- NZNOG - lists.nznog.org

RE: [nznog] nz spam
by Juha Saarinen 18 Aug '03

18 Aug '03

On Tue, 19 Aug 2003, Matthew Poole wrote: > Was that burst a blood vessel seeing them all or buying all the products? > :P Hahaha... anyone even remotely tempted to "gain three inches", should read this first: http://www.azcentral.com/business/articles/0813enlargement-pills13-ON.html > Seriously though, nice bit of investigative journalism. It's always good > to give <adjective> <adjective> <adjective> such as this one a good > LARTing, even if the T in this case was something other than the preferred > clue-by-four. Thanks. I just hope that Atkinson sticks to what he promised. -- Juha Saarinen

3 2

nz spam
by Thomas Salmen 18 Aug '03

18 Aug '03

so this is your fault juha http://www.nzherald.co.nz/storydisplay.cfm?storyID=3518682&thesection=news&t hesubsection=general

5 7

RE: [nznog] Weird pings
by Drazen Babich 18 Aug '03

18 Aug '03

Looks to be related to the stuff below : http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.htm l <http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.ht ml> PSS Security Response Team Alert - New Worm: Nachi, Blaster-D, Welchia<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /> SEVERITY: CRITICAL DATE: 08/18/2003 PRODUCTS AFFECTED: Windows 2000 and XP, Internet Information Services 5.0 ********************************************************************** WHAT IS IT? A new worm is spreading in the wild. The Microsoft Product Support Services Security Team is issuing this alert to advise customers to be on the alert for this virus as it spreads in the wild. Customers are advised to review the information and take the appropriate action for their environments. IMPACT OF ATTACK: Network Propagation, Patch Installation TECHNICAL DETAILS: Similar to the earlier Blaster worm and its variants, this worm also exploits the vulnerability patched by Microsoft Security Bulletin MS03-026, and instructs target systems to download its copy from the affected system using the TFTP program. In addition to exploiting the RPC vulnerability patched by Microsoft Security Bulletin <?xml:namespace prefix = st2 ns = "schemas-microsoft-com/microsoft" />MS03-026 this worm also uses a previously patched vulnerability in Microsoft Security Bulletin MS03-007 directed at IIS 5.0 over port 80 to propagate to un-patched systems. In addition upon successful infection this worm also patches systems with the patch for Microsoft Security Bulletin MS03-026. It does this by first determining the operating system and then downloading the associated patch for that operating system. For additional details on this worm from anti-virus software vendors participating in the Microsoft Virus Information Alliance (VIA) please visit the following links: Network Associates: http://vil.nai.com/vil/content/v_100559.htm <http://vil.nai.com/vil/content/v_100559.htm> Trend Micro: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAST .D <http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_MSBLAS T.D> Symantec http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.htm l <http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.ht ml> For more information on Microsoft's Virus Information Alliance please visit this link: http://www.microsoft.com/technet/security/virus/via.asp <http://www.microsoft.com/technet/security/virus/via.asp> Please contact your Antivirus Vendor for additional details on this virus. PREVENTION: Turn on Internet Connection Firewall (Windows XP or Windows Server 2003) or use a third party firewall to block incoming TCP ports 80, 135, 139, 445 and 593; UDP ports 135, 137, 38. To enable the Internet Connection Firewall in Windows XP please see the instructions below or visit this Knowledge Base Article: http://support.microsoft.com/?id=283673 <http://support.microsoft.com/?id=283673> * In Control Panel, double-click Networking and Internet Connections, and then click Network Connections. * Right-click the connection on which you would like to enable ICF, and then click Properties. * On the Advanced tab, click the box to select the option to Protect my computer or network. This worm utilizes two previously-announced vulnerabilities as part of its infection method. Because of this, customers must ensure that their computers are patched for the vulnerabilities that are identified in the following Microsoft Security Bulletins. Microsoft Security Bulletin MS03-026 http://www.microsoft.com/technet/security/bulletin/MS03-026.asp <http://www.microsoft.com/technet/security/bulletin/MS03-026.asp> Microsoft Security Bulletin MS03-007 http://www.microsoft.com/technet/security/bulletin/MS03-007.asp <http://www.microsoft.com/technet/security/bulletin/MS03-007.asp> In order to assist customers with the installation of the patch for Microsoft Security Bulletin MS03-026 Microsoft has released a tool which can be used to scan a network for the presence of systems which have not had the MS03-026 patch installed. More details on this tool are available in Microsoft Knowledge Base article 826369. RECOVERY: If your computer has been infected with this virus, please contact your preferred antivirus vendor or Product Support Services for assistance with removing it. RELATED KB ARTICLES: http://support.microsoft.com/default.aspx?scid=kb;en-us;826234 This article will be available within 24 hours. RELATED SECURITY BULLETINS: Microsoft Security Bulletin MS03-026 http://www.microsoft.com/technet/security/bulletin/MS03-026.asp <http://www.microsoft.com/technet/security/bulletin/MS03-026.asp> Microsoft Security Bulletin MS03-007 http://www.microsoft.com/technet/security/bulletin/MS03-007.asp <http://www.microsoft.com/technet/security/bulletin/MS03-007.asp> VIRUS ALERT LINK: http://www.microsoft.com/technet/security/virus/alerts/nachi.asp <http://www.microsoft.com/technet/security/virus/alerts/nachi.asp> As always please make sure to use the latest Anti-Virus detection from your Anti-Virus vendor to detect new viruses and their variants. -----Original Message----- From: Perry Lorier [mailto:perry(a)deeper.co.nz] Sent: Tuesday, 19 August 2003 1:09 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Weird pings _____ This e-mail message has been scanned and cleared by MailMarshal at www.gen-i.co.nz <http://www.gen-i.co.nz> _____

