- NZNOG - lists.nznog.org

Re: [nznog] TelstraClear Down?
by Peter Mott 04 Dec '05

04 Dec '05

Maybe there was an imperical decision taken by AU head office to close it down due to lack of profits. :-) regards Peter Mott MOTT & ASSOCIATES Tel: +64 9 488 9352 Fax: +64 9 486 7017 -/-

2 1

Xen for network services (aka web/mail/dns etc) - OT?
by Simon 02 Dec '05

02 Dec '05

Hi There, I have been discussing the utilisation of Xen in a production environment on a couple of other lists (nzlug, debian-isp etc), but wondering if anyone from this list is using it in new zealand for serving of network services? Please let me know if this is OT. Would like to hear your experiences if so. Simon

6 6

Re: [nznog] [Fwd: Re: Bizarre spam]
by Nic Wise 01 Dec '05

01 Dec '05

I'd go with zombie's :) the . Then new line new line thing means that the rest of whatever your script does is ignored by the SMTP server, and the big long number might be either a "key" to get the target of an attack (eg, HTTP to this server, present this key, get details back) or something, or the IP / DNS name / something else of it, maybe base64'ed or encrypted somehow. I could see a virus/trojan/etc sitting there, polling a pop3 account, looking for emails with those words in the subject, and some form of payload, then it pings up and goes and does something. Maybe the attacked script was used as a "trigger"?? Damn it's time for a beer. N > -----Original Message----- > From: Justin Cook [mailto:justin(a)skull.co.nz] > Sent: Friday, 2 December 2005 3:01 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] [Fwd: Re: Bizarre spam] > > It was, and it's already dealt with. Just looking for the > reason behind it. Adrian is probably on the mark when he > calls it a DoS. > > James Clark wrote: > > > > > Sounds like PHP injection, assume it's PHP. If not ignore me. > > > > These articles explain the cause and fixes in more depth: > > > > http://securephp.damonkohler.com/index.php/Email_Injection > > http://www.nyphp.org/phundamentals/email_header_injection.php > > > > > > Justin Cook wrote: > > > >> I've got a question for the appropriate higher minds. > >> > >> I fixed one of my clients self-built contact forms after I had an > >> inkling that someone was injecting headers into it to use it as a > >> relay. Turns out I was right, but it's beyond me what > they're trying > >> to accomplish: > >> > >> Content-Type: text/plain; charset="us-ascii" > >> MIME-Version: 1.0 > >> Content-Transfer-Encoding: 7bit > >> Subject: which a rising moon now threw from the scattered clouds > >> bcc: charleslegbe(a)aol.com > >> > >> 648a4d46b041327ac30fe4f27a9b72ee > >> . > >> > >> > >> Tons and tons of that just that. What possible use could > this garbage > >> be? Is someone trying to blackhole their domain? > >> > >> Cheers > >> Justin > >> > >> _______________________________________________ > >> NZNOG mailing list > >> NZNOG(a)list.waikato.ac.nz > >> http://list.waikato.ac.nz/mailman/listinfo/nznog > > > > > > > > > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog >

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 01 Dec '05

01 Dec '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9560:RS-ROUTES:AS17435 descr: advertised to AS9560 by WorldxChange Communications - AS17435 members: 202.182.192.0/19^19-29, 58.28.0.0/16^16-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: gsmith(a)wxc.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050308 source: NZRR REPLACED BY: route-set: AS9560:RS-ROUTES:AS17435 descr: advertised to AS9560 by WorldxChange Communications LTD - AS17435 members: 58.28.0.0/16^16-29, 202.182.192.0/19^19-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)wxnz.net mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051202 source: NZRR

1 0

Bizarre spam
by Justin Cook 01 Dec '05

01 Dec '05

I've got a question for the appropriate higher minds. I fixed one of my clients self-built contact forms after I had an inkling that someone was injecting headers into it to use it as a relay. Turns out I was right, but it's beyond me what they're trying to accomplish: Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: which a rising moon now threw from the scattered clouds bcc: charleslegbe(a)aol.com 648a4d46b041327ac30fe4f27a9b72ee . Tons and tons of that just that. What possible use could this garbage be? Is someone trying to blackhole their domain? Cheers Justin

2 1

[Fwd: Re: Bizarre spam]
by Justin Cook 01 Dec '05

01 Dec '05

It was, and it's already dealt with. Just looking for the reason behind it. Adrian is probably on the mark when he calls it a DoS. James Clark wrote: > > Sounds like PHP injection, assume it's PHP. If not ignore me. > > These articles explain the cause and fixes in more depth: > > http://securephp.damonkohler.com/index.php/Email_Injection > http://www.nyphp.org/phundamentals/email_header_injection.php > > > Justin Cook wrote: > >> I've got a question for the appropriate higher minds. >> >> I fixed one of my clients self-built contact forms after I had an >> inkling that someone was injecting headers into it to use it as a >> relay. Turns out I was right, but it's beyond me what they're trying >> to accomplish: >> >> Content-Type: text/plain; charset="us-ascii" >> MIME-Version: 1.0 >> Content-Transfer-Encoding: 7bit >> Subject: which a rising moon now threw from the scattered clouds >> bcc: charleslegbe(a)aol.com >> >> 648a4d46b041327ac30fe4f27a9b72ee >> . >> >> >> Tons and tons of that just that. What possible use could this garbage >> be? Is someone trying to blackhole their domain? >> >> Cheers >> Justin >> >> _______________________________________________ >> NZNOG mailing list >> NZNOG(a)list.waikato.ac.nz >> http://list.waikato.ac.nz/mailman/listinfo/nznog > > >

