August 2001 - NZNOG - lists.nznog.org

Re: Code Red errata
by Steve Phillips 08 Aug '01

08 Aug '01

At 11:20 9/08/2001, James McGlinn wrote: >Is it possible to filter on part of the shell code payload? At least one >CR variant doesn't request default.ida - rendering it useless (I assume), >but that should let you see those hits, and allow genuine default.ida >requests through... yep, the way the filter works is you can enter any string up to 32 characters in length, I used default.ida as it was easier to type, once i had it working and had tested it I was going to parse it on the shell code string :) -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 08 Aug '01

08 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday tomorrow, Friday 10 August, please. I have so far received fifty-eight votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. My access to email between now and some time tomorrow morning may be little variable, as I am engaged in moving offices. This is therefore likely to be the last reminder of the vote. If the change is approved, I intend to make the changes necessary to restrict posting to pre-submitted addresses only on Monday, 13 August. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 07 Aug '01

07 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. I have so far received thirty votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

spammer
by Michael Coates 07 Aug '01

07 Aug '01

Hello Is there a list in NZ I can get a spammer put onto to block them from sending emails with viruses attached? Thanks

3 2

Code Red Stats
by Craig Whitmore 07 Aug '01

07 Aug '01

I've been running a running couter of hits on 1 machine take logs from 500 IP addresses's (2 C Classes). Its Hits/sec has gone up from yesterday from about 3.4->6.9 and growing fast :-( Total Seconds = 8878 Total Unique Machines Infected = 6380 Total Hits = 51169 Total Hits/Sec = 6.89 Also I have it emailing the owners of the Unique IP addresses (automaticlly) (with an ugly script) and telling that their machines are infected and so far have had many happy people repling thanking me. (But the Number of infected machines still increases :-( ) This is only from 2 C Class Addresses.. I can't imagine how many hits/sec NZ is getting in Total from Overseas.. There have only been a few infected machines from inside NZ (mostly from Xtra and WorldNet Dialups) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

TCP Header Definition help request "Window"
by Mike Sutton [ awacs ] 07 Aug '01

07 Aug '01

TCP Header Could an expert tell me "how" the "window" value is generated and "what" explicitly it means... Appreciate your help as my reference books don't help and I have not been able to locate a precise definition on the Net. Michael Sutton --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

root.exe
by Dylan Reeve 07 Aug '01

07 Aug '01

Any ISPs had a look through their proxy logs for "root.exe" or "cmd.exe" so far? I bet there will be a few... Going to go after people for 'hacking'? -- Dylan Reeve - dylan(a)wibble.net "Um, yeah." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red: NZ vs Canada
by Dan Langille 06 Aug '01

06 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4