- NZNOG - lists.nznog.org

S92a implementation delayed, clause may be suspended.
by Juha Saarinen 22 Feb '09

22 Feb '09

http://bit.ly/3RiQL Bit.ly URL goes to Computerworld NZ. -- Juha Saarinen juha(a)saarinen.org

1 1

(Urgent) APNIC Executive Council (EC) Election this Week - We need your votes!
by Skeeve Stevens 22 Feb '09

22 Feb '09

Hey Everyone, I am here in Manila at the APRICOT 2009/APNIC 27 conference and it looks like this week is going to be a lot of fun with great people to meet as well as some very interesting things happening. The key issue I am sending this email to the AU/NZNOG and Aussie-ISP lists is to appeal to anyone who has not yet decided to, or just plain forgot to do anything about the voting power they may have as an APNIC member. We have a chance of getting two Australians onto the APNIC EC. The current membership is listed at http://www.apnic.net/ec/ and as you can see, it would be massively beneficial if we had some Australian representation. Our two nominations are James Spenceley<http://meetings.apnic.net/elections/james-spenceley.html> from Vocus Communications (www.vocus.com.au<http://www.vocus.com.au>) and David Woodgate<http://meetings.apnic.net/elections/david-woodgate.html> from Telstra. Both of these guys have both been involved in internet policy making for a VERY long time and are both worthy for the positions available on the EC. They are very respected in the Internet Community, both in Australia and NZ and the world over, both having presented policies an given talks at many conferences. If you don't know them and want some more information, please refer to their Nomination profiles by clicking on their names above. There are 10 nominations and 4 positions available with 1 re-standing with most of the nominees are people from countries with massive populations and large voting power such as China, India and so on. If we have any chance to get Australia/NZ to have some involvement in influencing the direction of internet governance and policy going forward, it is time we stood up and did something with out votes instead of wasting them. To me, it doesn't matter if you like or dislike either James or David, have a past or future with these guys, but if you want to support the Internet community in Australia and New Zealand as a whole, I think that these guys are will represent the issues of Australia/New Zealand very well and certainly worth the 5 minutes to fill out the proxy form and help get them elected. Details about the current election are here: http://meetings.apnic.net/elections/index.html The list of current nominations are as listed at: http://www.apnic.net/news/2009/0216a.html If you wish to contribute your votes there are two ways. You can assign proxy, or you can vote online using MyAPNIC, but many have not registered for this, and it is too late now if you already have not. I am happy to be the person for you to allocate your votes to, which you can do once off for this election by using the Proxy Form included. Please note: A proxy appointment is valid only for a single election, so I can only vote for you in this one case. You are not assigning me permanent voting rights for your organisation. If you didn't receive the attached Proxy form you can download a pre-filled one with my details from http://www.eintellego.net/apnic/APNIC27VoteProxySkeeve.pdf, or failing that, use my details below - don't forget to inform me if you are sending me your proxy as I need to know what members I am collecting the forms for. For details: http://meetings.apnic.net/elections/about/proxy.html are the official details on assigning your proxy votes. If you don't know your membership level as it is right now, Aussies please check http://www.apnic.net/apnic-bin/memlist.pl?size=&cc=au&sort=ascending or for the Kiwi's http://www.apnic.net/apnic-bin/memlist.pl?size=&cc=nz&sort=ascending which will show you what APNIC considers your membership level to currently be. Note: You may have more resources than your current level, but your annual membership might not have come up yet. All your votes are useful, even if you are an associate with only 1 vote as they all add up and elections can come down to just a couple of votes. The number of votes you have are as follows: Associate 1 Very small 2 Small 4 Medium 8 Large 16 Very large 32 Extra large 64 My voting will be for James and David, but with the excess votes, I will be following their advice on who else should be supported. If you know anyone on that membership list who isn't using those votes, please contact them... the larger the members the better as it is less work, but every single vote counts. Forward this email to them and they might have the 5 minutes to fill it out. Just remember, it has to be completed by the Corporate Contact. Also, this has to be done today or tomorrow... please spare the 5 minutes to help us have a say in our own future as ISP's and internet community members. If you have any questions, please send them and I will get back to you asap ...Skeeve -- Skeeve Stevens, CEO/Technical Director eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve -- NOC, NOC, who's there? Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

1 0

UPDATE: CCIP Alert: Adobe Acrobat unpatched vulnerability
by Paul McKitrick 21 Feb '09

