- NZNOG - lists.nznog.org

Re: [nznog] Phishing expedition - Westpac heads-up!
by Craig Whitmore 02 Nov '03

02 Nov '03

Yes I am seeing those emails as well: Nov 2 17:40:10 dbmail-mx3 sm-mta[26879]: hA24di60026879: ruleset=check_mail, arg1=<martin.williams(a)citibank.net>, relay=c-65-97-16-13.va.client2.attbi.com [65.97.16.13], reject=451 4.1.8 Domain of sender address martin.williams(a)citibank.net does not resolve Nov 3 13:41:28 dbmail-mx3 sm-mta[27391]: hA30ebfg027391: ruleset=check_mail, arg1=<martin.williams(a)citibank.net>, relay=adsl-66-120-247-125.dsl.lsan03.pacbell.net [66.120.247.125], reject=451 4.1.8 Domain of sender address martin.williams(a)citibank.net does not resolve (but not as many of them at all) Thanks Craig ----- Original Message ----- From: "Mark Piper" <Mark.Piper(a)nec.co.nz> To: "Craig Whitmore" <lennon(a)orcon.net.nz> Cc: <nznog(a)list.waikato.ac.nz> Sent: Monday, November 03, 2003 1:35 PM Subject: Re: [nznog] Phishing expedition - Westpac heads-up! > http://lists.insecure.org/lists/fulldisclosure/2003/Oct/1429.html > > Two more banks according to the above URL are having almost identical mailouts (citybank and natwest). >

1 0

The New Zealand Network Operators' Group
by Donald Neal 02 Nov '03

02 Nov '03

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. A face-to-face gathering is to take place in Hamilton on January 29 and 30 2004, hosted by the WAND group. See http://www.nznog.org/ for more details, including the Call for Presenters. Also see http://thursdaynightcurry.com/about.html if you live in or near Wellington or Auckland. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Internet Exchanges See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there, http://www.wix.net.nz/ for the Wellington Internet Exchange. About This Mailing List This list has around 550 addresses subscribed. You may only post to the list from a subscribed address. A number of people subscribe addresses which do not receive email purely to allow posting from them. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by an employee of Alcatel NZ Ltd. Neither of these organisations, nor the administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrator remains happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. One way to search the archive is to use google and prefix your search with site:list.waikato.ac.nz . Subscribing to the List See http://list.waikato.ac.nz/mailman/listinfo/nznog to subscribe. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

Strange BGP 'problem'
by Nathan Ward 01 Nov '03

01 Nov '03

At the risk of posting something on topic.. I have 2 routers (lets call them A and B), talking to different upstream providers, advertising 202.6.75.0/24 via BGP. 202.6.75.0/24 is subnetted, each subnet is on a different VLAN. These routers talk to each other with iBGP, giving each other everything (including 202.6.75.0/24 le 32). I run HSRP between the 2 routers. Router B prepends my ASN several times before advertising 202.6.75.0. Relevant stuff (on both boxes): router bgp 23729 network 202.6.75.0 no synchronization ! ip route 202.6.75.0 255.255.255.0 Null0 With this config, reachability for 202.6.75.0/24 hosts alternates on and off roughly every minute. 47% total loss over 10 minutes (ie 5 'bursts' of loss). These packets are all hitting my AS at router A. I've turned HSRP off and on again to see if that was causing problems (it wasn't). Several solutions I've found: - Turning the iBGP session to router B off. (uhh..) - Turning syncronization on. My understanding of BGP synchronization, is that BGP will only re-advertise with eBGP prefixes learned via iBGP after learning them via another IGP if one is running. <snip> ec-br-1(config-router)#do sh run | inc router router bgp 23729 bgp router-id 202.6.75.1 </snip> I'm not running any IGPs, so synchronization shouldn't be part of the equation. In any case, I'm not a transit provider. And, there seems to be no relation to readvertising routes here, the packets AFAICT are getting to router A and being dropped. I've got no problem running running with synchronization on at the moment, but thats not the point. :-) Any ideas/thoughts? -- Nathan Ward

3 3

RE: [nznog] Domain Names NZ scam
by Tim John - Domainz 01 Nov '03

01 Nov '03

Yep ! Had calls dribbling in here all morning ... The DNC is aware and I'm sure things will be taken up by her. Tim -----Original Message----- From: jfp [mailto:jfp(a)clearfield.com] Sent: Wednesday, 29 October 2003 10:42 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Domain Names NZ scam Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

9 10

RE: [nznog] Domain Names NZ scam
by Geoff Williams 31 Oct '03

31 Oct '03

We have been through this here on the other side of the creek. Some years ago when this guy first started this scam I actually spoke to him trying to recover money that a client had inadvertently paid. Even though the money had not been passed to the sole registrar of .au domains at that time (we had already paid for the domain's renewal) the most that we were able to threaten was a civil action for not refunding monies that had not been applied for the purpose that they were collected. He just didn't give a @#$% about it and continued on his merry way. Unfortunately the problem is that the person paying the money doesn't know enough about what the invoice means and also they don't read the thing in detail. The most success was had here when the registrar used the domain contacts list and emailed a warning to all domain owners. Perhaps your registrar should consider something similar. The warning is probably still on the site at www.inww.com if you need text. The other thing is to get it into the tabloid press, perhaps someone should approach some of your shock jocks to run the story. Maybe Holmes could turn it into a global news story :)) -----Original Message----- From: Tikiri Wicks [mailto:tcwicks(a)maxnet.co.nz] Sent: Saturday, 1 November 2003 3:21 PM To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Domain Names NZ scam Re: Domain Names NZ scam Just wondering is anyone on this list a lawyer I just got my second mail from these bastards. It's made out just like an invoice telling me to register my domain.net.nz Unauthorized use of the domain name registry for commercial solicitation perhaps ? New Zealand Privacy law perhaps ? Is there anything like class action lawsuits in New Zealand and Australia? ----- Original Message ----- From: "Juha Saarinen" <juha(a)saarinen.org> To: "Steven Heath" <sheath(a)paradise.net.nz> Cc: <nznog(a)list.waikato.ac.nz>; "'Matthew G Brown'" <Matt(a)Brh.Co.Nz> Sent: Thursday, October 30, 2003 3:09 PM Subject: Re: [nznog] Domain Names NZ scam > Steven Heath wrote: > > > In my opinion it is just more of the many scum aussie operators that just > > extend thier scams to include NZ. > > Was just informed that the AuDA and ACCC court proceedings against > Domain Names Pty Ltd will be heard on the 19th of next month. > > -- > Juha > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Spamcop.net DNS
by Peter Macaulay 31 Oct '03