1 0

Weird pings
by Perry Lorier 18 Aug '03

18 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is everyone else seeing ICMP echo request packets sent to random IP's from what appear to be insecure windows machines? The pings seem to be appearing every few minutes, and don't seem to be isolated to any particular ISP, or even anywhere in particular in the world, which is easily confirmed by ssh'ing to machines in the US and EU and doing tcpdump and seeing exactly the same traffic. The pings look like: 00:53:59.511049 61.85.33.233 > xx.xx.xx.xx: icmp: echo request (ttl 114, id 32026, len 92) 0x0000 4500 005c 7d1a 0000 7201 028e 3d55 21e9 E..\}...r...=U!. 0x0010 xxxx xxxx 0800 fba0 0400 a309 aaaa aaaa .m.M............ 0x0020 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................ 0x0030 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................ 0x0040 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa ................ 0x0050 aaaa aaaa aaaa aaaa aaaa aaaa ............ This seems to have been going on for quite a long time (a week? two weeks?) and the source addresses seem rather varied. Current speculation is that this is an attack on the source address done by spoofing the source to be the target and sending to legitimate destination addresses. Does anyone have any more information? - -- Xerox does it again and again and again and ... -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Only when you are sure they have you, can you stop being paranoid iD8DBQE/QM/rcAgRpy8z8UQRAjAIAKC8So3A3cRgOuIjJYx9M6GwMMQ0ewCgj5+u kmG5NtMLnUx71k7c6eyQpyI= =LEDs -----END PGP SIGNATURE-----

6 6

RE: [nznog] blaster worm
by Simon Byrnand 17 Aug '03

17 Aug '03

At 14:16 16/08/2003 +1000, Nathan Mercer wrote: >If you are having problems with WU can I suggest you try this URL >https://v4.windowsupdate.microsoft.com/en/default.asp > >Cheers >Nathan Yep that works, it reports updates that are needed. However, two days later and the normal Windows Update URL, that everyone else in the world uses, still doesn't work - it just reports that there are no updates needed, and it doesn't perform the scanning step (33%....66%) that it should. I just checked on a Windows 2000 machine that hadn't already been updated for the Blaster Worm, and the normal Windows Update (as accessed from the Start menu or through Tools -> Windows Update) cheerfully announced that there were no critical updates (or indeed updates of any kind) while your link revealed that the patch was needed. I wonder just how widespread this is and how many people are getting lulled into a false sense of security thinking they're protected against the worm because Windows Update doesn't offer any updates.... Regards, Simon

