- NZNOG - lists.nznog.org

UPDATED CCIP ALERT: Conficker worm
by Paul McKitrick 29 Mar '09

29 Mar '09

Good Evening, CCIP issued an alert on 8/01/2009 about the Conficker worm which attempts to exploit a previously patched stack buffer overflow vulnerability in Microsoft Windows Server Service (MS08-067). CCIP is issuing this update notice to warn organisations of this activity and to prevent further compromises from occurring. The latest variants of the Conficker worm include updates to its ability to communicate to itself and these changes are scheduled to activate on 1 April 2009, it is unknown what will happen on 1 April 2009. CCIP has been working with organisations nationally and with the international Conficker Working Group on this situation and would appreciate being informed of any outbreaks of Conficker or incidents relating to Conficker via incidents(a)ccip.govt.nz as this will assist in CCIP¹s ability to determine the impact of Conficker on New Zealand's networks and to coordinate any responses or flows of information. Further information about Conficker, including how to detect and remove it can be found on the Conficker Working Group website: http://www.confickerworkinggroup.org/wiki/pmwiki.php?n=ANY.GeneralAssistance Further infromation about MS08-067 can be found on Microsofts website: http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx Regards, Paul. -- Paul McKitrick Head of Stakeholder Engagement Centre for Critical Infrastructure Protection D: (+64) 4 498 7645 P: (+64) 4 498 7654 F: (+64) 4 498 7655 E: paul.mckitrick(a)ccip.govt.nz W: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

NZRR Route Registry Update
by NZRR Database Notifications 26 Mar '09

26 Mar '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS24324 descr: advertised to AS9560 by Kordia - AS24324 members: 118.148.0.0/15^15-29, 124.157.64.0/18^18-29, 58.84.224.0/20^20-29, 114.134.0.0/20^20-29, 116.89.224.0/20^20-29, 202.56.32.0/20^20-29, 202.68.80.0/20^20-29, 203.144.32.0/20^20-29, 116.90.128.0/21^21-29, 117.104.176.0/21^21-29, 123.108.144.0/21^21-29, 202.20.0.0/21^21-29, 202.49.16.0/21^21-29, 202.49.128.0/21^21-29, 202.56.48.0/21^21-29, 202.137.240.0/21^21-29, 218.185.224.0/21^21-29, 202.6.116.0/23^23-29, 202.27.88.0/23^23-29, 202.49.164.0/23^23-29, 202.65.160.0/23^23-29, 202.174.190.0/23^23-29, 203.110.28.0/23^23-29, 192.173.17.0/24^24-29, 202.21.130.0/24^24-29, 202.27.34.0/24^24-29, 202.27.83.0/24^24-29, 202.27.90.0/24^24-29, 202.36.75.0/24^24-29, 202.36.137.0/24^24-29, 202.36.154.0/24^24-29, 202.36.173.0/24^24-29, 202.37.168.0/24^24-29, 202.37.197.0/24^24-29, 202.49.158.0/24^24-29, 202.49.168.0/24^24-29, 202.49.183.0/24^24-29, 202.129.253.0/24^24-29, 203.30.174.0/24^24-29, 203.92.25.0/24^24-29, 203.170.56.0/24^24-29, 203.171.4.0/24^24-29, 203.174.26.0/24^24-29, 203.97.62.200/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: david.johnson(a)kordia.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090120 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS24324 descr: advertised to AS9560 by bcl-nz - AS24324 members: 118.148.0.0/15^15-29, 124.157.64.0/18^18-29, 58.84.224.0/20^20-29, 114.134.0.0/20^20-29, 116.89.224.0/20^20-29, 202.56.32.0/20^20-29, 202.68.80.0/20^20-29, 203.144.32.0/20^20-29, 116.90.128.0/21^21-29, 117.104.176.0/21^21-29, 123.108.144.0/21^21-29, 202.20.0.0/21^21-29, 202.49.16.0/21^21-29, 202.49.128.0/21^21-29, 202.56.48.0/21^21-29, 202.137.240.0/21^21-29, 218.185.224.0/21^21-29, 202.6.116.0/23^23-29, 202.27.88.0/23^23-29, 202.49.164.0/23^23-29, 202.65.160.0/23^23-29, 202.174.190.0/23^23-29, 203.110.28.0/23^23-29, 192.173.17.0/24^24-29, 202.21.130.0/24^24-29, 202.27.34.0/24^24-29, 202.27.83.0/24^24-29, 202.27.90.0/24^24-29, 202.36.29.0/24^24-29, 202.36.75.0/24^24-29, 202.36.137.0/24^24-29, 202.36.154.0/24^24-29, 202.36.173.0/24^24-29, 202.37.168.0/24^24-29, 202.37.197.0/24^24-29, 202.49.158.0/24^24-29, 202.49.168.0/24^24-29, 202.49.183.0/24^24-29, 202.129.253.0/24^24-29, 203.30.174.0/24^24-29, 203.92.25.0/24^24-29, 203.170.56.0/24^24-29, 203.171.4.0/24^24-29, 203.174.26.0/24^24-29, 203.97.62.200/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: philip.tan(a)kordia.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090327 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 26 Mar '09

