- NZNOG - lists.nznog.org

CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

2 1

NZNOG List Change Now Effective
by Donald Neal 12 Aug '01

12 Aug '01

NZNOG People, Postings for the NZNOG list should now be accepted only from addresses subscribed to one of the following lists: nznog - this list nznog-digest - the digest version of this list nznog-postonly - a list which exists only to allow addresses subscribed to it to post to the nznog list. Messages will not normally be sent to addresses subscibed to nznog-postonly. To subscribe new addresses to one or more of these lists, send email to majordomo(a)list.waikato.ac.nz where each line of the body of the message has the form subscribe <list name> to subscribe the address from which that message is being sent, or subscribe <list name> <address> to subscribe a different address. More than one subscription request may be sent in the same message. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi all, Sorry about the Spam, I have the displeasure of being on the end of one of these links (the mail client did not get the signoff from the smtp server so it tried again). Neil Fincham Integral LTD ----- Original Message ----- From: Olderon To: Neil Sent: Monday, August 13, 2001 4:47 PM Subject: Re: CLEAR Net Tempest is there something wrong with your mail? youve sent that same email 4times. 4:23 4:28 4:29 4:36 ----- Original Message ----- From: Neil To: nznog(a)list.waikato.ac.nz Sent: Monday, August 13, 2001 4:18 PM Subject: CLEAR Net Tempest Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

1 0

CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

1 0

CLEAR Net Tempest
by Neil 12 Aug '01

12 Aug '01

Hi All, Has anyone else had any problems with Clear's 802.11 wireless internet service (http://www.clear.net.nz/services/tempest.html) as a source of interference? They have just done a rollout in Rotorua and totally stoped 3 separate wireless networks that had been running together nicely for the past year or two. Clear have told me that Rotorua is the only place that this has happened in and are being very slow to do anything about it so if this has happened to you could you let me know. Neil Fincham Integral LTD.

1 0

Code red logging
by Simon Byrnand 12 Aug '01

12 Aug '01

Thought those of you playing Code Red Detective may find the following URL of some use :) http://salfter.dyndns.org/codered.shtml Regards, Simon --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Abuse@xtra.co.nz now guilty of abuse?
by PhoneNet 11 Aug '01

11 Aug '01

If anyone at Xtra is reading this list please get them to fix the autoresponder for messages to abuse(a)xtra.co.nz... I've now had 5 identical replies over a period of 3 days to my complaint re spam.... Perhaps they think they are supposed to be the abusers? Ian Cousins PhoneNet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Fwd: Code red infected customers
by Steve Phillips 10 Aug '01

10 Aug '01

FYI, these are the IP's I've collected to date that are in the NZ domain, some of these will be on dynamic dialup accounts, if you would like the actual log entries which should include times they were online let me know, i'll probably clear off the log files and restart the collection at a later date as the time on the server was out by an hour <self fwap> >Date: Sat, 11 Aug 2001 18:57:54 +1200 >From: root <root(a)hangover.nz.asiaonline.net> >To: steve(a)nz.asiaonline.net >Subject: Code red infected customers > >Code Red Infected customers on our network trying to infect remote sites.. > > >202.154.128.18 : 18.128.154.202.IN-ADDR.ARPA domain name pointer >ak-d18.connections.net.nz >202.180.111.174 : 174.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-174.nas3.chc.attica.net.nz >202.180.111.18 : 18.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-18.nas3.chc.attica.net.nz >202.180.111.77 : 77.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-77.nas3.chc.attica.net.nz >202.180.111.95 : 95.111.180.202.IN-ADDR.ARPA domain name pointer >202-180-111-95.nas3.chc.attica.net.nz >202.180.68.127 : 127.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-127.nas1.wgn.attica.net.nz >202.180.68.40 : 40.68.180.202.IN-ADDR.ARPA domain name pointer >202-180-68-40.nas1.wgn.attica.net.nz >202.180.69.248 : 248.69.180.202.IN-ADDR.ARPA domain name pointer >202-180-69-248.ipn1.attica.net.nz >202.180.71.36 : 36.71.180.202.IN-ADDR.ARPA domain name pointer >202-180-71-36.nas4.akl.attica.net.nz >202.180.90.163 : 163.90.180.202.IN-ADDR.ARPA domain name pointer >202-180-90-163.nas7.akl.attica.net.nz >202.37.167.38 : 38.167.37.202.IN-ADDR.ARPA domain name pointer >nwp-38.world-net.co.nz >202.37.68.193 : 193.68.37.202.IN-ADDR.ARPA domain name pointer >nw3-193.world-net.co.nz >202.49.144.221 : 221.144.49.202.IN-ADDR.ARPA domain name pointer >storefrontmail.viatx.com >202.49.144.225 : 225.144.49.202.IN-ADDR.ARPA domain name pointer >stage.viatx.com >202.50.111.114 : >202.50.111.91 : >202.50.111.97 : >203.109.193.163 : 163.193.109.203.IN-ADDR.ARPA domain name pointer >203-109-193-163.ihug.net >203.109.203.103 : 103.203.109.203.IN-ADDR.ARPA domain name pointer >203-109-203-103.nzl.ihugultra.co.nz >203.167.132.64 : 64.132.167.203.IN-ADDR.ARPA domain name pointer >203-167-132-64.dialup.clear.net.nz >203.167.161.144 : 144.161.167.203.IN-ADDR.ARPA domain name pointer >203-167-161-144.dialup.clear.net.nz >203.167.164.208 : 208.164.167.203.IN-ADDR.ARPA domain name pointer >203-167-164-208.dialup.clear.net.nz >203.167.166.71 : 71.166.167.203.IN-ADDR.ARPA domain name pointer >203-167-166-71.dialup.clear.net.nz >203.167.171.155 : 155.171.167.203.IN-ADDR.ARPA domain name pointer >203-167-171-155.dialup.clear.net.nz >203.167.214.50 : >203.167.247.214 : 214.247.167.203.IN-ADDR.ARPA domain name pointer >cf4-acld.auckland.clix.net.nz >203.167.254.136 : 136.254.167.203.IN-ADDR.ARPA domain name pointer >napr-m36.dialup.inhb.co.nz >203.79.102.72 : 72.102.79.203.IN-ADDR.ARPA domain name pointer >203-79-102-72.tnt14.paradise.net.nz >203.79.103.179 : 179.103.79.203.IN-ADDR.ARPA domain name pointer >203-79-103-179.tnt14.paradise.net.nz >203.96.106.59 : 59.106.96.203.IN-ADDR.ARPA domain name pointer >203-96-106-59.dialup.xtra.co.nz >203.96.110.172 : 172.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-172.dialup.xtra.co.nz >203.96.110.66 : 66.110.96.203.IN-ADDR.ARPA domain name pointer >203-96-110-66.dialup.xtra.co.nz >203.96.62.201 : 201.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-201-tollfree.actrix.co.nz >203.96.62.53 : 53.62.96.203.IN-ADDR.ARPA domain name pointer >203-96-62-53-tollfree.actrix.co.nz >203.97.85.108 : 108.85.97.203.IN-ADDR.ARPA domain name pointer >a004-m001-u108.chch.clear.net.nz >210.48.102.170 : 170.102.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-102-170.iconz.net.nz >210.48.103.150 : 150.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-150.iconz.net.nz >210.48.103.4 : 4.103.48.210.IN-ADDR.ARPA domain name pointer >ip-210-48-103-4.iconz.net.nz >210.48.81.19 : 19.81.48.210.IN-ADDR.ARPA domain name pointer >p19.pool1.staticadsl.iconz.net.nz >210.54.121.65 : 65.121.54.210.IN-ADDR.ARPA domain name pointer >210-54-121-65.adsl.xtra.co.nz >210.54.199.115 : 115.199.54.210.IN-ADDR.ARPA domain name pointer >210-54-199-115.dialup.xtra.co.nz >210.54.201.186 : 186.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-186.dialup.xtra.co.nz >210.54.201.49 : 49.201.54.210.IN-ADDR.ARPA domain name pointer >210-54-201-49.dialup.xtra.co.nz >210.54.217.216 : 216.217.54.210.IN-ADDR.ARPA domain name pointer >ppp-15.satlan.co.nz >210.54.221.186 : 186.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-186.ipnets.xtra.co.nz >210.54.221.194 : 194.221.54.210.IN-ADDR.ARPA domain name pointer >210-54-221-194.ipnets.xtra.co.nz >210.54.224.235 : 235.224.54.210.IN-ADDR.ARPA domain name pointer >210-54-224-235.adsl.xtra.co.nz >210.54.229.174 : 174.229.54.210.IN-ADDR.ARPA domain name pointer >210-54-229-174.dialup.xtra.co.nz >210.54.233.174 : 174.233.54.210.IN-ADDR.ARPA domain name pointer >210-54-233-174.adsl.xtra.co.nz >210.54.242.194 : 194.242.54.210.IN-ADDR.ARPA domain name pointer >210-54-242-194.adsl.xtra.co.nz >210.54.247.251 : 251.247.54.210.IN-ADDR.ARPA domain name pointer >smtp.carolineeve.co.nz >210.54.254.97 : 97.254.54.210.IN-ADDR.ARPA domain name pointer >210-54-254-97.adsl.xtra.co.nz >210.54.76.237 : 237.76.54.210.IN-ADDR.ARPA domain name pointer >210-54-76-237.dialup.xtra.co.nz >210.54.77.98 : 98.77.54.210.IN-ADDR.ARPA domain name pointer >210-54-77-98.dialup.xtra.co.nz >210.54.80.49 : 49.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-49.adsl.xtra.co.nz >210.54.80.78 : 78.80.54.210.IN-ADDR.ARPA domain name pointer >210-54-80-78.adsl.xtra.co.nz >210.54.8.148 : >210.54.83.179 : 179.83.54.210.IN-ADDR.ARPA domain name pointer >210-54-83-179.adsl.xtra.co.nz >210.54.84.137 : 137.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-137.adsl.xtra.co.nz >210.54.84.211 : 211.84.54.210.IN-ADDR.ARPA domain name pointer >210-54-84-211.adsl.xtra.co.nz >210.54.89.14 : 14.89.54.210.IN-ADDR.ARPA domain name pointer >smtp.insteplimited.com >14.89.54.210.IN-ADDR.ARPA domain name pointer smtp.hanmerinstitute.com >210.54.98.43 : 43.98.54.210.IN-ADDR.ARPA domain name pointer >210-54-98-43.dialup.xtra.co.nz >210.54.99.167 : 167.99.54.210.IN-ADDR.ARPA domain name pointer >210-54-99-167.dialup.xtra.co.nz >210.55.103.213 : 213.103.55.210.IN-ADDR.ARPA domain name pointer >port55-103-213.jetstart.win.co.nz >210.55.106.10 : 10.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-10.ip.maxnet.co.nz >210.55.106.136 : 136.106.55.210.IN-ADDR.ARPA domain name pointer >ip210-55-106-136.ip.maxnet.co.nz >210.55.123.35 : 35.123.55.210.IN-ADDR.ARPA domain name pointer >210-55-123-35.dialup.xtra.co.nz >210.55.146.39 : 39.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-39.dialup.xtra.co.nz >210.55.146.83 : 83.146.55.210.IN-ADDR.ARPA domain name pointer >210-55-146-83.dialup.xtra.co.nz >210.55.159.221 : 221.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-221.ipnets.xtra.co.nz >210.55.159.222 : 222.159.55.210.IN-ADDR.ARPA domain name pointer >210-55-159-222.ipnets.xtra.co.nz >210.55.178.166 : 166.178.55.210.IN-ADDR.ARPA domain name pointer >210-55-178-166.dialup.xtra.co.nz >210.55.228.173 : 173.228.55.210.IN-ADDR.ARPA domain name pointer >adsl-173.world-net.co.nz >210.55.57.45 : 45.57.55.210.IN-ADDR.ARPA domain name pointer >210-55-57-45.adsl.xtra.co.nz >210.55.9.105 : >210.86.24.203 : 203.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-203.adsl.xtra.co.nz >210.86.24.254 : 254.24.86.210.IN-ADDR.ARPA domain name pointer >210-86-24-254.adsl.xtra.co.nz >210.86.25.142 : 142.25.86.210.IN-ADDR.ARPA domain name pointer >210-86-25-142.adsl.xtra.co.nz > >Total customers Code Red infected so far counted at : 79 -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red errata
by Brodie Davis 09 Aug '01

09 Aug '01

Has any one else noticed a big drop of traffic related to this. my stats for this week have been so far (pretty low.. but as i only have 2 world viewable port 80's) Monday : 37 (ids was playing up so only partial records) Tuesday : 599 Wednesyday : 511 Today (from 8am) : nill I am just wondering is this the norm.. or I am just lucky. (or has AoL started filting this now?) Cheers, Brodie --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 10

Vote Result and NZNOG List Changes
by Donald Neal 09 Aug '01

09 Aug '01

NZNOG People, Voting has now closed on the following proposed addition to this list's acceptable use policy: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. A total of seventy votes were recieved, with all votes cast in favour of the change. This change is therefore now in effect. During the afternoon of Monday, 13 August, I intend to change the nznog list's settings so that postings will be accepted only from addresses subscribed to one of the following lists: nznog - this list nznog-digest - the digest version of this list nznog-postonly - a new list which exists only to allow addresses subscribed to it to post to the nznog list. Messages will not normally be sent to addresses subscibed to nznog-postonly. To subscribe new addresses to one or more of these lists, send email to majordomo(a)list.waikato.ac.nz where each line of the body of the message has the form subscribe <list name> to subscribe the address from which that message is being sent, or subscribe <list name> <address> to subscribe a different address. More than one subscription request may be sent in the same message. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Given the current topic of discussion in here...
by Chris Rigby 09 Aug '01