1 0

RE: [nznog] blaster worm
by Nathan Mercer 17 Aug '03

17 Aug '03

Infected systems begin the attack when their system clocks reach 16 August, and continue until December 31. From January through July, infected systems will only conduct the DDoS attack from the 15th through the end of each month Nathan -----Original Message----- From: Steve Withers [mailto:swithers(a)mmp.org.nz] Sent: Saturday, 16 August 2003 12:52 a.m. To: NZ NOG Subject: Re: [nznog] blaster worm On Fri, 2003-08-15 at 23:22, Malcolm Lockyer wrote: > Should be a more interesting 24 hours then eh? :-| It's supposed to start on the 16th.....do we know for sure if it is set to stop on the 17th? Or will it keep going until the PCs concerned are disconnected from the network? -- Steve Withers <swithers(a)mmp.org.nz> _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

7 6

RE: [nznog] microsoft.com
by Jithen Singh 16 Aug '03

16 Aug '03

Whoops !! Sorry, missed that .. -----Original Message----- From: Craig Spiers [mailto:craig(a)concept.net.nz] Sent: Sunday, 17 August 2003 5:57 p.m. To: 'Jithen Singh' Cc: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] microsoft.com Friday august 1.. Last Friday was Friday august 15th.. :) -----Original Message----- From: Jithen Singh [mailto:jsingh(a)net4u.co.nz] Sent: Sunday, August 17, 2003 5:55 PM To: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] microsoft.com Microsofts downtime on Friday was in fact due to a denial of service attack http://www.microsoft.com/homepage/features/2003/denialofservice.htm Quote : "Overnight, microsoft.com has suffered an outage of a little over an hour. Microsoft have posted to the effect that this was caused by a [presumably non-http] denial of service that is not associated with any known vulnerability in Microsoft's own software. Speculation on Information Week that the outage might be part of a broader attack on internet infrastructure or linked to the start of the Defcon conference seems implausible, as only one other Fortune 100 site has shown an outage in the last 24 hours. Three of the 52 leading hosting providers monitored by Netcraft are showing outages in the last 24 hours, but all three are outside the US." Regards, Jithen -----Original Message----- From: Barry Murphy [mailto:barry(a)unix.co.nz] Sent: Saturday, 16 August 2003 6:12 p.m. To: Craig Spiers Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] microsoft.com Contentm not logs. They have 31gig or something (stand to be corrected, just read the link), but they currently have 102gig of content. If they creating 4gig of content a day, that would mean in 25 days they would have 204gigs of content. Surely this cannot be correct. Maybe it's just the beers doing the math, but thats the way I understand it. Barry ----- Original Message ----- From: "Craig Spiers" <craig(a)concept.net.nz> Cc: <nznog(a)list.waikato.ac.nz> Sent: Saturday, August 16, 2003 6:06 PM Subject: RE: [nznog] microsoft.com > That would be about right.. Logfiles and all.. > > Surely they don't keep logs more than 7 days :) > > -----Original Message----- > From: Barry Murphy [mailto:barry(a)unix.co.nz] > Sent: Saturday, August 16, 2003 6:05 PM > To: Nathan Mercer; Juha Saarinen > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] microsoft.com > > Sorry, it also says on the MS site ... > > "102 GB of content" then goes on to say "Content created around the clock. > Approximately 4 GB of new and updated content published daily". That > would mean that every 25 days it would create or update the same > amount of content > that is currently on the server. Surely this isnt correct? > > Barry > > ----- Original Message ----- > From: "Nathan Mercer" <nmercer(a)microsoft.com> > To: "Juha Saarinen" <juha(a)saarinen.org> > Cc: <nznog(a)list.waikato.ac.nz> > Sent: Saturday, August 16, 2003 5:32 PM > Subject: RE: [nznog] microsoft.com > > > Microsoft.com is run on IIS6 with Windows Server 2003 > http://www.microsoft.com/backstage/inside.htm > > Akamai provide a content distribution network and dns to get download files > closer to end users to improve the overall end user experience by > speeding up file downloads. > > http://uptime.netcraft.com/up/graph?site=www.microsoft.com reports > that MS is running IIS6 on Linux! How is that possible? > > http://uptime.netcraft.com/up/accuracy.html#impossible > > Why do you report impossible operating system/server combinations ? > > Webservers that operate behind a caching system, load balancer, > reverse proxy server or a firewall may sometimes report the operating > system of the > intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate > that either the web server is behind a Linux server that is acting as > a reverse proxy, or has configured the Akamai caching system such that > the first request to the site goes to one of Akamai's servers [which > run Linux], > or as in the case of www.walmart.com has been configured to send a > misleading signature. > > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Saturday, 16 August 2003 9:12 a.m. > To: Joe Abley > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] microsoft.com > > Joe Abley wrote: > > > That power outage knocked out bits of the North Eastern US and most > > of > > > South-Western Ontario (including my house -- still no power here, > > just > > > laptops and cellphones). To the best of my knowledge most > > Microsoft-branded services are served out of Redmond, and Hotmail is > in > > the Bay Area somewhere (used to be in an MFN/AboveNet facility in > > San Jose, but I seem to remember they moved a while ago). > > > > Most large exchange facilities in New York seem to have survived on > > battery and diesel power, and I don't believe the outage stretched > > as far as Virginia (where it might have stood a fighting chance of > > impacting some high concentrations of network operators). > > > > So probably not related to the power outage. > > It's also interesting to note that a good chunk of Microsoft's Web > content is served from Linux boxes. "Akamaighost" apparently runs on Linux. > > Here's an example: > > http://uptime.netcraft.com/up/graph?site=a100.ms.a.microsoft.com > > Looks like Windows Update arrives to you via Linux as well. > > -- > Juha > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] microsoft.com
by Nathan Mercer 16 Aug '03

