July 2008 - NZNOG - lists.nznog.org

IPv6 Technical Workshops - PCH / Cisco
by Keith Davidson 24 Jul '08

24 Jul '08

All, InternetNZ, in conjunction with REANNZ, Cisco, Packet Clearing House, NZRS, auDA and FX Networks, is offering IPv6 technical workshops in Christchurch and Auckland. This follows on from having already run this workshop in Wellington in August last year. The first 5 day programme will run in Christchurch from Saturday 30 August to Wednesday 3 September, and the second in Auckland from Monday 8 September to Friday 12 September. Attendence on each course is limited to 28 participants. Registration is on a first come, first served basis. Please see the attached document for details. More details are available at http://blog.internetnz.net.nz/wp-content/uploads/2008/07/2008-augsep-ipv6-w… To register email richard at internetnz.net.nz To keep this message list-compliant, please note InternetNZ will possibly provide beer to workshop participants. Cheers Keith Davidson Executive Director - InternetNZ

1 0

NZRR Route Registry Update
by NZRR Database Notifications 23 Jul '08

23 Jul '08

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS65531 descr: Route set advertised to AS9439 by parliament - AS65531 members: 202.22.16.0/23^23-29, 202.22.18.0/24^24-29, 202.22.23.0/24^24-29, 202.22.30.0/24^24-29, 202.49.210.0/24^24-29, 202.49.213.0/24^24-29, 203.97.200.0/24^24-29, 203.97.232.80/28^28-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: john.howell(a)parliament.govt.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051102 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS65531 descr: advertised to AS9439 by Parliamentary Service - AS65531 members: 202.22.16.0/21^21-29, 202.49.208.0/21^21-29, 202.22.24.0/22^22-29, 202.22.28.0/23^23-29, 202.22.30.0/24^24-29, 203.97.232.80/28^28-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: John.Howell(a)parliament.govt.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080724 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 23 Jul '08

23 Jul '08

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS17705 descr: advertised to AS9560 by InspireNet - AS17705 members: 203.114.128.0/18^18-29, 121.79.192.0/19^19-29, 192.138.251.0/24^24-29, 203.92.25.0/24^24-29, 210.7.46.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: brenden(a)staff.inspire.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080411 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS17705 descr: advertised to AS9560 by InspireNet - AS17705 members: 203.114.128.0/18^18-29, 121.79.192.0/19^19-29, 140.200.248.0/22^22-29, 192.138.251.0/24^24-29, 203.92.25.0/24^24-29, 203.174.26.0/24^24-29, 210.7.46.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: brenden(a)staff.inspire.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080724 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 23 Jul '08

23 Jul '08

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS17705 descr: advertised to AS9439 by InspireNet - AS17705 members: 203.114.128.0/18^18-29, 121.79.192.0/19^19-29, 192.138.251.0/24^24-29, 203.92.25.0/24^24-29, 210.7.46.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: brenden(a)staff.inspire.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080410 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS17705 descr: advertised to AS9439 by InspireNet - AS17705 members: 203.114.128.0/18^18-29, 121.79.192.0/19^19-29, 140.200.248.0/22^22-29, 192.138.251.0/24^24-29, 203.92.25.0/24^24-29, 203.174.26.0/24^24-29, 210.7.46.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: brenden(a)staff.inspire.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080724 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 23 Jul '08

23 Jul '08

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.53.176.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 202.160.116.0/22^22-29, 202.124.106.0/23^23-29, 202.160.114.0/23^23-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.36.33.0/24^24-29, 202.36.119.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.105.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: service(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080619 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.53.176.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 202.160.116.0/22^22-29, 202.124.106.0/23^23-29, 202.160.114.0/23^23-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 198.32.71.0/24^24-29, 202.20.97.0/24^24-29, 202.36.33.0/24^24-29, 202.36.119.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.105.0/24^24-29, 203.119.56.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080724 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 23 Jul '08