09 Aug '01

I though this slashdot article might be on interest. http://slashdot.org/articles/01/08/09/1758200.shtml Chris Rigby Senior Systems Engineer IHUG - Into the Internet --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[OT] 802.11 and stuff
by James Tyson 08 Aug '01

08 Aug '01

Hi all Just a couple of quick questions to you folks that know so much about 802.11. Firstly, do I really need a base station? I have my new ibook here and I want to grab the airport card to use with the Cisco Aironet base station at work, but I was thinking is it possible to just throw an orinoco card or something in my Linux box gateway and use that in place of a base station while I am at home? If not, does anyone know of any base stations in the sub $500 range that work reasonably? I am not really that worried about WEP and SSID while I am at home, because I will set my DHCP server up to only assign my card an IP address and use an encrypted tunnel to get to the net. Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

8 9

Looking for DialUp RAS Equipment
by Craig Whitmore 08 Aug '01

08 Aug '01

Has anyone got any Spare RAS Equipment they are willing to sell Such as: Cisco 5200/5300/5800 etc (Or Modem Cards to put in them) USR/3Com TotalControl Equipment (or any Cards for the Chassis such as netserver/Quads etc) Shiva LANRover (Whole thing or Spare Modems etc) Max Ascend 4000/6000/3000/TNT? Anything else that will take R2's and work reasonable. If you have any of the above please let me know with estimated price for Sale. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

2 1

Re: Code Red errata
by Steve Phillips 08 Aug '01

08 Aug '01

At 11:20 9/08/2001, James McGlinn wrote: >Is it possible to filter on part of the shell code payload? At least one >CR variant doesn't request default.ida - rendering it useless (I assume), >but that should let you see those hits, and allow genuine default.ida >requests through... yep, the way the filter works is you can enter any string up to 32 characters in length, I used default.ida as it was easier to type, once i had it working and had tested it I was going to parse it on the shell code string :) -- Steve Systems Admin, Asia Online (NZ) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 08 Aug '01

08 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday tomorrow, Friday 10 August, please. I have so far received fifty-eight votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. My access to email between now and some time tomorrow morning may be little variable, as I am engaged in moving offices. This is therefore likely to be the last reminder of the vote. If the change is approved, I intend to make the changes necessary to restrict posting to pre-submitted addresses only on Monday, 13 August. Donald Neal List Administrator --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Proposed Change to Acceptable Use Policy
by Donald Neal 07 Aug '01

07 Aug '01

NZNOG People, Voting is now under way on the following proposed addition to the list''s acceptable use policy. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. I have so far received thirty votes, and have acknowledged all of them. If you have not received email saying your vote has been recorded, it is not likely that it has been recorded. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

spammer
by Michael Coates 07 Aug '01

07 Aug '01

Hello Is there a list in NZ I can get a spammer put onto to block them from sending emails with viruses attached? Thanks

3 2

Code Red Stats
by Craig Whitmore 07 Aug '01

07 Aug '01

I've been running a running couter of hits on 1 machine take logs from 500 IP addresses's (2 C Classes). Its Hits/sec has gone up from yesterday from about 3.4->6.9 and growing fast :-( Total Seconds = 8878 Total Unique Machines Infected = 6380 Total Hits = 51169 Total Hits/Sec = 6.89 Also I have it emailing the owners of the Unique IP addresses (automaticlly) (with an ugly script) and telling that their machines are infected and so far have had many happy people repling thanking me. (But the Number of infected machines still increases :-( ) This is only from 2 C Class Addresses.. I can't imagine how many hits/sec NZ is getting in Total from Overseas.. There have only been a few infected machines from inside NZ (mostly from Xtra and WorldNet Dialups) Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

TCP Header Definition help request "Window"
by Mike Sutton [ awacs ] 07 Aug '01

07 Aug '01

TCP Header Could an expert tell me "how" the "window" value is generated and "what" explicitly it means... Appreciate your help as my reference books don't help and I have not been able to locate a precise definition on the Net. Michael Sutton --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 7

root.exe
by Dylan Reeve 07 Aug '01

07 Aug '01

Any ISPs had a look through their proxy logs for "root.exe" or "cmd.exe" so far? I bet there will be a few... Going to go after people for 'hacking'? -- Dylan Reeve - dylan(a)wibble.net "Um, yeah." --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red: NZ vs Canada
by Dan Langille 07 Aug '01

07 Aug '01

I can give you two lots of stats, one from a NZ server, the other from a Canada server: http://www.langille.org/stats-red-worm/ - in Wellington http://www.freebsddiary.org/stats-red-worm/ - in Ottawa Both are updated every 30 minutes, 15 minutes after and after the hour. -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

Whazzup w/ Ihug?
by Juha Saarinen 06 Aug '01

06 Aug '01

http://www.internettrafficreport.com/cgi-bin/tr_chartpage.pl?203.98.56.1 70 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red Weirdness
by Mark Foster 06 Aug '01

06 Aug '01

[Tue Aug 7 13:56:39 2001] [error] [client 203.199.60.10] Invalid URI in request XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u 8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Ive had just one today, in the last half hour. None prior to that Did someone try to write a variant and screw up or maybe one of the infectees got weird? At 13:58 7/08/2001 +1200, you wrote: >[Tue Aug 7 13:57:14 2001] [error] [client 203.228.144.15] Invalid URI in >request >XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a >HTTP/1.0 > >Just started getting these. no default.ida?. > >Has the worm turned, again? > > >Tim J. Shackleton ------------------+ +- Business http://www.netlink.co.nz/ >Networks Admin/Programmer ----------+ +- Personal http://www.netnet.net.nz/ >Netlink LTD -- DDI +64 4 922 8476 --+ +------------- Pager 64 +26 253 4356 >+64 29 650 476 -- Cellular ---------+ +------------------------------------ >---- "Cold silence has a tendency to atrophy any sense of compassion" ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

Code Red Stats
by Neil 06 Aug '01

06 Aug '01

Hi All, After about 30 second's of thinking about how to get rrdtool or mrgt to display what Code Red is up to on my server I decided to use webalizer instead. It defiantly gives you a better view on what is going on, have a look at http://203.97.86.130/codered/usage_200108.html . I have put the script in the cron.hourly directory so check back as often as you like. Neil Fincham Integral LTD.

6 8

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: "Barry Raveendran Greene" <bgreene(a)cisco.com> Date: Mon, 6 Aug 2001 05:18:53 -0700 > Is anyone seeing router impact caused by all the bogus queries sent out by > Code Red? Just wondering if there could be some side effects. We had the cpu running at 100% on our border router till we tuned the access-lists to deal with traffic to port 80 early. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

Internet issues for discussion at APEC TEL24
by Frank March 06 Aug '01

06 Aug '01

I have previously posted information about APEC TEL24 to this list inviting people to join the NZ delegation. As a reminder: the meeting will take place 19-21 September in Jeju, Korea. It will be preceeded by two days (17,18 September) of workshops on various areas. I will be there for all five days. Details at http://www.apectel24.org/. Please feel free to pass the contents of this email on to anyone you think may be interested. One workshop area is 'Internet issues'. The first draft of the programme is as follows. I invite anyone to send to me **(off-line)** comments about any of the matters mentioned. Note that this was the first forum to raise the issue of international Internet charging (and that matter is still hanging around). There is an invitation to comment on agenda matters and I will probably take that up in 10 days or so. >From the organisers..... "The Workshop will consist of two parts. The FIRST part will consist of three presentations (20 minutes each) about the following topics: 1.- Presentation about the Current State of the Debate on Internet Issues. 2.- Presentation about the development of traffic flows within and between Latin American countries and other regions. 3.- Presentation about the situation of small ISP's in the Asia-Pacific region. The SECOND part will consist of an open-floor moderated discussion between the delegates. We suggest the following topics. Please we will appreciate if you could indicate your first three issues of more interest: 1.- APEC Contribution to promoting Internet access in the Asia-Pacific Region 2.- Traffic Exchange Models (Current and Next Generation) How is Internet traffic exchanged? What financial mechanisms are in place for the exchange of Internet traffic and how are they encouraging Internet development? What are the trends in content location and how do these factors influence Internet traffic patterns and financial arrangements? 3.- Global Capacity Availability and Trading What are the recent developments in large-scale bandwidth provision? What are the recent developments in retail internet service provision? How do global capacity relate to Internet traffic exchange? 4.- Local Internet Interconnection What are the main principles of the new interconnection frameworks? How much progress has been made in developing interconnection frameworks appropriate to the exchange of Internet traffic? 5.- Role for Regulators Is there a role for regulators? What are the policy implications for some of the directions Internet traffic exchange will take with next generation Internet architecture? 6.- Users Needs How do users view current developments in Internet traffic exchange? How does the financial community view the current state of play? User Needs - IP-based services and content providers. 7.- WTO What is the current state of the debate? How negotiating frameworks from different countries compare? What is the treatment of Internet services in the negotiating frameworks? 8.- Internet Connectivity What policy and regulatory reforms are required to stimulate Internet development and address the international digital divide? What regulatory barriers exist to the development of the Internet including infrastructures such as international connectivity, domestic teledensity and Internet exchange points? How can economies maximise the benefits of their Internet development including lower costs for infrastructure service? (development funds) 9.- Costs and Prices What is going to replace the international settlements system in the new environment? How are countries adapting to the changes in settlement rates? 10.- Quality Voice over IP " Frank March Specialist Advisor, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, NZ Ph: (+64 4) 474 2908; Fax: (+64 4) 471 2658 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 11:15:46 +1200 > What IOS version? Are you running compiled ACLs? Don't know, no. Its not actually my box I just get to look at it occasionally when they have issues. > That seems to help a > fair bit if your CPU bound due to access-list activity. I just looked up the docs on compiled access-lists and the reference I found implied that they were only available on 7200's and bigger boxes. > Also, you can > try "show access-list blah" and reorder the most frequent terms to > nearer the top. I've cleaned the lists up several times in the past (as well as they could be) but they keep adding more ugliness to them. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red - Network Impact?
by Barry Raveendran Greene 06 Aug '01

06 Aug '01

Hi Folks, Is anyone seeing router impact caused by all the bogus queries sent out by Code Red? Just wondering if there could be some side effects. Barry --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

Re: Code Red - Network Impact?
by Mark Davies 06 Aug '01

06 Aug '01

From: Chris Wedgwood <cw(a)f00f.org> Date: Tue, 7 Aug 2001 10:46:27 +1200 > On Tue, Aug 07, 2001 at 10:36:51AM +1200, Mark Davies wrote: > We had the cpu running at 100% on our border router till we tuned > the access-lists to deal with traffic to port 80 early. > Ouch... what kind of router? Where was all the CPU being spent? A cisco 2600 with a rather ugly set of access-lists having to deal with the probes for an entire Class B net. I was somewhat surprised that it couldn't deal with it as it was only about 100 probes a second (this was last Friday). Tweaking the access-lists got the load down to about 40-50%. cheers mark --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: Code Red V3!?
by Lindsay Druett 06 Aug '01

06 Aug '01

You must be a Bob Jones Fan.... "Location, location, location...." Those poor souls that are topologically near NT servers that have been infected are getting hammered :/ If you're getting hammered, you live in a bad neighbourhood, time to cleanup or move :) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: NZIX is gone!
by Rob Edkins 06 Aug '01

06 Aug '01

Arron wrote: > Them were the glory days ... New Zealand's routing table in IGRP (no not EIGRP), 24 routers connected via Coax and a 1.5Mbps Frame Relay link to the US.< ...and you tell the kids today that, and they doooooon't believe yer! ;-) Rob __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

NZIX is gone !!!
by Lindsay Druett 05 Aug '01

05 Aug '01

Hi, As of 10:45am this morning the last router (HNCR1) was turned off, and by 11:45am NZIX (as far as University of Waikato is concerned) has been fully dismantled. As most providers most providers have stopped peering with NZIX late last year, I thought it would be worth making note that as of this morning, NZIX is now part of New Zealand internet's history books, and is no longer in existence. Kind Regards, Lindsay. Lindsay Druett, CCNA, CCDA, NZTC (Elect.) Network Engineer, Network and Development, Information and Technology Services, University of Waikato, Hamilton, New Zealand. lindsayd(a)waikato.ac.nz Phone 64-7-838 4999 Fax 64-7-838 4416 Mobile 025-276 0700 <<Lindsay Druett.vcf>>

3 2

Wellington 2
by Dean Pemberton 05 Aug '01

05 Aug '01

Well wellington wasn't so dead afterall. Turns out that all we needed as a 1.5 metre tall whip antenna bolted to the top of Simon Blakes car. Yes we have photos I'll get them developed when I get back to Oz. Dean --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 20

smtp.xtra.co.nz --- sick?
by Chris Wedgwood 05 Aug '01

05 Aug '01

I'm seeing funnies to smtp.xtra.co.nz --- basically some connections when sending email are terribly slow, while others work perfectly well. Does anyone know if this address is a load-balancer or something? If that's the case then it might be a host behind it is a bit sick or something... I'm seeing 10 second delays or more between having received a TCP ACK and getting an SMTP ACK back. The helpdesk didn't seem too interested, I didn't even ask if they wanted to see my packet dumps[1] :) --cw [1] Another outstanding pickup line. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Code Red V3!?
by Mark Foster 05 Aug '01

05 Aug '01

http://www.idg.net.nz/webhome.nsf/UNID/3B65B7D06B08DB2DCC256AA00001AF76!ope… -.-. --.- Mark Foster - markf(a)intermech.co.nz IT Manager, Intermech Ltd +64-21-499-368 / +64-9-525-2220 http://www.intermech.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: NZIX is gone !!!
by Lindsay Druett 05 Aug '01