31 Oct '03

Looks like someone has killed spamcop. Can anyone explain how this happened? I can't see their registrar (joker.com) doing it unless they have been conned. -- Peter Macaulay Executive Director InternetNZ Direct +64 4 495 2113

6 5

elevated icmp traffic
by Anton Smith 29 Oct '03

29 Oct '03

Hi guys, Was just wondering if anyone else has been experiencing a lot of icmp traffic (pings) lately, seems to a lot of pinging of entire ranges going on. Another new worm or the left overs from the last lot? Regards, Anton Smith nzwireless Ltd

2 1

RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability?
by Geoff Williams 28 Oct '03

28 Oct '03

Right, but due to no SMTP AUTH logging in Exchange 2000, we cannot easily track any attempt to intrude using the brute force password crack method. We only get to see badmail folders filling up and so on. Additionaly we cannot see exactly which account's password has been compromised. A more comprehensive anti-relay option which checked for the existence of the recipient and/or sender in Active Directory, as this ORF thing does, would be beneficial in future releases. I haven't seen Exchange 2003 yet so can't comment on whether it has any such functionality. Regards Geoff Williams -----Original Message----- From: Nathan Mercer [mailto:nmercer(a)microsoft.com] Sent: Wednesday, 29 October 2003 10:27 AM To: Geoff Williams; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? So just to be clear, a new and unacknowledged Exchange or Windows 2000 vulnerability has not been discovered here right? We want to know about vulnerabilities (not mis-configurations) If you do wish to report a suspected security vulnerability please either contact myself directly, log the details on https://s.microsoft.com/technet/security/bulletin/alertus.asp or email secure(a)microsoft.com (PGP key is on https://s.microsoft.com/technet/security/MSRC.asc ) Details of our vulnerability handling processes are on http://microsoft.com/technet/security/bulletin/msrpracs.asp Regards Nathan Technology Specialist Microsoft NZ _____ From: Geoff Williams [mailto:geoff(a)katnet.com.au] Sent: Tuesday, 28 October 2003 11:26 a.m. To: nznog(a)list.waikato.ac.nz Subject: FW: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? Further to my earlier post, Neil G has pointed me correctly to an SMTP AUTH attack. I have used the logs of the ORF tool to pinpoint which accounts have been compromised. Strangely the spammers are trying to work out why, even if they authenticate, they can't relay, so there is a lot of traffic to watch and learn from. A large number of their connections are being blocked by the IP blacklists I have selected. I had originally blocked 2 Class A IP ranges at our router after watching the traffic and finding that they were allocated to a provider in China. But I am not 100% sure that IP addresses are not being spoofed as they seem to have a huge range of Class A and B addresses available to them and I was really chasing my tail trying to block them at that level. So now I have a new password generator and will start training the mind to work with 12 or more character passwords. Hope this is of assistance to others. Geoff Williams -----Original Message----- From: Geoff Williams Sent: Monday, 27 October 2003 11:01 PM To: nznog(a)list.waikato.ac.nz Subject: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 _____ size=2 width="100%" align=center> This email is confidential and intended for the recipient only. If you have received it in error please delete it immediately.

1 0

Re: New and unacknowledged Exchange / Win2k SMTP vulnerability?
by John Rothlisberger 28 Oct '03

28 Oct '03

I would *strongly* recommend against EVER running Exchange as your Internet-facing SMTP server. Use a *nix box as a proxy. There have been too many [unacknowledged] bugs/holes in MS Exchange, and troubleshooting something that hasn't been acknowledged by the manufacturer can have you thinking that you've gone crazy. Using a *proper* SMTP server to sanity check incoming connections is the only way to go with Exchange, even for small customers -- the risks are pretty high otherwise. And while you're at it throw SpamAssassin/Antivirus on it and kill multiple birds, et al. My COP$35.28 --John R?thlisberger

3 2

RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerabi lity?
by Neil Gardner 28 Oct '03

28 Oct '03

Hmm, I guess the extention of your argument is that presumably SCO will give me a discount on my license for any vulnerability I find in any flavour of Linux in the world? :-) Not directed at you, and I too will stop right there :-) -- Cheers - Neil Gardner Networking and Security Support Engineer Renaissance Brands Ltd (09) 968-3681 / (021) 746-345 -----Original Message----- From: Barry Murphy [mailto:barry(a)unix.co.nz] Sent: Wednesday, 29 October 2003 12:52 p.m. To: Nathan Mercer; nznog(a)list.waikato.ac.nz Subject: Re: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? Is there a reward for reporting a vulnrability? Surely if the end user is having to find bugs then MS isn't spending enough to secure it's software. Not directed at you and i'll stop there. Barry

1 0

RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability?
by Nathan Mercer 28 Oct '03

28 Oct '03

So just to be clear, a new and unacknowledged Exchange or Windows 2000 vulnerability has not been discovered here right? We want to know about vulnerabilities (not mis-configurations) If you do wish to report a suspected security vulnerability please either contact myself directly, log the details on https://s.microsoft.com/technet/security/bulletin/alertus.asp or email secure(a)microsoft.com (PGP key is on https://s.microsoft.com/technet/security/MSRC.asc ) Details of our vulnerability handling processes are on http://microsoft.com/technet/security/bulletin/msrpracs.asp Regards Nathan Technology Specialist Microsoft NZ ________________________________ From: Geoff Williams [mailto:geoff(a)katnet.com.au] Sent: Tuesday, 28 October 2003 11:26 a.m. To: nznog(a)list.waikato.ac.nz Subject: FW: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? Further to my earlier post, Neil G has pointed me correctly to an SMTP AUTH attack. I have used the logs of the ORF tool to pinpoint which accounts have been compromised. Strangely the spammers are trying to work out why, even if they authenticate, they can't relay, so there is a lot of traffic to watch and learn from. A large number of their connections are being blocked by the IP blacklists I have selected. I had originally blocked 2 Class A IP ranges at our router after watching the traffic and finding that they were allocated to a provider in China. But I am not 100% sure that IP addresses are not being spoofed as they seem to have a huge range of Class A and B addresses available to them and I was really chasing my tail trying to block them at that level. So now I have a new password generator and will start training the mind to work with 12 or more character passwords. Hope this is of assistance to others. Geoff Williams -----Original Message----- From: Geoff Williams Sent: Monday, 27 October 2003 11:01 PM To: nznog(a)list.waikato.ac.nz Subject: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 ________________________________ size=2 width="100%" align=center> This email is confidential and intended for the recipient only. If you have received it in error please delete it immediately.