23 Jul '08

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.53.176.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 202.160.116.0/22^22-29, 202.124.106.0/23^23-29, 202.160.114.0/23^23-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.36.33.0/24^24-29, 202.36.119.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.105.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: service(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080619 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.53.176.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 202.160.116.0/22^22-29, 202.124.106.0/23^23-29, 202.160.114.0/23^23-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 198.32.71.0/24^24-29, 202.20.97.0/24^24-29, 202.36.33.0/24^24-29, 202.36.119.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.105.0/24^24-29, 203.119.56.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080724 source: NZRR ------------------------------------------------------------

1 0

Rule 6... part 2.
by Steve Holdoway 21 Jul '08

21 Jul '08

Apologies to those who didn't get the Monty Python reference ( there is no rule 6, after all! ), I'll take the general census as an ok, and hope this isn't too off-list. I'm working for a company down here in Christchurch who are developing a new tool aimed at catching email spam. Much simplified, it uses linear regression techniques to create a signature of the email involved, and then performs a fuzzy match on that sig against databases held on our servers ( via a local cache to improve performance ). We reckon we've got it to be pretty indestructible ( and with a pretty small footprint ), but we need to test it further. Are there any ISP's out there who could help us out by a) trialling it ( our testing up to now has been as a milter under sendmail/postfix on linux ), and/or b) sending us loads of spam to stress our backend processes?? If so, could they contact me offlist? Cheers and thanks, Steve

1 0

Re: [nznog] DNS Vulnerability
by Ewen McNeill 21 Jul '08

21 Jul '08

In message <20080708234533.B080B112872(a)wat.la.naos.co.nz>, Ewen McNeill writes: >See also, eg, http://isc.sans.org/diary.html?storyid=4687 which has some >sane discussion of the issue [...] It appears that someone guessed close enough to how the attack worked to cause one of the people "in the know" to post a confirmation, and then attempt to withdraw it -- but of course people have found traces of the confirmation description and mirrored it. So the cat seems to be out of the bag, and presumably the Bad Guys (tm) will now try to do this for real. See, eg, http://it.slashdot.org/it/08/07/21/2212227.shtml which has various cut'n'paste copies of what seems to be the confirmation description, plus a link to the guess that prompted it. >Amongst other things they suggest patching any recursive/caching DNS >servers with vendor patches at the soonest suitable patch window. If you haven't already patched your recursive/caching DNS servers used by customers, today would be a good day to do it. So says Dan Kaminsky who found the issue in the first place: http://www.doxpara.com/?p=1176 Also beware that the NAT in at least some firewalls has been reported to undo the port randomisation that the patch introduces, resulting in predictable port numbers again (and thus no increase in randomness or protection against this attack). Linux-based firewalls are reported to be okay (apparently by default they pass through the port number used by the client on outgoing UDP packets if they can), and presumably OpenBSD based ones are okay given their choice to randomise everything. But beware of running recursive DNS servers behind NAT on firewalls without checking what the outgoing packets look like -- if in doubt perhaps put your recursive DNS servers into the DMZ outside the NAT. Ewen

1 0

Rule 6.
by Steve Holdoway 20 Jul '08

20 Jul '08

... which in this case isn't 'No pommy poofters' (: Is is appropriate to post a request for partners to trial software, or is this a breach of the aforesaid rule??? Cheers, Steve

3 2

Compromised websites
by Glen Eustace 14 Jul '08

14 Jul '08

Hi, We have had only a single site compromised so far but googling around indicates that this particular hack is all over the place. On the site in question all files .htm, .html and .shtml have had code added before the </body> tag, the code is a <jscript></jscript> that loads fgg.js from http://www.usaadw.com, the script that is loaded then tries to open an iframe but the content gives a 500 server error. I can not identify the vector used to edit all the files. This is on a linux server running apache 2 but google finds plenty of .asp pages that have been attached as well. The script is also called ngg.js but has almost identical content. Has anyone else been hit and if so, has the vector been identified ? Any assistance appreciated. -- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Glen and Rosanne Eustace GodZone Internet Services, a division of AGRE Enterprises Ltd. P.O. Box 8020, Palmerston North, New Zealand 4446. Ph: +64 6 357 8168, Fax +64 6 357 8165, Mob: +64 21 424 015 http://www.godzone.net.nz "A Ministry specialising in providing low-cost Internet Services to NZ Christian Churches, Ministries and Organisations."

7 12