26 Mar '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS45279:RS-ROUTES:AS9503 descr: advertised to AS45279 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: peering(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20081222 source: NZRR REPLACED BY: route-set: AS45279:RS-ROUTES:AS9503 descr: advertised to AS45279 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.88.99.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090327 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 26 Mar '09

26 Mar '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9281:RS-ROUTES:AS9503 descr: advertised to AS9281 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: peering(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20081219 source: NZRR REPLACED BY: route-set: AS9281:RS-ROUTES:AS9503 descr: advertised to AS9281 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.88.99.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090327 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 26 Mar '09

26 Mar '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: peering(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20081219 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.88.99.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090327 source: NZRR ------------------------------------------------------------

1 0

NZRR Route Registry Update
by NZRR Database Notifications 26 Mar '09

26 Mar '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: peering(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090313 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 119.15.0.0/19^19-29, 202.14.32.0/19^19-29, 202.53.176.0/20^20-29, 202.86.96.0/20^20-29, 202.160.48.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 120.89.80.0/21^21-29, 192.173.16.0/21^21-29, 202.46.176.0/21^21-29, 202.49.0.0/21^21-29, 202.78.240.0/21^21-29, 202.160.112.0/21^21-29, 203.190.208.0/21^21-29, 113.197.64.0/22^22-29, 202.37.48.0/22^22-29, 202.89.4.0/22^22-29, 203.84.134.0/23^23-29, 124.248.128.0/24^24-29, 124.248.132.0/24^24-29, 124.248.136.0/24^24-29, 124.248.140.0/24^24-29, 192.88.85.0/24^24-29, 192.88.99.0/24^24-29, 192.122.171.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.8.13.0/24^24-29, 202.12.0.0/24^24-29, 202.12.91.0/24^24-29, 202.20.97.0/24^24-29, 202.27.83.0/24^24-29, 202.36.33.0/24^24-29, 202.36.75.0/24^24-29, 202.36.119.0/24^24-29, 202.36.154.0/24^24-29, 202.36.162.0/24^24-29, 202.36.218.0/24^24-29, 202.37.93.0/24^24-29, 202.37.168.0/24^24-29, 202.37.205.0/24^24-29, 202.46.188.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29, 202.55.99.0/24^24-29, 202.55.105.0/24^24-29, 202.55.107.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090327 source: NZRR ------------------------------------------------------------

1 0

Re: [nznog] VF / Ihug issues with Cisco ADSL Routers
by Terry Wilson 26 Mar '09

26 Mar '09

Thanks for everyone's quick replies. The trick with the 877 was to add "ip tcp adjust-mss 1400" onto the LAN interface and everything started working just like it should. Does anyone have any thoughts about the appropriate segment size to use for traffic in NZ that goes over DSL like this? Thanks again, Terry ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by MailMarshal #####################################################################################