2 1

RE: [nznog] Domain Names NZ scam
by Paul Adshead 28 Oct '03

28 Oct '03

Deja vu anyone: http://www.domainz.net.nz/Domainz.asp?Content=news21 http://www.dnc.org.nz/story/30127-32-1.html http://www.comcom.govt.nz/publications/display_mr.cfm?mr_id=1219 Paul Adshead OTL Software Ltd www.otl.co.nz paul.adshead(a)otl.co.nz Tel +64 9 373 9920 Fax +64 9 303 9129 -----Original Message----- From: jfp [mailto:jfp(a)clearfield.com] Sent: Wednesday, 29 October 2003 10:42 To: nznog(a)list.waikato.ac.nz Subject: [nznog] Domain Names NZ scam Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Domain Names NZ scam
by jfp 28 Oct '03

28 Oct '03

Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

1 0

How to get deliberately attacked?
by Neil Gardner 28 Oct '03

28 Oct '03

Hi guys, I am testing a firewall here at work with a DHCP spoofing ADSL router and I wanted to check the integrity of the reporting with the attacks it can recognise... I don't really want to spend too much work time jumping into hacky IRC channels and annoying people to generate some attack traffic (plus I don't want to be attacked for too long :-) so I thought I'd ask here to see if anyone knows of any web based attack generators or could indulge me and hit me with a few things (short of classic DOS - I'm testing the firewall, not my ADSL line :-) Anyway - answers on the back of a postcard please, or email me direct. Oh, it's not this IP, so please don't just start attacking - please contact me and we'll work something out :-) -- Cheers - Neil Gardner Networking and Security Support Engineer Renaissance Brands Ltd (09) 968-3681 / (021) 746-345

4 3

Orcon Internet Prefix List Update (2003-10-19)
by Craig Whitmore 28 Oct '03

28 Oct '03

For all those peering with Orcon Internet (AS17746) Nationally, please update your prefix lists with the following networks as in attached file. Thanks Craig Whitmore Systems Administrator Orcon Internet http://www.orcon.net.nz

1 0

RE: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 27 Oct '03

27 Oct '03

Thanks Matt I haven't started on the 218's as some of those are here in Australia also. Geoff Williams -----Original Message----- From: Matt Camp [mailto:gargoyle(a)noise.net.nz] Sent: Tuesday, 28 October 2003 9:59 PM To: Geoff Williams Cc: Joe Abley; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? On Tue, 28 Oct 2003, Geoff Williams wrote: > The bulk of the 218.0.0.0 Class A range is allocated to provincial > entities in the PRC. Except for the /17's out of this class A which are allocated to NZ entities such as TelstraClear. Blocking this would be inadvisable. --- Matt Camp This email is confidential and intended for the recipient only. If you receive it in error please delete it immediately.

1 0

RE: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 27 Oct '03

27 Oct '03

The bulk of the 218.0.0.0 Class A range is allocated to provincial entities in the PRC. The other big source of addresses I have seen is the 61.0.0.0 subnet which is spread between India and the PRC, again in the PRC it seems to be allocated to provincial entities. The 61.11 range in India has been very active trying to fish passwords but strangely whoever is doing it is coming from right across the whole A range. Snip of repeated ORF event below: NOTIFICATION - Open Relay Filter Enterprise Edition =================================================================== The following event has occurred: Class : Block Severity : Info Source : SMTPSVC-1 Related IP : 61.11.47.52 Text description: ================= Blocked. Recipient address (user3(a)989888.com) is not listed in the Active Directory. Sender: test(a)yahoo.com. SMTP response: End snip. This particular event just won't stop. Geoff Williams -----Original Message----- From: Joe Abley [mailto:jabley(a)isc.org] Sent: Tuesday, 28 October 2003 12:41 PM To: Geoff Williams Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? On 27 Oct 2003, at 17:25, Geoff Williams wrote: > I had originally blocked 2 Class A IP ranges at our router after > watching the traffic and finding that they were allocated to a > provider in China. Which class A networks do you think are allocated to a provider in China? This email is confidential and intended for the recipient only. If you receive it in error please delete it immediately.

3 2

FW: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 27 Oct '03

27 Oct '03

Further to my earlier post, Neil G has pointed me correctly to an SMTP AUTH attack. I have used the logs of the ORF tool to pinpoint which accounts have been compromised. Strangely the spammers are trying to work out why, even if they authenticate, they can't relay, so there is a lot of traffic to watch and learn from. A large number of their connections are being blocked by the IP blacklists I have selected. I had originally blocked 2 Class A IP ranges at our router after watching the traffic and finding that they were allocated to a provider in China. But I am not 100% sure that IP addresses are not being spoofed as they seem to have a huge range of Class A and B addresses available to them and I was really chasing my tail trying to block them at that level. So now I have a new password generator and will start training the mind to work with 12 or more character passwords. Hope this is of assistance to others. Geoff Williams -----Original Message----- From: Geoff Williams Sent: Monday, 27 October 2003 11:01 PM To: nznog(a)list.waikato.ac.nz Subject: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 _____ This email is confidential and intended for the recipient only. If you have received it in error please delete it immediately.

2 1

httpd traffic with ie 5.5
by Barry Murphy 27 Oct '03

27 Oct '03

Howdy, Anyone noticing a lot of traffic in the httpd-access logs? I have had the following unique hits to my catch domain: August: 5401 September: 10950 October: 18535 Can't see much in tcpdump but they all seem to be windows 98 IE 5.5. 65.95.18.179 - - [28/Oct/2003:11:11:33 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 82.37.50.69 - - [28/Oct/2003:11:11:45 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 24.125.71.52 - - [28/Oct/2003:11:11:52 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 24.85.14.211 - - [28/Oct/2003:11:12:03 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 24.207.23.172 - - [28/Oct/2003:11:12:22 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 68.117.32.241 - - [28/Oct/2003:11:12:30 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 68.114.179.170 - - [28/Oct/2003:11:12:37 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" Cheers Barry

