December 2005 - NZNOG - lists.nznog.org

Re: [nznog] (OT?) Phishers targetting Kiwibank
by Donald Neal 08 Dec '05

08 Dec '05

Andy Linton wrote: > > It would be good if these phishing discussions focussed on > technical aspects > of what can be done by people on this list once the list > knows about the > latest scam. The banks I suspect will make their own > decisions without seeking > advice here. > This thread should now turn to a technical topic or go away. - Donald Neal NZNOG List Administrator Donald Neal |"You know what young, carnivorous, Support Engineer |alien mammal-like monsters are like. NGN Operations |Always getting into scrapes." Integration & Services Division +----------------------------------- Alcatel NZ Ltd - Telecom's network operations manager This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002.

4 3

(OT?) Phishers targetting Kiwibank
by Lesley Walker 08 Dec '05

08 Dec '05

I've received a reasonably plausible-looking phish for Kiwibank, appears to have originated in Washington DC. The domain it uses is "kiwibahk.com", registered through bookmyname.com, and I have sent a complaint to the registrar. Does anyone want a copy for reference? Lesley W

11 10

Re: [nznog] (OT?) Phishers targetting Kiwibank
by Regan Murphy 07 Dec '05

07 Dec '05

> They shut down their whole Internet banking site because of a > phishing email ! I would have thought that was somewhat of an > over reaction. That would sure annoy me if I happened to be > one of their customers. Well they wouldn't be the first bank to take this sort of action.... -- Regan

2 1

TelstraClear Down?
by jfp 04 Dec '05

04 Dec '05

Does anybody know what's up with TelstraClear. I can't get to their nameservers from NZ or the US. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Senior Software Engineer Phone (+64-9) 358 2081 Clearfield Software Ltd Fax (+64-9) 358 2083 4th Floor 8-10 Whitaker Place Mob (+64-21) 640 779 P O Box 3901 Auckland, New Zealand ------------------------------------------------------------------------

3 3

Re: [nznog] TelstraClear down
by Stewart Fleming 04 Dec '05

04 Dec '05

DNS certainly gone bang. IP routing still working, but very slow. Denial of service attack? Had a call from my Telstra rep earlier, but that was for a billing error outstanding since February. Maybe they keep the DNS records in the same file...? -- Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request GET http://networkstatus.telstraclear.co.nz/home/clearnet.html. Reason: DNS lookup failure for: networkstatus.telstraclear.co.nz Apache/2.0.52 (Unix) Server at networkstatus.telstraclear.co.nz Port 80 Traceroute from TC frame relay hosted in ChCh to www.xtra.co.nz 3 218.101.61.74 (218.101.61.74) 28.325 ms 21.328 ms 27.119 ms 4 218.101.61.69 (218.101.61.69) 25.932 ms 18.852 ms 40.947 ms 5 218.101.61.33 (218.101.61.33) 17.685 ms 28.273 ms 124.740 ms 6 ggis-gige-v906.telstraclear.net (203.98.18.67) 43.038 ms 42.818 ms 15.735 ms 7 g0-1-0-4.akcr8.global-gateway.net.nz (210.55.202.49) 18.469 ms 36.399 ms 28.106 ms 8 v4.aksw7.global-gateway.net.nz (210.55.202.51) 46.682 ms 36.813 ms 43.531 ms 9 xtra-dom-2.aksw7.global-gateway.net.nz (203.96.120.150) 32.408 ms 18.452 ms 39.837 ms

