- NZNOG - lists.nznog.org

Any XTRA Mail Server Admins available?
by David Howes 04 Oct '05

04 Oct '05

We've been seeing the same 300KB message resend through our servers every few seconds for the last 18 hours (3500 messages so far) from the XTRA mail servers. Can someone that has the ability to resolve this, contact me off-list? I've had no luck with anyone I've spoken to at XTRA/Telecom. - Dave. ---------- The information contained in this e-mail and any attachments is confidential and is intended for the attention and use of the named addressee(s) only. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of Chelmer Limited. ##################################################################################### This e-mail message has been scanned for Viruses and Content and cleared by NetIQ MailMarshal #####################################################################################

2 1

The New Zealand Network Operators' Group
by Donald Neal 03 Oct '05

03 Oct '05

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. It consists of the subscribers to this mailing list, which anyone is free to join. Conference Our next conference is to be held in Wellington on 22-24 March, 2006. That's the week before the scheduled ICANN meeting. See http://www.nznog.org/ for more information, including the Call for Participation and Papers. Other Meetings See http://auckland.thursdaynightcurry.com/ or http://wellington.thursdaynightcurry.com/ if you live in or near Auckland or Wellington. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators, not by most customers. Internet Exchanges See http://nzix.net/ for details of exchanges in operation, and some information on others under construction. About This Mailing List This list has around 850 addresses subscribed. You may only post to the list from a subscribed address. A number of people subscribe addresses which do not receive email purely to allow posting from them. You may choose to receive postings as they come in, or just to receive daily "digests". See the bottom of the page http://list.waikato.ac.nz/mailman/listinfo/nznog/ to change the form in which you receive postings. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by employees of Alcatel NZ Ltd, Citylink and Telecom. None of these organisations, nor any administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/pipermail/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrators remain happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. One way to search the archive is to use google and prefix your search With site:list.waikato.ac.nz . Subscribing to the List See http://list.waikato.ac.nz/mailman/listinfo/nznog to subscribe. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002."

1 0

Bankdirect phish
by Craig Box 01 Oct '05

01 Oct '05

Just got a phish for BankDirect. The telling part: "<a href="http://www.bankdlrect.co.nz/index_secure.asp" >" - notice the 'l' where the I should be. Hopefully as this is inside .nz DNS we can get this one shut down quickly. The domain is registered with DiscountDomains.co.nz to a RODNEY GUISTWITE. admin_contact_name: RODNEY GUISTWITE admin_contact_address1: 9740 CONIFER LANE admin_contact_city: MURRELLS INLET admin_contact_country: US (UNITED STATES) admin_contact_phone: +84 3 6501641 admin_contact_email: directmain(a)yahoo.com The email headers: Received: from firewall.itpartners.co.nz ([10.7.0.254]) by penfold.itpartners.co.nz with Microsoft SMTPSVC(6.0.3790.1830); Fri, 30 Sep 2005 08:46:23 +1200 Received: from [218.233.125.18] (helo=-1208382648) by firewall.itpartners.co.nz with smtp (Exim 4.34) id 1EL5Iv-0007GJ-5u for craig(a)itpartners.co.nz; Fri, 30 Sep 2005 08:47:04 +1200 Received: from bankdirect.co.nz (-1208528168 [-1208791160]) by google.com (Qmailv1) with ESMTP id 554E5D0054 for <craig(a)itpartners.co.nz>; Thu, 29 Sep 2005 13:13:12 -0700 Date: Thu, 29 Sep 2005 13:13:12 -0700 From: Bankdirect Accounts <accounts(a)bankdirect.co.nz> X-Mailer: The Bat! (v2.00.8) Personal X-Priority: 3 Message-ID: <5432025998.20050929131312(a)bankdirect.co.nz> To: Craig <craig(a)itpartners.co.nz> Subject: New Fraud-Prevention system. MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------C0723C19AFB5862" X-Virus-Scanned: Symantec AntiVirus Scan Engine X-Spam-Score: -5.8 {-----} X-Spam-Report: No, hits=-5.8 required=5.0 tests=ALL_TRUSTED,BAYES_00,HTML_MESSAGE,HTML_TAG_EXIST_TBODY autolearn=ham version=3.0.2 Return-Path: accounts(a)bankdirect.co.nz X-OriginalArrivalTime: 29 Sep 2005 20:46:23.0798 (UTC) FILETIME=[DAB2BD60:01C5C536] Craig Box Phone 07 957 2653 IT Partners Ltd Fax 07 957 2659 PO Box 9361 Mobile 021 475 869 Hamilton, New Zealand _________________________________________________________________ #include <standard-disclaimer.h> _________________________________________________________________