5 4

Linksys + Netgear Worm
by Philip D'Ath 25 Mar '09

25 Mar '09

Oh joy, a worm is now out that infects Linksys and NetGear DSL routers. http://blogs.zdnet.com/BTL/?p=15197 'Psyb0t' worm infects Linksys, Netgear home routers, modems More information has surfaced about the botnet “psyb0t,” the first known to be capable of directly infecting home routers and cable/DSL modems. It was first observed infecting a Netcomm NB5 modem/router in Australia. Members of the website DroneBL, a real-time IP tracker that scans for and botnets and vulnerable machines, came to the conclusion that the “psyb0t” (or “Network Bluepill”) botnet was a test run to prove the technology. After the botnet’s discovery and public outing, the botnet operator swiftly shut it down, APC reports. [Read more: Stealthy router-based botnet worm squirming] However, the most recently discovered generation (dubbed ‘version 18′ in the code) targets a wide range of devices, and contains the shellcode for over 30 different Linksys models, 10 Netgear models, and 15 other models of cable and DSL modems, APC reports. It did not specify which models. APC: A list of 6000 usernames and 13,000 passwords were also included, to be used for brute force entry to Telnet and SSH logins which are open to the LAN and sometimes even the public WAN side of the routers. Generally, routers do not lock a user out after a number of incorrect password attempts, making brute force attacks possible. According to DroneBL, any router that uses a MIPS processor and runs the Linux Mipsel operating system (a simple operating system for MIPS Processors) is vulnerable if they have the router administration interface, or sshd/telnetd in a DMZ, with weak username/passwords. DroneBL noted this includes devices flashed with the open-source firmwares openwrt and dd-wrt, and the group also said that other routers may be vulnerable, as it had observed the bot running on routers based on the Vxworks operating system. Clearly, exploiting a home network ? which are growing in popularity ? has its benefits: they rarely power down, and a router attack enables hackers to exploit a network with greater levels of stealth, since there’s no affect on individual PCs on the network, APC writes. In fact, the staff of DroneBL wrote that the exploit is very difficult to detect, and the only way to discover it is to monitor traffic going in and out of the router itself ?beyond the reach of desktop computer software. In the past, exploits on professional-grade Cisco routers were easier to detect, as Cisco provides dedicated ports for connecting to the router, monitoring internal performance and configuring them. However, the vast majority of home routers sacrifice these features for the sake of cost savings. DroneBL says that the botnet is capable of scanning for vulnerable PHPMyAdmin and MySQL installations, and can also disable access to the control interfaces of a router, (meaning a factory reset is necessary to clear the worm). DroneBL was successful in shutting down the Command & Control channel that the botnet utilized, and the DNS that was hosted with afraid.org was also nullrouted. The Command & Control channel is now defunct, but at the height of its penetration, the botnet was suspected to control 100,000 hosts. Worse, the author of the botnet claimed to have infected 80,000 routers at one point while chatting anonymously on an IRC channel. WHAT DEVICES ARE AFFECTED According to Drone BL: We don’t know. There are so many devices out there that we could not possibly know. Your best bet would be to take action to upgrade the device firmware and secure any passwords if there is concern that the device may be vulnerable. Such actions will help to avoid exploitation by the worm. WHAT TO DO According to DroneBL: Ports 22, 23 and 80 are blocked as part of the infection process (but NOT as part of the rootkit itself, running the rootkit itself will not alter your iptables configuration). If these ports are blocked, you should perform a hard reset on your device, change the administrative passwords, and update to the latest firmware. These steps will remove the rootkit and ensure that your device is not reinfected.

3 2

Re: [nznog] VF / Ihug issues with Cisco ADSL Routers
by Martin Wilkinson 25 Mar '09

25 Mar '09

Have you tried to manually lock down the dsl operating mode? I.e don't let it autodetect Int atm0 Dsl operating-mode itu ________________________________ From: Terry Wilson <terry(a)pds-dn.co.nz> To: nznog(a)list.waikato.ac.nz <nznog(a)list.waikato.ac.nz> Sent: Thu Mar 26 09:55:05 2009 Subject: Re: [nznog] VF / Ihug issues with Cisco ADSL Routers Problem doesn’t go away if I shutdown and bring up interfaces. Not sure if its ADSL2+ related for us as the 827/837s that have shown this behaviour aren’t ADSL2 capable. Virtual interface comes up ok and I can ping the outside world no problem, can connect in via VPN and incoming email works ok (as long as it doesn’t time out) and web works occasionally. I have also tried with the newer adsl firmware from ftp://ftp.cisco.com/pub/access/800 with no success. ________________________________ This e-mail message has been scanned for Viruses and Content and cleared by MailMarshal ________________________________

1 0

Re: [nznog] VF / Ihug issues with Cisco ADSL Routers
by Terry Wilson 25 Mar '09

25 Mar '09

Problem doesn't go away if I shutdown and bring up interfaces. Not sure if its ADSL2+ related for us as the 827/837s that have shown this behaviour aren't ADSL2 capable. Virtual interface comes up ok and I can ping the outside world no problem, can connect in via VPN and incoming email works ok (as long as it doesn't time out) and web works occasionally. I have also tried with the newer adsl firmware from ftp://ftp.cisco.com/pub/access/800 with no success. ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by MailMarshal #####################################################################################

1 0