2 1

Re: [nznog] Cloaked SPAM hosting service
by Richard Cox 26 Oct '03

26 Oct '03

On 25 Oct 2003 12:00:07 +1300 (NZDT) Simon Byrnand <simon(a)igrin.co.nz> asked NZ-NOG: > Correct me if I'm wrong but isn't this idea just a reverse proxy farm? >From what investigators have seen there is more to this exploit than just a reverse-proxy. I'm reluctant to say too much, even here, since investigations are continuing. The previous well-reported exploit which was known as "Super-Zonda" simply packaged reverse-proxying with a set of custom DNS tricks designed so that only the designated proxies could get the IP address of the real source of the website. Two strains of virus - "Fizzer" and "Sobig" each deliver a payload that compromises the infected computer, and in many cases the compromise can survive normal "cleansing" operations. This leaves a suite of abusive tools on the victim's computer that can, without the owner's knowledge or permission, be used by the attacker. Fizzer is known to install a spam sender and Denial-of-Service module, both of which "phone home" and listen for remote instructions. This means they can lie dormant for days, even weeks, without being activated. When they are activated to spam, they will usually only send out a small quantity of messages at one time, and then become silent again; the whole point is that as there are so many of them available to the spammer, there is no need for any one infected machine to send any great quantity. This, in turn, means that it is unlikely to trigger any traffic-based alarms, and any spam reports which reach abuse desks - if they even get that far - will often be treated as either misdirected or ill-informed, because "if it really was a spam source there would inevitably be many more complaints" That is exactly what the malware-writer intended ISPs to think, so don't be caught by it! Some Abuse desks may even go as far as looking for any open ports, and finding none, will take the view that the machines are secure. Not so! As all the trojans "phone home" for their instructions, there will not be any need for open ports, and none to find. The trojan may open some ports when ordered to, but generally will appear to be completely locked down (well, as much as any Windows machine can be!). There is one thing I want to stress here, as many of you will have no doubt read about the various DDoS attacks on various targets - Cisco, and some of the anti-spam resources being the ones that got publicity. If you get (a small number of) reports of spamming from a customer IP and you are tempted to disbelieve or ignore those reports, please don't. Regardless of your views on spam, those reports may be the only warning you will get that you have a malware-attacked box on your netblock, and that box is then fully equipped and ready to take part in a Distributed Denial of Service (DDoS) attack on a target at a moment's notice. | Sounds like the author of the article doesn't understand round robin | dns, expressing surprise that every time they checked the site the ip | address was different...(well duh :) Er, no. That's not the primary point of this exploit, even though Round Robin DNS is certainly used in it. Remember - we are talking about large quantities of boxes here, and a different zombie can be activated in seconds. The compromised machines are able to act as DNS servers as well as web servers - and they do. The key is that the DNS servers are in the .biz TLD and that registry offers its customers the ability to update their DNS in real time, rather than having to wait for a timed update as with the .com/.net environment. Thus as machines are booted, come online, and "phone home", some of them are put in the queue for their IPs to be sent to the root .biz servers. Anyone monitoring the zonefiles for the latest .biz domain that these spammers are using (they change domains regularly, of course ...) will see the IPs of both the nameservers and A records change on a regular basis, and the location of those IPs will tend to follow the sunrise - so at one time of day there will be some in Europe, a few hours later they will mostly be on the US East Coast, later the US West Coast, and some hours after that NZ, then Australia, then Japan, and so on. > In other words said spammers host the actual site on a real server > somewhere, use round robin dns with hundreds (?) of dns entries > pointing to different hijacked computers, that then forward the > requests to the real servers as a reverse proxy. If they did that, the operation could be closed down by terminating (or bogussing) all the DNS servers that hold the round-robin DNS list. As ordinary user machines (mainly broadband) are being used as these servers, they can change almost as often as the A records do, and so any that are disabled are immediately replaceable. While admittedly tempting, it is hardly practical to bogus out the entire .biz root! The contact details for the domains used in this exploit vary from "suspicious" to "proven fake" but you could say the same about rather a lot of domains at the moment. The ICANN promises of a clean-up have not materialised, and given ICANN's (lack of) authority in general, some would say that any clean-up can only be cosmetic until there is general international agreement to enforce new rules. What may be of interest is that quite a few of these domains we've looked into turned out to have been registered with "DomainDiscover" in San Diego, USA (http://www.domaindiscover.com/) Even if DomainDiscover closed down all those domains immediately, the spammers would just move across to another Registrar and carry on. The only effective way to stop THIS particular exploit would need the root .biz registry to be persuaded to withdraw the real-time DNS updating feature in .biz. You may well conjecture on the likelihood of that ever happening! The zombies installed by the SoBig series of viruses also install an FTP server (TFTP) on first infection, which is used to fetch the rest of the SoBig payload some days later, and that means that absolutely anything can be subsequently downloaded to those machines - so unless you actually remove the infection and compromise, a machine that scans as completely clean today may be a Webserver serving up kiddie-porn by this time tomorrow. Yes, Tikiri, this one *is* more alarming. -- Richard Cox Mandarin

2 1

New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 26 Oct '03

26 Oct '03

Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 This email is confidential and intended for the recipient only. If you receive it in error please delete it immediately.

1 0

Cisco ISDN config
by Michael Hallager 25 Oct '03

25 Oct '03

Hi all. I am after configurations for running a point-to-point link using two Cisco ISDN routers. At one end will be 192.168.1.0/24 and the other end will be 192.168.2.0/24 Tested configs only please. Thanks. Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH.

1 0

The fraudsters used email forwarding and routing via a New Zealand-based service provider to cover their tracks.
by Andy Gardner 25 Oct '03

25 Oct '03

http://www.theregister.co.uk/content/55/33582.html NatWest customers targeted in 'phishing' scam "At the time of writing, the site, which seems to have been run off the servers of Hotbox hosting in Russia, has been replaced by a holding page. The fraudsters used email forwarding and routing via a New Zealand-based service provider to cover their tracks." Who was that, then?

1 0

Current Jetstream 'Deal'...
by Dan Clark 23 Oct '03

23 Oct '03

OK, we've all seen the $99.00 install fee for JetStream waived before but currently it would seem Telecom are only offering the free install if you connect via XTRA? http://www.telecom.co.nz/chm/0,5123,203191-202534,00.html I think if I was a consumer, I would find it a little hard to use another ISP's JetStream service via Telecom's website, it seems a bit anti-competitive. Fair enough it's Telecom's network but basicly forcing the consumer to use XTRA as an ISP? Regards Dan Clark Network Manager Scarfies.Net Ltd

7 7

Slasdot update: AT&T Blocking All Incoming Mail
by Jeff Williams 23 Oct '03

23 Oct '03

All, >From slashdot, See: http://www.sosdg.org/attmail.txt Regards, -- Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!) "Be precise in the use of words and expect precision from others" - Pierre Abelard =============================================================== CEO/DIR. Internet Network Eng. SR. Eng. Network data security Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 214-244-4827 or 214-244-3801