2 1

Notification of NZRR Database changes
by NZRR Database Notifications 01 Dec '05

01 Dec '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: route-set: AS9560:RS-ROUTES:AS18119 descr: Route set advertised to AS9560 by Linux Net - AS18119 members: 202.46.160.0/20^20-29, 202.126.80.0/21^21-29, 202.21.136.0/23^23-29, 202.61.2.0/23^23-29, 192.107.113.0/24^24-29, 202.36.44.0/24^24-29, 202.37.136.0/24^24-29, 202.49.144.0/24^24-29, 202.49.249.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: lincoln(a)linuxnet.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051202 source: NZRR

1 0

Re: [nznog] Bizarre spam]
by Justin Cook 01 Dec '05

01 Dec '05

I think they're going to 30 or 40 different AOL addresses. Just trashed about 800 of them so I can't really go back and check for sure. They're being sent from a lot of different IP addresses, some of them in the same range but not always. Probably zombies. Seems like a lot of work to go to for fuck all. Kitto, Adrian - Axon AKL wrote: >Does it all BCC the same mailbox? > >Could be an old fashion dos on the mailbox... (seen it before) > >Cheers > >Adrian > > >-----Original Message----- >From: Justin Cook [mailto:justin(a)skull.co.nz] > >Sent: Friday, 2 December 2005 2:54 p.m. >To: nznog(a)list.waikato.ac.nz >Subject: [nznog] Bizarre spam > >I've got a question for the appropriate higher minds. > >I fixed one of my clients self-built contact forms after I had an > >inkling that someone was injecting headers into it to use it as a relay. > >Turns out I was right, but it's beyond me what they're trying to >accomplish: > >Content-Type: text/plain; charset="us-ascii" >MIME-Version: 1.0 >Content-Transfer-Encoding: 7bit >Subject: which a rising moon now threw from the scattered clouds >bcc: charleslegbe(a)aol.com > >648a4d46b041327ac30fe4f27a9b72ee >. > > >Tons and tons of that just that. What possible use could this garbage > >be? Is someone trying to blackhole their domain? > >Cheers >Justin > >_______________________________________________ >NZNOG mailing list >NZNOG(a)list.waikato.ac.nz >http://list.waikato.ac.nz/mailman/listinfo/nznog > >-- >The information contained in this e-mail message is intended only for the >use of the person or entity to whom it is addressed and may contain >information that is CONFIDENTIAL and may be exempt from disclosure under >applicable laws. > >If you read this message and are not the addressee you are notified that >use, dissemination, distribution, or reproduction of this message is >prohibited. If you have received this message in error, please notify us >immediately and delete the original message. You should scan this message >and any attached files for viruses. > >Axon accepts no liability for any loss caused either directly or >indirectly by a virus arising from the use of this message or any >attached file. > > >

1 0

JSR.COM Prefix List Update (and peering request)
by John S Russell 01 Dec '05

01 Dec '05

Hiya all (and sundry), For those of you who peer with jsr.com, here's a prefix update. It's a massive update, since I am DOUBLING the amount of advertised prefixes[1], like woah. New list can be found here: http://jsr.com/prefix For those of you who are not currently peering with jsr.com, please consider doing so. jsr.com is a very very tiny boutique and exclusive as hell co-location service. It's run by geeks, for geeks, generally to service geek whims and projects. There's a fair wack of content on there, including: - The personal mail and web servers for various notable NZ geeks! - [Unable to state due to NDA compliance!] - Up-To-Date Debian Mirrors! - [Unable to state due to a personal promise!] - [Unable to state for fear of reprisal!] If you'd like to set up a direct peering session via APE, please contact jsr(a)jsr.com to arrange it (TelstraClear staff, I'm looking forward to hearing from you!). Sadly we do not yet have a WIX presence, but this is in our roadmap for future growth.[2] If you'd like to discuss co-location in our Sky Tower facility, please also contact jsr(a)jsr.com and have a list of reasons why you're geeky enough or your project is cool enough to merit the allocation of our sweet, precious, incandescent with awesomeness[3], rack units on L48. Cheers, JSR [1] To two. [2] Mind you, so is "Evolve into energy beings, rule universe from on high." [3] Incandescence may actually be caused by thermal dissipation from servers. YMMV.

1 0

Remote server booting
by Simon 01 Dec '05

01 Dec '05

Hi There, Im wondering if anyone has used or is using a good solution to remote boot (from complete power down) servers and equiptment? This i have done in the past by having the bios on the server set to reboot after power fail and that takes care of the rest along with good load UPS's and backup power. But what if you acually had to shut down a server for some reason out-there (backup power fails)? Regards, Simon

19 23