3 2

Re: [nznog] TelstraClear Down?
by Simon Allard 04 Dec '05

04 Dec '05

Just the nameservers? They have probably been ACL'ed to stop DNS DDoS attacks, like what xtra etc have done. Simon Allard ihug Limited P +64 9 962 9827 M +64 21 456 412 E simon.allard(a)staff.ihug.co.nz > -----Original Message----- > From: jfp [mailto:jfp(a)clearfield.com] > Sent: Monday, 5 December 2005 10:20 a.m. > To: NZNOG(a)list.waikato.ac.nz > Subject: [nznog] TelstraClear Down? > > > Does anybody know what's up with TelstraClear. I can't get to their > nameservers from NZ or the US. > > > jfp. > > ------------------------------------------------------------------------ > Jean-Francois Pirus <jfp(a)clearfield.com> Senior Software Engineer > Phone (+64-9) 358 2081 Clearfield Software Ltd > Fax (+64-9) 358 2083 4th Floor 8-10 Whitaker Place > Mob (+64-21) 640 779 P O Box 3901 Auckland, New Zealand > ------------------------------------------------------------------------ > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

10 13

Re: [nznog] TelstraClear Down?
by Peter Mott 04 Dec '05

04 Dec '05

Maybe there was an imperical decision taken by AU head office to close it down due to lack of profits. :-) regards Peter Mott MOTT & ASSOCIATES Tel: +64 9 488 9352 Fax: +64 9 486 7017 -/-

2 1

Xen for network services (aka web/mail/dns etc) - OT?
by Simon 02 Dec '05

02 Dec '05

Hi There, I have been discussing the utilisation of Xen in a production environment on a couple of other lists (nzlug, debian-isp etc), but wondering if anyone from this list is using it in new zealand for serving of network services? Please let me know if this is OT. Would like to hear your experiences if so. Simon

6 6

Re: [nznog] [Fwd: Re: Bizarre spam]
by Nic Wise 01 Dec '05

01 Dec '05

I'd go with zombie's :) the . Then new line new line thing means that the rest of whatever your script does is ignored by the SMTP server, and the big long number might be either a "key" to get the target of an attack (eg, HTTP to this server, present this key, get details back) or something, or the IP / DNS name / something else of it, maybe base64'ed or encrypted somehow. I could see a virus/trojan/etc sitting there, polling a pop3 account, looking for emails with those words in the subject, and some form of payload, then it pings up and goes and does something. Maybe the attacked script was used as a "trigger"?? Damn it's time for a beer. N > -----Original Message----- > From: Justin Cook [mailto:justin(a)skull.co.nz] > Sent: Friday, 2 December 2005 3:01 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] [Fwd: Re: Bizarre spam] > > It was, and it's already dealt with. Just looking for the > reason behind it. Adrian is probably on the mark when he > calls it a DoS. > > James Clark wrote: > > > > > Sounds like PHP injection, assume it's PHP. If not ignore me. > > > > These articles explain the cause and fixes in more depth: > > > > http://securephp.damonkohler.com/index.php/Email_Injection > > http://www.nyphp.org/phundamentals/email_header_injection.php > > > > > > Justin Cook wrote: > > > >> I've got a question for the appropriate higher minds. > >> > >> I fixed one of my clients self-built contact forms after I had an > >> inkling that someone was injecting headers into it to use it as a > >> relay. Turns out I was right, but it's beyond me what > they're trying > >> to accomplish: > >> > >> Content-Type: text/plain; charset="us-ascii" > >> MIME-Version: 1.0 > >> Content-Transfer-Encoding: 7bit > >> Subject: which a rising moon now threw from the scattered clouds > >> bcc: charleslegbe(a)aol.com > >> > >> 648a4d46b041327ac30fe4f27a9b72ee > >> . > >> > >> > >> Tons and tons of that just that. What possible use could > this garbage > >> be? Is someone trying to blackhole their domain? > >> > >> Cheers > >> Justin > >> > >> _______________________________________________ > >> NZNOG mailing list > >> NZNOG(a)list.waikato.ac.nz > >> http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > > > > > > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog >

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 01 Dec '05

01 Dec '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS17435 descr: advertised to AS9560 by WorldxChange Communications - AS17435 members: 202.182.192.0/19^19-29, 58.28.0.0/16^16-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: gsmith(a)wxc.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050308 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS17435 descr: advertised to AS9560 by WorldxChange Communications LTD - AS17435 members: 58.28.0.0/16^16-29, 202.182.192.0/19^19-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)wxnz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051202 source: NZRR

1 0