05 Aug '01

John Houlker will be touched... Everybody should turn off all their routers for a minute, as a mark of resepect. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Different Code Red?
by Juha Saarinen 05 Aug '01

05 Aug '01

I'm getting lots of hits on my home box, unfortunately. 142 since August 1 is the latest count. :-( Noticed that the GET requests look different now: 203.231.234.229 - - [05/Aug/2001:11:46:35 +1200] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9 090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0 078%u0000%u00=a HTTP/1.0" 404 283 "-" "-" Whereas earlier on, they looked like this: 65.192.84.7 - - [05/Aug/2001:06:51:26 +1200] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNN%u9090%u68 58%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u90 90%u8190%u00c3%u0003%u8b00% u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 330 "-" "-" -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

15 27

idg.net.nz --- IMHO privacy implications of archives are debatable (Paul Brislen)
by Chris Wedgwood 05 Aug '01

05 Aug '01

In light of recent comments WRT a certain IDG article I find: http://www.idg.net.nz/webhome.nsf/UNID/EA33E2992D04A5C0CC256A9E0010FACC!ope… Ah, internet. Bane and boon of my life. What would I do without you, dear old friend? Well, for a start, I wouldn't be following a language tutor's advice quite so often. He told me there are two steps to learning a foreign language. Step one: open mouth. Step two: insert foot. [...] Most entertaining of all, however, is that when I rewrote the story for Computerworld it changed the story as it appears on the web. The old version ("Newsgroups could be breaching privacy act") was effectively replaced with a new one ("Privacy issue over mailing list archives") in a single Orwellian moment. Ironic, really, when you consider the story in the first place was triggered by a question about whether an archive could or should be changed to remove old postings. Pretty reasonable comments this time, certainly worth reading. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Globe.NET (www.globe.net.nz) Mail Server full
by Craig Whitmore 04 Aug '01

04 Aug '01

If anyone has any contacts for Globe.NET (www.globe.net.nz) (I've tried their 0508 number and no answer) can you please contact them and tell them that their mail server has no space left on its Disk. Thanks Craig Whitmore Orcon Internet http://www.orcon.net.nz

1 0

CodeRed Worm Stats
by Brian Gibbons 04 Aug '01

04 Aug '01

>From: Craig Whitmore >I just did some graphs of the codered worms attacking over today.. and have a look at >http://www.nzdsl.co.nz/codered >Anyone got any similar stats?? Similar stats from one of our boxes that does nothing all day except ignore ARP broadcasts on it's LAN segment. http://www.outersite.co.nz/codered.html This is probably ho hum for many, however I pity those that pay per MB. At NZ retail rates a box infected with CodeRed could easily burn bandwidth at $300 per hour, fairly scary to come back Monday to find your box has burnt $15,000 over the weekend. BG --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Increase in Code Red activity?
by Brian Gibbons 04 Aug '01

04 Aug '01

We have noticed a large increase (10 fold) in CodeRed activity since bang on midnight last night. The probe rate seems to have now leveled off at one probe per IP address every three minutes. This activity was actually noticed from monitoring of broadcast traffic on an ethernet LAN (TCP SYN to Black hole LAN IP address). If WorldNet are listening, these two systems are hitting us regularly 210.55.74.165 210.55.76.51 Cheers BG. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

CodeRed Worm Stats
by Craig Whitmore 04 Aug '01

04 Aug '01

I just did some graphs of the codered worms attacking over today.. and have a look at http://www.nzdsl.co.nz/codered The last batch of attacks started about 11pm last night.. This is from 2 completely different networks in NZ and the results where about the Same The 1st graph is 1 Machine only and the 2nd Graph is a C Class. Pretty Scary.. Anyone got any similar stats?? The worse offenders are a couple of machines @ worldnet so far. Thanks Craig Whitmore Orcon Internet http://www.nzdsl.co.nz

1 0

FW: Alert: New version of Code Red, XXXX
by Chris Woodrow 04 Aug '01

04 Aug '01

Cross posted from the NTBugtraq list -----Original Message----- From: Russ [mailto:Russ.Cooper(a)RC.ON.CA] Sent: Sunday, 5 August 2001 3:48 p.m. To: NTBUGTRAQ(a)LISTSERV.NTBUGTRAQ.COM Subject: Alert: New version of Code Red, XXXX -----BEGIN PGP SIGNED MESSAGE----- Just a quick FYI, there is a new version of Code Red which appears to be spreading rather rapidly. - - Appears to be a new re-write. - - Drops some sort of remote access trojan. - - Turns off System File Checker (Windows File Protection.) - - Moves CMD.EXE to the scripts directory in IIS - - Looks like the way they make the entry into code very differently than before. - - If your IDS is looking for "NNNN", forget it (but then you should have been shot if you used this string anyway) Cheers, Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor p.s. if we don't respond right away its because we're now going to go and light the fireworks here at my retreat. Might as well have lots of fireworks tonight! -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.2 iQCVAwUBO2zCARBh2Kw/l7p5AQH95wQAqjGp7vRYK8SYky/ydyU1wxBmCe2c8Mpd DBdxrv+TY9112ZuH663ZspUOXThS9oeEyT4sdbVYNv8Z28nMipbioyTXYa5dw8po 21tkilo6ZoGX+AmKJ6Kz7WDvMpHpEfzDr3JHGtxuev0/rclXeRSN4urypMR3YnRz uw5ZW/F3U/I= =OhCV -----END PGP SIGNATURE----- ---------------------------------------------------------------------------- Delivery co-sponsored by Trend Micro ============================================================================ TREND MICRO REAL-TIME VIRUS ALERTS If you would like to know about a virus outbreak before CNN and ZDNet get Trend Micro Virus Info Feed FREE. Simply copy and paste a small piece of code to give your visitors a real-time top 10 list and the latest virus advisories. Setup takes just 10 minutes and requires no server-side code on your Web site. All content is updated automatically from Trend Micro's Web site. http://www.antivirus.com/banners/tracking.asp?si=8&bi=237&ul=/syndication/ vinfo/ ---------------------------------------------------------------------------- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Different Code Red?
by Thomas Salmen 04 Aug '01

04 Aug '01

For those who havn't seen yet - -----BEGIN PGP SIGNED MESSAGE----- Just a quick FYI, there is a new version of Code Red which appears to be spreading rather rapidly. - - Appears to be a new re-write. - - Drops some sort of remote access trojan. - - Turns off System File Checker (Windows File Protection.) - - Moves CMD.EXE to the scripts directory in IIS - - Looks like the way they make the entry into code very differently than before. - - If your IDS is looking for "NNNN", forget it (but then you should have been shot if you used this string anyway) Cheers, Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor p.s. if we don't respond right away its because we're now going to go and light the fireworks here at my retreat. Might as well have lots of fireworks tonight! -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.5.2 iQCVAwUBO2zCARBh2Kw/l7p5AQH95wQAqjGp7vRYK8SYky/ydyU1wxBmCe2c8Mpd DBdxrv+TY9112ZuH663ZspUOXThS9oeEyT4sdbVYNv8Z28nMipbioyTXYa5dw8po 21tkilo6ZoGX+AmKJ6Kz7WDvMpHpEfzDr3JHGtxuev0/rclXeRSN4urypMR3YnRz uw5ZW/F3U/I= =OhCV -----END PGP SIGNATURE----- Quite exciting really, isn't it? Regards, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 -----Original Message----- From: Dan Langille [mailto:dan(a)langille.org] Sent: Sunday, 5 August 2001 4:00 p.m. To: Juha Saarinen Cc: nznog(a)list.waikato.ac.nz Subject: Re: Different Code Red? On 5 Aug 2001, at 11:53, Juha Saarinen wrote: > I'm getting lots of hits on my home box, unfortunately. 142 since August > 1 is the latest count. :-( > > Noticed that the GET requests look different now: [snip] Some look different: [dan(a)dev:/var/log] $ grep -c "default.ida?X" /var/log/httpd-access.log 12 [dan(a)dev:/var/log] $ grep -c "default.ida?N" /var/log/httpd-access.log 116 [dan(a)dev:/var/log] $ grep -c "default.ida" /var/log/httpd-access.log 128 The above represents the last 24 hours EST. All hits were against the IP address, not against any known domain (i.e. the HTTP headers did not include a domain name). -- Dan Langille pgpkey - finger dan(a)unixathome.org | http://unixathome.org/finger.php --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Code Red v. II
by Juha Saarinen 03 Aug '01

03 Aug '01

Arrghhh... three times as many hits: pts/0 juha(a)vimfuego:/mnt/hdb6/home/juha$ grep -c default.ida /var/log/httpd/access_log 54 -- Juha Saarinen --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

The Wellington Wander
by Dean Pemberton 02 Aug '01

02 Aug '01

Ok the numbers are in. Wellington scored much less usage on the wireless front Well less on the 'being able to pick up with a dinky antenna on the sidewalk' front I happen to know for certain that there are wireless stations out there that I missed Wellington seems to have a few hot spots rather than a general level of wireless. It does score higher on the security side though. Of the 17 networks that I saw, 9 were using WEP The ones that weren't however did try valiantly to give me IP addresses and invite me onto their networks. This kinda freaked me out (this is not an intrusion attempt remember) so I ended up disabling all protocols on that interface In the spirit of Tim Allen I think I need more power. So I'm on the lookout for a larger antenna, and I think I know just the place to get one on loan =) Later Dean --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

Re: Dean's Wireless Walkabout
by Dean Pemberton 02 Aug '01

02 Aug '01

HAHAHAHA ROFLMAO Choccie Fish for Joe here. Yes of course I mean 802.11 hahaha - I'm still laughing at that cock up. So how many people were worried that I could see their Vlans from the street? Dean On Wed, Aug 01, 2001 at 10:48:38PM +1200, Joe Lewis wrote: > > Hi, umm feel free to shoot me down but don't you mean 802.11(b)? > > --- > Joe Lewis > > On Wed, 1 Aug 2001, Dean Pemberton wrote: > > > > > Hi all; > > > > Yes this might be a first, I'm going to drag the topic BACK to something network related. > > > > I happen to be in Auckland today. Flew in for customer chit chat which will happen tommorow. > > Had a spare afternoon and no one to see so I thought I might do the geek thing and see how little old Auckland was getting along with it's wireless networking. > > > > SO, I slapped the 802.1Q card into the laptop and strapped the GPS onto the outside of my backpack and went for a walk. > > > > I walked down Queen Street from the top to the water, and then back up to Albert St to Wellesley then back up Symonds to my hotel. > > > > Well. Auckland sure is brimming with wireless. But the concern (and I spose the reason that I posted this at all) was that most of it is insecure. > > > > Now I'm a good guy. I don't want to get access to anything, god knows I see enough internet as it is. I just wanted to see how many places had embraced the 802.1Q fad. > > > > So all in all 29 networks jumped out and grabbed me as I was walking past. only 4 of them were using WEP. > > Now because I didn't actually try to gain access to any of them, I have no idea what the internal security of them is like. But I'm not expecting much. > > > > I don't think I sniffed anything off the sky tower, I was only using the small antenna on the card. > > > > So if you run a wireless network in the center of Auckland and you were using the strategy of "Oh it will never make it down to the street" Then you are wrong and you might like to put some more security on. > > > > I thought about mailing my networklist out as well. But I decided against it. Mainly because it has exact GPS locations and network names. It would make easy pickings for anyone who wanted to gain access. > > If you want to mail me privatly with your network name and/or card MAC address then I will give you a yes or no answer. > > > > Dont feel alone though. I've done the same in North Sydney and come up with similar numbers. > > > > Next week wellington. > > > > Have fun > > > > Dean > > --------- > > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > > where the body of your message reads: > > unsubscribe nznog > > > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 10

Proposed Change to Acceptable Use Policy
by Donald Neal 02 Aug '01

02 Aug '01

NZNOG People, It is not always obvious, but this list does have an acceptable use policy. Here it is: ---------- NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. ---------- This has served us well enough for a number of years. I now propose the following addition: 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Votes on this change to me (not the list!) by midday, Friday 10 August, please. In the interim, I intend to proceed as I outlined previously. I shall issue formal warnings for irrelevant or abusive postings, and shall act to block postings as soon as a third warning within thirty days is issued to any individual. To avoid any appearance of retrospective action, I shall start counting warnings only from the appearance of this posting to the list. NB: This wiping of the slate excludes persons who have during the last week threatened me with legal action or have threatened to approach my employers to get them to influence my issuing of warnings for inappropriate posting. I consider that those involved have received far more warning than most people already. If a majority of votes cast support the change, this will become permanent practice, and the list will switch in the near future to accepting postings only from addresses supplied in advance. If the majority oppose it, we shall return to relying on people's goodwill. Unless someone else has a better idea? Donald --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: IP Address Management software.
by Steve Lang 02 Aug '01

02 Aug '01

Hiya. > Solarwinds (solarwinds.net) have a pretty cool suite of tools > that include > among others, IP management tools. They cost, but if you have > real buisiness > needs they are more cost effective than other commercial > solutions (Ci$co > included), and will quickly justify the cost. I had found them as well. Useful, and not that expensive when compared with others. > Network Address Recovery (This pings all IP address ranges > that you tell it > on a predetermined regular period (default 4 Hours), and > reports on the last > time an IP address was seen on the network) > There is a sample screen shot @ > http://solarwinds.net/Tools/Network_Discovery/Network_Address_ > Recovery/NetAd > Rec-1.gif I tested this, it looked quite good, but it's insistence at pinging things was annoying. > DHCP Scope Monitor (Requires Micro$soft DHCP and SNMP with > obviously NOT > public as the community string) Eeek. That would be interesting. Cheers and thanx. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IP Address Management software.
by Steve Lang 02 Aug '01

