- NZNOG - lists.nznog.org

Prime Minister heart attack trojan spam run
by matthew＠auscert.org.au 18 Feb '07

18 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 G'day all Have just released an alert on a(nother) trojan spam run at: AL-2007.0026 -- [Win] -- "Prime Minister heart attack" trojan http://www.auscert.org.au/7314 Basically there being emails currently in circulation with a variety of subject lines, including: "Current Australia's Prime Minister survived a hear attack" "The life of the Prime Minister is in grave danger" "Prime Minister survived a heard attack" with a link to malicious websites, including: h**p://www,austr-news,com/ h**p://www,theaunews,com/ h**p://www,theau-news,org/ Anyone seeing a lot of this? Perhaps targeting other heads of state? Might be worth keeping an eye out as we've seen similar to this before: AL-2006.0069 -- [Win] -- "John Howard tragedy" email attachment installs Torpig credential stealing trojan http://www.auscert.org.au/6645 with similar 'hooks' in that one appearing to be targeting Italy and the UK at least with messages of their government leaders' reported assassination. Feedback appreciated. Best regards, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRdlMDyh9+71yA2DNAQKhGwQAmY99YaXxm48qj5LqxSSYYeMlTTSjWIvm F1S/Qop5km5/e2ZrDNJHbojfVNpLg9YrXGG8AxtY5nTcD852ojBuTf9tBmHUwqwF ljnyc4L6zxZ4iFzFWEZhypXBcnN6AZEYU8++vnnqePCK6KPfZsNJkhgodq2L53n9 GimZG4XHaso= =/dMS -----END PGP SIGNATURE-----

1 0

[Fwd: [pacnog] IPv4 exhaustion discussions in Asia Pacific region]
by Andy Linton 18 Feb '07

18 Feb '07

Given our discussions on IPv4 and IPv6 at the recent nznog meeting some of you may be interested in this. -------- Original Message -------- Subject: [pacnog] IPv4 exhaustion discussions in Asia Pacific region Date: Mon, 12 Feb 2007 10:44:32 +1000 (EST) From: Elly Tawhai <elly(a)apnic.net> To: pacnog(a)pacnog.org Hi You are probably aware by now that the exhaustion of IPv4 address space is likely to occur in the next few years. You might be interested to know that a proposal to deal with IPv4 exhaustion has been put forward for discussion in the APNIC region. The proposal suggests five main principles: (1) Global synchronization: All five RIRs will proceed at the same time for measures on IPv4 address exhaustion. (2) Some Blocks to be left: Keep a few /8 stocks instead of distributing all. (3) Keeping current practices until the last moment: Maintain the current policy until the last allocation. (4) Separate discussions on "recycle" issue: Recovery of unused address space should be discussed separately For more information on the proposal, see: http://www.apnic.net/docs/policy/proposals/prop-046-v001.html This proposal affects the whole Internet community. I encourage you to read the proposal and have your say on the APNIC Policy SIG mailing list, or at the upcoming APNIC 23 meeting in Bali, Indonesia, 26 February - 2 March 2007. If you can't attend the meeting in person, you can still have your say by participating remotely via live chat. APNIC Policy SIG mailing list information: http://www.apnic.net/community/lists APNIC 23: http://www.apnic.net/meetings/23/ Kind regards, Elly APNIC

13 13

[Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Patrick Jordan-Smith 18 Feb '07

18 Feb '07

> Which is a problem if we are reliant on the telco's to move to IPv6. > Why would any sane [NZ] telco spend serious money changing to a > technology which further relegates them to a common bit pusher? > There is an argument here that IPv4 exhaustion provides a technical > rational for telcos to provide walled garden, proxy-style services. I fully support this style of thinking. Infact, if I was an ISP I would be seriously considering NATing my entire customer base - except for those who were willing to pay $x/mo for a real IP. At the end of the day, with a few exceptions, most protocols work quite well from behind a nat. And it gives me another revenue stream, which if I am an ISP would be quite useful considering I am probably losing money on the DSL I am currently providing. Cheers, Patrick -- patpatnz(a)gmail.com

6 6

APNIC fee structure - Online voting period extended
by Elly Tawhai 18 Feb '07

18 Feb '07

Dear Colleagues Voting on the APNIC fee schedule questions has now been extended by one week. The APNIC Executive Council decided to extend the online vote due to the low number of responses so far. This is an important issue for all APNIC members, so we encourage you to have your opinions counted. The new deadline for votes is 14:00 UTC, Friday 23 February, 2007. To vote, or get more information about the process, please go to: https://my.apnic.net/voting Please note that only registered voting contacts are able to cast votes. If you have any questions about using MyAPNIC, please contact helpdesk(a)apnic.net. Kind regards, Elly ________________________________________________________________________ Elly Tawhai email: elly(a)apnic.net Internet Resource Analyst, APNIC sip: elly(a)voip.apnic.net http://www.apnic.net/helpdesk phone: +61 7 3858 3188 fax: +61 7 3858 3199 ________________________________________________________________________ See you at APNIC 23! Bali, 26 February - 2 March, 2007 http://www.apnic.net/meetings

