July 2009 - NZNOG - lists.nznog.org

NZRR Route Registry Update
by NZRR Database Notifications 07 Jul '09

07 Jul '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS2687 descr: advertised to AS9439 by AT&T - AS2687 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 203.114.128.0/18^18-29, 119.15.0.0/19^19-29, 121.79.192.0/19^19-29, 202.154.128.0/19^19-29, 124.248.128.0/20^20-29, 202.46.160.0/20^20-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.191.32.0/20^20-29, 203.96.16.0/20^20-29, 203.96.48.0/20^20-29, 203.96.128.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 202.27.192.0/21^21-29, 202.78.240.0/21^21-29, 202.126.80.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.59.224.0/22^22-29, 202.27.200.0/22^22-29, 202.27.212.0/22^22-29, 202.27.216.0/22^22-29, 202.36.192.0/22^22-29, 202.37.48.0/22^22-29, 202.49.0.0/22^22-29, 202.89.4.0/22^22-29, 122.248.172.0/23^23-29, 202.14.32.0/23^23-29, 202.27.210.0/23^23-29, 202.36.68.0/23^23-29, 202.36.204.0/23^23-29, 202.37.70.0/23^23-29, 202.169.194.0/23^23-29, 202.175.142.0/23^23-29, 203.84.134.0/23^23-29, 203.99.128.0/23^23-29, 203.163.70.0/23^23-29, 203.176.122.0/23^23-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.138.251.0/24^24-29, 192.173.17.0/24^24-29, 192.173.18.0/24^24-29, 192.173.20.0/24^24-29, 192.195.219.0/24^24-29, 192.203.216.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.12.105.0/24^24-29, 202.14.45.0/24^24-29, 202.14.63.0/24^24-29, 202.14.102.0/24^24-29, 202.20.65.0/24^24-29, 202.20.92.0/24^24-29, 202.20.97.0/24^24-29, 202.21.157.0/24^24-29, 202.27.77.0/24^24-29, 202.27.83.0/24^24-29, 202.27.136.0/24^24-29, 202.27.160.0/24^24-29, 202.27.209.0/24^24-29, 202.27.222.0/24^24-29, 202.27.236.0/24^24-29, 202.27.247.0/24^24-29, 202.27.251.0/24^24-29, 202.36.12.0/24^24-29, 202.36.29.0/24^24-29, 202.36.33.0/24^24-29, 202.36.43.0/24^24-29, 202.36.75.0/24^24-29, 202.36.80.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.198.0/24^24-29, 202.36.218.0/24^24-29, 202.37.68.0/24^24-29, 202.37.117.0/24^24-29, 202.37.118.0/24^24-29, 202.37.167.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.37.254.0/24^24-29, 202.46.176.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.5.0/24^24-29, 202.49.6.0/24^24-29, 202.49.106.0/24^24-29, 202.49.141.0/24^24-29, 202.49.144.0/24^24-29, 202.49.159.0/24^24-29, 202.49.183.0/24^24-29, 202.49.189.0/24^24-29, 202.50.95.0/24^24-29, 202.50.247.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29, 202.135.38.0/24^24-29, 202.135.49.0/24^24-29, 202.135.62.0/24^24-29, 202.135.64.0/24^24-29, 202.135.85.0/24^24-29, 202.135.107.0/24^24-29, 202.135.111.0/24^24-29, 202.135.112.0/24^24-29, 202.135.116.0/24^24-29, 202.135.142.0/24^24-29, 202.135.146.0/24^24-29, 202.135.190.0/24^24-29, 202.135.192.0/24^24-29, 202.135.231.0/24^24-29, 202.169.193.0/24^24-29, 202.169.196.0/24^24-29, 202.169.198.0/24^24-29, 202.169.223.0/24^24-29, 203.92.25.0/24^24-29, 203.96.119.0/24^24-29, 203.163.68.0/24^24-29, 203.163.94.0/24^24-29, 203.163.98.0/24^24-29, 203.196.101.0/24^24-29, 203.196.119.0/24^24-29, 203.196.121.0/24^24-29, 210.7.46.0/24^24-29, 219.88.230.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dl-globalwork(a)att.