02 Aug '01

Hiya all. 'Been lurking here for a while now, and actually have something worth saying now! I'm looking into IP Address Management packages. I've grazed through google, and a few others, and found pointers to many. It seems that there are a few packages that purport to allow people to manage IP Address space, but many of them focus on the integration of DHCP/DNS. Now, for what I'm after at the moment, this isn't an issue, and all I really want is something that can document allocations and what they're used for. There are some packages that don't exist now, and a couple that have changed hands within the last few years. An understanding of VLSM/CIDR etc. is required, although maybe not an understanding, but an allowance to docuement super/subnets. What do you, the contributors to this list use? And yes, I've done the spreadsheet thing to death... Cheers - -------------------------------------------------------------------------- Steve Lang Telephone: +64-9-309-7918 Consultant DDI: +64-9-307-5584 Optimation New Zealand Limited. Mobile: +64-25-864-653 P.O.Box 106104 Fax: +64-9-309-7919 Auckland E-mail: steve.lang(a)optimation.co.nz New Zealand Web: www.optimation.co.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

M1122 --- spontaneously corrupting flash
by Chris Wedgwood 01 Aug '01

01 Aug '01

Anyone out there inflicted with an M1122? I am, and for the second time to me, and third time in total (once at my old work) have had these modem die completely... Investigation (via console) has shown, in every single case, the flash has gotten corrupted or something, as image.exe (the firmware that is booted from ROM) is either corrupt or deleted. The worst thing is, the console refused to respond, which really sucks, as it means I can't revert to the previous image or put a new one on it. To make life even more interesting, the phone lines here are pretty spectacular, modems barely work and when they do, they drop about every 10 minutes or so even when you lock the modulation to v34 in an attempt to make things more reliable. --cw --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Crap
by Donald Neal 01 Aug '01

01 Aug '01

>>> "Matt Camp" <gargoyle(a)noise.net.nz> 08/01/01 08:55 >>> >I'd like to ask that this list is immediatly changed to drop non-member >submissions, and that Joe and Jeff are removed. >There is off topic conversation, and then there is pointless, induced, >drivel. NZNOG People, I'm not willing to get involved in a process of deciding for myself that one poster's five postings are cause for blocking, and someone else's are not. And the balance of the (admittedly small) number of emails I got on the subject last month was against restricting postings. On the other hand, I'm not at all happy with this list's s/n ratio. I have this morning sent to a number of posters requests not to send further inappropriate postings to this list. If these result in much improved behaviour, well and good. If not, I plan to move to a practice familiar to followers of cricket. Friendly warnings for misbehaviour may be given. Formal warnings follow. Too many formal warnings and you are asked to retire from the match. And yes, that would mean a move to restricting postings to addresses previously supplied, if not necessarily subscribed. Comments on that plan to the list, please. If it seems to me necessary to implement it I plan to put it to a vote as a set of additions to the AUP. When that might happen depends on postings. - Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

10 13

Code Red Early warning for SANS
by Jeff Williams 01 Aug '01

01 Aug '01

All, For your interest on Code Red Worm... See: http://www.digitalisland.net/codered/ for hour to hour reports... I also have an Eradicator if anyone is interested... Regards, -- Jeffrey A. Williams Spokesman for INEGroup - (Over 118k members strong!) CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 972-447-1800 x1894 or 214-244-4827 Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Dean's Wireless Walkabout
by Dean Pemberton 01 Aug '01

01 Aug '01

Hi all; Yes this might be a first, I'm going to drag the topic BACK to something network related. I happen to be in Auckland today. Flew in for customer chit chat which will happen tommorow. Had a spare afternoon and no one to see so I thought I might do the geek thing and see how little old Auckland was getting along with it's wireless networking. SO, I slapped the 802.1Q card into the laptop and strapped the GPS onto the outside of my backpack and went for a walk. I walked down Queen Street from the top to the water, and then back up to Albert St to Wellesley then back up Symonds to my hotel. Well. Auckland sure is brimming with wireless. But the concern (and I spose the reason that I posted this at all) was that most of it is insecure. Now I'm a good guy. I don't want to get access to anything, god knows I see enough internet as it is. I just wanted to see how many places had embraced the 802.1Q fad. So all in all 29 networks jumped out and grabbed me as I was walking past. only 4 of them were using WEP. Now because I didn't actually try to gain access to any of them, I have no idea what the internal security of them is like. But I'm not expecting much. I don't think I sniffed anything off the sky tower, I was only using the small antenna on the card. So if you run a wireless network in the center of Auckland and you were using the strategy of "Oh it will never make it down to the street" Then you are wrong and you might like to put some more security on. I thought about mailing my networklist out as well. But I decided against it. Mainly because it has exact GPS locations and network names. It would make easy pickings for anyone who wanted to gain access. If you want to mail me privatly with your network name and/or card MAC address then I will give you a yes or no answer. Dont feel alone though. I've done the same in North Sydney and come up with similar numbers. Next week wellington. Have fun Dean --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

RE: Code Red (Take Two)
by Thomas Salmen 01 Aug '01

01 Aug '01

A little less of an impact this time then, huh? We've had two customers infected, both installs of which were less than a few days old. Seems that most admins (in NZ at least) have been rather better prepared this time round. Don't know if I can say the same for our friends overseas - many of the IPs that I have logged originate in Asia. Some in the States and Europe, but not as many. A few illegal, unpatched IIS installs, maybe... Must say, though, it was rather funny reading about the 'Code Red no-show' in the news this morning... Regards, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 -----Original Message----- From: Thomas Salmen [mailto:thomas(a)radionet.co.nz] Sent: Thursday, 2 August 2001 2:12 p.m. To: nznog(a)list.waikato.ac.nz Subject: Code Red (Take Two) Just curious... have many people been affected by the second round of Code Red infections? We have seen plenty of inbound traffic here (well, the odd bit, anyway) but very few of our customers web servers have been hit - not like last time... Regards, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Code Red (Take Two)
by Thomas Salmen 01 Aug '01

01 Aug '01

Just curious... have many people been affected by the second round of Code Red infections? We have seen plenty of inbound traffic here (well, the odd bit, anyway) but very few of our customers web servers have been hit - not like last time... Regards, Thomas Salmen System Administrator Radionet Ltd. 1/72 Paul Matthews Road Albany, Auckland, New Zealand Ph: +64 9 414 0300 ext 718 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 9

Hmm.
by David Robb 01 Aug '01

01 Aug '01

Is this true? http://www.bogusjourney.com/08018.html David Robb --- Senior Network Engineer DDI +64-9-359-2710 ihug (AS7657) NOC +64-9-359-2708 "The Earth is a single point of failure" --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

13 25

(off topic) Stop with all the garbage please.
by stephen sheehan 01 Aug '01

01 Aug '01

Jeff, Dr Joe and all, I see myself as being fortunate to be a member of this mailing list, to here the wisdom of the local net Gods. It appears some of you do not share this view. I see this list as a valuable resource for the local net industry, and of late it seems to have deteriated into basicly a type of email chatroom for all sorts of off-topic bitching. So I am asking that you please have some respect for the intended purpose of this list and other list members. If you want to bitch to each other or discuss stuff that is not relavent, please do so by private email, as I am sure most of you have better things to do than sort through all the shit that has been posted to the list lately. Sorry for posting this off topic e-mail and sounding like a hypocrite and also adding to the large amount of crap alread on this list. Your sincerely Stephen Sheehan __________________________________________________ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/ --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Alternative List
by Matt Camp 01 Aug '01

01 Aug '01

A while back an alternative list was proposed... most people seemed quite receptive to the idea... so it now exists. To subscribe, send a mail to majordomo(a)noise.net.nz with 'subscribe nznet' in the body. The alternative list is more informal, and more generally aimed at the NZ Networking industry. It may contain things such as details of used equipment for sale, and discussions which would be regarded as off topic here. Hopefully this will give us a place to discuss such things, and will keep the noise level down here somewhat. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Crap
by Michael Bordignon 01 Aug '01

01 Aug '01

maybe uh, ending discussion of this completely off-topic discussion and refraining from replying to any further attempts to revive it may be productive? (including replying to this rhetorical post) Michael > i know this well and so does jeff. example - you filter me > out - or jeff > - or whomever it may be you choose to filter - then some third party > begins the drivel about jeff williams. well - you end up on > the receiving > end of the drivil from the third parties. in most cases > filtering ends up > causing confusion. you would essentially have to filter out > everyone who > is speaking about jeff williams - and that in my opinion is counter > productive. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Validation of INEGROUP.GOD Domain
by The dot.GOD Registry, Limited 01 Aug '01

01 Aug '01

Hello: This email will confirm that we have processed your domain registration request for: INEGROUP.GOD. Someone, hopefully you, has registered this domain with us. If not please let us know. You must now visit our web site to validate your domain and enter your validation ticket number. TICKET: 52396544d99665168490 Please click on the following URL to activate your new domain name now. https://secure.dot-god.com/god.nic/validate.cgi?inegroup=52396544d996651684… Or if the above URL does not work (some email systems may crop the URL) then please visit: https://secure.dot-god.com/cgi-bin/validate.cgi and enter the following information manually at the prompt: DOMAIN: inegroup TICKET: 52396544d99665168490 Regards hostmaster(a)dot-god.com http://www.dot-god.com/ The dot.GOD Registry, Limited Executive Plaza, Suite 908 150 West 51st Sreet New York, New York, 10019 US --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 5

RED WORM Virus
by Mike Conner 01 Aug '01

01 Aug '01

Has any one seen the worm yet? Mike Conner. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 3

Code Red growth stats (fwd)
by !Dr. Joe Baptista 01 Aug '01

01 Aug '01

my contribution to keeping this conference topical today. ---------- Forwarded message ---------- Date: Wed, 1 Aug 2001 09:44:05 -0700 From: k claffy <kc(a)ipn.caida.org> To: nanog(a)nanog.org Subject: Code Red growth stats (david moore with help from a bunch of elves) http://www.caida.org/analysis/security/code-red/aug1-live-hosts.gif was exponential till about an hour ago, we're not sure if leveling off is due to our monitor load or an actual peak in the data. log-scale version http://www.caida.org/analysis/security/code-red/aug1-live-hosts-log.gif will put on main caida home page later today and update every minute (you'll have to hit reload, and you won't actually notice changes at a minute granularity so please no per-minute cron jobs to reload :) ) note the corresponding graph for 19-20 july: http://www.caida.org/analysis/security/code-red/gifs/cumulative-ts.log.gif no per AS stats for this outbreak yet, also under construction. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Preemptive strike.
by Andrew Garrett 01 Aug '01

01 Aug '01

Yes, the name Andrew Garrett has been in the news lately. No, I'm not that Andrew Garrett. Yes, my employer is aware of the name similarity, and has investigated the difference between the two individuals, and is satisfied that we are different people. No, the New Zealand Stock Exchange has not hired a "known hacker". Yes, it is rather amusing. No, not very amusing when you're involved. Regards Andrew "sigh, no, not that one" Garrett --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 6

Re: nznog subscriber test (jwkckid1@ix.netcom.com)]
by Jeff Williams 31 Jul '01

31 Jul '01

Olderon and all, All I did was be sure to send my response along with my question to the list. I also send Andrew's response as well to the list as I am this one. It seems that perhaps that Andrew is not in agreement with your assessment. As such, it seems that the test was in and of itself a failure or misleading... ????? Olderon wrote: > Jeff. > That was an Intelligence test. you failed. > > "The easiest was for me to do this is to send each subscriber this > brief email and then examine any bounces and errors." > > See the word each? > > That email was sent to everyone on the list. If any of the email addresses > got bounced back or got errors then they would be deemed inactive and > removed from the list. > > ----- Original Message ----- > From: "Jeff Williams" <jwkckid1(a)ix.netcom.com> > To: <nznog(a)list.waikato.ac.nz> > Cc: "Chris Wedgwood" <cw(a)f00f.org> > Sent: Wednesday, August 01, 2001 3:06 PM > Subject: [Fwd: nznog subscriber test (jwkckid1(a)ix.netcom.com) > > > Chris, > > > > What is this all about? Why is My E-mail being singled out? > > > > -- > > Jeffrey A. Williams > > Spokesman for INEGroup - (Over 118k members strong!) > > CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. > > Information Network Eng. Group. INEG. INC. > > E-Mail jwkckid1(a)ix.netcom.com > > Contact Number: 972-447-1800 x1894 or 214-244-4827 > > Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 > > > > Regards, -- Jeffrey A. Williams Spokesman for INEGroup - (Over 118k members strong!) CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 972-447-1800 x1894 or 214-244-4827 Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [Fwd: nznog subscriber test (jwkckid1@ix.netcom.com)]
by Jeff Williams 31 Jul '01

31 Jul '01

Sheath and all, Thank you for this clarification. However it does not explain Andrew's response.... ????? sheath(a)paradise.net.nz wrote: > everyone got one with the email addy in the subject line to help with > recording the bounces. > > So each person got a test msg with their own email addy in it. > > SPH > > > Chris, > > > > What is this all about? Why is My E-mail being singled out? > > > > -- > > Jeffrey A. Williams > > Spokesman for INEGroup - (Over 118k members strong!) > > CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. > > Information Network Eng. Group. INEG. INC. > > E-Mail jwkckid1(a)ix.netcom.com > > Contact Number: 972-447-1800 x1894 or 214-244-4827 > > Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 > > > > Regards, -- Jeffrey A. Williams Spokesman for INEGroup - (Over 118k members strong!) CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 972-447-1800 x1894 or 214-244-4827 Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [Fwd: nznog subscriber test (jwkckid1@ix.netcom.com)]
by Donald Neal 31 Jul '01

