- NZNOG - lists.nznog.org

04 Dec '05

Does anybody know what's up with TelstraClear. I can't get to their nameservers from NZ or the US. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Senior Software Engineer Phone (+64-9) 358 2081 Clearfield Software Ltd Fax (+64-9) 358 2083 4th Floor 8-10 Whitaker Place Mob (+64-21) 640 779 P O Box 3901 Auckland, New Zealand ------------------------------------------------------------------------

3 3

Re: [nznog] TelstraClear down
by Stewart Fleming 04 Dec '05

04 Dec '05

DNS certainly gone bang. IP routing still working, but very slow. Denial of service attack? Had a call from my Telstra rep earlier, but that was for a billing error outstanding since February. Maybe they keep the DNS records in the same file...? -- Proxy Error The proxy server received an invalid response from an upstream server. The proxy server could not handle the request GET http://networkstatus.telstraclear.co.nz/home/clearnet.html. Reason: DNS lookup failure for: networkstatus.telstraclear.co.nz Apache/2.0.52 (Unix) Server at networkstatus.telstraclear.co.nz Port 80 Traceroute from TC frame relay hosted in ChCh to www.xtra.co.nz 3 218.101.61.74 (218.101.61.74) 28.325 ms 21.328 ms 27.119 ms 4 218.101.61.69 (218.101.61.69) 25.932 ms 18.852 ms 40.947 ms 5 218.101.61.33 (218.101.61.33) 17.685 ms 28.273 ms 124.740 ms 6 ggis-gige-v906.telstraclear.net (203.98.18.67) 43.038 ms 42.818 ms 15.735 ms 7 g0-1-0-4.akcr8.global-gateway.net.nz (210.55.202.49) 18.469 ms 36.399 ms 28.106 ms 8 v4.aksw7.global-gateway.net.nz (210.55.202.51) 46.682 ms 36.813 ms 43.531 ms 9 xtra-dom-2.aksw7.global-gateway.net.nz (203.96.120.150) 32.408 ms 18.452 ms 39.837 ms

3 2

Re: [nznog] TelstraClear Down?
by Simon Allard 04 Dec '05

04 Dec '05

Just the nameservers? They have probably been ACL'ed to stop DNS DDoS attacks, like what xtra etc have done. Simon Allard ihug Limited P +64 9 962 9827 M +64 21 456 412 E simon.allard(a)staff.ihug.co.nz > -----Original Message----- > From: jfp [mailto:jfp(a)clearfield.com] > Sent: Monday, 5 December 2005 10:20 a.m. > To: NZNOG(a)list.waikato.ac.nz > Subject: [nznog] TelstraClear Down? > > > Does anybody know what's up with TelstraClear. I can't get to their > nameservers from NZ or the US. > > > jfp. > > ------------------------------------------------------------------------ > Jean-Francois Pirus <jfp(a)clearfield.com> Senior Software Engineer > Phone (+64-9) 358 2081 Clearfield Software Ltd > Fax (+64-9) 358 2083 4th Floor 8-10 Whitaker Place > Mob (+64-21) 640 779 P O Box 3901 Auckland, New Zealand > ------------------------------------------------------------------------ > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

10 13

Re: [nznog] TelstraClear Down?
by Peter Mott 04 Dec '05

04 Dec '05

Maybe there was an imperical decision taken by AU head office to close it down due to lack of profits. :-) regards Peter Mott MOTT & ASSOCIATES Tel: +64 9 488 9352 Fax: +64 9 486 7017 -/-

2 1

Xen for network services (aka web/mail/dns etc) - OT?
by Simon 02 Dec '05

02 Dec '05

Hi There, I have been discussing the utilisation of Xen in a production environment on a couple of other lists (nzlug, debian-isp etc), but wondering if anyone from this list is using it in new zealand for serving of network services? Please let me know if this is OT. Would like to hear your experiences if so. Simon