2 1

Re: [nznog] Current Jetstream 'Deal'...
by Richard Parkinson 23 Oct '03

23 Oct '03

I fail to see how raising a simple and valid question of possibly "biased" operators in this list has anything to do with my integrity. Frankly, you just raised a BIG question about your own "Integrity" in simply responding with a public attack on mine, when I have a valid point, being that other issues in this list go unnoticed and unchallenged for days, unless they are matters relating to Telecom's monopolistic way of doing business, in which case we are told to discontinue the thread. In my opinion, this thread had some valid content, perhaps some not, but the request for it to be stopped came far too quickly, Telecom staff member or not. I agree with Tikiri, it's time Telecom explained a few things like why no static IP's for jetstart instead of the " because it's a residential service " routine which simply reminds me of the childish answer you get from angry parents " ....because I said so ". I also agree that there is probably no point in saying much more in here, as it would be a better waste of time to put it all in a letter to someone at the appropriate government department. -----Original Message----- From: mark.harris(a)ssc.govt.nz [mailto:mark.harris(a)ssc.govt.nz] Sent: Friday, 24 October 2003 1:19 p.m. To: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] (no subject) Richard Parkinson wrote: > > I agree with Donald, this thread doesn't seem entirely appropriate, > however I have seen less appropriate threads go on longer, and can't > help but notice the @telecom.co.nz after Donald's address. :). > I realise there's a smiley on the end of that, but sugar-coating an question to Donald's integrity says more about your own than I suspect you realise. Regards Mark Harris Moderator *.govt.nz State Services Commission PO Box 329, Wellington, NZ Tel: 64 4 495 2844 Email: moderator(a)ssc.govt.nz _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

(no subject)
by Richard Parkinson 23 Oct '03

23 Oct '03

I agree with Donald, this thread doesn't seem entirely appropriate, however I have seen less appropriate threads go on longer, and can't help but notice the @telecom.co.nz after Donald's address. :). >From a technical stand point, I would like to know the technical reasons as to why Telecom cannot provide other ISP's with the same level of national connectivity that Xtra have been getting, but then this probably isn't a technical issue. More like anti-competitive and predatory market tactics. -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 24 October 2003 12:20 p.m. To: Donald Neal Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Current Jetstream 'Deal'... Donald.Neal(a)telecom.co.nz wrote: > People, > > As you may recall, our AUP requires that > > 1. Discussion will focus on Internet operational and technical > issues. > > This thread should, in my view, either acquire some operational or > technical content or go away. > > - Donald Neal Doesn't ISPs discussing operational issues surrounding the provision of DSL to customers count? -- Juha _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

Research paper on the effects of spam
by Simon Byrnand 23 Oct '03

23 Oct '03

Interesting reading.... http://www.pewinternet.org/reports/toc.asp?Report=102 (Click "summary of findings", whose link is too big to post in email without wrapping :) Regards, Simon

2 2

RE: [nznog] Cloaked SPAM hosting service
by Donald Neal 23 Oct '03

23 Oct '03

> From: Tikiri Wicks [mailto:tcwicks(a)maxnet.co.nz] > Sent: Friday, 24 October 2003 12:59 > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Cloaked SPAM hosting service > > > This one is more alarming > > Cloaked SPAM hosting via hijacked computers > It's being sold by a Polish Hacker group > http://www.wired.com/news/business/0,1367,60747,00.html Nothing very new there, alas. This subject was among those discussed by Barry Ravendran Greene at the conference in July. Donald Neal | "They are not mistaken about Technical Specialist | what they want. It just Operations Engineering | conflicts with what they are Integration & Services Divn. | going to get." - [quoted Alcatel NZ Ltd | by Cathy Wittbrodt] All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

RE: [nznog] (no subject)
by mark.harris＠ssc.govt.nz 23 Oct '03

23 Oct '03

Richard Parkinson wrote: > > I agree with Donald, this thread doesn't seem entirely appropriate, > however I have seen less appropriate threads go on longer, and can't > help but notice the @telecom.co.nz after Donald's address. :). > I realise there's a smiley on the end of that, but sugar-coating an question to Donald's integrity says more about your own than I suspect you realise. Regards Mark Harris Moderator *.govt.nz State Services Commission PO Box 329, Wellington, NZ Tel: 64 4 495 2844 Email: moderator(a)ssc.govt.nz

1 0

What can I say to this
by Tikiri Wicks 23 Oct '03

23 Oct '03

Hi Folks I'm just wondering if anyone has any feedback regarding this situation. I maintain a multi homed Linux router in the Seychelles Islands for the Seychelles government and the CTO of one of the ISP's wants me to use an IP of 217.161.116.143 with a netmask of 255.255.255.255 and a default gateway of 217.161.116.8. To explain it further they are running a fibre optic link to my linux router and at the other end of it they've got a cisco 2500 with an IP of 217.161.116.8. What I get is ethernet and they want me to use the IP 217.161.116.143 with a netmask of 255.255.255.255 on my linux router. I do not want to run IP unnumbered and anyway I cannot think of how anything but a CISCO can talk IP unnumbered to another CISCO. Everything I know and everything I ever learned says this is mission impossible. I am at a loss of words on what to say to this. Am I missing something here perhaps ? Can anyone think of anything to say to this. This ISP is called Atlas and their URL is http://www.seychelles.net They also happen to be the operators of the .sc ccTLD I would greatly appreciate any feedback from anyone as to what I could possibly say to these people. Then again maybe I missed something and maybe I am wrong ? Cheers Tikiri

5 9

RE: [nznog] Current Jetstream 'Deal'...
by Donald Neal 23 Oct '03

23 Oct '03

People, As you may recall, our AUP requires that 1. Discussion will focus on Internet operational and technical issues. This thread should, in my view, either acquire some operational or technical content or go away. - Donald Neal > -----Original Message----- > From: Richard Parkinson [mailto:Richard(a)sigel.co.nz] > Sent: Friday, 24 October 2003 11:29 > Cc: nznog(a)list.waikato.ac.nz > Subject: RE: [nznog] Current Jetstream 'Deal'... [...] > Not to mention their less than THIN excuses for not allowing ISP's to > control IP address assignment on Jetstart. Do they even still have a > reason? > > Telecom are way overdue for a big slap in the face over these issues. Donald Neal | "They are not mistaken about Technical Specialist | what they want. It just Operations Engineering | conflicts with what they are Integration & Services Divn. | going to get." - [quoted Alcatel NZ Ltd | by Cathy Wittbrodt] All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