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090522 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS2687 descr: advertised to AS9439 by AT&T - AS2687 members: 130.123.0.0/16^16-29, 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 203.114.128.0/18^18-29, 119.15.0.0/19^19-29, 121.79.192.0/19^19-29, 202.154.128.0/19^19-29, 124.248.128.0/20^20-29, 202.46.160.0/20^20-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.191.32.0/20^20-29, 203.96.16.0/20^20-29, 203.96.48.0/20^20-29, 203.96.128.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 202.27.192.0/21^21-29, 202.78.240.0/21^21-29, 202.126.80.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.59.224.0/22^22-29, 202.27.200.0/22^22-29, 202.27.212.0/22^22-29, 202.27.216.0/22^22-29, 202.36.192.0/22^22-29, 202.37.48.0/22^22-29, 202.49.0.0/22^22-29, 202.89.4.0/22^22-29, 122.248.172.0/23^23-29, 202.14.32.0/23^23-29, 202.27.210.0/23^23-29, 202.36.68.0/23^23-29, 202.36.204.0/23^23-29, 202.37.70.0/23^23-29, 202.169.194.0/23^23-29, 202.175.142.0/23^23-29, 203.84.134.0/23^23-29, 203.99.128.0/23^23-29, 203.163.70.0/23^23-29, 203.176.122.0/23^23-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.138.251.0/24^24-29, 192.173.17.0/24^24-29, 192.173.18.0/24^24-29, 192.173.20.0/24^24-29, 192.195.219.0/24^24-29, 192.203.216.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.12.105.0/24^24-29, 202.14.45.0/24^24-29, 202.14.63.0/24^24-29, 202.14.102.0/24^24-29, 202.20.65.0/24^24-29, 202.20.92.0/24^24-29, 202.20.97.0/24^24-29, 202.21.157.0/24^24-29, 202.27.77.0/24^24-29, 202.27.83.0/24^24-29, 202.27.136.0/24^24-29, 202.27.160.0/24^24-29, 202.27.209.0/24^24-29, 202.27.222.0/24^24-29, 202.27.236.0/24^24-29, 202.27.247.0/24^24-29, 202.27.251.0/24^24-29, 202.36.12.0/24^24-29, 202.36.29.0/24^24-29, 202.36.33.0/24^24-29, 202.36.43.0/24^24-29, 202.36.75.0/24^24-29, 202.36.80.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.198.0/24^24-29, 202.36.218.0/24^24-29, 202.37.68.0/24^24-29, 202.37.117.0/24^24-29, 202.37.118.0/24^24-29, 202.37.167.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.37.254.0/24^24-29, 202.46.176.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.5.0/24^24-29, 202.49.6.0/24^24-29, 202.49.106.0/24^24-29, 202.49.141.0/24^24-29, 202.49.144.0/24^24-29, 202.49.159.0/24^24-29, 202.49.183.0/24^24-29, 202.49.189.0/24^24-29, 202.50.95.0/24^24-29, 202.50.247.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29, 202.135.38.0/24^24-29, 202.135.49.0/24^24-29, 202.135.62.0/24^24-29, 202.135.64.0/24^24-29, 202.135.85.0/24^24-29, 202.135.107.0/24^24-29, 202.135.111.0/24^24-29, 202.135.112.0/24^24-29, 202.135.116.0/24^24-29, 202.135.142.0/24^24-29, 202.135.146.0/24^24-29, 202.135.190.0/24^24-29, 202.135.192.0/24^24-29, 202.135.231.0/24^24-29, 202.169.193.0/24^24-29, 202.169.196.0/24^24-29, 202.169.198.0/24^24-29, 202.169.223.0/24^24-29, 203.92.25.0/24^24-29, 203.96.119.0/24^24-29, 203.163.68.0/24^24-29, 203.163.94.0/24^24-29, 203.163.98.0/24^24-29, 203.196.101.0/24^24-29, 203.196.119.0/24^24-29, 203.196.121.0/24^24-29, 210.7.46.0/24^24-29, 219.88.230.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dl-globalwork(a)att.com mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090708 source: NZRR ------------------------------------------------------------