31 Jul '01

>>> "Mark Foster" <blakjak(a)blakjak.net> 08/01/01 01:21 >>> >The list administrator sent every individual on the list an email in order >to analyse the bounces (if any). > >So therefore noone is 'singled out'. [...] No, I didn't. I'm advised of bounces automatically when they occur. The email in question appears to have originated from Chris Wedgwood. He will presumably now tell us why he sent it. - Donald Neal -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: [Fwd: nznog subscriber test (jwkckid1@ix.netcom.com)]
by Jeff Williams 31 Jul '01

31 Jul '01

Andrew and all, I always read all my E-mail closely. What Bullshit? Andrew Garrett wrote: > 1. read the e-mail > 2. learn to not clog lists will bullshit. > > At 08:06 PM 7/31/01 -0700, you wrote: > >Chris, > > > > What is this all about? Why is My E-mail being singled out? > > > >-- > >Jeffrey A. Williams > >Spokesman for INEGroup - (Over 118k members strong!) > >CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. > >Information Network Eng. Group. INEG. INC. > >E-Mail jwkckid1(a)ix.netcom.com > >Contact Number: 972-447-1800 x1894 or 214-244-4827 > >Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 > > > >Return-Path: <cw+nznog-test-bounce-jwkckid1=ix.netcom.com(a)f00f.org> > >Received: from weta.f00f.org ([203.167.249.89]) > > by elektra (Earthlink/Netcom Mail Service) with ESMTP id > > tmejqq.lmr.37tiu4v > > for <jwkckid1(a)ix.netcom.com>; Tue, 31 Jul 2001 17:37:46 -0700 (PDT) > >Received: by weta.f00f.org (Postfix, from userid 1000) > > id 18BED159B7; Wed, 1 Aug 2001 12:38:14 +1200 (NZST) > >From: Chris Wedgwood <cw(a)f00f.org> > >To: jwkckid1(a)ix.netcom.com > >Subject: nznog subscriber test (jwkckid1(a)ix.netcom.com) > >X-NZNOG-USER: jwkckid1(a)ix.netcom.com > >Reply-To: cw+nznog-test-dont-reply(a)f00f.org > >Message-Id: <20010801003814.18BED159B7(a)weta.f00f.org> > >Date: Wed, 1 Aug 2001 12:38:14 +1200 (NZST) > >MIME-Version: 1.0 > > > >Firstly, my apologies for this brief intrusion. I'm currently testing > >which subscribers of nznog are invalid. > > > >The easiest was for me to do this is to send each subscriber this > >brief email and then examine any bounces and errors. > > > >If you have any questions, please feel free to contact me (create a > >new email, don't reply to this or use the subject above, as it may > >interfere with my primitive automagic filtering technique). > > > >I will post a summary of these results to nznog early next week if > >not sooner. > > > > > > > >Thanks, and once again my apologies for this interruption. > > > > --cw -- Jeffrey A. Williams Spokesman for INEGroup - (Over 118k members strong!) CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 972-447-1800 x1894 or 214-244-4827 Address: 5 East Kirkwood Blvd. Grapevine Texas 75208 --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

[Fwd: nznog subscriber test (jwkckid1@ix.netcom.com)]
by Jeff Williams 31 Jul '01

31 Jul '01

Chris, What is this all about? Why is My E-mail being singled out? -- Jeffrey A. Williams Spokesman for INEGroup - (Over 118k members strong!) CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng. Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 972-447-1800 x1894 or 214-244-4827 Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

2 1

Broadband in Greenhithe?
by Juha Saarinen 31 Jul '01

31 Jul '01

Possible? A person there needs something quicker than dial-up for remote access etc. but was told that Jet{start|stream} isn't available in Greenhithe. The area is Black's Road, top of the ridge. Any advice would be appreciated... :-) -- Juha --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 2

New Zealand Network Operators' Group
by Donald Neal 31 Jul '01

31 Jul '01

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This list has around 260 subscribers, growing by a handful each month. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Telecom NZ Ltd. Neither of these organisations (nor the administrator) is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Subscribing to the List To subscribe to the NZNOG list, send email to majordomo(a)list.waikato.ac.nz, where the body of the message reads subscribe nznog There are at present no restrictions on who may subscribe to the list, or even on who may post to the list. A recent suggestion that posting be restructed to subscribers received little support. Digest Mailing List If you don't wish to receive postings as they are sent, you can instead subscribe to the nznog-digest mailiing list, on which all postings are sent out in a single "digest" every couple of days. Other Activities NZNOG does not at present have other regular activities than this mailing list. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IDGNet News: The fixed version
by IDGNetAdministrator＠idg.co.nz 26 Jul '01

26 Jul '01

This message has been sent to you by a user of IDGNet, New Zealand's leading I.T. information Website. Version as of 2:50 26/7/01 Privacy issue over mailing list archives Mailing lists that make archives of their postings publicly accessible on the internet could be in breach of the Privacy Act, according to an Auckland lawyer. http://www.idg.net.nz/webhome.nsf/UNID/29322B8165E1E256CC256A94001886CB?ope… For the latest in I.T. News, Reviews, Opinion and more visit http://idg.net.nz If you wish to block your email address from receiving further emails of this type please email nzwebmaster(a)idg.co.nz. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

5 4

FW: Help! Cistron major failure in production! (fwd)
by Matt Camp 26 Jul '01

26 Jul '01

Anyone had any experience with cistron radius? I'm suffering some sort of major magic weridy problem, if anyone has any ideas. --- Matt Camp ---------- Forwarded message ---------- Date: Wed, 25 Jul 2001 17:24:51 +1200 (NZST) From: Matt Camp <gargoyle(a)noise.net.nz> To: cistron-radius(a)lists.cistron.nl Subject: Help! Cistron major failure in production! I run a network of 4 cistron 1.6.3 servers on FreeBSD machines. This afternoon, all 4 of them stopped responding. Its as like the radiusd process isn't running. Neither our lucent NAS gear, radtest, or the various people who have proxys pointed at our servers get any response at all. The server logs, and console when running in -xxx mode show that the server starts, and then is just waiting for connections. Every 5 minutes, i propagate a new raddb/users file out from a central host. This system has worked fine for around 18 months now. On _ONE_ of the servers, if i restart it (totally. Kill and restart radiusd), the log shows "Wed Jul 25 17:21:38 2001: Info: Starting - reading configuration files ...", then there is nothing for approximately 4 minutes, after which it appears to process all the requests that have been sent to it during that time. (of course, most of them actually fail in reality since the NAS has long since dropped the call). Then it will run fine, up until it detects a new users file, and reloads the config files, at which point its back into total non-responsiveness until i manually restart it. This only works on one server. The other 3 don't come back at all, even after a restart. ANd they're all on the same config. (Which i rsync to them after making a change) radtest tests from localhost which normally work fine just act exactly as if the radiusd process isn't even running. I've tried everything i can think of, including the microsoft approach of power-cycling all machines involved. Load averages are normal, disk space is fine. Heaps of memory available. File descriptor loads seem ok, in that there are only around 100 or so connections to each box in total. (for the other services they run) Any ideas? This is urgent... I've got thousands customers who can't log in right now. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

xtra rejecting mail from mailing lists?
by Simon Blake 25 Jul '01

25 Jul '01

Hi folks I've got a mailing list on one of my servers that appears to have a bunch of xtra subscribers on it. Postings to the list get sent to about the first 10 xtra users, and then I start getting: Jul 25 21:49:03 wilbur qmail: 996054543.173139 delivery 2330: deferral: Connected_to_203.96.92.131_but_greeting_failed./Remote_host_said: _421_mta4-rme.xtra.co.nz_connection_refused_from_[203.97.152.50]/ It's a fairly unhelpful message from xtra, I assume it's some kind of antispam rate limiting thing - anybody know what they're up to? These things appear to get delivered later, since I've not had any grizzles about non delivery of mail (and there's nothing in the qmail queue). Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 13

RE: IDG article.
by David Buckingham 25 Jul '01

25 Jul '01

Privacy Act 1993 028 Commenced: 1 Jul 1993 VI: Codes of Practice and Exemptions from Information Privacy Principles Specific Exemptions 55 Certain personal information excluded 55. Certain personal information excluded---Nothing in principle 6 or principle 7 applies in respect of--- (a) Personal information in the course of transmission by post, telegram, cable, telex, facsimile transmission, electronic mail, or other similar means of communication; or (b) Evidence given or submissions made to--- (i) A Royal Commission; or (ii) A commission of inquiry appointed by an Order in Council made under the Commissions of Inquiry Act 1908,--- at any time before the report of the Royal Commission or commission of inquiry has been published or, in the case of evidence or submissions given or made in the course of a sitting open to the public, at any time before the Royal Commission or commission of inquiry has reported to the Governor-General; or (c) Evidence given or submissions made to a commission of inquiry or board of inquiry or court of inquiry or committee of inquiry appointed, pursuant to, and not by, any provision of an Act, to inquire into a specified matter; or (d) Information contained in any correspondence or communication that has taken place between the office of the Ombudsmen and any agency and that relates to any investigation conducted by an Ombudsman under the Ombudsmen Act 1975 or the Official Information Act 1982 or the Local Government Official Information and Meetings Act 1987, other than information that came into existence before the commencement of that investigation; or (e) Information contained in any correspondence or communication that has taken place between the office of the Commissioner and any agency and that relates to any investigation conducted by the Commissioner under this Act, other than information that came into existence before the commencement of that investigation. PRINCIPLE 6 Access to personal information (1) Where an agency holds personal information in such a way that it can readily be retrieved, the individual concerned shall be entitled--- (a) To obtain from the agency confirmation of whether or not the agency holds such personal information; and (b) To have access to that information. (2) Where, in accordance with subclause (1) (b) of this principle, an individual is given access to personal information, the individual shall be advised that, under principle 7, the individual may request the correction of that information. (3) The application of this principle is subject to the provisions of Parts IV and V of this Act. (This part is from section 6 of the act)... PRINCIPLE 7 Correction of personal information (1) Where an agency holds personal information, the individual concerned shall be entitled--- (a) To request correction of the information; and (b) To request that there be attached to the information a statement of the correction sought but not made. (2) An agency that holds personal information shall, if so requested by the individual concerned or on its own initiative, take such steps (if any) to correct that information as are, in the circumstances, reasonable to ensure that, having regard to the purposes for which the information may lawfully be used, the information is accurate, up to date, complete, and not misleading. (3) Where an agency that holds personal information is not willing to correct that information in accordance with a request by the individual concerned, the agency shall, if so requested by the individual concerned, take such steps (if any) as are reasonable in the circumstances to attach to the information, in such a manner that it will always be read with the information, any statement provided by that individual of the correction sought. (4) Where the agency has taken steps under subclause (2) or subclause (3) of this principle, the agency shall, if reasonably practicable, inform each person or body or agency to whom the personal information has been disclosed of those steps. (5) Where an agency receives a request made pursuant to subclause (1) of this principle, the agency shall inform the individual concerned of the action taken as a result of the request. -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Greg Clare Sent: Thursday, 26 July 2001 1:23 p.m. To: nznog(a)list.waikato.ac.nz Subject: RE: IDG article. Does this mean that what was originally reported and quoted as having been said by someone, has now been edited and changed? Does this constitute creative reporting? By chance does the article include an addendum to state that it has since been edited due to people or terms being mis-quoted... for the archive of course ;) Greg > -----Original Message----- > From: Simon Lyall [mailto:simon.lyall(a)ihug.co.nz] > Sent: Thursday, 26 July 2001 12:46 pm > To: nznog(a)list.waikato.ac.nz > Subject: IDG article. > > > Looks like they have gone through and changed all the mentions of > "newsgroups" to "mailing list" and changed other stuff around. > > This includes the the stuff in quotes. > > -- > Simon Lyall. | Newsmaster | Work: > simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: > simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IDG article.
by Simon Lyall 25 Jul '01

25 Jul '01

Looks like they have gone through and changed all the mentions of "newsgroups" to "mailing list" and changed other stuff around. This includes the the stuff in quotes. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: IDG article.
by Greg Clare 25 Jul '01

25 Jul '01

Does this mean that what was originally reported and quoted as having been said by someone, has now been edited and changed? Does this constitute creative reporting? By chance does the article include an addendum to state that it has since been edited due to people or terms being mis-quoted... for the archive of course ;) Greg > -----Original Message----- > From: Simon Lyall [mailto:simon.lyall(a)ihug.co.nz] > Sent: Thursday, 26 July 2001 12:46 pm > To: nznog(a)list.waikato.ac.nz > Subject: IDG article. > > > Looks like they have gone through and changed all the mentions of > "newsgroups" to "mailing list" and changed other stuff around. > > This includes the the stuff in quotes. > > -- > Simon Lyall. | Newsmaster | Work: > simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: > simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

prefix list update
by James Tyson 25 Jul '01

25 Jul '01

Can all Attica's BGP peers please update their filters: ip prefix-list attica-networks seq 5 permit 202.180.96.0/19 ip prefix-list attica-networks seq 10 permit 202.180.64.0/18 le 19 ip prefix-list attica-networks seq 15 permit 210.55.254.0/24 ip prefix-list attica-networks seq 20 permit 210.55.5.0/24 ip prefix-list attica-networks seq 25 permit 202.50.170.0/24 ip prefix-list attica-networks seq 30 permit 202.55.111.0/24 Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