8 7

Olfrygt - a word for the NZNOG lexicon
by Andy Linton 01 Oct '05

01 Oct '05

An article in this weekend's Dom Post talked about words in other languages which don't have a direct equivalent in English. The Danes have "olfrygt" - the fear arising from a lack of beer.

2 2

Re: [nznog] Waiuku/ glen brook area wireless access
by Richard Naylor 29 Sep '05

29 Sep '05

At 10:36 AM 9/30/2005 +1200, Webmaster wrote: >and more beer..... > > >>> Richard Naylor <richard.naylor(a)citylink.co.nz> 30/09/2005 10:30 > >>> >of course using both birds would be nice....but so would lower latency, > >higher bandwidth, cheaper access, no rain, more money, air >conditioning in >the van, cheaper diesel, better hotels, better food, <sigh> it must be friday - is it 4:30 yet ? Are you bringing your thirst down here ? (easier than bringing our fridge up)

1 0

Re: [nznog] Waiuku/ glen brook area wireless access
by Webmaster 29 Sep '05

29 Sep '05

and more beer..... >>> Richard Naylor <richard.naylor(a)citylink.co.nz> 30/09/2005 10:30 >>> of course using both birds would be nice....but so would lower latency, higher bandwidth, cheaper access, no rain, more money, air conditioning in the van, cheaper diesel, better hotels, better food, <sigh>

1 0

Waiuku/ glen brook area wireless access
by Garrett Stoupe 29 Sep '05

29 Sep '05

Hey guys My parents have just recently moved out to the country, how ever telecom has stated they will not be able to install a phone line for them until December or early next year. How ever they require internet access, they have already approached woosh, woosh has said they do not cover that area, wired country they have also contacted and they said they need to be in view of the pukekohe hills, in this case my parents aren't Is anyone aware of any other wireless internet service that covers the gelnbrook, waiuku , pukekohe area? Garrett Stoupe

5 4

Re: [nznog] Bankdirect phish - perl script
by Webmaster 29 Sep '05

29 Sep '05

I'd suggest that the loop have a longish sleep - say 10 seconds or so - so that it does not look like a denial of service attack. R >>> Liz Q <liz(a)debian.co.nz> 30/09/2005 09:49 >>> If a few of you were to run this in a loop it may screw things up for them #!/usr/bin/perl -w my $url = "http://www.bankdlrect.co.nz/Logon.html"; use WWW::Mechanize; use String::Random; $randstuff = new String::Random; my $fakeuser = $randstuff->randregex('\d\d\d\d\d\d\d\d'); # Prints random digits my $fakepass = $randstuff->randpattern("........"); # Prints random printable characters my $mech = WWW::Mechanize->new(); $mech->get( $url ); #$mech->follow_link( n => 3 ); #$mech->follow_link( text_regex => qr/download this/i ); #$mech->follow_link( url => 'http://host.com/index.html' ); $mech->submit_form( form_number => 1, fields => { username => '$fakeuser', password => 'fakepass', } ); print "Logging into $url with $fakeuser and $fakepass\n"; Liz On Fri, 30 Sep 2005 08:55, James Clark wrote: > Craig Box wrote: > > Just got a phish for BankDirect. The telling part: "<a > > href="http://www.bankdlrect.co.nz/index_secure.asp" >" > > I've seen this phish aswell. > > Cheers, > James. > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog -- It's a poor sort of memory that only works backwards. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