6 6

Re: [nznog] [Fwd: Re: Bizarre spam]
by Nic Wise 01 Dec '05

01 Dec '05

I'd go with zombie's :) the . Then new line new line thing means that the rest of whatever your script does is ignored by the SMTP server, and the big long number might be either a "key" to get the target of an attack (eg, HTTP to this server, present this key, get details back) or something, or the IP / DNS name / something else of it, maybe base64'ed or encrypted somehow. I could see a virus/trojan/etc sitting there, polling a pop3 account, looking for emails with those words in the subject, and some form of payload, then it pings up and goes and does something. Maybe the attacked script was used as a "trigger"?? Damn it's time for a beer. N > -----Original Message----- > From: Justin Cook [mailto:justin(a)skull.co.nz] > Sent: Friday, 2 December 2005 3:01 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] [Fwd: Re: Bizarre spam] > > It was, and it's already dealt with. Just looking for the > reason behind it. Adrian is probably on the mark when he > calls it a DoS. > > James Clark wrote: > > > > > Sounds like PHP injection, assume it's PHP. If not ignore me. > > > > These articles explain the cause and fixes in more depth: > > > > http://securephp.damonkohler.com/index.php/Email_Injection > > http://www.nyphp.org/phundamentals/email_header_injection.php > > > > > > Justin Cook wrote: > > > >> I've got a question for the appropriate higher minds. > >> > >> I fixed one of my clients self-built contact forms after I had an > >> inkling that someone was injecting headers into it to use it as a > >> relay. Turns out I was right, but it's beyond me what > they're trying > >> to accomplish: > >> > >> Content-Type: text/plain; charset="us-ascii" > >> MIME-Version: 1.0 > >> Content-Transfer-Encoding: 7bit > >> Subject: which a rising moon now threw from the scattered clouds > >> bcc: charleslegbe(a)aol.com > >> > >> 648a4d46b041327ac30fe4f27a9b72ee > >> . > >> > >> > >> Tons and tons of that just that. What possible use could > this garbage > >> be? Is someone trying to blackhole their domain? > >> > >> Cheers > >> Justin > >> > >> _______________________________________________ > >> NZNOG mailing list > >> NZNOG(a)list.waikato.ac.nz > >> http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > > > > > > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog >

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 01 Dec '05

01 Dec '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS17435 descr: advertised to AS9560 by WorldxChange Communications - AS17435 members: 202.182.192.0/19^19-29, 58.28.0.0/16^16-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: gsmith(a)wxc.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050308 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS17435 descr: advertised to AS9560 by WorldxChange Communications LTD - AS17435 members: 58.28.0.0/16^16-29, 202.182.192.0/19^19-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)wxnz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051202 source: NZRR

1 0

Bizarre spam
by Justin Cook 01 Dec '05

01 Dec '05

I've got a question for the appropriate higher minds. I fixed one of my clients self-built contact forms after I had an inkling that someone was injecting headers into it to use it as a relay. Turns out I was right, but it's beyond me what they're trying to accomplish: Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: which a rising moon now threw from the scattered clouds bcc: charleslegbe(a)aol.com 648a4d46b041327ac30fe4f27a9b72ee . Tons and tons of that just that. What possible use could this garbage be? Is someone trying to blackhole their domain? Cheers Justin

2 1

[Fwd: Re: Bizarre spam]
by Justin Cook 01 Dec '05

01 Dec '05

It was, and it's already dealt with. Just looking for the reason behind it. Adrian is probably on the mark when he calls it a DoS. James Clark wrote: > > Sounds like PHP injection, assume it's PHP. If not ignore me. > > These articles explain the cause and fixes in more depth: > > http://securephp.damonkohler.com/index.php/Email_Injection > http://www.nyphp.org/phundamentals/email_header_injection.php > > > Justin Cook wrote: > >> I've got a question for the appropriate higher minds. >> >> I fixed one of my clients self-built contact forms after I had an >> inkling that someone was injecting headers into it to use it as a >> relay. Turns out I was right, but it's beyond me what they're trying >> to accomplish: >> >> Content-Type: text/plain; charset="us-ascii" >> MIME-Version: 1.0 >> Content-Transfer-Encoding: 7bit >> Subject: which a rising moon now threw from the scattered clouds >> bcc: charleslegbe(a)aol.com >> >> 648a4d46b041327ac30fe4f27a9b72ee >> . >> >> >> Tons and tons of that just that. What possible use could this garbage >> be? Is someone trying to blackhole their domain? >> >> Cheers >> Justin >> >> _______________________________________________ >> NZNOG mailing list >> NZNOG(a)list.waikato.ac.nz >> http://list.waikato.ac.nz/mailman/listinfo/nznog > > >

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 01 Dec '05

01 Dec '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: route-set: AS9560:RS-ROUTES:AS18119 descr: Route set advertised to AS9560 by Linux Net - AS18119 members: 202.46.160.0/20^20-29, 202.126.80.0/21^21-29, 202.21.136.0/23^23-29, 202.61.2.0/23^23-29, 192.107.113.0/24^24-29, 202.36.44.0/24^24-29, 202.37.136.0/24^24-29, 202.49.144.0/24^24-29, 202.49.249.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: lincoln(a)linuxnet.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051202 source: NZRR

1 0