July 2006 - NZNOG - lists.nznog.org

Trojan "MS Windows TCP/IP Patch" spam run
by matthew＠auscert.org.au 31 Jul '06

31 Jul '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings all, We've had a few reports of a spam run for a fake MS Windows TCP/IP Patch (as below) that leads to a trojan site. Anyone else seeing much of this? Any feedback appreciated. - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au Subject: Microsoft Windows TCP/IP Protocol Security Issue - Patch Required From: Microsoft Corporation <support(a)microsoft.com> Date: 31 Jul 2006 19:31:57 +0200 To: auscert(a)auscert.org.au Dear Customer, Our anti-virus labs have detected a new 0-day vulnerability in the Microsoft Windows TCP/IP protocol, that could allow an attacker to takeover an unpached computer.We dont have too many details, since we have recently become aware of the vulnerability, but if patch is not applied as soon as possible, you risk your computer to be exploited.Because the vulnerability affects the kernel of Microsoft Windows, we cannot provide the patch using the Microsoft Update Service, so we have decided to notify all our customers that have registered their Microsoft Windows Operating System about this new threat. Because the security of our customers is very important to us, we have developed a patch to fix the kernel of Microsoft Windows, and to prevent your computer from being attacked. Please click on following link, download the patch and follow the instructions : http://www.microsoft.com/security/tcp-ip/download.php?country=AU,234,242,211 1.Download the patch on your Desktop. 2.Run the patch. 3.Reboot your computer. Each customer has an unique link to download the patch that will expire in 24 hours, so you have to apply within 24 hours after you receive this email. If you fail to do so, you risk your computer to be attacked and exploited by hackers. Thank you Microsoft Corp. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRM65yCh9+71yA2DNAQLbEgP+Kwuu5ldbrEkyYu1jmgCenjGIF7cCSDCa ht7GQOGZL5ss9ZsZS2SfYk3Hi4v5NhtJ47KWmFumputa/H4chCAZ3bFxIzMsvO2+ IeP+7YVqQgXM3sXVd4HNAHRZlmY4SYfDrJ7RX836lmYtOionUg3NxhruJKV25rEc p9lpFhPs5QY= =dQxq -----END PGP SIGNATURE-----

1 0

Re: [nznog] Leaving TelstraClear
by Josh Bailey 31 Jul '06

31 Jul '06

> I'm joining the list of names who have left TelstraClear. > I'll be popping back up at Prophecy Networks in late Aug. Congratulations on the new job. Prophecy are lucky to have you. Beer and stuff.

1 0

Leaving TelstraClear
by Dean Pemberton 30 Jul '06

30 Jul '06

Hi everyone. I'm joining the list of names who have left TelstraClear. I'll be popping back up at Prophecy Networks in late Aug. If you need to contact me, then personal email is best. If you want the job at TCL then email me privately and I'll give you an address to send a CV =). Dean

2 1

Looking glass covering domestic transit?
by Neil Bertram 30 Jul '06

30 Jul '06

Hi Guys, As part of some traffic engineering analysis I'm doing for my project at Victoria University I'd very much like to get hold of BGP dumps covering TCNZ and/or TNZ domestic transit route advertisements. Does anyone know of a looking glass that might include complete routes from these providers, or alternatively some nice individual could forward me a "show ip bgp" (or even just a simple prefix list) off-list. Help much appreciated, and may you have a beer-filled weekend! Thanks, Neil

2 2

Notification of NZRR Database changes
by NZRR Database Notifications 27 Jul '06

27 Jul '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS17746 descr: advertised to AS9439 by Orcon Internet Ltd - AS17746 members: 60.234.0.0/16^16-29, 202.150.96.0/19^19-29, 203.99.0.0/19^19-29, 202.126.192.0/20^20-29, 203.96.192.0/20^20-29, 219.88.128.0/20^20-29, 219.88.240.0/20^20-29, 210.54.56.0/21^21-29, 210.54.148.0/22^22-29, 210.55.12.0/22^22-29, 202.37.82.0/23^23-29, 202.0.151.0/24^24-29, 202.36.170.0/24^24-29, 202.37.19.0/24^24-29, 202.37.173.0/24^24-29, 202.37.194.0/24^24-29, 202.49.187.0/24^24-29, 202.49.233.0/24^24-29, 202.49.246.0/24^24-29, 202.50.164.0/24^24-29, 202.50.167.0/24^24-29, 202.50.246.0/24^24-29, 202.174.160.0/24^24-29, 203.86.200.0/24^24-29, 210.54.12.0/24^24-29, 210.55.1.0/24^24-29, 210.55.8.0/24^24-29, 210.55.199.0/24^24-29, 202.27.188.128/25^25-29, 210.55.0.0/25^25-29, 210.55.180.128/26^26-29, 210.55.193.64/27^27-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: karl.skewes(a)team.orcon.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060727 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS17746 descr: advertised to AS9439 by Orcon Internet Ltd - AS17746 members: 60.234.0.0/16^16-29, 202.150.96.0/19^19-29, 203.99.0.0/19^19-29, 202.126.192.0/20^20-29, 203.96.192.0/20^20-29, 219.88.128.0/20^20-29, 219.88.240.0/20^20-29, 210.54.56.0/21^21-29, 210.54.148.0/22^22-29, 210.55.12.0/22^22-29, 202.37.82.0/23^23-29, 202.0.151.0/24^24-29, 202.36.170.0/24^24-29, 202.37.19.0/24^24-29, 202.37.78.0/24^24-29, 202.37.173.0/24^24-29, 202.37.194.0/24^24-29, 202.49.187.0/24^24-29, 202.49.233.0/24^24-29, 202.49.246.0/24^24-29, 202.50.164.0/24^24-29, 202.50.167.0/24^24-29, 202.50.246.0/24^24-29, 202.174.160.0/24^24-29, 203.86.200.0/24^24-29, 210.54.12.0/24^24-29, 210.55.1.0/24^24-29, 210.55.8.0/24^24-29, 210.55.199.0/24^24-29, 202.27.188.128/25^25-29, 210.55.0.0/25^25-29, 210.55.180.128/26^26-29, 210.55.193.64/27^27-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: karl.skewes(a)team.orcon.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 27 Jul '06