1 0

CCIP Alerts on NZNOG
by Paul McKitrick 07 Jul '09

07 Jul '09

Good Morning All, 1. Thank you for the feedback everyone. There have been a number of requests how to subscribe to CCIP's mailing lists, if you send an email to CCIP Publications <publications(a)ccip.govt.nz> with the subject of "Subscribe" then we will add you to our lists, which are relatively low volume one-two posts per month. If you have a security incident you would like to report it or you are aware of something that you think CCIP should be aware of then please send an email to CCIP Incident Response <incidents(a)ccip.govt.nz> When it comes to security related issues I always say that "I would rather hear about something three times than not at all!" 2. CCIP are not currently not preparing regular summaries of activity but it is something we will consider implementing. 3. Currently the volume of CCIP Alerts is about four a year, so posting those here sounds like it would be appropriate and we will review that if the volume starts increasing significantly. Again the threshold for issuing an alert is when there is active exploitation of a new or unpatched vulnerability. CCIP's current philosophy is that we would rather issues alerts and advisories less frequently but have people listen to us when we do, versus just being another noisy feed that becomes somewhat ignored. We definitely don't want to be considered as another "Chicken Little", but sometimes we have to err on the side of caution. When it comes to security I always say that "I would rather hear about something three times than not at all!" 4. This is a dynamic field we work in and we are constantly reviewing what we do, and how we do it. We are always open to feedback and suggestions either on list or off list. 5. Thanks for reading. Regards, Paul. -- Paul McKitrick Head of Stakeholder Engagement Centre for Critical Infrastructure Protection D: (+64) 4 498 7645 P: (+64) 4 498 7654 F: (+64) 4 498 7655 E: paul.mckitrick(a)ccip.govt.nz W: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

[Fwd: CCIP ALERT: Microsoft unpatched vulnerability is being actively exploited in the wild]
by Paul McKitrick 07 Jul '09

07 Jul '09

Good Morning, CCIP did not initially post this alert to the NZNOG list yesterday as it was felt that members might not deem this type of posting appropriate for the NZNOG list. However there have been a number of requests from NZNOG members requesting for this to be posted here, who had received it from yesterday CCIP's mailing lists. CCIP would be interested in feedback about the applicability of CCIP's Alerts on the NZNOG list. Currently CCIP's threshold for issuing these types of alerts is when there is active exploitation of a new or unpatched vulnerability in the wild. Regards, Paul. -- Paul McKitrick Head of Stakeholder Engagement Centre for Critical Infrastructure Protection D: (+64) 4 498 7645 P: (+64) 4 498 7654 F: (+64) 4 498 7655 E: paul.mckitrick(a)ccip.govt.nz W: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. --- -------- Original Message -------- Subject: CCIP ALERT: Microsoft unpatched vulnerability is being actively exploited in the wild Date: Tue, 07 Jul 2009 13:38:28 +1200 From: CCIP Info <info(a)ccip.govt.nz> To: CCIP <info(a)ccip.govt.nz> CC: incidents(a)ccip.govt.nz Good Afternoon, For those of you who are not already aware, CCIP would like to bring your attention the the Microsoft Security Advisory 972890 that was released today: http://www.microsoft.com/technet/security/advisory/972890.mspx Microsoft have announced a vulnerability in Microsoft Video ActiveX Control that allows remote code execution. This is reported to affect versions of Windows XP and Window Server 2003. CCIP is bringing this to your attention as this vulnerability has been reported as being actively exploited in the wild. MITIGATION Administrators are advised to take the following mitigation steps immediately. There is currently no patch to correct this issue. However you can set the kill-bit to mitigate this vulnerability. Microsoft have provided a way to automatically implement the workaround by following the instructions under "Fix It For Me" in the following Knowledge Base article: http://support.microsoft.com/kb/972890 Alternatively the following quoted text can be included in a .REG file and imported into your registry. ---BEGIN QUOTE--- Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}] "Compatibility Flags"=dword:00000400 ---END QUOTE--- Please note that in addition to the class identifier listed in the above example there is a full list of class identifiers in the Suggested Actions-->Workarounds section of the Microsoft Advisory: http://www.microsoft.com/technet/security/advisory/972890.mspx It is recommended that all of them are implemented. There is also a writeup on Microsoft's Security Response Centre Blog: http://blogs.technet.com/msrc/archive/2009/07/06/microsoft-security-advisor… Regards, The CCIP Team --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

4 3

NZ Contacts for Integration/Network Work
by Skeeve Stevens 06 Jul '09

06 Jul '09

Hey all, I met a lot of you awesome guys at the last NZNOG and there is a pile of you that I would love to work with more, but in that wide jigsaw piece country of yours, I have no idea where you all are. We've got a lot of proposed projects on at the moment and NZ is featuring heavily in most of them, so I want to get a bunch of people on a list who we can use in different cities for different kinds of work. Work can involve site visits to install DSL services, onsite basic Cisco work, IPv6 work, general IT (fix server, pc, etc), and some consulting perhaps. We're dealing with a lot of large retail, and hotel chains which have networks throughout NZ as well, which is where some of the above work types slot into. I am not fabulous with NZ geography, so I would need someone to help with a list of the key cities, regional cities that might have those massive malls that always seem to have most of the 'common' chains. I prefer small businesses who are reliable, can be well presented, professional and know their towns well, as I will also need local advice on connectivity solutions - fibre, MetroE, wireless and so on in your particular area. There may be possible emergency work for problems, so I need to know your availability, and also your rates. I am looking at implementing a solution (which I've talked about before), where we have DSL handed off for the entire country (if possible) to a LNS in Auckland, so I will start talking to providers soon (don't all start emailing/calling me like last time!) ;-) So if you can send me an email directly on skeeve(a)eintellego.co.nz<mailto:skeeve(a)eintellego.co.nz> ...Skeeve -- Skeeve Stevens, CEO/Technical Director eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve www.linkedin.com/in/skeeve ; facebook.com/eintellego -- NOC, NOC, who's there? Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