21 Feb '09

UPDATE: Apologies for the previous email that contained the wrong content. Good Afternoon, For those of you who are not already aware, CCIP would like to bring your attention the critical vulnerability in Adobe Reader and Adobe Acrobat that could potentially allow an attacker to take control of the affected system which was released on February 19: http://www.adobe.com/support/security/advisories/apsa09-01.html CCIP is releasing this alert as it has been made aware of active exploitation of this vulnerability in the wild. Adobe have stated that they are expecting to release an update by 11 March 2009 for Adobe 9 and updates for other versions (8 and 7) to follow soon after. Adobe has reported that the following versions are affected: * Adobe Reader 9 and earlier versions * Adobe Acrobat Standard, Pro, and Pro Extended 9 and earlier versions Shadowserver have a write up on their website: http://www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20090219 The US-CERT write up (https://www.kb.cert.org/vuls/id/905281) includes the following mitigation advice: Disable JavaScript in Adobe Reader and Acrobat Disabling Javascript may prevent this vulnerability from being exploited. Acrobat JavaScript can be disabled in the General preferences dialog (Edit -> Preferences -> JavaScript and un-check Enable Acrobat JavaScript). Some vendors ship javascript support in a seperate package. Removing this package may remove javascript support in the Adobe PDF reader. Prevent Internet Explorer from automatically opening PDF documents The installer for Adobe Reader and Acrobat configures Internet Explorer to automatically open PDF files without any user interaction. This behavior can be reverted to the safer option of prompting the user by importing the following as a .REG file: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\AcroExch.Document.7] "EditFlags"=hex:00,00,00,00 Disable the displaying of PDF documents in the web browser Preventing PDF documents from opening inside a web browser may mitigate this vulnerability. If this workaround is applied to updated versions of the Adobe reader, it may mitigate future vulnerabilities. To prevent PDF documents from automatically being opened in a web browser: 1. Open Adobe Acrobat Reader. 2. Open the Edit menu. 3. Choose the preferences option. 4. Choose the Internet section. 5. Un-check the "Display PDF in browser" check box. Do not access PDF documents from untrusted sources Do not open unfamiliar or unexpected PDF documents, particularly those hosted on web sites or delivered as email attachments Regards, The CCIP Team -- Centre for Critical Infrastructure Protection Government Communications Security Bureau P: +64 4 498 7654 F: +64 4 498 7655 E: info(a)ccip.govt.nz I: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

CCIP Alert: Adobe Acrobat unpatched vulnerability
by Paul McKitrick 21 Feb '09

21 Feb '09

Good Afternoon, For those of you who are not already aware, CCIP would like to bring your attention the the Critical Microsoft Security Bulletin MS09-002 that was released on February 10: http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx Microsoft have announced a vulnerability in Internet Explorer 7 that could allow remote code execution if a user views a specially crafted Web page. Administrators are advised to patch immediately. Microsoft have rated as Critical for Window XP and Windows Vista and as Moderate for Windows Server 2003 and Windows Server 2008. CCIP is releasing this alert as it has been made aware of active exploitation of this vulnerability in the wild. Due to the recent impact of the Conficker worm CCIP wants to ensure that there is awareness of the active exploitation of MS09-002 and to encourage the patching of systems if they have not already been patched. AusCERT have a write up on their website: http://www.auscert.org.au/render.html?it=10477 There is also a write up on the Sourcefire Vulnerability Research Team’s blog: http://vrt-sourcefire.blogspot.com/2009/02/ms09-002-in-wild.html Regards, The CCIP Team -- Centre for Critical Infrastructure Protection Government Communications Security Bureau P: +64 4 498 7654 F: +64 4 498 7655 E: info(a)ccip.govt.nz I: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

CCIP ALERT: Exploitation of MS09-002
by Paul McKitrick 21 Feb '09

21 Feb '09

Good Afternoon, For those of you who are not already aware, CCIP would like to bring your attention the the Critical Microsoft Security Bulletin MS09-002 that was released on February 10: http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx Microsoft have announced a vulnerability in Internet Explorer 7 that could allow remote code execution if a user views a specially crafted Web page. Administrators are advised to patch immediately. Microsoft have rated as Critical for Window XP and Windows Vista and as Moderate for Windows Server 2003 and Windows Server 2008. CCIP is releasing this alert as it has been made aware of active exploitation of this vulnerability in the wild. Due to the recent impact of the Conficker worm CCIP wants to ensure that there is awareness of the active exploitation of MS09-002 and to encourage the patching of systems if they have not already been patched. AusCERT have a write up on their website: http://www.auscert.org.au/render.html?it=10477 There is also a write up on the Sourcefire Vulnerability Research Team’s blog: http://vrt-sourcefire.blogspot.com/2009/02/ms09-002-in-wild.html Regards, The CCIP Team -- Centre for Critical Infrastructure Protection Government Communications Security Bureau P: +64 4 498 7654 F: +64 4 498 7655 E: info(a)ccip.govt.nz I: www.ccip.govt.nz --- This e-mail contains official New Zealand Government information, which is intended for the use of addressees only. If you have received this e-mail in error, please notify the sender immediately and delete. You should not further disseminate, distribute or copy this e-mail in any way. ---