16 Aug '03

Microsoft.com is run on IIS6 with Windows Server 2003 http://www.microsoft.com/backstage/inside.htm Akamai provide a content distribution network and dns to get download files closer to end users to improve the overall end user experience by speeding up file downloads. http://uptime.netcraft.com/up/graph?site=www.microsoft.com reports that MS is running IIS6 on Linux! How is that possible? http://uptime.netcraft.com/up/accuracy.html#impossible Why do you report impossible operating system/server combinations ? Webservers that operate behind a caching system, load balancer, reverse proxy server or a firewall may sometimes report the operating system of the intermediate machine. Hence reports of 'Microsoft/IIS on Linux' may indicate that either the web server is behind a Linux server that is acting as a reverse proxy, or has configured the Akamai caching system such that the first request to the site goes to one of Akamai's servers [which run Linux], or as in the case of www.walmart.com has been configured to send a misleading signature. -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Saturday, 16 August 2003 9:12 a.m. To: Joe Abley Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] microsoft.com Joe Abley wrote: > That power outage knocked out bits of the North Eastern US and most of > South-Western Ontario (including my house -- still no power here, just > laptops and cellphones). To the best of my knowledge most > Microsoft-branded services are served out of Redmond, and Hotmail is in > the Bay Area somewhere (used to be in an MFN/AboveNet facility in San > Jose, but I seem to remember they moved a while ago). > > Most large exchange facilities in New York seem to have survived on > battery and diesel power, and I don't believe the outage stretched as > far as Virginia (where it might have stood a fighting chance of > impacting some high concentrations of network operators). > > So probably not related to the power outage. It's also interesting to note that a good chunk of Microsoft's Web content is served from Linux boxes. "Akamaighost" apparently runs on Linux. Here's an example: http://uptime.netcraft.com/up/graph?site=a100.ms.a.microsoft.com Looks like Windows Update arrives to you via Linux as well. -- Juha _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

5 7

RE: [nznog] blaster worm
by Nathan Mercer 16 Aug '03

16 Aug '03

We're experiencing increased traffic levels, but its not DoSing us. You might be interested in reading some more about the Blaster worm here Recommendations to ISPs Regarding the Blaster Worm http://www.microsoft.com/serviceproviders/security/isp_blaster.asp There is a Word DOC there with some more info. You can read with the Word viewer downloadable here http://download.microsoft.com/download/word2000/wd97vwr/2000/WIN98/EN-US /wd97vwr32.exe Nathan -----Original Message----- From: Barry Murphy [mailto:barry(a)unix.co.nz] Sent: Saturday, 16 August 2003 9:45 a.m. To: Nathan Mercer Cc: NZ NOG Subject: Re: [nznog] blaster worm Nathan, Are you aware of microsoft being affected from the DDoS of this virus yet? Seeing as you people will probably hear first off.