3 2

RE: [nznog] Current Jetstream 'Deal'...
by Richard Parkinson 23 Oct '03

23 Oct '03

More than once I have had to explain to clients that Jetstream isn't just Xtra. On one recent occasion one of my customers ordered Jetstream, and wasn't even consulted regarding their choice of ISP. They were simply given their Xtra login and password when the installer came onsite to install the jack and filter. Clearly Xtra have an unfair advantage over other ISP's when it comes to signups. Speaking of unfair advantages, I don't see any other ISP's having the ability to incorporate the monthly charges onto the Telecom phone bill? What about National traffic... Is it not true that Telecom's network routes and handles Xtra's national data way more efficiently, and that such data travels much more directly between points, as opposed to how it does for other ISP's whom have all the National data piped in on one PVC, then feed back out on another? Should other ISP's not be getting the same unbiased treatment? Not to mention their less than THIN excuses for not allowing ISP's to control IP address assignment on Jetstart. Do they even still have a reason? Telecom are way overdue for a big slap in the face over these issues. -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Friday, 24 October 2003 9:52 a.m. To: Dan Clark; Juha Saarinen; David Mill Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Current Jetstream 'Deal'... At 09:26 24/10/2003 +1300, Dan Clark wrote: >my point exactly. >I did not expect to call Telecom when I shift house recently and get >asked if I am already an XTRA customer then get told they will set that >up in a jiffy, I had to explain to the operator that I had no intention >of shifting ISP's and the operator was puzzled that I wouldn't want to >go with XTRA and above all he wasn't entirely aware that other ISP's >were offering JetStream! > >Regards >Dan Same thing happened to me a year ago when I moved house and needed the phone connected up, (first phone line in my name) and the guy at the other end started asking lots of leading questions about if I was likely to use the line for internet access, how many hours I currently used a month on the intenet etc, and then proceeded to try and sell me Xtra + Jetstream, so this is nothing new. (Remember, I just rang up to get the phone hooked up) Even after clearly saying that I knew what Jetstream was and how it worked, and wasn't interested in it at this time *AND* that I worked for an ISP and therefore already had a free dialup connection anyway, he was still trying to sell me on Xtra, and explain to me what Jetstream was and why its so wonderful.... I think I had to repeat myself two or three times before he gave up....so obviously the telecom staff are instructed to put the hard sell on everyone that rings up, pretty much regardless of what you're ringing about... Regards, Simon _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

RE: [nznog] Cisco 2948G-L3
by Craig Spiers 23 Oct '03

23 Oct '03

So what would you deam appropriate for this list? I have a wheelbarrow im looking to sell.. $30 ono.. Networking equipment for sale, on a networking related list.. Seems appropriate to me.. Ive seen many people offer sales and wanted's on this list before! Including Michael Hallager! -----Original Message----- From: Drazen Babich [mailto:Drazen.Babich(a)gen-i.co.nz] Sent: Thursday, October 23, 2003 7:15 PM To: 'Craig Spiers' Subject: RE: [nznog] Cisco 2948G-L3 Still, not the right place for things like those Craig, you have to admit... regards, Drazen -----Original Message----- From: Craig Spiers [mailto:craig(a)concept.net.nz] Sent: Thursday, 23 October 2003 3:57 p.m. To: michael(a)networkstuff.co.nz; 'Philip D'Ath' Cc: nznog(a)list.waikato.ac.nz Subject: RE: [nznog] Cisco 2948G-L3 Michael, Ive seen you post messages similar to this, to this list many many times. I think you need to take a chill pill. -----Original Message----- From: Michael Hallager [mailto:michael(a)networkstuff.co.nz] Sent: Thursday, October 23, 2003 2:01 PM To: Philip D'Ath Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Cisco 2948G-L3 Do you think that you are special that you are excused from the list rules? This is not a trading forum. Advertise your item on Trademe or something. Michael Hallager Networkstuff Limited > I'm currently liquidating a Cisco 2948G-L3. The unit is new with > original packaging manuals and cables, and has only been used for demo > purposes. It will ship with a new warranty. > > RRP=$17,710+GST > Normal dealer buy would be=$12,928=GST > > Looking for around $10.5k+GST, or near offers. > > Offlist replies only please. > > > Philip D'Ath > CCNP, CCDA, BCMS > http://www.ifm.net.nz/ -- Michael Hallager Managing Director Networkstuff Limited URL: http://www.networkstuff.co.nz Networkstuff, NZ's leading supplier of high quality used networking equipment. E-Mail: michael @ networkstuff.co.nz Member of the NZ Open Source Society. Member of the Auckland VHF Group. Amateur radio callsign: ZL1VMH. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ###################################################################### This e-mail message has been scanned and cleared by MailMarshal at http://www.gen-i.co.nz ######################################################################

3 3

Cisco 2948G-L3
by Philip D'Ath 22 Oct '03

22 Oct '03

I'm currently liquidating a Cisco 2948G-L3. The unit is new with original packaging manuals and cables, and has only been used for demo purposes. It will ship with a new warranty. RRP=$17,710+GST Normal dealer buy would be=$12,928=GST Looking for around $10.5k+GST, or near offers. Offlist replies only please. Philip D'Ath CCNP, CCDA, BCMS http://www.ifm.net.nz/

3 2

FW: Heads-up: AT&T apparently going to whitelist-only inbound mai l
by Bowden, Terry 22 Oct '03

22 Oct '03

AT&T STATEMENT - CURRENT SPAM ATTACK - 22/10/03 AT&T and a number of other large companies have seen a marked increase in the amount of incoming SPAM in recent days. A team of experts that includes members from AT&T Labs, Network Services, and Corporate Security has implemented a number of procedures to remediate this situation and minimize its impact on those trying to send e-mail to "att.com" addresses. As of this morning - Wednesday, October 22nd - the level of incoming e-mail messages is returning to normal and the situation appears to be well in hand. Although all AT&T e-mail servers are fully operational at this time, some incoming messages are experiencing intermittent delays as SPAM filtering continues at all network gateways. Customers who received e-mail bulletins from AT&T Monday and Tuesday requesting specific information are advised to disregard those messages. They were inadvertently sent out in error and we apologize for any confusion or inconvenience they may have caused. Network reliability is one of our top priorities at AT&T, so for obvious reasons we will not be providing more detailed information regarding the specific security procedures implemented to curb this SPAM attack. We have no intention of helping those who generate this type of computer and Internet mischief. Terry Bowden

1 0

Heads-up: AT&T apparently going to whitelist-only inbound mail
by Simon Lyall 21 Oct '03