1 0

Re: [nznog] [Fwd: [pacnog] IPv4 exhaustion discussionsin Asia Pacific region]
by Ewen McNeill 17 Feb '07

17 Feb '07

In message <2B310DEB-219F-4F70-9779-F27EDDEE60AA(a)ca.afilias.info>, Joe Abley writes: >On 16-Feb-2007, at 17:00, Nathan Ward wrote: >> End-to-end IP connectivity is so passe. > >But it's arguably what allowed the Internet to grow and flourish. If >the network controls the applications that users can deploy, then >[provider catchup or user disappointment or] >people will stop dreaming up new applications for users to run, and >will instead concentrate on packages they can sell to carriers and ISPs. Or, perhaps worse, all new applications will have an extra layer to "route around" this problem. The rise of application data over XML over HTTP (over SSL) over TCP over IP hints at what this world might be like. That's not exactly progress. The security folks aren't exactly keen on this either (even without the SSL, it's very hard to "pinhole" inspect what is going on in the midst of large XML payloads, and you don't get much of a service type indicator if it's all XML over HTTP). The "big win" of Skype, and Kazaa before it, is its ability to "route around" the NAT everywhere, firewall everywhere, world and overlay what is basically an end-to-end network again (at least bits of it created on demand). That's not exactly progress either. Some other possibilities have been suggested, such as smarter intermediate boxes (firewalls, NAT), with which one negotiates (as in a protocol to request) a path through to the end box. This is already starting to happen with, eg, STUN, but potentially could be formalised as part of connection setup, and done automatically rather than requiring per-application custom setup. One is left wondering if instead of inventing random ad-hoc "tunnel through intermediate boxes" protocols it may be that things converge on, eg, 6-over-4. At least, eg, application over TCP over IPv6 over IPv4 is still pretty transparent, and doesn't have _that_ much overheard (compared with, eg, XML over HTTP). And there's some eventual migration path which involves reducing layers (eventually when everything is 6-over-4 it makes sense to just get rid of the IPv4 bit). Ewen

1 0

Apropos addressing
by Juha Saarinen 17 Feb '07

17 Feb '07

Geoff Huston has something to say on that: http://www.circleid.com/posts/addressing_the_future_internet/ (Shamelessly nicked from Bill St Arnaud's CAnet news: http://www.canarie.ca/canet4/library/list.html) -- Juha Saarinen www.geekzone.co.nz/juha | Skype: juha_saarinen blogs.pcworld.co.nz/pcworld/techsploder www.computerworld.co.nz | MSN: juha_saarinen(a)msn.com Voice: +64 9 950 3023 Subtle recursive jokes in .sigs are not funny.

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 13 Feb '07

13 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS38292 descr: Route set advertised to AS9439 by Zero One - AS38292 members: 210.48.94.0/24^24-29, 210.48.103.192/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: nick(a)01.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS38292 descr: advertised to AS9439 by ZeroOne (NZ) Limited - AS38292 members: 202.174.6.0/23^23-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)zeroone.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070214 source: NZRR

1 0

NZNOG 2007: Sysadmin Miniconf: Slides available
by Ewen McNeill 11 Feb '07

11 Feb '07

For those that attended the Sysadmin Miniconf at NZNOG 2007 (or wished to but had conflicts), the slide sets from most of the talks at the miniconf are now online: http://nznog.miniconf.org/ Thank you to everyone who participated in the miniconf and helped make it a success, and especially to those who spoke at the miniconf. If anyone has anything else that they want linked to the Sysadmin Miniconf page please email it to <talks(a)nznog.miniconf.org>. Ewen

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 11 Feb '07

11 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061214 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS9503 descr: advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 11 Feb '07

11 Feb '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061218 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9503 descr: advertised to AS9439 by FX Networks - AS9503 members: 131.203.0.0/16^16-29, 161.29.0.0/16^16-29, 161.65.0.0/16^16-29, 202.53.176.0/20^20-29, 202.174.160.0/20^20-29, 202.191.32.0/20^20-29, 210.48.160.0/20^20-29, 123.108.144.0/21^21-29, 202.46.176.0/21^21-29, 202.78.240.0/21^21-29, 203.190.208.0/21^21-29, 202.37.48.0/22^22-29, 202.59.4.0/22^22-29, 202.124.106.0/23^23-29, 192.88.85.0/24^24-29, 192.133.31.0/24^24-29, 202.20.97.0/24^24-29, 202.27.208.0/24^24-29, 202.36.119.0/24^24-29, 202.36.183.0/24^24-29, 202.46.190.0/24^24-29, 202.50.247.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc-minor(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070212 source: NZRR

1 0