6 5

spam farms
by Liz Q 16 Aug '03

16 Aug '03

Is there anything that can be done about these 'Spam Farms' ? ie Companies that take 30+ C classes have a domain for every c class and set up reverse and forward mx<num>@<domain> for each ip. They appear to be designed purely for spam and One company in particular ive been having issues with, appear to own a couple hundred C class. Is there any way they can be mass listed with spam servers? Liz Q

1 0

RE: [nznog] blaster worm
by Nathan Mercer 16 Aug '03

16 Aug '03

www.windowsupdate.com isn't used for anything. It used to redirect to windowsupdate.microsoft.com If customers need to download patches they should be going to Windows Update link in their start menus which goes to windowsupdate.microsoft.com or www.windows.com 30 mins to go... Regards Nathan Microsoft NZ -----Original Message----- From: Malcolm Lockyer [mailto:ipvariance(a)hotmail.com] Sent: Friday, 15 August 2003 11:23 p.m. To: lennon(a)orcon.net.nz; simon.lyall(a)ihug.co.nz Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] blaster worm --snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas! _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 6

blaster worm
by Simon Lyall 15 Aug '03

15 Aug '03

According to published docs on the worm it attacks "windowsupdate.com" which maps to ip's in 204.79.188.0/24 However checks to my cache logs show that nothing ever goes to plain old http://windowsupdate.com . Everything goes to download.windowsupdate.com , www.download.windowsupdate.com or something else. Even www.windowsupdate.com points elsewhere. In fact a glance though cache logs so nothing going anywhere near the 204.79.188.0/24 network. Even better the 204.79.188.0/24 is a /24 all by itself advertised as a /24. Does this mean: 1. It's safe to null route this network. 2. Microsoft will withdraw the advertisement for the network if the going gets tough. I notice that there is no route for the network on route-server.cw.net already. Thoughts? -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

11 11

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

If you are having problems with WU can I suggest you try this URL https://v4.windowsupdate.microsoft.com/en/default.asp Cheers Nathan -----Original Message----- From: Jithen Singh [mailto:jsingh(a)net4u.co.nz] Sent: Saturday, 16 August 2003 10:06 a.m. To: 'Simon Byrnand'; 'Barry Murphy' Cc: 'NZ NOG' Subject: RE: [nznog] blaster worm According to articles posted on the web, Microsoft installed Windows Update from scratch (fresh install), and since then, updates that needed downloading have failed to show. Some have suggested changing the language to EN-US and this will fix the problem, but I have yet to see proper solution as yet. Regards Jithen -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:57 a.m. To: Barry Murphy Cc: NZ NOG Subject: Re: [nznog] blaster worm > Nathan, > > Are you aware of microsoft being affected from the DDoS of this virus yet? > Seeing as you people will probably hear first off. > > P.S. I dont want you to loose your job so you can mail me off list if > you > like:) > > Barry I don't know about direct effects of the worm, but both windows update and the microsoft sites in general seemed to be down for many hours yesterday afternoon.... maybe it was just a huge influx of people trying to get at the patches, or maybe some server upgrades went awry...(apparently MS were going to increase their web serving capacity...) Also I tried Windows Update from a Windows 2000 machine just now and although it appears to be working, all is not well because it reports "There are no updates available for your computer" when I know full well that it normally keeps insisting that I install the .NET stuff and Media player 9. (And a few other things under the windows section that I normally refuse to install) Perhaps MS have temporarily suspended downloading of "non critical" updates to reduce the server load from people who go to windows update primarily to get the security related updates.... Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

You're correct. We never used windowsupdate.com for anything, none of our stuff points to it at all - it was only a redirect site. There was a redirect in place going from windowupdate.com to windowsupdate.microsoft.com up until about 9pm NZ time last night. Cheers Nathan -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:33 a.m. To: Kerry Thompson Cc: NZ NOG Subject: RE: [nznog] blaster worm > windowsupdate.com has been pulled my MS. > See > > http://slashdot.org/article.pl?sid=03/08/15/1730200&mode=thread&tid=109& tid=126&tid=172&tid=187 > > I believe they've shifted to windowsupdate.microsoft.com I wouldn't say they've "shifted" to windowsupdate.microsoft.com. As far as I'm aware, thats always been the actual URL of windows update pretty much since day one. I've been using windowsupdate.microsoft.com as the URL for years now.... Maybe they had a redirection page at windowsupdate.com or just mirrored that URL as well. If the worm really targets windowsupdate.com and not windowsupdate.microsoft.com then the worm author isn't as smart as they'd like to think they are :) (big surprise there huh....) Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 5

