- NZNOG - lists.nznog.org

Malware used to spam pump and dump scams
by matthew＠auscert.org.au 17 Jan '07

17 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings all, As above - anyone aware of what particular bit of malware is being used to spam pump and dump scams? Also seeing similar usage for mule recruitment. Subjects may have the stock symbol CBFE for the stock P&D or "Managers opened - GAPFG Co" for the mule recruitment. Any feedback appreciated. Thanks for your time, - -- Matthew McGlashan -- Coordination Centre Team Leader | Hotline: +61 7 3365 4417 Australian Computer Emergency Response Team | Direct: +61 7 3365 7924 (AusCERT) | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert(a)auscert.org.au -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: http://www.auscert.org.au/render.html?it=1967 Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRa7T0Ch9+71yA2DNAQLKHAP/U0x1SudRh4BRtg+mxxkry6YifNUPFD+J 6sYjwErVf1N4N+Y6WN5zmU9JuXO+HqrMf79JiZ9eff3fC/2xd7jK1wJWr1GzNO5w jw8jZmO0QAC/2UzrEQuC9q4eDbogk/mHCLzSpg2qyzY6+cdN6IFGcnmgnkL0ycUk eTRO+t+6PQE= =AijR -----END PGP SIGNATURE-----

1 0

IGMP testing - thanks
by Ian Batterbee 16 Jan '07

16 Jan '07

Thanks all for the suggestions. That C source code, (the setting of theIP_ADD_MEMBERSHIP socket option in particular), led me to this rather useful document: http://tldp.org/HOWTO/Multicast-HOWTO-7.html ...which describes how it is the kernel's task to send IGMP out for sockets set as above, and not the application's problem, which explains why there aren't many apps around that send IGMP. And using 'tcpdump -n igmp', on the client end, I can see that it's doing what it should be doing :) Thanks.

1 0

Re: [nznog] IGMP test tools
by chris＠chrishellberg.com 16 Jan '07

16 Jan '07

Hi Ian, What about using a media application like vlc (videolan) and joining a multicast group? I think you might be able to run it in command line mode, if you don't have an X server listening. This'll trigger your IGMP membership reports and respond to group queries. /Chris ----- Original Message ---- From: Ian Batterbee <ian.batterbee(a)aut.ac.nz> To: nznog(a)list.waikato.ac.nz Sent: Tuesday, January 16, 2007 10:45:30 PM Subject: [nznog] IGMP test tools Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

2 1

IGMP test tools
by Ian Batterbee 16 Jan '07

16 Jan '07

Hi all, I'm looking for some linux test tools that I can run that will send IGMP join commands and that will respond to IGMP queries (to keep the group alive), that I can use to prove or disprove a sparse mode pim configuration. There's such a blatent lack of matches for anything like this on google that I wonder if I'm overlooking some basic utility that is already included with most distros or is built into the kernel, but I can't come up with anything on that front either. Using a Cisco router or switch as a multicast group member is a possibility, but I'd rather use linux hosts if I can do so.

3 2

Notification of NZRR Database changes
by NZRR Database Notifications 15 Jan '07

15 Jan '07

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS9733 descr: Route set advertised to AS9439 by Netspace Services Limited - AS9733 members: 203.118.134.64/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: operations(a)netspace.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20061219 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS9733 descr: advertised to AS9439 by Netspace Services Limited - AS9733 members: 210.4.208.0/21^21-29, 203.118.134.64/26^26-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: operations(a)netspace.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20070116 source: NZRR

1 0

Hello all & a word on SPEWS DNS blackhole
by Michael Fincham 15 Jan '07

15 Jan '07

Hi everyone... Just wondering if anyone knows how prevalent checking against the (supposedly now defunct) SPEWS SPAM DNS blackhole list remains among NZ operators? Reason I ask is that our netblock seems to be inadvertently (and/or incorrectly) listed as an Aussie porn spam sender, and with the general unpleasantness involved in dealing with SPEWS combined with the apparent departure of their admins, I don't see any real resolution to this other than waiting for people to stop using SPEWS on their mail servers... Currently it looks like iServe's mail server is still using SPEWS as are the mail servers used by ISP amuri.net. These are the only two I have encountered so far since moving our mail server to its new home (202.6.116.105) -- --Michael Fincham Unleash Technology Solutions

3 2

Re: [nznog] Hello all & a word on SPEWS DNS blackhole
by Michael Fincham 15 Jan '07

15 Jan '07

> We do not use SPEWS though if you would kindly provide onlist a list > > of your > netblock addresses, myself and I'm sure others will check them against the > BL's we use and if neccessary whitelist accordingly. Hooray. Nothing like a post like that to restore my faith in humanity :^) We've got: 202.6.116.0/23 and for a short time longer, 210.55.104.0/26 - although that is technically assigned to Maxnet, not directly to us, and we are phasing out mailing from addresses in that range. Here's hoping I didn't break the threading with this post - I need to turn off digest mode :) -- --Michael Fincham Unleash Technology Solutions

2 1

Bus/Train to NZNOG
by Joel van Velden 15 Jan '07

15 Jan '07

Hi all The idea was floated at last weeks Curry in Auckland about hiring a bus to travel to NZNOG, as there would possibly be quite a number of people between Auckland and Palmerston North interested in a less stressful and cheaper means of getting there. I have no idea of what numbers would be required at this stage or what the cost would be. Obviously it would be cheaper than flying, but take longer to get there. The other alternative might be to group-book the train, which has tables, not sure about AC power, you can walk around, is apparently newly-refurbished, but probably takes a little longer than a bus, and possibly more expensive. Is anyone is interested? Contacting me off-list would be best. Regards, Joel van Velden

4 3

NZNOG Programme.
by Jonny Martin 14 Jan '07

14 Jan '07

Right, Neil and I have pretty much sorted the NZNOG programme. It's reasonably flexible, with a bit of room to slot things in if any important last minute talks pop up etc. It takes into account any preferences for days to talk on I have received. A couple of additions that have come up recently are for InternetNZ to have a talking slot to cover anti-spam legislation, copyright bills, and general telecommunications issues and how they impact ISPs. There is also a NZ internet history session slotted in. Richard Wood is writing a book on the subject for InternetNZ so will use this slot to gain some more content for this. Can someone give this a quick sanity check please? Dave will be throwing this on the website when he gets back in the office this afternoon. Cheers, Jonny.

3 2

[NZNOG 07 Conference] Registrations Close Today!
by Mark Foster 14 Jan '07

14 Jan '07

A gentle reminder that today is the last day for Conference registrations. If you havn't yet, but intended to, now is the time! I would imagine that ~3pm today is as late as anyone would want to dare leave it, as after that details of the registrations need to go out to our hosts, etc. (Registrations post today will continue to be accepted, but theres no guarantees around the availability of accomodation, for example.) Cheers Mark.

1 1