear.co.nz] > Sent: Tuesday, February 15, 2000 1:51 PM > To: Dennis Su > Cc: 'Roger De Salis'; nznog(a)list.waikato.ac.nz > Subject: Re: Large Scale Internet Attacks - Technical article. > > > > Alternatively, a packet filter on boundary router blocking any > > IP packet destined to *.0 or *.255 would do the trink but you > > still need "no ip directed-broadcast" to deal with the > > directed broadcast originating from your internal network. > > That can and will break access to hosts that are on /n networks > where n!=0 mod 8, for example, 10.0.100.0 and 10.0.0.255 are > perfectly valid host addresses in 10.0.0.0/8. > > > > -cw > > P.S. Alas, ot make matters worse, for machines (for example Suns > boxes) still repond to *.255 pings even when they are on a > (say) /21 network and shouldn't... > > -- > Chris Wedgwood chris.wedgwood(a)clear.co.nz > --------- > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Large Scale Internet Attacks - Technical article.
by Dennis Su 14 Feb '00

14 Feb '00

Hi, > In one of the e commerce sites, they were blown up by a Smurf attack. > However, the attack was against the upstream ISP, not the e commerce > site > itself. Had the target insisted the ISP put the "no ip directed > broadcast" > command on the outgoing line from the ISP to the target, then > the Smurf > would have not worked. Just a little opinion of mine. "no ip directed-broadcast" only deals with the directed broadcast to the interface where the command is specified. It does nothing to the transit directed broadcast. To prevent from SMURF attack you have to code this command on each Cisco router interfaces in your network. Alternatively, a packet filter on boundary router blocking any IP packet destined to *.0 or *.255 would do the trink but you still need "no ip directed-broadcast" to deal with the directed broadcast originating from your internal network. Dennis Su ITS, University of Waikato --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Cache testing
by Joe Abley 14 Feb '00

14 Feb '00

Hi all, I'm doing a little bit of cache testing, and I'm looking for a nice, realistic-looking list of objects to fetch from the web; I'm going to use it as a test set to compare different boxes. Anybody care to share a log from a busy-hour cache that's used for residential internet access? All I'm after is a list of URLs to fetch (hits _and_ misses) so anonymised logs are fine. Any help would be greatly appreciated :) Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

CLEAR-ly incompetent
by Brent McDowell 13 Feb '00

13 Feb '00

I wonder why Clear's level of service has diminished greatly over the last two months? Could we talk about Frame Relay? How about the nearly three months it took to upgrade the bandwidth? What about the 14 hours (so far) that one of our PVC's have been down? (Not to mention our 0508 lines, and all). Makes you curious, doesn't it? -- regards, Brent McDowell Network Operations Manager Globe.Net Communications Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 6

CLEAR - Service and Account management
by Mark Munns 13 Feb '00

13 Feb '00

Dear all GlobeNet have required major new upgrades recently and there has been an outage on Friday night. SLA issues are being progressed by myself. CLEAR account managers are contactable in business hours and ISP services are managed from the carrier wholesale group. My contact details are attached. Regards Mark Munns Account Manager - Carrier Wholesale Ph 09-912-4370 Fax 09-912-4455 Email mmunns(a)clear.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0