21 Oct '03

Forwarded from nanog. Apparantly this is already in place according to one person. I called the number listed and they advised sending details in. You can ask questions to the email address listed. The Callcenter person said they had been flooded with calls. -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT. ---------- Forwarded message ---------- Return-Path: <rm-antiattspam(a)ems.att.com> Message-ID: <3F80414B002D0EC2(a)attrh0i.attrh.att.com> (added by postmaster(a)attrh1i.attrh.att.com) Content-Disposition: inline Content-Transfer-Encoding: binary Content-Type: text/plain MIME-Version: 1.0 X-Mailer: MIME::Lite 2.102 (B2.12; Q2.03) Date: Tue, 21 Oct 2003 20:21:50 UT Subject: *** ACTION: IP Address of Outbound SMTP Server Requested (Updated 10/21/03) From: rm-antiattspam(a)ems.att.com AT&T Business Partners & Customers AT&T has received many of the requested IP addresses in response to an e-mail originally broadcast yesterday to our business partners and clients. However, we have also received many concerned responses to the original request. This 2nd e-mail is to let you know that this is a legitimate AT&T request asking for your cooperation, which will let us improve the service that AT&T offers you and that our partnership requires. We have provided a toll-free number below to help you confirm the legitimacy of this request. We have assembled the distribution list for this e-mail by looking up the administrative contacts for each of the known e-mail domains we currently exchange e-mail with, referencing WHOIS and other such services available via the Internet. What AT&T is asking is for you to help AT&T to restrict incoming mail to just our known and trusted sources (e.g., business partners, clients and customers). Therefore, we need to know which IP address(es) are used by your outbound e-mail service so we can selectively permit them. Please send this information to the following e-mail address (rm-antiattspam(a)ems.att.com) If you need assistance determining what these IP addresses are, please contact your company's administrative e-mail server support / network administration personnel. We regret that AT&T is burdening you with this request, but our AT&T security team is advising that we take this step to help safeguard our e-mail systems, which ultimately will help us serve you better. Please contact us with any concerns or questions: AT&T Security Help Desk 1-800-456-4230, prompt 4 (8am - 10pm est) Thank you for your prompt attention to this matter. We appreciate your cooperation. Sincerely, Brian Williams, IP Network Services Tim Scholl - District Manager, IP Network Services Kevin O'Connell - Division Manager, Information Technology Services Engineering Bill O'Hern - Division Manager, Network Security ----- Original Message (Sent Monday, 10/20/03) ----- AT&T has an urgent situation with our anti-spam list. In order to continue to allow email to AT&T you need to provide the IP addresses of all your outbound email gateways. If you do not respond immediately, your access may not continue. The required information should be sent to rm-antiattspam(a)ems.att.com. ----- End forwarded message -----

4 4

APE Peering - JSR.COM
by J S Russell 20 Oct '03

20 Oct '03

jsr.com (AS9897) is a new ISP/hosting provider/etc, designed primarily as a testbed platform for various new and developing technologies. Dialup/ADSL/wireless/etc Internet access through jsr.com is currently limited to a small and select customer-base. However, immediately upon launch jsr.com will be hosting a variety of very content-rich servers and websites. At this time, the vast majority of traffic from AS9897 is expected to be outbound from jsr.com netblocks to other "domestic" New Zealand providers. jsr.com is greatly interested in hearing from any other APE-connected entities who would like to set up a BGP peering session over the APE. Replies to jsr(a)jsr.com please. In the interest of network efficiency, jsr.com's official peering policy is "If you have an AS#, you are welcome to peer with us." JSR -- John S Russell | Big Geek | Doing geek stuff.

1 0

could maxnet contact me plz
by Simon Blake 15 Oct '03

15 Oct '03

Could whomever is responsible for APE peering for Maxnet please contact me off list. Cheers Si

1 0

domainz
by Dan Clark 14 Oct '03

14 Oct '03

Would someone at Domainz please contact me as soon as possible offlist. Kind Regards Dan Clark Network Manager Wickliffe Ltd Scarfies.Net Ltd

1 0

Re: [nznog] Paradise.net is on MX.RBl" spam blacklist
by Steve Phillips 13 Oct '03

13 Oct '03

Was bound to happen sooner or later with their "just press delete" policy toward abuse complaints about their customers spamming. -- Steve. At 09:15 p.m. 14/10/2003, Steve Withers wrote: >Anyone on paradise.net.nz trying to send mail to attglobal.net will have >no success due to paradise.net.nz being on the "MX.RBL" blacklist.....if >there is such a beast. The entry is dated october 2nd...... > >If MX.RBL is a widely used list, paradise users may have some trouble. > >I have reported this to paradise. > >-- >Steve Withers <swithers(a)mmp.org.nz> > >_______________________________________________ >NZNOG mailing list >NZNOG(a)list.waikato.ac.nz >http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Paradise.net is on MX.RBl" spam blacklist
by Steve Withers 13 Oct '03

13 Oct '03

Anyone on paradise.net.nz trying to send mail to attglobal.net will have no success due to paradise.net.nz being on the "MX.RBL" blacklist.....if there is such a beast. The entry is dated october 2nd...... If MX.RBL is a widely used list, paradise users may have some trouble. I have reported this to paradise. -- Steve Withers <swithers(a)mmp.org.nz>

1 0

Cunning Vicodin SPAM Practice
by tltoh＠attglobal.net 13 Oct '03

13 Oct '03

Hi, Lately I would say majority of people have been bombarded with Vicodin SPAM as I've been getting about 30 a day for the last month. My delete key have been whinging at me asking for a holiday. And they are sending their SPAM email out through other networks which does not happen to be housing their websites. In my case the Vicodin websites which they are referring me to are as follows: www.medscheap.biz www.rxpalace.biz I manage to track down that both domain's happen to be registered to this person, Pio Lage (peterwolf1239(a)yahoo.com) Both sites are hosted in China which I have inform his network providers which houses both of his websites on his activity but I'm not sure what is the success rate and outcome of it. However so far for the last 6 days I haven't receive any Vicodin SPAM for www.medscheap.biz site at this stage, could be a good start. I could send an email if that is still a valid email account to the Domain owner but I don't want to be ended up in any other of their mailing scam. I thought of forwarding all his SPAM email back to him but I don't believe that is an appropriate practice at all. Any suggestion as to what else can be done to stop this kind of practice ? Thanks. Cheers, Leon

2 1

Re: [nznog] High volumes of ICMP echo request (type 8)
by Ewen McNeill 13 Oct '03

