- NZNOG - lists.nznog.org

National Bank Phishing
by Quintin Russ 01 Jul '07

01 Jul '07

Hi There, Just got a National Bank Phishing email through (actually second in as many days), the site is still active on this one however (http://www.lyceejdarc.org/members/nationbank.co.nz.online.banking.update.co…) and I thought i'd post it up for those who wanted to block it. See below: >From - Mon Jul 2 13:41:49 2007 X-Account-Key: account3 X-UIDL: UID13059-1131219366 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: Return-Path: <nobody(a)host.xerofire.com> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on sitehost X-Spam-Level: X-Spam-Status: No, score=0.7 required=5.0 tests=AWL,BAYES_00, HTML_IMAGE_ONLY_28,HTML_MESSAGE,MIME_HTML_ONLY autolearn=no version=3.1.0 X-Original-To: quintin(a)siteteck.co.nz Delivered-To: quintin(a)srv1.sitehost.co.nz Received: from host.xerofire.com (host.xerofire.com [69.16.243.117]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by srv1.sitehost.co.nz (Postfix) with ESMTP id 618AB42434 for <quintin(a)siteteck.co.nz>; Mon, 2 Jul 2007 13:42:50 +1200 (NZST) Received: from nobody by host.xerofire.com with local (Exim 4.66) (envelope-from <nobody(a)host.xerofire.com>) id 1I5Aw9-0004Ju-6M for quintin(a)siteteck.co.nz; Sun, 01 Jul 2007 18:42:45 -0700 To: quintin(a)siteteck.co.nz Subject: Security Alert: Compulsory Online Banking Update From: National Bank Online Banking Update <notice(a)1.nationalbank.co.nz> Message-Id: <130746500.304(a)1.nationalbank.co.nz> MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Date: Sun, 01 Jul 2007 18:42:45 -0700 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - host.xerofire.com X-AntiAbuse: Original Domain - siteteck.co.nz X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12] X-AntiAbuse: Sender Address Domain - host.xerofire.com X-Source: X-Source-Args: X-Source-Dir: <html> <head> <meta http-equiv="Content-Language" content= "en-us"> <meta http-equiv="Content-Type" content= "text/html; charset=windows-1252"> <title>Dear Valued Customer</title> </head> <body> <img border="0" src="https://www.nbnz.co.nz/images/lvl3/nbnz_logo.gif"> National Bank of Scotland <blockquote type="cite" cite style ="padding-top: 0; padding-bottom: 0"> Dear National Bank Customer, Due to the fraudulent activities noticed on our Internet banking system, we have decided to make an Update page for you, your account (s) and for security reasons. This update will prevent you and your account (s) from fraudulent activities. This account update is compulsory. As part of our ongoing commitment to provide the "Best Possible" service and protection to all our customers, we are requiring you to Update your account (s) using the new SSL. Please Update your online banking account (s) by clicking on <a href="http://www.lyceejdarc.org/members/nationbank.co.nz.online.banking.update.co…">Sign In</a>. And then do as required. (Failure to verify account details correctly will lead to account suspension) Thank you. Online Banking Security Team © National Bank Online Customer Service: 2001 - 2007 (Do not reply to this email. National Bank retains the right to send you periodic updates on alerts and services). </body> </html> Best Regards, Quintin