1 0

NZNOG-09 Videos
by Richard Naylor 20 Feb '09

20 Feb '09

Video and audio (MP3) from NZNOG 09 is available at http://www.r2.co.nz/20090129/ There is both streamed and downloadable versions, and versions in wmv, MP4 and MP3. One talk was not recorded at the request of the presenter. The video isn't too bad - the lighting was a challenge, and there was no one driving the audio desk, so the feed we got varied a little. But it should be quite usable for those who couldn't make it. Richard

1 0

Voting process
by Skeeve Stevens 19 Feb '09

19 Feb '09

Just a quick question about the APNIC EC elections. If someone has a lot of votes/proxies, and they don't get up, are they able to pass their votes to someone else? ...Skeeve -- Skeeve Stevens, CEO/Technical Director eintellego Pty Ltd - The Networking Specialists skeeve(a)eintellego.net / www.eintellego.net Phone: 1300 753 383, Fax: (+612) 8572 9954 Cell +61 (0)414 753 383 / skype://skeeve -- NOC, NOC, who's there? Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.

8 8

New Telstra transparent proxy/config?
by Joel Wiramu Pauling 18 Feb '09

18 Feb '09

Over the last 24-48 hours I have noticed that I am seeing my IP being mis-represented quite often as 203.98.50.27 which appears to be a new upstream proxy hop I have not seen before: traceroute to 203.98.50.27 (203.98.50.27), 30 hops max, 40 byte packets 1 121-73-24-1.cable.telstraclear.net (121.73.24.1) 18.037 ms 17.681 ms 17.413 ms 2 ae0-840.ie4.telstraclear.net (203.167.223.114) 12.952 ms 12.781 ms 12.475 ms 3 ge-1-2-0-843.ie1.telstraclear.net (218.101.61.105) 21.357 ms 20.910 ms 20.661 ms 4 203.98.50.27 (203.98.50.27) 24.332 ms 24.066 ms 23.950 ms I have noticed it preventing non http traffic flowing across port 80 (netcat to amazon cloud), as well as interfering with stun and various other bits and pieces, (incoming and outgoing connections to/from local webserver take longer than usual) Can anyone confirm similar behaviour who is on Telstra cable network, or have further details. Appears to be a netcache proxy. Proxy Server Details: 1.1 nc2 (NetCache NetApp/6.0.5P1) Kind regards -JoelW

5 6

S92A - Public demonstration at MIDDAY parliament grounds
by Andrew Ruthven 18 Feb '09

18 Feb '09

[Forwarded, very last minute, sorry for the late warning] Hi folks, So today there is a public demonstration at MIDDAY on Parliament grounds in support of MPs speaking against Section 92A. Details are here: http://creativefreedom.org.nz/story.html?id=127 "In Wellington on the steps of Parliament on Thursday 19th at MIDDAY with a petition handover at 12:30pm. This is a postive event where we will hand out hundreds of CDs and thank the politicans that support us - so please keep it friendly and polite. While we appreciate people arranging their own demonstrations it might be best if we don't dilute our numbers with multiple events. We want everyone reading this to email everyone they know in Wellington about this. We can't let this be another internet protest that results in few people turning up. This is important so we need to prove it in numbers. NOTE: Please don't wear all black as that has negative associations with other demonstrations but instead come along with bright clothes and BLACK PLACARDS!" As an example of how to be awesome do this: http://coffee.geek.nz/public-demonstration.html Now here's the sobering bit... We need everyone you can get to be there. This is a lot about establishing the credibility of the anti-S92A voice in numbers. If you can bring your friends and co-workers that's the kind of thing that will make this work. We need all of your support -- don't think that other will do it -- we need you to be there MIDDAY. Thanks, Matthew Holloway Creative Freedom -- Andrew Ruthven, Wellington, New Zealand At home: andrew(a)etc.gen.nz | linux.conf.au 2010 | Follow the signs. Visit Wellington! | http://www.penguinsvisiting.org.nz

2 1

NZRR Route Registry Update
by NZRR Database Notifications 18 Feb '09

18 Feb '09

Dear Colleague, This is to notify you that one or more objects in which you are designated for notification have been modified in the NZRR routing registry database. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. Diagnostic output: ------------------------------------------------------------ --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES6:AS131110 descr: Route set advertised to AS9439 by Slush Technologies - AS131110 mp-members: 2001:4410:2005:0:0:0:0:0/48^48-64 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dene(a)slush.ca mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20080910 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES6:AS131110 descr: Route set advertised to AS9439 by Dane Foster - AS131110 mp-members: 2001:4410:2005:0:0:0:0:0/48^48-64, 2001:0470:a080:0:0:0:0:0/48^48-64 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: dane(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20090219 source: NZRR ------------------------------------------------------------

1 0