13 Oct '03

In message <20031013102226.GQ14751(a)citylink.co.nz>, Simon Blake writes: >On Mon, Oct 13, 2003 at 04:51:08PM +1300, Ewen McNeill said: >> And snooping on Citylink (which is implemented as a big LAN) shows >> much-higher-than-I'd-normally-expect volumes of ICMP echo requests > >Just a small point of protest here, there isn't higher volumes of >anything floating around Citylink And to be fair, it's ages since I've had reason to look, so "higher than I'd expect" is probably a pretty low standard. And a chunk of the volume was definitely NAT'd traffic outgoing; but not all of it. So these various worms are clearly still drifting about. You may well be right however that it was (mostly|just) stuff that was routed to/from that 'net; the volumes were such that it was difficult to get an accurate picture of exactly which addresses were involved it at the time. Sorry for implying otherwise. >Increased worm probing tends to manifest as increased ARP requests, >rather than ICMP packets. That, FWIW, is why 95% of all the >noise-to-every-port on Citylink is ARP requests to unused IP numbers. Likewise on the TelstraClear cable network -- there's a steady background level of ARP requests all the time, good for keeping the incoming data light flickering away to itself. Ewen

1 0

High volumes of ICMP echo request (type 8)
by Ewen McNeill 12 Oct '03

12 Oct '03

Hi, Is anyone else seeing very high volumes of ICMP echo requests today (ie, in the order of hundreds/thousands per second)? At one client I've been seeing in the order of 2000+ ICMP echo requests per minute from each of four different desktops (desktop support is tracking down the relevant desktops now) to IP addresses all over the net. And snooping on Citylink (which is implemented as a big LAN) shows much-higher-than-I'd-normally-expect volumes of ICMP echo requests flying around from all sorts of random addresses to all sorts of other random addresses. I'm aware that some worms use this as part of their probing/spreading (eg, MS Blaster) but not of any newly released worm (or worm due to make a comeback at present), so I'm a bit puzzled at it's "sudden" appearance. Ewen

5 4

Re: [nznog] High volumes of ICMP echo request (type 8)
by Ewen McNeill 12 Oct '03

12 Oct '03

In message <20031013045849.5E4DE3C486EB(a)basilica.la.naos.co.nz>, Ewen McNeill wr ites: >In message <874qyd4v8f.fsf(a)it029205.massey.ac.nz>, James Riden writes: >>Ewen McNeill <ewen(a)naos.co.nz> writes: >>> Is anyone else seeing very high volumes of ICMP echo requests today (ie, >>> in the order of hundreds/thousands per second)? [....] >> >>What do the ping packets look like? > >block in on ste7: [internal ip] > [victim ip]: icmp: echo request > 4500 005c 58fa 0000 7f01 4929 0a04 0102 > 3df3 5085 0800 c9c8 0200 d6e1 aaaa aaaa > aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa > aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa > aaaa aaaa As James pointed out, that's a truncated packet (to tcpdump's default snaplen). The real packet is 92 octets, with 64 octets of payload (0xaa octets). Which is what the Welchia/Nachi worm sends out. Desktop support at the client has found several of the machines generating these ICMP streams to be infected with the Welchia/Nachi worm, and are busy checking the rest. They also believe they've identified the source (a laptop that arrived back today IIRC). It has, however, highlighted which machines didn't get put into the default policy for lock downs, updates, etc .... So nothing new, it seems. Just another infection with another windows worm. Sorry to trouble you all. Ewen

1 0

Re: [nznog] High volumes of ICMP echo request (type 8)
by Ewen McNeill 12 Oct '03

12 Oct '03

In message <874qyd4v8f.fsf(a)it029205.massey.ac.nz>, James Riden writes: >Ewen McNeill <ewen(a)naos.co.nz> writes: >> Is anyone else seeing very high volumes of ICMP echo requests today (ie, >> in the order of hundreds/thousands per second)? [....] > >Welchia used pings, not Blaster.A IIRC. I've seen Welchia at around >180 packets/second on a LAN and it seems to do a strictly linear scan, >so it doesn't sound like that either. > >What do the ping packets look like? block in on ste7: [internal ip] > [victim ip]: icmp: echo request 4500 005c 58fa 0000 7f01 4929 0a04 0102 3df3 5085 0800 c9c8 0200 d6e1 aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa aaaa Not very exciting. All the ones I've looked contain the same thing (ie IP and ICMP headers, and then filled to minimum packet size with 0xaa bytes). And the addresses aren't always as random as I first thought. When I narrow my scope down to one of the "infected" machines as a source, I sometimes see it walking netblocks sequentially (eg, one internal ip just walked all (most?) of 61.243/16). But when it got to the end of that, the pattern got less predictable again, hitting IPs in at about a dozen different /24s in an overlappped fashion (from the same internal IP). (Perhaps it's getting upset at getting no replies; I've been dropping it at the firewall since I noticed it happening.) I'm seeing around 6000 per second from a single IP address (ie, around 100/second) outgoing hitting the firewall. (It's easy to track a single IP address as these are internal ips; obviously tracking it from the "other end" would be considerably harder.) So I'm pretty much convinced those desktops have "caught" something, I'm just not sure what it is. (And since this client does mail filtering for spam/viruses/etc it's less likely to be a known email virus/worm.) Ewen

1 0

Brightmail Spam Performance
by Mark Frater 12 Oct '03

12 Oct '03

With a sample size of 1015 spam messages over 4 weeks and using a pop mailbox from a provider that recently announced free spam protection (but have been a bit quieter about it only being free 'till xmas), 709 spam messages were detected as spam and 308 spam messages were let through. ie Brightmail (as per the default settings used by this provider) lets through about 30% of spam. How does thing compare to other providers? I guess one woman's spam is another man's v1agra! Mark

3 2

Re: [nznog] ICMP and port 80 traffic
by Blair Harrison 09 Oct '03

09 Oct '03

On 10 Oct 2003 08:57:01 +1300 Donovan Jones <d.jones(a)comnet.co.nz> wrote: > We are seeing the same thing here its currently hitting some of our > unused address space. Yay, not just me! > > Have you found out anything more about it? > Heard a rumour of a variant of Welchia/Nachi.a but nothing more... Still seeing it streaming in... :( Cheers, Blair

2 1

ICMP and port 80 traffic
by Blair Harrison 08 Oct '03

08 Oct '03

Hi All Is anyone else seeing a massive increase in ICMP and traffic to port 80? I started noticing this last night on one of my subnets that is mostly unused, just a huge amount of packets to random addresses. It's still going flat tack.. I've grabbed a quick packet dump if any of you want to see what I mean - it's in tcpdump format. http://blair.wise.net.nz/~blair/icmpandport80.gz Is this some worm variant that nobody's figured out yet? Cheers, Blair Harrison Systems Administrator WISE Net http://wise.net.nz

1 0