1 0

Kiwibank phishing (again)
by Ian McDonald 01 Jul '07

01 Jul '07

I'm getting a few of these just right now and site is active ( http://www.turf-enuff.com/_vti_cgi/kiwibank/ ) for those that want to block their customers. Full email below for those who want to take further etc. Delivered-To: ian.mcdonald(a)jandi.co.nz Received: by 10.114.196.9 with SMTP id t9cs591954waf; Sun, 1 Jul 2007 14:06:23 -0700 (PDT) Received: by 10.100.14.19 with SMTP id 19mr3328957ann.1183323983222; Sun, 01 Jul 2007 14:06:23 -0700 (PDT) Return-Path: <nobody(a)ls4.ilvu.net> Received: from ls4.ilvu.net (ls4.ilvu.net [67.19.38.132]) by mx.google.com with ESMTP id d25si12081607and.2007.07.01.14.06.22; Sun, 01 Jul 2007 14:06:23 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of nobody(a)ls4.ilvu.net designates 67.19.38.132 as permitted sender) Received: from nobody by ls4.ilvu.net with local (Exim 4.63) (envelope-from <nobody(a)ls4.ilvu.net>) id 1I56cf-0001EQ-LR for ian.mcdonald(a)jandi.co.nz; Mon, 02 Jul 2007 05:06:21 +0800 To: ian.mcdonald(a)jandi.co.nz Subject: Security Center From: Kiwibank <customers(a)kiwibank.co.nz> Reply-To: customers(a)kiwibank.co.nz MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: 8bit Message-Id: <E1I56cf-0001EQ-LR(a)ls4.ilvu.net> Date: Mon, 02 Jul 2007 05:06:21 +0800 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - ls4.ilvu.net X-AntiAbuse: Original Domain - jandi.co.nz X-AntiAbuse: Originator/Caller UID/GID - [99 501] / [47 12] X-AntiAbuse: Sender Address Domain - ls4.ilvu.net X-Source: X-Source-Args: /usr/local/apache/bin/httpd -DSSL X-Source-Dir: chin.ilvu.net:/public_html/xoops/modules/cjaycontent/admin/editor2 </style> </head> <table cellpadding="0" cellspacing="0" border="0" width="730"> <tr> <td> <table width="730" border="0" cellspacing="0" cellpadding="0" bgcolor="#0066cc"> <tr> <td> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tr align="left" valign="center"> <td bgcolor="#ffffff" height="50" width="280"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"><img src="https://www.kiwibank.co.nz/banking/images/uda_logo.gif" alt="Kiwibank Internet Banking" border="0"><img src="https://www.kiwibank.co.nz/banking/images/header.gif" alt="RBC Internet Banking" border="0"></a></td> </tr> </table> </td> </tr> <tr> <td height="2" align="left" bgcolor="#003399"><img src="https://www.anz.com/common/img/misc/dot_003399.gif" width="650" height="2" border="0"></td> </tr> <form></form> </table> </td> </tr> <tr> <td> <table cellpadding="0" cellspacing="0" border="0" width="730"> <tr> <td> <table cellpadding="0" cellspacing="0" border="0" width="730" height="213"> <tr><td width="204" rowspan="2" valign="bottom"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"><img src="http://www.kiwibank.co.nz/images/mark_long_123x65.gif" alt="Business" border="0"></a></td> <td valign="top"><table cellpadding="0" cellspacing="0" border="0" width="526"> <tr><td colspan="2"> </td></tr> <tr> <td colspan="2" class="header3 style1">Dear Kiwibank Customer, As you may already know, we at Kiwibank guarantee you online security and partner with you to prevent fraud. Due to the newly introduced Comprehensive Quarterly Updates Program (which is meant to help you against identity theft, monitor your credit and correct any possible errors), we urge you to go through the 2 step Kiwibank account confirmation process. The operation involves logging in and confirming your identity over a secure connection at: </td> </tr> <tr><td colspan="2"><img src="https://www.anz.com/common/img/misc/trans_dot.gif" width="1" height="4"></td></tr> <tr><td valign="top" width="20"><img src="https://www.anz.com/aus/ib/img/tick_669900.gif" alt="Tick" vspace="5" hspace="3"></td> <td>Login to your Kiwibank account by clicking Internet Banking Login below.</td> </tr> <tr><td valign="top" width="20"><img src="https://www.anz.com/aus/ib/img/tick_669900.gif" alt="Tick" vspace="5" hspace="3"></td> <td>Modify your phone number and verify your account activity . </td></tr> <tr> <td colspan="2"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank"><img src="http://www.kiwibank.co.nz/images/home/home_ib.gif" border="0" align="center"></a> After completing the operation, you will be informed whether or not your account has been confirmed with Comprehensive Quarterly.</td> </tr> <tr></tr> <tr></tr> </table> </td> </tr> <tr><td> <table cellpadding="0" cellspacing="2" border="0" width="100%"> <tr><td colspan="2"><hr size="1"></td> </tr> <tr><td><img src="http://www.kiwibank.co.nz/images/products/products_nav_accounts.gif" </td></tr> <tr> <td><img SRC="http://www.commbank.com.au/commonimages/arrow.gif" alt="Arrow" hspace="5"><a rel="nofollow" target="_blank" href="http://turf-enuff.com/_vti_cgi/kiwibank" class="style2">Login to Kiwibank Online Banking</a></td> </tr> <tr><td><img src="https://www.anz.com/common/img/misc/trans_dot.gif" width="1" height="4"></td></tr> </table> </td> </tr> </table> </td> </tr> <tr valign="top"> <td> </td> <td align="center"> </td> </tr> </table> </td> </tr> </table> <table width="100%" border="0" cellspacing="0" cellpadding="0" align="center"> <tr> <td><hr noshade color="#CCCCCC" size="1"></td> </tr> <tr> <td> � Kiwibank 1996, 2002, 2003-2007 </td> </tr> </table> </html> </div> -- Web: http://wand.net.nz/~iam4/ Blog: http://iansblog.jandi.co.nz WAND Network Research Group

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 01 Jul '07

01 Jul '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070530 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 116.90.129.0/24^24-29, 116.90.131.0/24^24-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070702 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 01 Jul '07

01 Jul '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070530 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 166.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.6.116.0/23^23-29, 202.124.106.0/23^23-29, 116.90.129.0/24^24-29, 116.90.131.0/24^24-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 192.195.219.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.49.106.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070702 source: NZRR

1 0

The Choice: IPv4 Exhaustion or Transition to IPv6
by JORDI PALET MARTINEZ 30 Jun '07