Nauru
by Jon Leeman 15 Aug '03

15 Aug '03

>What is Nauru? and do you connect via telstra clear; they the only ISP i >know that connect via reach. That's the fourth, private query from members of this list I've had..............look north from NZ and it's just below the equator..........Nauru is known as the 'smallest' sovereign nation (if you discount the Vatican) on the planet...........google for Nauru + "phosphate" (or "John Howard's Pacific Solution", "Money Laundering", etc.. Internet access is via a 64/64 Kbps link with an F3 IDR ES using IntelSat and Telstra Reach. I'm an Oz 'expat' resident (14+ years). Rgds., Jon Jon Leeman .nr ccTLD Technicial Contact ISP Technician CenpacNet Inc. Republic of Nauru e: jleeman(a)cenpac.net.nr w: www.cenpac.net.nr

1 0

APE route servers
by Andy Linton 14 Aug '03

14 Aug '03

Those of you who use our route servers should use the Looking Glass at http://www.wix.net.nz/cgi-bin/mrlg-ape.cgi to check that you are peering with both route servers. Some of you have a session with rs1 but not with rs2. It would make sense for you to add the second server for redundancy. The configuration details are identical apart from the IP address of the BGP peer. 192.203.154.2 instead of 192.203.154.1.

3 2

Re: [nznog] blaster worm
by Malcolm Lockyer 14 Aug '03

14 Aug '03

--snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas!

2 1

OT: MP3 Players
by Dan Clark 12 Aug '03

12 Aug '03

Hey did anyone else get one of these MP3 players My version of the manual has no page 9 and 2 page 10's incl 2 covers ?? Also, how do ya get it to be recognised in WinXP? Kind Regards, Dan Clark Network Manager Scarfies.Net Ltd

6 5

ISPs / Sites blocking IPs?
by Steve Withers 10 Aug '03

10 Aug '03

All I'm on a TelstraClear / paradsie cable modem. When I try to access the web site for the "Indepednent" in the UK, I get: Access Denied You don't have permission to access "http://news.independent.co.uk/uk/environment/story.jsp?" on this server. I'm thinking they have started blocking IPs they may consider possible sources of SPAM.... Has anyone else seen this? Can everyone else access this site from their networks? I'm on 203.96.144.119. -- Steve Withers <swithers(a)mmp.org.nz>

4 3

Full URL
by Steve Withers 10 Aug '03

10 Aug '03

Sorry...the full URL is: http://news.independent.co.uk/uk/environment/story.jsp?story=431319 -- Steve Withers <swithers(a)mmp.org.nz>

1 0

Error
by Sahil Gupta - NET4U LIMITED 10 Aug '03

10 Aug '03

Apologies, the network is 202.50.167.0/24 and not 202.50.267.0/24 Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

Prefix-List Update for Net4U Limited (AS23746)
by Sahil Gupta - NET4U LIMITED 10 Aug '03

10 Aug '03

Hi, Could ISP's currently peering with Net4U at APE kindly add the below listed network to the net4u's current prefix-list: 202.50.267.0/24 A full prefix-list is attached. Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

RE: [nznog] Re:Domain Name Scams
by Paul Adshead 10 Aug '03

10 Aug '03

It is to be fair, incredibly simple to find out most of the information regarding the allocation of a domain. Just go to the main DomaiNZ page: www.domainz.net.nz and enter your (NZ) domain name into the search box on the left. After selecting OK, then a warning about not being able to use this information for any other purpose appears - and this warning automatically disappears after a few seconds anyway. After this, then all of the details for the queried domain appear! As the warning message automatically disappears, then the content of the warning is probably not legally enforceable anyway - you could have been looking away from your screen at that point! They should have a "Yes I've read the above agreement" checkbox before you can proceed... Possible ways that the scam has found out the contact info: - if you knew enough about HTML, ASP and VB, it would be simple enough to write a program that once every five seconds sent a request to the DomaiNZ webserver starting at "a.co.nz" and finishing at "zzzzzzz999.net.nz", to find out the information for the various domains - it would take a while though; - you could use an 'electronic dictionary' of words in order to cut down on the unlikely examples; - there is also probably an online listing somewhere, of all of the currently active companies in New Zealand, you could then just try "<company name>.co.nz" and "<company name>.net.nz". There are far too many ways that people could have done it. I'm not condoning what has happened and have not done so myself, I'm just trying to explain how easy it is to do so. I was hit with three renewals too... Paul Adshead Network and Systems Manager OTL Software Ltd www.otl.co.nz -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 8 August 2003 13:04 To: PhoneNet Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Re:Domain Name Scams On Fri, 8 Aug 2003, PhoneNet wrote: > I have today received 5 letters from The Domain Registry of America, > Melbourne (posted in UK) asking me to re-register some of my domains as > they are due to expire - so they are at it also. Got one here as well, and what bothers me is that although the domain in question is registered under my own name, the letter was addressed to my company, which doesn't appear in whois data anywhere. Somebody's been trawling... -- Juha Saarinen _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