3 2

Re: [nznog] Bankdirect phish
by Webmaster 29 Sep '05

29 Sep '05

It has just occured to me that a good way to 'deal' with phishing sites prior to them being shut down might be to have a script that submits random usernames and passwords. Thousands of them. It would certainly make it much harder for the phisher. cheers, Richard >>> "Craig Box" <Craig(a)itpartners.co.nz> 30/09/2005 08:52 >>> Just got a phish for BankDirect. The telling part: "<a href="http://www.bankdlrect.co.nz/index_secure.asp" >" - notice the 'l' where the I should be. Hopefully as this is inside .nz DNS we can get this one shut down quickly. The domain is registered with DiscountDomains.co.nz to a RODNEY GUISTWITE. admin_contact_name: RODNEY GUISTWITE admin_contact_address1: 9740 CONIFER LANE admin_contact_city: MURRELLS INLET admin_contact_country: US (UNITED STATES) admin_contact_phone: +84 3 6501641 admin_contact_email: directmain(a)yahoo.com The email headers: Received: from firewall.itpartners.co.nz ([10.7.0.254]) by penfold.itpartners.co.nz with Microsoft SMTPSVC(6.0.3790.1830); Fri, 30 Sep 2005 08:46:23 +1200 Received: from [218.233.125.18] (helo=-1208382648) by firewall.itpartners.co.nz with smtp (Exim 4.34) id 1EL5Iv-0007GJ-5u for craig(a)itpartners.co.nz; Fri, 30 Sep 2005 08:47:04 +1200 Received: from bankdirect.co.nz (-1208528168 [-1208791160]) by google.com (Qmailv1) with ESMTP id 554E5D0054 for <craig(a)itpartners.co.nz>; Thu, 29 Sep 2005 13:13:12 -0700 Date: Thu, 29 Sep 2005 13:13:12 -0700 From: Bankdirect Accounts <accounts(a)bankdirect.co.nz> X-Mailer: The Bat! (v2.00.8) Personal X-Priority: 3 Message-ID: <5432025998.20050929131312(a)bankdirect.co.nz> To: Craig <craig(a)itpartners.co.nz> Subject: New Fraud-Prevention system. MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------C0723C19AFB5862" X-Virus-Scanned: Symantec AntiVirus Scan Engine X-Spam-Score: -5.8 {-----} X-Spam-Report: No, hits=-5.8 required=5.0 tests=ALL_TRUSTED,BAYES_00,HTML_MESSAGE,HTML_TAG_EXIST_TBODY autolearn=ham version=3.0.2 Return-Path: accounts(a)bankdirect.co.nz X-OriginalArrivalTime: 29 Sep 2005 20:46:23.0798 (UTC) FILETIME=[DAB2BD60:01C5C536] Craig Box Phone 07 957 2653 IT Partners Ltd Fax 07 957 2659 PO Box 9361 Mobile 021 475 869 Hamilton, New Zealand _________________________________________________________________ #include <standard-disclaimer.h> _________________________________________________________________ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

9 9

Re: [nznog] Bankdirect phish
by Craig Box 29 Sep '05

29 Sep '05

> Anyone want to donate a large chunk of bandwidth to the cause? I'm sure a well placed phone call could probably achieve a better end result. :) > Well, the phish website is still up and running, and it is *very* well > done. I didn't get any certificate warning when going to the https site, > and it looks exactly like the real one. They even promote the NetCODE > security system, and all of the links on the page point to the real site. That's because the site is actually only http:// - go to the https:// site and you get an expired cert for localhost.localdomain. Craig

1 0