27 Jul '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS17746 descr: advertised to AS9560 by Orcon Internet Ltd - AS17746 members: 60.234.0.0/16^16-29, 202.150.96.0/19^19-29, 203.99.0.0/19^19-29, 202.126.192.0/20^20-29, 203.96.192.0/20^20-29, 219.88.128.0/20^20-29, 219.88.240.0/20^20-29, 210.54.56.0/21^21-29, 210.54.148.0/22^22-29, 210.55.12.0/22^22-29, 202.37.82.0/23^23-29, 202.0.151.0/24^24-29, 202.36.170.0/24^24-29, 202.37.19.0/24^24-29, 202.37.173.0/24^24-29, 202.37.194.0/24^24-29, 202.49.187.0/24^24-29, 202.49.233.0/24^24-29, 202.49.246.0/24^24-29, 202.50.164.0/24^24-29, 202.50.167.0/24^24-29, 202.50.246.0/24^24-29, 202.174.160.0/24^24-29, 203.86.200.0/24^24-29, 210.54.12.0/24^24-29, 210.55.1.0/24^24-29, 210.55.8.0/24^24-29, 210.55.199.0/24^24-29, 202.27.188.128/25^25-29, 210.55.0.0/25^25-29, 210.55.180.128/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: karl.skewes(a)team.orcon.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060727 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS17746 descr: advertised to AS9560 by Orcon Internet Ltd - AS17746 members: 60.234.0.0/16^16-29, 202.150.96.0/19^19-29, 203.99.0.0/19^19-29, 202.126.192.0/20^20-29, 203.96.192.0/20^20-29, 219.88.128.0/20^20-29, 219.88.240.0/20^20-29, 210.54.56.0/21^21-29, 210.54.148.0/22^22-29, 210.55.12.0/22^22-29, 202.37.82.0/23^23-29, 202.0.151.0/24^24-29, 202.36.170.0/24^24-29, 202.37.19.0/24^24-29, 202.37.78.0/24^24-29, 202.37.173.0/24^24-29, 202.37.194.0/24^24-29, 202.49.187.0/24^24-29, 202.49.233.0/24^24-29, 202.49.246.0/24^24-29, 202.50.164.0/24^24-29, 202.50.167.0/24^24-29, 202.50.246.0/24^24-29, 202.174.160.0/24^24-29, 203.86.200.0/24^24-29, 210.54.12.0/24^24-29, 210.55.1.0/24^24-29, 210.55.8.0/24^24-29, 210.55.199.0/24^24-29, 202.27.188.128/25^25-29, 210.55.0.0/25^25-29, 210.55.180.128/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: karl.skewes(a)team.orcon.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 27 Jul '06

27 Jul '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: aut-num: AS38189 as-name: NZRR-AS38189 descr: parliament1 descr: WIX peering at '202.7.0.159' descr: see Citylink RT job #6051 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS38189 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: danies(a)datacom.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR REPLACED BY: aut-num: AS38189 as-name: NZRR-AS38189 descr: parliament1 descr: WIX peering at '202.7.0.159' descr: see Citylink RT job #6051 descr: WIX peering at '202.7.0.160' descr: see Citylink RT job #6051 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS38189 import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS38189 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: danies(a)datacom.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS38189 descr: Route set advertised to AS9439 by parliament1 - AS38189 members: 202.68.89.64/27^27-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: danies(a)datacom.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS38189 descr: Route set advertised to AS9439 by parliament2 - AS38189 members: 202.68.89.64/27^27-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: danies(a)datacom.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 27 Jul '06

27 Jul '06

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: aut-num: AS38189 as-name: NZRR-AS38189 descr: parliament1 descr: WIX peering at '202.7.0.159' descr: see Citylink RT job #6051 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS38189 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: danies(a)datacom.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR --- OBJECT BELOW CREATED: route-set: AS9439:RS-ROUTES:AS38189 descr: Route set advertised to AS9439 by parliament1 - AS38189 members: 202.68.89.64/27^27-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: danies(a)datacom.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20060728 source: NZRR

1 0

Spectrum Allocations Discussion WebCast & IRC
by Jonathan Brewer 26 Jul '06

26 Jul '06

Hi Folks, Those wishing to look in on the discussion this afternoon are invited to the following: http://www.r2.co.nz/20060727 will give a range of streams. IRC will be on irc.internetnz.net.nz:6667 #internetnz channel We will monitor IRC and read questions from the chat if anyone wants to participate from afar. Cheers, Jon ------------------------- Araneo Limited 230B Left Bank 116 Cuba Street Wellington 6011 Ph: 04 978 7350 Fx: 04 978 7355 http://www.araneo.net.nz/ -------------------------

2 2

Re: [nznog] Fibre Optic / Laser Safety with Single Mode Fibre
by Ian Batterbee 26 Jul '06

26 Jul '06

#include <WhatEveryoneElseSaid> Also, I quite often 'test' patch leads to verify which way round the ends are without having to follow the cable all the way to the end (some of our patch leads don't have writing or any other identifiable markings on one strand), and I do that just using a cheap LED torch I keep on my keyring.. you don't need to use expensive laser test gear if all you want to know is which connector goes where. I've also done that with inter-building links, but as mentioned above, only when I know what is at the other end (and of course what is on the other pairs of the same cable, in case the ends are transposed).

1 0