RE: xtra rejecting mail from mailing lists?
by Jeremy Clyma 25 Jul '01

25 Jul '01

At 08:17 26/07/2001 +1200, Tech Support wrote: > >On Wed, 25 Jul 2001, Simon Blake wrote: > >> I've got a mailing list on one of my servers that appears to have a > >> bunch of xtra subscribers on it. Postings to the list get sent to about > >> the first 10 xtra users, and then I start getting: > >I had someone come up to me with this too. > >Apparently when they rang up the helpdesk about it they were told > >it wasn't xtra's problem. All I did was suggest they forward the > >bounce to postmaster(a)xtra hoping someone does read email there. > > > >With the 2 examples I saw, it was bouncing emails sent to domains that > >were not hosted at xtra. However emails were sent by xtra customers > >using xtra's smtp server. One of them tried xtra's smtp server after > >they had a problem sending from their own in-house smtp server (thus > >eliminating perhaps a possible problem with their server). > > > >I'll try to get the actual bounce emailed to me. I think it said > >something about being unable to relay email > > > >Lin > >Hmmm, perhaps Xtra subscribe to ORBS, and have blacklisted their own >server..... ;) /sv_tui_ad Yeah. Right. Looks like its a transient error, one which could be caused by the backoff limits we've got in place. Simon, do you know how many concurrent smtp connections was your server attempting to open? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fwd: 'we should all be uncomfortable with the extent to which luck..' (fwd)
by n.brownlee＠auckland.ac.nz 25 Jul '01

25 Jul '01

Hello all: You might find this article interesting reading ... Cheers, Nevil ------------------------------------------------------------- Nevil Brownlee Internet Researcher Phone: (858) 534 8338 CAIDA, San Diego ---------- Forwarded message ---------- Date: Tue, 24 Jul 2001 22:35:37 -0700 From: k claffy <kc(a)caida.org> To: nanog(a)nanog.org Cc: caida(a)caida.org Subject: 'we should all be uncomfortable with the extent to which luck..' david moore's analysis of code red: episode 0/1 is at http://www.caida.org/analysis/security/code-red/ [funded by DARPA's ITO office NGI/NMS programs, NSF ANIR, and CAIDA members, david a caida PI] definitely check out jeff brown's animation at bottom; watch carefully around 15:00 for pretty ominous elbow in infection rate (get an epidemiologist to look at it without telling them what it is...) 360,000 machines (well, IP addresses) infected in under 14 hours. from conclusion: // ..in the final analysis, we should all be uncomfortable with the extent to which luck, rather than proactive diligence, maintains the stability of the Internet infrastructure. // it goes without saying that many hosts are still vulnerable. and will likely remain so (to this or the next poison) until our luck runs out. do we expect the next version to have the two weaknesses christopher pointed out today? do we expect the next version won't clear every 3rd bit on the hard drive? almost makes me wonder if some white hat might (should?) have been behind CodeRed as some 'vaccination' attempt. "The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure," said Rasch. The good news is, there will be a global catastrophic failure." -- http://www.nando.net/technology/story/44887p-694372c.html the worse news is: protecting 'critical infrastructure' is far from enough. again from http://www.caida.org/analysis/security/code-red/ This assault also demonstrates that machines operated by home users or small businesses (hosts less likely to be maintained by a professional sysadmin) are integral to the robustness of the global Internet. As is the case with biologically active pathogens, vulnerable hosts can and do put everyone at risk, regardless of the significance of their role in the population. fwiw, caida trying to do gentle survey of patching speed, see http://worm-security-survey.caida.org/ k ps: john maddog hall (linux int'l) had a great slide a few months ago at UCSD talk; upshot something like INSTALLED BASE (EARTH) + 20 million linux systems + 450 million gates licenses ==> 4.4 - 6.6 % of the population total ... world population: ~6B ==> 5.4 billion people haven't selected an OS yet [k: maybe we can get them on OS-antioxidants before it's too late] --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: xtra rejecting mail from mailing lists?
by Tech Support 25 Jul '01

25 Jul '01

>On Wed, 25 Jul 2001, Simon Blake wrote: >> I've got a mailing list on one of my servers that appears to have a >> bunch of xtra subscribers on it. Postings to the list get sent to about >> the first 10 xtra users, and then I start getting: >I had someone come up to me with this too. >Apparently when they rang up the helpdesk about it they were told >it wasn't xtra's problem. All I did was suggest they forward the >bounce to postmaster(a)xtra hoping someone does read email there. > >With the 2 examples I saw, it was bouncing emails sent to domains that >were not hosted at xtra. However emails were sent by xtra customers >using xtra's smtp server. One of them tried xtra's smtp server after >they had a problem sending from their own in-house smtp server (thus >eliminating perhaps a possible problem with their server). > >I'll try to get the actual bounce emailed to me. I think it said >something about being unable to relay email > >Lin Hmmm, perhaps Xtra subscribe to ORBS, and have blacklisted their own server..... ;) Peter Gray Telstra Saturn Tech Support E-mail: tech(a)tsnz.net Phone: 0800 949 000 Fax: 04 922 8401 Website: www.netlink.net.nz PO Box 5358, Wellington, New Zealand "Smile," they said "things could be worse!" So I smiled, and things were worse.... --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

'we should all be uncomfortable with the extent to which luck..'
by k claffy 24 Jul '01

24 Jul '01

david moore's analysis of code red: episode 0/1 is at http://www.caida.org/analysis/security/code-red/ [funded by DARPA's ITO office NGI/NMS programs, NSF ANIR, and CAIDA members, david a caida PI] definitely check out jeff brown's animation at bottom; watch carefully around 15:00 for pretty ominous elbow in infection rate (get an epidemiologist to look at it without telling them what it is...) 360,000 machines (well, IP addresses) infected in under 14 hours. from conclusion: // ..in the final analysis, we should all be uncomfortable with the extent to which luck, rather than proactive diligence, maintains the stability of the Internet infrastructure. // it goes without saying that many hosts are still vulnerable. and will likely remain so (to this or the next poison) until our luck runs out. do we expect the next version to have the two weaknesses christopher pointed out today? do we expect the next version won't clear every 3rd bit on the hard drive? almost makes me wonder if some white hat might (should?) have been behind CodeRed as some 'vaccination' attempt. "The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure," said Rasch. The good news is, there will be a global catastrophic failure." -- http://www.nando.net/technology/story/44887p-694372c.html the worse news is: protecting 'critical infrastructure' is far from enough. again from http://www.caida.org/analysis/security/code-red/ This assault also demonstrates that machines operated by home users or small businesses (hosts less likely to be maintained by a professional sysadmin) are integral to the robustness of the global Internet. As is the case with biologically active pathogens, vulnerable hosts can and do put everyone at risk, regardless of the significance of their role in the population. fwiw, caida trying to do gentle survey of patching speed, see http://worm-security-survey.caida.org/ k ps: john maddog hall (linux int'l) had a great slide a few months ago at UCSD talk; upshot something like INSTALLED BASE (EARTH) + 20 million linux systems + 450 million gates licenses ==> 4.4 - 6.6 % of the population total ... world population: ~6B ==> 5.4 billion people haven't selected an OS yet [k: maybe we can get them on OS-antioxidants before it's too late] --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: anything going?
by Simon Lyall 24 Jul '01

24 Jul '01

On Wed, 25 Jul 2001, Matt Camp wrote: > Anyone know of any jobs going for experienced > IP/Cisco/Lucent/Unix/perl/php/database/networky type engineers that > don't suck? > > This ones getting kinda old, (the job, not the engineer) and the pay is > actually decreasing. You could apply at ihug Matt, someone with NT experience would be useful :) Actually does anyone know the best places to find jobs in the industry? , I notice that Telecom and I assume most of the others don't advertise a lot of their jobs online (or on their own websites). ObOperational: www.whitehouse.gov has akamai's themselves. Resume online here. | | V -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 5

Re: anything going?
by Donald Neal 24 Jul '01

24 Jul '01

Simon Lyall: >You could apply at ihug Matt, someone with NT experience would be useful :) >Actually does anyone know the best places to find jobs in the industry? , I >notice that Telecom and I assume most of the others don't advertise a lot >of their jobs online (or on their own websites). Telecom's jobs are at http://telecomnz.hire.com/joblist.html, which is linked to from the official web site. Donald Neal (who works for Telecom but generally does not speak for them) -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

anything going?
by Matt Camp 24 Jul '01

24 Jul '01

Anyone know of any jobs going for experienced IP/Cisco/Lucent/Unix/perl/php/database/networky type engineers that don't suck? This ones getting kinda old, (the job, not the engineer) and the pay is actually decreasing. --- Matt Camp Head Geek Mercury/Quicksilver --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

SuSe Linux Mirrors
by Matthew G Brown 23 Jul '01

23 Jul '01

Anyone Mirroring SuSe 7.x ? , 3.0 isn't cutting the mustard :) Matthew G Brown Tasman Solutions LTD --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Blank vendor letter
by Andrea Moran 23 Jul '01

23 Jul '01

Hi! How are you? I send you this file in order to have your advice See you later. Thanks

5 5

Fax to vendor
by Andrea Moran 23 Jul '01

23 Jul '01

Hi! How are you? I send you this file in order to have your advice See you later. Thanks

5 4

NZNOG Posting Policy
by Donald Neal 23 Jul '01

23 Jul '01

NZNOG People, At present, NZNOG accepts postings from anywhere. A previous effort to switch to accepting mail only from subscribed addresses was abandoned due to the inconveince caused. If anyone wishes another attempt made at that change, please contact me directly. Donald Neal List Administrator -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Antigen found Win32.SirCam.137216 (CA(Vet)) virus
by Antigen 23 Jul '01

23 Jul '01

Antigen for Exchange found Blank vendor letter.doc~pif infected with Win32.SirCam.137216 (CA(Vet)) virus. The file is currently Removed. The message, "Blank vendor letter", was sent from Andrea Moran and was discovered in SMTP Messages\Inbound located at JUNIPER/AMERICAS/BETA. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Antigen found Win32.SirCam.137216 (CA(Vet)) virus
by Antigen 23 Jul '01

23 Jul '01

Antigen for Exchange found Fax to vendor.doc~bat infected with Win32.SirCam.137216 (CA(Vet)) virus. The file is currently Removed. The message, "Fax to vendor", was sent from Andrea Moran and was discovered in SMTP Messages\Inbound located at JUNIPER/AMERICAS/BETA. --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Fax to vendor
by Steven Perich 23 Jul '01

23 Jul '01

Guys, Anyone with half a brain who's concerned about security wouldn't open this, I know, but I thought I'ld inform the masses of this as a friendly, public service announcement :-) Scan type: Realtime Protection Scan Event: Virus Found! Virus name: W32.Sircam.Worm(a)mm File: Fax to vendor.doc.bat Location: Mail System Action taken: Clean failed : Quarantine succeeded : Date found: Tue Jul 24 09:22:26 2001 Steve > -----Original Message----- > From: owner-nznog(a)list.waikato.ac.nz > [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Andrea Moran > Sent: Tuesday, July 24, 2001 09:06 > To: nznog(a)list.waikato.ac.nz > Subject: Fax to vendor > > > Hi! How are you? > > I send you this file in order to have your advice > > See you later. Thanks > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: Fax to vendor
by Greg Clare 23 Jul '01

23 Jul '01

WARNING:- This message contained a virus (W32.Sircam.Worm(a)mm). For more details refer:- http://service1.symantec.com/SUPPORT/nav.nsf/aab56492973adccd882569450055235 5/f75929f63f73df5f882569a80022dbd0?OpenDocument Norton Virus definitions dated 17 July 2001 or later will detect this recent worm. Regards Greg > -----Original Message----- > From: Andrea Moran [mailto:andrea(a)petrinamoran.freeserve.co.uk] > Sent: Tuesday, 24 July 2001 9:06 am > To: nznog(a)list.waikato.ac.nz > Subject: Fax to vendor > > > Hi! How are you? > > I send you this file in order to have your advice > > See you later. Thanks > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

(no subject)
by AngelaMcIntee＠aol.com 23 Jul '01

23 Jul '01

Can anyone tell me the physical address of the Sprint NAP in Pennsauken, NJ? Thanks, Angela --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Julian Angelo - Conclusion
by Donald Neal 22 Jul '01

22 Jul '01

<Multimedia>If you wish this posting to be a multimedia experience, go to http://www.netspace.org/~dmacks/internet-songbook/lart-lart-lart-the-spamme… and sing the contents of that page to yourself while reading.</Multimedia> NZNOG People, Three days ago I posted to this list, saying >Just over a year ago, there was discussion on this list of spamming by >one Julian Angelo. He has now approached me, asking to have these >references removed from the NZNOG archive. It seems that prospective >employers who look up his name on the web find these archive entries, a >fact which may not be helping his career any. >If any network operator has an objection to these entries being removed >from the archive, could they please contact me directly. I had a number of reasons for doing things in this way. For one thing, I do not see myself as owner in the usual sense of that word of this list or its archive. For another, the content of email sent to me in response to such an enquiry might conceivably be actionable. I also take the view that spammers are thieves who must be shown the error of their ways and encouraged to live useful, constructive lives. I am in principle very happy with the idea of editing the names of the guilty out of publicly-readable archives a suitable period after their offending ceases. The chance to gain useful employment would then be one of the reasons why they would give up their vile activities in the first place. My request to be contacted directly was followed by close to fifty emails to the list. Some had particularly disappointing content. The acceptable use policy for this list states that character assassination is unacceptable. It also states that discussion unrelated to Internet technical and operational matters is not appropriate. Discussions of a legal nature are particularly discouraged. This has not been a good week for this list's s/n ratio, nor for constructive discussion. I am all in favour of a certain amount of humour of questionable relevance, but there was little of that here. The only such contribution was Matt Camp's, which observed "I'm sure there's a lesson there. f33r the far-reaching p0w3rz of NZNOG! [...] we shall [...] smite the career prospects of spammers and script kiddies with our flaming LARTting tool of justice!" I have doubts about his spelling of LARTing, but I too am sure there's a lesson here. As I've already said, I see publicity and its withdrawal as a useful tool in encouraging spammers into the paths of righteousness. Regrettably, the point was not taken up by others. My thanks to those who did respond directly to me. The suggestion that by altering the archive's contents on any occasion I might become responsible for all of its content was one I had not previously considered. Other opinions expressed fell into two groups. Some subscribers believed that an apology was called for before Mr Angelo's name was removed from the archive, while others felt that archives should not ever be altered. Some of this latter group observed that archiving an apology from Julian Angelo would give prospective employers a full piucture of events. I count four subscribers in the first group and thirteen in the second. Removing from the count people I believe not to be staff of network operators, and the subscriber who expressed both opinions, leaves three in the first group and eight in the second. I feel myself to be bound by this expression of the views of subscribers, and will not seek to have the archives changed. At no point has anyone even implied to me that Julian Angelo has done anything wrong since the events of July 2000. I went into this thinking that was the question. Donald Neal List Administrator/Muggins <Multimedia>You can stop singing now.</Multimedia> -- Donald Neal Mobility & Calling Platforms Network Delivery Telecom New Zealand Ltd --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 21