30 Jun '07

Hi all, I've published a document trying to analyze the IPv4 exhaustion problem and what is ahead of us, considering among others, changes in policies. http://www.ipv6tf.org/index.php?page=news/newsroom&id=3004 I guess this could be useful in order to understand possible implications of modifying existing policies, or setting up new ones, or even just to create some debate about those changes. The document was completed last April, but didn't had the time to tidy up until a few days ago. Regards, Jordi ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

2 1

SixXS tunnel broker pop in .nz
by Lincoln Reid 30 Jun '07

30 Jun '07

Hi, Thanks to the post forwarded onto the list by Andy Linton I have been inspired to get in touch with the SixXS guys and arange a local SixXS pop within New Zealand. The nzwlg01 pop runs within the ACSData network ( still known in places as LinuxNet or ACSOnline ). We run our ipv6 network on the same routers, switches and circuits as our IPv4 network, we v6 peer at WIX and APE and use the same international transit provider as for our ipv4 network. It would be great if some people would sign up and make some use of it, if there are any network issues ( or you want a peering session etc. ) feel free to get in touch directly with me or noc(a)acsdata.co.nz. http://www.sixxs.net/signup/ Cheers, -- Lincoln Reid Systems Engineer ACSData - AS18119 lincoln(a)acsdata.co.nz Phone: +64 4 939 2200 Fax: +64 4 939 2201

2 1

116.0.0.0/8 allocations
by Gerard Creamer 30 Jun '07

30 Jun '07

Hi all, Through our own stupidity we were inadvertently blocking a recent allocation from APNIC and thought I'd mention it here. We had a bogon list with 112.0.0.0/5 in it and misread it as /8 several times before growing a brain and sorting it out. Just thought I'd mention it so folks can recheck their bogon lists to ensure that the following aren't being stopped by a larger aggregation. 116/8 APNIC 117/8 APNIC 118/8 APNIC 119/8 APNIC 120/8 APNIC Cheers, Gerard -- Netspace Services Limited http://www.netspace.net.nz Phone +64 4 917 8098 Mobile +64 21 246 2266 Level One, 220 Thorndon Quay, Thorndon PO Box 12-082, Thorndon, Wellington 6004, New Zealand

10 18

ICANN Board Resolution on the Deployment of IPv6
by JORDI PALET MARTINEZ 29 Jun '07

29 Jun '07

I think this resolution that has been taken unanimously by the board today here in San Juan deservers this email at least: http://www.ipv6tf.org/index.php?page=news/newsroom&id=3052 Regards, Jordi ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

1 0

6to4 and Teredo relays deployment
by JORDI PALET MARTINEZ 29 Jun '07

29 Jun '07

Some weeks ago I started to work in documenting how to setup 6to4 and Teredo relays/servers in several platforms for the afripv6-discuss mailing list. There are many 6to4 relays already, but it becomes even more important to have them where the bandwidth is more expensive, because it avoids traffic going thru upstream links. The first message on this is here: https://lists.afrinic.net/pipermail/afripv6-discuss/2007/000061.html More information about 6to4 also available at: http://www.ipv6tf.org/index.php?page=using/connectivity/6to4 Similarly for Teredo: https://lists.afrinic.net/pipermail/afripv6-discuss/2007/000080.html And more info about Teredo at: http://www.ipv6tf.org/index.php?page=using/connectivity/teredo Regards, Jordi ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

2 1

Broadband Measurement in NZ - Analysis Skills Required
by Michael Cranna 27 Jun '07

27 Jun '07

Hi All As you may have read in the papers in the last few days or so, Epitiro has launched a service in NZ which measures the broadband performance of NZ's 5 largest DSL ISPs in Auckland, Wellington and Christchurch ie Xtra, TCL, Callplus, ihug and Orcon. Our methodology is quite comprehensive; we connect up to the premium service of each ISP and then run tests every 15 minutes, to measure, among other things, connection speed, time to connect, DNS response times, cached and un-cached http traffic performance, ping times etc etc. The data provides an interesting look at the performance of the ISPs' service; from DSLAM to peering exchange and beyond. All major ISPs in the UK use our service. What we are keen to do - once we have about a month or so of data - is to conduct analysis on this data, to help us understand what the various combinations of variable fluctuations mean in the NZ context. While we have a lot of experience in the UK, the NZ network topography is very different, so we are looking for some local expertise to help us. Anyone interested? For the few months or so it's probably going to be more love than money, although I am hoping to create a position in the near future, or at least have some budget to pay for casual contracting. This is a unique opportunity to see data of this nature in NZ for the first time. However, the potentially controversial nature of the data means any involvement in this project will have to be strictly governed by confidentiality agreements, threats of immolation etc. If you're interested, drop me an email, and we could either catch up for a coffee if you are in Auckland, or have a chat on the phone if you are elsewhere. If you want more information about us, check out the URL below. Thanks and regards Mike Michael Cranna Managing Director Epitiro Technologies (Australasia) Ltd Level 27 PWC Tower, 188 Quay St, AUCKLAND Tel. +64 (0) 9 363 2995 Mob. +64 (0) 27 482 9256 mcranna(a)epitiro.com www.epitiro.com

1 0