5 5

FW: [nznog] Re:Domain Name Scams
by Tim John 09 Aug '03

09 Aug '03

> Just go to the main DomaiNZ page: www.domainz.net.nz and > enter your (NZ) > domain name into the search box on the left. After selecting > OK, then a > warning about not being able to use this information for any > other purpose > appears - and this warning automatically disappears after a > few seconds > anyway. After this, then all of the details for the queried > domain appear! > As the warning message automatically disappears, then the > content of the > warning is probably not legally enforceable anyway - you > could have been > looking away from your screen at that point! They should > have a "Yes I've > read the above agreement" checkbox before you can proceed... > Actually, the warning message appears on the Domainz homepage, the 'SRS is being queried' page and the results page. It only disappears when the page reloads with the results. It's only a GUI'd representation of a WhoIs query. On registration, there is a physical need to click a "I've read the terms of service" button, but at the end of the day, any information entered as part of a domain name registration is available in the public domain. Tim > Possible ways that the scam has found out the contact info: > - if you knew enough about HTML, ASP and VB, it would be > simple enough to > write a program that once every five seconds sent a request > to the DomaiNZ > webserver starting at "a.co.nz" and finishing at > "zzzzzzz999.net.nz", to > find out the information for the various domains - it would > take a while > though; > - you could use an 'electronic dictionary' of words in order > to cut down on > the unlikely examples; > - there is also probably an online listing somewhere, of all of the > currently active companies in New Zealand, you could then > just try "<company > name>.co.nz" and "<company name>.net.nz". > > There are far too many ways that people could have done it. > > I'm not condoning what has happened and have not done so > myself, I'm just > trying to explain how easy it is to do so. I was hit with > three renewals > too... > > Paul Adshead > Network and Systems Manager > OTL Software Ltd > www.otl.co.nz > > > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Friday, 8 August 2003 13:04 > To: PhoneNet > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: [nznog] Re:Domain Name Scams > > > On Fri, 8 Aug 2003, PhoneNet wrote: > > > I have today received 5 letters from The Domain Registry > of America, > > Melbourne (posted in UK) asking me to re-register some of > my domains as > > they are due to expire - so they are at it also. > > Got one here as well, and what bothers me is that although > the domain in > question is registered under my own name, the letter was > addressed to my > company, which doesn't appear in whois data anywhere. > > Somebody's been trawling... > > -- > Juha Saarinen > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > _______________________________________________ > Nznog mailing list > Nznog(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

1 0

Info Session: Certificate In Web-based Instruction
by Abigail 07 Aug '03

07 Aug '03

On Thursday, August 14th at 1100 hrs Pacific Standard Time (GMT 08:00) there will be a Webcast featuring the instructors of the Certificate in Web-Based Instruction (CWI). Webcast participants can ask questions and interact with the instructors of this 24 week program that will be offered entirely online beginning September 15, 2003. The CWI program gives you the tools and knowledge necessary to design, develop and deliver Web-based courses or add online components to the face-to-face classroom. Please register to participate in the live Webcast by visiting http://www.sfu.ca/lidc/telestraining. If you are unable to make it to this live presentation at the above date then you can attend our next Webcast scheduled for Wednesday, September 3 at 1100 hrs PST (GMT 8:00). Abby Dy Communications Specialist Certificate in Web-Based Instruction Tel: 604-806-5156 ady(a)sfu.ca

1 0