[dranch@trinnet.net: How the IIS Red Worm works..]
by Dean Pemberton 21 Jul '01

21 Jul '01

> so which ISP in Wellington was it that is reported to have lost its servers > as a result of thei worm (reported in the Herald).... and did it really > infect/affect 250000 sites? > > Ian Dunno about the first one - but there is a portion in this article that talks to your second point. Dean ----- Forwarded message ----- Interesting.. From http://www.w2knews.com/subscribe.cfm?id=W2K -- Explanation As stated earlier the .ida "Code Red" worm is spreading throughout IIS Web servers on the Internet via the .ida buffer-overflow attack that was published last month. The following are the steps that the worm takes once it has infected a vulnerable Web server: Setup initial worm environment on infected system. Setup 100 threads of the worm. Use the first 99 threads to spread the worm (infect other Web servers). � The worm spreads itself by creating a sequence of random IP addresses. However, the worm's list of IP addresses to attack is not all together random. In fact, there seems to be a static seed (a beginning IP address that is always the same) that the worm uses when generating new IP addresses. Therefore every computer infected by this worm is going to go through the same list of "random" IP addresses. Because of this feature, the worm will end up re-infecting the same systems multiple times, and traffic will cross traffic back and forth between hosts ultimately creating a denial-of-service type effect. The denial-of-service will be due to the amount of data being transferred between all of the IP addresses in the sequence of random IP addresses. The worm could have done truly random IP generation and that would have allowed it to infect many more systems much faster. We are not sure why this was not done, but a friend of ours did pose an interesting idea: If the person who wrote this worm owned an IP address that was one of the first hundred or thousand to be scanned, then they could setup a "sniffer" and anytime and IP address tried to connect to port 80 on their server they would get confirmation that the IP address that connected to them was infected with the worm. With this knowledge, they would be able to create a list of the majority of systems that were infected by this worm. The 100th thread checks to see if it is running on an English (US) Windows NT/2000 system. � If the infected system is found to be a English (US) system, the worm will proceed to deface the infected system's website. The local Web server's Web page will be changed to a message that says: "Welcome to http://www.worm.com!, Hacked By Chinese!". This hacked Web page message will stay "live" on the Web server for 10 hours and then disappear. The message will not appear again unless the system is re-infected by another computer. � If the system is not an English (US) Windows NT/2000 system, the 100th worm thread is also used to infect other systems. Each worm thread checks for c:\notworm. � If the file c:\notworm is found, the worm goes dormant. � If the file is not found, each thread will continue to attempt to infect more systems. Each worm thread checks the infected computer's system time. � If the date is past the 20th of the month (GMT), the thread will stop searching for systems to infect and will instead attack www.whitehouse.gov. The attack consists of the infected system sending 100k bytes of data (1 byte at a time + 40 bytes overheard for the actually TCP/IP packet) to port 80 of www.whitehouse.gov. This flood of data (410 megabytes of data every 4 and a half hours per instance of the worm) would potentially amount to a denial-of- service attack against www.whitehouse.gov. � If the date is between the 1st and the 19th of the month, this worm thread will not attack www.whitehouse.gov and will continue to try to find and infect new Web servers. We have calculated that the worm can attempt to infect roughly half a million IP addresses a day. This is a rough estimate generated by testing on a very slow network. At the time of writing this document (July 19th, 3:00pm), we have had reports from administrators that have been probed by over 196 thousand unique hosts. This leads us to believe that this worm has infected at least 196 thousand computers. During testing we noticed that sometimes the worm does not execute "normally" and will continue to spawn new threads until the infected machine crashes and has to be rebooted, effectively killing itself. We have not been able to isolate the cause of this behavior. ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: the .ida "Code Red" worm - ISP suffers?
by PhoneNet 21 Jul '01

21 Jul '01

so which ISP in Wellington was it that is reported to have lost its servers as a result of thei worm (reported in the Herald).... and did it really infect/affect 250000 sites? Ian --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

China-diesel fuel injection 7/20
by china-lutong.com 20 Jul '01

20 Jul '01

hi: My name is ChenHua, and I'm writing on behalf of the China-Lutong mechanical company. Located in the south east of China, we specialize in hydraulic heads for the VE distributor pump. We can supply standard, good quality units at a very competitive price. The following types are available: Engine model VE PUMS code NO UNIT PRICE(EX WORK) ISUZU 4JB1 NP-VE4/11F1800LNP777 146402-0920 $USD40 ISUZU 4JB1 NP-VE4/11L(DENSO) 096400-1600 $USD40 ISUZU 4JB1 NP-VE4/11R 146402-0820 $USD45 ISUZU 4JA1 NP-VE4/11R 146402-3820 $USD45 ISUZU 4JA1 NP-VE4/12R 146430-1420 $USD45 CUMMINS 6BT NP-VE6/12F1050R381-7 1 468 336 423 $USD45 IVECO 8140 NP-VE4/11FR1900R127 1 468 334 798 $USD45 We use precision forging technology to create our products and surface treat them using an imported shot-blasting machine. The constant grinding process guarantees identical clearance in each plunger. Because we have been in the field of diesel fuel injection systems for quite a few years, we are acquainted with many domestic manufacturers of, and sales agents for, parts such as injector nozzles, plungers, delivery valves and so on. If you are interested in our products, please contact me. Thank you for your interest in our company. Best regards! C.Hua Sale & purchasing department director HTTP://WWW.China-LuTong.COM C.H(a)CHINA-LUTONG.COM