2 2

Ops Manager Required at Araneo
by Jonathan Brewer 06 Jul '09

06 Jul '09

Hi Folks, We're looking for someone up to the challenge of running our network. I kind of figured that this would be on topic for NZNOG. :-) The Trademe Jobs advert is here: http://www.trademe.co.nz/Trade-me-jobs/IT/Management/auction-228577017.htm All CVs through the Trademe process, please. I will not be involved in screening the apps, but if you're interested in the job and can remind me of the last time we had a beer at Curry or NZNOG I will ensure your CV gets a thorough read by the team. Regards, Jon

1 0

802.11 Wireless plotting per AP
by Barry Murphy 05 Jul '09

05 Jul '09

Hey Guys, I know this may be a little off topic, however I know there are many wireless operators on list. I'm wondering what you use to track wireless signal from a base station to see what the footprint is. I.e. I would like to drive around down all the streets where this hotspot is located to plot a map of what signal strength is like in this location for a specific AP, I will circle the streets around the AP until I've lost all signal and hope to have some sort of map to work with :) Any help offlist would be appreciated. Thanks Barry Murphy

10 11

OFF-TOPIC - Samoa Vacancy - Chief Technologist - ISP
by Keith Davidson 02 Jul '09

02 Jul '09

All, Please pardon the slightly off topic nature of this post, but given the wintertime blues currently affecting NZ, perhaps just dreaming about a geek position in paradise and perpetual sunshine will bring about cheer and warmth to some. Cheers Keith ___________________ Subject: Vacant Position Chief Technologist - ISP Computer Services Limited is Samoa's oldest and largest IT company and operates Samoa's largest ISP. We are seeking an individual with flair and passion to help take our ISP business to the next level. We need an experienced IT guru wishing to relocate to Samoa to head up our internet Services development and support team. Ideally this person will come from a practical, hands-on environment in the same or a related industry. The chosen person will head up a team of local IT specialists and would have the ability to manage, mentor and develop this team to their full potential. We would like our preferred candidate to have practical knowledge in many of the following skills... * 5+ years of experience in the support and development in an internet services provider or related industry * Advanced programming knowledge of REDHAT or similar OS * Competency on Email server systems - SendMAIL, Mailwasher, SPAM Assassin or similar * Competency in support of MySQL and/or MS'SQL based Applications * General skills in one or more of PERL, JAVA, Flash, MS'Access, ODBC, CGI, PHP, Coldfusion, AJAX. * Familiarity with SQL in billing databases * Familiarity with a RADIUS server solution e.g RADIATOR * General skills in WEB Server maintenance - Microsoft and/or Apache * Ability to develop Caching technology - SQUID, Cisco WCCP or similar * Familiarity with Cisco router Advanced IOS and command structure * Familiarity with network technologies - VLAN, VPN * Familiarity with TCP/IP, BGP, AS, delegation and route assignments * Familiarity with WiFi technologies and hotspot services e.g ChilliSpot etc What we offer is a fun filled company in the warmest , safest and friendliest nation in the Galaxy. Outside of work Samoa has a very relaxed and social lifestyle with the opportunity for you to enjoy our beautiful nation and our strong Faa'Samoa culture... white sand beaches with warm water all year round, ideal for swimming, snorkeling ,diving, fishing, golf, tennis, squash, rugby, reading , running, mountain climbing and socializing. The position would be for a negotiable term of up to three years and includes relocation expenses to Samoa, family accommodation, educational expenses and a generous salary package with bonus. Our desire is for someone to fill this position immediately although we would make exceptions for our ideal candidate. If you feel this is you and your interested in experiencing our Faa'Samoa, please make contact including a copy of your CV with references to Technologist Position C/- CSL Private Bag Apia, Samoa dave(a)csl.ws or tevi(a)csl.ws Dave Main Business Development Manager Computer Services Ltd Apia, SAMOA Ph +685 20926 Fax +685 20932 Cell +685 7771301 dave(a)csl.ws

1 0