1 0

Full analysis of the .ida "Code Red" worm.
by Chris Rigby 19 Jul '01

19 Jul '01

I think this is something we should all be aware of for those of you not on bugtraq (which I hope most of you are.) This attack has gone from something like 0 hits in my web logs yesterday to 11 in the last 4 hours Some people are estimating over 12,000 hosts infected already. Also to worry about are later announcements that : "A notable side effect of this.. the worm signature is wreaking havoc with Cisco 675, 677, and 678 DSL routers that have the Web Based Configuration Interface enabled." since they lock up when "?" is sent to them in a URL. And apparently has issues for some 7500 size routers. The main thing I'm concenred over is that the worm is programmed to flood www.whitehouse.gov between 20:00pm and 23:59 (local system time). I'm not looking forward to what effect this might have on the internet. Escpecially the small outbound links in NZ. Chris Rigby Senior Systems Engineer IHUG - Into the Internet ---------- Forwarded message ---------- Date: Wed, 18 Jul 2001 22:40:11 -0700 From: Marc Maiffret <marc(a)eeye.com> To: BUGTRAQ <BUGTRAQ(a)securityfocus.com> Subject: Full analysis of the .ida "Code Red" worm. The following is a detailed analysis of the "Code Red" .ida worm that we reported on July 17th 2001. This analysis was performed by Ryan Permeh and Marc Maiffret of eEye Digital Security. The disassembly (complete with comments) was done by Ryan "Shellcode Ninja" Permeh. Table of Contents ================= 1. Introduction 2. Explanation 3. Commentary 4. Deep Analysis 5. Conclusion 6. Appendix 7. Credits You can get a copy of this analysis, commented disassembly, full IDA database, and binary of worm from http://www.eeye.com/html/advisories/codered.zip Introduction ============ On Friday July 13th we received packet logs and information from 2 network administrators that were experiencing large amounts of attacks targeting the recent .ida vulnerability that eEye Digital Security discovered (http://www.eeye.com/html/Research/Advisories/AD20010618.html) on June 18, 2001. After reviewing the logs sent to us we determined that in fact someone had released a worm into the Internet that was spreading rapidly through IIS web servers. The full analysis of the .ida "Code Red" worm has provided numerous new details as to the functionality and method of propagation of this worm. For instance this worms purpose ultimately seems to be to perform a denial of service attack against www.whitehouse.gov. Also it has been found that only US English Windows NT/2000 systems will show the defaced ("Hacked by Chinese !") web page. We've designated this the .ida "Code Red" worm, because part of the worm is designed to deface web pages with the text "Hacked by Chinese" and also because code red mountain dew was the only thing that kept us awake all last night to be able to disassemble this exploit even further. Explanation =========== As stated earlier the .ida "Code Red" worm is spreading throughout IIS web servers on the Internet via the .ida buffer overflow attack that was published weeks ago. The following are the steps that the worm takes once it has infected a vulnerable web server. 1. Setup initial worm environment on infected system. 2. Setup a 100 threads of the worm 3. The first 99 threads are used to spread the worm (infect other web servers). -The worm spreads itself by creating a sequence of random IP addresses. However, the worm's randomization of IP addresses to attack is not all together random. In fact there seems to be a static seed that the worm uses when generating new IP addresses to try to attack. Therefore every computer infected by this worm is going to go through the same list of random IP addresses to try to infect. The "problem" with that is that the worm is going to end up reinfecting systems and also end up crossing traffic back and forth between hosts to end up creating a denial of service type affect because of the amount of data that will be transferred between all the IP addresses in the sequence of random IP addresses. The worm could have done truly random IP generation and that would have allowed it to infect a lot more systems a lot faster. We are not sure why that was not done but a friend of ours did pose an interesting idea... If the person who wrote this worm owned an IP address that was one of the first hundred or thousand etc... to be scanned then they could setup a sniffer and anytime and IP address tried to connect to port 80 on their IP address they would know that the IP address that connected to them was infected with the worm and they would therefore be able to create a list of the majority of systems that were infected by this worm. 4. The 100th thread checks to see if it is running on a English (US) Windows NT/2000 system. -If the infected system is found to be a English (US) system then the worm will proceed to deface the infected systems website. That means... the local web servers web page will be changed to a message that says Welcome to http://www.worm.com !, Hacked By Chinese!. This hacked web page message will stay "live" on the web server for 10 hours and then disappear and never appear again unless the infected system is re-infected by another host. -If the system is not a English (US) Windows NT/2000 system then the 100th worm thread is also used to infect other systems. 5. Each worm thread checks for c:\notworm -If the file c:\notworm is found, the worm goes dormant. -If the file is not found then each thread will continue to attempt to infect more systems. 6. Each worm thread will now check the infected computers time. -If the time is between 20:00 UTC and 23:59 UTC then the worm will proceed to use this thread to attack www.whitehouse.gov. The attack consists of the infected system sending 100k bytes of data to port 80 of www.whitehouse.gov therefore potentially performing a denial of service attack against www.whitehouse.gov. -If the time is below 20:00 UTC then this worm thread will try to find and infect new web servers. In testing we have calculated that the worm can attempt to infect roughly half a million IP addresses a day and that was a ruff estimate made from using a very slow network. As of writing this document (July 18 6:49pm) we have had reports from administrators that have been probed by over 12 thousand unique hosts. That basically means at least 12 thousand hosts have been infected by this worm. In testing we have seen that sometimes the worm does not execute correctly and will continue to spawn new threads until the infected machine crashes and has to be rebooted. We have not been able to isolate the cause of this behavior. Commentary ========== As we sat and watched this worm spread itself through the Internet we were somewhat dumbfounded as to the number of reported systems being infected. The main reason for that is that this worm is using a, what we thought to be, very well known vulnerability. A patch for this vulnerability has been available for over a month now and at the time of the release of the vulnerability many news agencies ran stories about it therefore trying to spread awareness. Even with all of that though there have still been, at the very least, 12 thousand web servers infected by this worm. So we once again encourage administrators to pay attention to security issues and patch their systems as soon as patches are available for holes. All of this research would not be available if we were not a Full Disclosure company and if the many people who helped us research this worm were against full disclosure. Although we did not release any exploit code for the .ida vulnerability, the computer underground still had no problem creating a devastating worm. In the past we have seen a much higher percentage of patched systems when example exploit code was provided. System administrators do not believe vulnerabilities exist without a public exploit, or until something like this worm happens forcing them to patch their systems. We feel that if the security community moves away from Full Disclosure more incidents like this will happen and everyone will be left in the dark as to what is going on. An example of why full disclosure is so important would be this worm itself. Chances are this worm would have not been discovered if we had not fully disclosed details about the .ida vulnerability, allowing Intrusion Detection System vendors to create signatures for the .ida buffer overflow attack. Because of the way that IIS performs logging (logging a request after processing it), servers hit with this worm will actually have no traces of information left in the IIS log files making tracking this worm (via IIS logs) virtually impossible. The first instances of _anyone_ learning anything useful about this worm was via Intrusion Detection Systems that had signatures based on our .ida vulnerability research which would not have been there if not for full disclosure. The computer underground continues to find vulnerabilities everyday. If full disclosure goes away, then the general security community is left in the dark, and therefore so are administrators. More and more we are seeing an increase in worms attacking the Internet. There have been about 2 or 3 worms in as many months. Worms force computer security to become a global issue. With the rise of the Internet, not only do you have to worry about securing your own systems, you must also be careful of your "neighbors" systems. For instance with this worm even if you have done everything right (installed the .ida patch etc...) your network connection could still be taken down because of the amount of data flooding you from all of the "other guys" who hadn't applied patches and were infected by this worm. It is important to not only maintain your own security but make sure that other people you come in contact with secure their sites. Only with global cooperation to maintain security will the threat of worms start disappear. We received information from "friends" that leads us to believe that this worm is actually a derivative of another worm which was written to exploit the first ever remote IIS buffer overflow (also discovered by eEye Digital Security), the .htr buffer overflow. From reports, the .htr worm had a much smaller infection base and seemed to go under the radar probably because the .htr vulnerability was/is very old. Deep Analysis ============= The following is a very detailed analysis of what the worm is doing at each step of its infection. Full disassembled and commented worm code is available at our website at http://www.eeye.com/html/advisories/codered.zip. It will be provided as both a assembly text dump and as a IDA (Interactive Disassembler) database file. We have chosen not distribute the worm code in this eMail as to not clog up your bandwidth anymore then we already are >:-] Note: We will use CODEREF comments in the analysis to reference where we are in the disassembled code so you can "follow along" with us. The tools that we used to perform this detailed analysis were: IDA (Interactive Disassembler) from www.datarescue.com. IDA is an advanced disassembler that made this analysis possible. MS VC++ debugging environment. We used this to monitor modified pieces of the worm as they interacted with IIS. Ryan's brain + Marc's brain + private eEye tools. No... you cant have any of those. We will be heavily referencing the disassembled worm code in the following analysis. In an attempt to make this easier to understand we have broken the functionality of the worm into 3 parts. The core worm functionality, the worm hack web page functionality and the attack www.whitehouse.gov functionality. Core worm functionality ----------------------- 1. Initial infection vector (i.e. host is vulnerable to the .ida attack and gets hit with this worm). The initial infection starts to take place when a web server, vulnerable to the .ida attack, is hit with a HTTP get request that contains the necessary code to exploit the .ida attack and uses this worm as its payload. At the time of the .ida overflow a systems stack memory will look like the following: <MORE 4E 00> 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 92 90 58 68 4E 00 4E 00 4E 00 4E 00 4E 00 4E 00 FA 00 00 00 90 90 58 68 D3 CB 01 78 90 90 58 68 D3 CB 01 78 90 90 58 68 D3 CB 01 78 90 90 90 90 90 81 C3 00 03 00 00 8B 1B 53 FF 53 78 EIP is overwritten with 0x7801CBD3 which an address within msvcrt.dll. The code at 0x7801CBD3 disassembles to: call ebx When EIP is overwritten with call ebx it then causes program flow to divert back to the stack. The code on the stack jumps into the worm code that's held in the body of the initial HTTP request. 2. Sets up some initial stack variables CODEREF: seg000:000001D6 WORM At this point we are executing the initial code of the worm. The first thing to happen is that the worm sets up a new stack for its own use. The new stack is 218h bytes, filled with CCh. The worm code then moves on to initialize its function jump table. The entire worm heavily uses an EBP stack based memory offset system. This means that all variables are referenced as EBP-X values. On our website we have a document called worm-ebp.txt that attempts to track stack usage throughout the course of the worm code. 3. Load functions (create the "jump table") CODEREF: seg000:00000203 DataSetup The first thing the worm code does is reference the data portion of the exploit code at EBP-198h. The worm then needs to setup its internal function jump table. A function jump table is a stack based table used to store function addresses. It allows the worm to generate the function addresses at run time (This makes the worm have a better chance of executing cleanly on more systems). The technique used by this worm is what is called an RVA (Relative Virtual Addresses) lookup. Basically this means that all functions, or specifically GetProcAddress, are found within IIS itself. For more details on RVA please consult any good PE (Portable Executable, the executable file format for Microsoft platforms) documentation, or read through the assembly code of this worm. In a nutshell, RVA techniques are used to get the address of GetProcAddress. GetProcAddress is then used to get the address of LoadLibraryA. Between these two functions all other functions that the worm may need can be easily found. The worm uses these two functions to load the following functions: >From kernel32.dll: GetSystemTime CreateThread CreateFileA Sleep GetSystemDefaultLangID VirtualProtect >From infocomm.dll: TcpSockSend >From WS2_32.dll: socket connect send recv closesocket Finally the worm stores the base address of w3svc.dll which it will later use to potentially deface the infected website. 4. Check the number of threads the worm has created. CODEREF: seg000:00000512 FUNC_LOAD_DONE Here the worm seems to perform a WriteClient (Part of the ISAPI Extension API), sending "GET" back to the attacking worm. This possibly could be a way of telling attacking worms that they have successfully infected a new host. Next the worm code will count the number of worm threads already in action. If the number of threads is 100 then control is shifted to the Worm hack web page functionality. If the number of threads is below 100 then the worm creates a new thread. Each new thread is an exact replica of the worm (Using the same code base). The worm now continues its path of execution. 6. Checks for the existence of c:\notworm CODEREF: seg000:0000079D DO_THE_WORK There seems to be a to be built in "lysine deficiency" (See Jurassic Park, or Caesar's paper on this at www.rootkit.com) A "lysine deficiency" is a built in check to keep malicious code from spreading further. In this case the "lysine deficiency" is a check for the existence of the file c:\notworm. If this file exists then the worm will become dormant. This means it will not attempt to make connections out to other IP addresses to try to infect. If this file does not exist then the worm continues onto the next step. 7. Check the infected systems time (computer clock) CODEREF: seg000:00000803 NOTWORM_NO The worm will now check the infected systems local time (in UTC). If the hour is greater then 20:00 UTC then the worm will proceed to goto the first step of the attack www.whitehouse.gov functionality. If the time is less than 20:00 UTC then the worm will attempt to continue to try to infect new systems. 8. Infect a new host (send .ida worm to a "random" IP address on port 80). At this point the worm will resend itself to any IP addresses which it can connect to port 80 on. It uses multiple send()'s so packet traffic may be broken up. On a successful completion of send, it closes the socket and goes to step 6... therefore repeating this loop infinitely. Worm hack webpage functionality ------------------------------- This functionality is called after a hundred threads are spawned within the worm. 1. Check if local system default language is English us then goto step 6 of core worm functionality. CODEREF: seg000:000005FE TOO_MANY_THREADS The first thing the worm does is get the local codepage. A codepage specifies the local operating system language (I.E. English (US), Chinese, German etc...). It then compares the local codepage against 0x409. 0x409 is the codepage for English (US) systems. If the infected system is an English (US) system then the worm will proceed to deface the local systems webpage. If the local codepage is not English (US) then this worm thread will goto step 6 of core worm functionality. 2. Sleep for 2 hours. CODEREF: seg000:00000636 IS_AMERICAN This worm thread now sleeps for 2 hours. We anticipate that this is to allow the other worm threads to attempt to spread the infection before making a presence known via defacing the infected systems webpage. 3. Attempt to modify infected systems webpages in memory. CODEREF: seg000:0000064F HACK_PAGE This worm uses an interesting technique called "hooking" to effectively deface (alter) an infected systems webpages. Hooking is modifying code in memory to point to code that the worm provides. In this case the worm is modifying w3svc.dll to change the normal operation of a function called TcpSockSend. TcpSockSend is what w3svc.dll (IIS core engine) uses to send information back to the client. By modifying this, the worm is able to change data being written back to clients who request web pages of an infected server. To perform hooking, first the worm makes the first 4000h bytes of w3svc.dll's memory writable. In a normal situation the memory for w3svc.dll (and basically all mapped dll's) is read-only. It uses the function VirtualProtect to change the memory of w3svc.dll to be writable, saving the old state to a stack variable. It then uses the saved codebase of w3svc.dll (from step 3 of core worm functionality) as a start point to search the import table (again see PE header documentation) for the address of TcpSockSend. Once the address for TcpSockSend is located the worm then replaces TcpSockSend's actual address with an address within the worm. The address that TcpSockSend now points to is a function within the worm that will return the "Hacked by Chinese !" webpage. The CODEREF for this function is seg000:00000C9A FAKE_TCPSOCKSEND. This thread of the worm now sleeps for 10 hours. During this 10 hours all web requests to the infected server will return the "Hacked by chinese !" webpage. After the 10 hours is up this thread will return w3svc.dll to its original state, including re-protecting memory. Execution after this proceeds to step 6 of the core worm functionality. Attack www.whitehouse.gov functionality --------------------------------------- Sooner or later every thread within the worm seems to shift its attacking focus to www.whitehouse.gov. 1. create socket and connect to www.whitehouse.gov on port 80 and send 100k byes of data CODEREF: seg000:000008AD WHITEHOUSE_SOCKET_SETUP Initially the worm will create a socket and connect to 198.137.240.91 (www.whitehouse.gov/www1.whitehouse.gov) on port 80. CODEREF: seg000:0000092F WHITEHOUSE_SOCKET_SEND If this connection is made then the worm will create a loop that performs 18000h single byte send()'s to www.whitehouse.gov. CODEREF: seg000:00000972 WHITEHOUSE_SLEEP_LOOP After 18000h send()'s the worm will sleep for about 4 and a half hours. It will then repeat the attack against www.whitehouse.gov (goto step one of Attack www.whitehouse.gov functionality). Appendix ======== This is associated information about the "Code Red" worm including how to stop the worm, commentary on the worm, and dispelling common misconceptions about this worm. How to secure your system from this .ida "Code Red" worm? --------------------------------------------------------- Microsoft patch for this .ida vulnerability http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/ bulletin/MS01-033.asp The worm spreads itself to new vulnerable systems via the .ida vulnerability. Applying this patch will keep your server from being infected. However, as stated earlier, because of the way the worm creates its list of "random" IP addresses to attack, you could still be affected by a high traffic overload denial of service. eEye Digital Security Advisory for .ida vulnerability http://www.eeye.com/html/Research/Advisories/AD20010618.html We initially discovered the .ida vulnerability which is being used by this worm as its infection vector. The above advisory details our research of that specific vulnerability. We worked with Microsoft to help them create a patch for the .ida vulnerability. SecureIIS - Application firewall, stops known and unknown IIS vulnerabilities. http://wwww.eeye.com/secureiis We do produce a product that protects IIS web servers from attack which is one of the reasons that we were so quick to research this worm. Funny enough in our initial testing we couldn't get the worm to work because we forgot we had SecureIIS enabled on the lab web server. heh. I have been infected by this worm what can I do? ------------------------------------------------ The first thing you must do is goto the Microsoft security site, as referenced above, and install the .ida patch ASAP. The worm will remain in memory until you reboot your server so make sure to reboot after installing the .ida patch. I think I am infected, how can I tell? -------------------------------------- An infected system will show an increase in load (processor/network). It will also show a number of external connections (or attempts) to port 80 of random IP addresses. You can see this by doing a "netstat -an" from a MS-DOS prompt. Either way do not take any chances... if your system is missing the .ida patch then install it ASAP and reboot. How to setup your IDS to detect this specific worm? --------------------------------------------------- The following is part of the packet data that is sent for this .ida "Code Red" worm attack: GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0 Just add that to your IDS signature database. What are some common misconceptions about the "Code Red" worm? -------------------------------------------------------------- 1. It connects to worm.com. This worm only specifies www.worm.com in the initial HTTP GET request HOST: header and in the defaced page show on English (US) systems. This worm does _not_ connect to www.worm.com. This worm operates completely independent and can spread and infect systems without having a single point of failure. What that means is that this worm will be wild on the Internet until there is a _VERY_ high degree of systems that go and install the .ida patch. 2. This worm is based off of hsj's "proof of concept" .ida exploit. This worm is _NOT_ based off of hsj's "proof of concept" .ida exploit. His exploit code had no worm functionality. It was a simple exploit shell that had little to no implicit functionality. It was designed to prove to administrators the seriousness of this vulnerability so that they would install patches ASAP. Credits ======= Ken Eichman of Chemical Abstracts Service Matthew Asham of Left Coast Systems Corp and a large handful of administrators who gave us much needed data to piece this together. Signed, eEye Digital Security T.949.349.9062 F.949.349.9538 http://eEye.com/Retina - Network Security Scanner http://eEye.com/Iris - Network Traffic Analyzer http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities "Its not a virus! Its a worm!" - z3r0 c00l "Whats this one eat?" - l0rd n1k0n "th1s 0n3 34ts 11S s3rv3rs!" - ch4m3l30n h4ck3rs --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

17 35

Code Red --- request for logs (from NANOG)
by Chris Wedgwood 19 Jul '01

19 Jul '01

>From NANOG: From: "Steven M. Bellovin" <smb(a)research.att.com> To: nanog(a)merit.edu Cc: Balachander Krishnamurthy <bala(a)research.att.com> Subject: Re: Code Red -> Router Memory depletion? Date: Thu, 19 Jul 2001 20:39:31 -0400 Message-Id: <20010720003931.77D057B57(a)berkshire.research.att.com> X-Mailer: exmh version 2.1.1 10/15/1999 A colleague of mine, Balachander Krishnamurthy, is looking for Web server logs from sites that have been attacked by Code Red. He's working on analysis techniques to detect flash crowds, DDoS attacks, etc. Please reply directly to him (bala(a)research.att.com) if you can supply any data. (You can see the kind of stuff he's been doing by looking at some of his recent papers, at www.research.att.com/~bala/papers) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0