- NZNOG - lists.nznog.org

Woosh prefix update
by Nathan Ward 20 Sep '05

20 Sep '05

We are now advertising an additional prefix to our APE and WIX connected peers, including the route servers for these exchanges. I also ask that anyone not currently accepting up to 24 bit long prefixes in our advertisements, to please do so. We have no need to advertise these now, but we'd like to have the option available if needed, yadda yadda. The new prefix is 203.211.64.0/20. So, in the end it should look something like: ip prefix-list woosh-in seq 5 permit 202.74.192.0/19 le 24 ip prefix-list woosh-in seq 10 permit 203.211.64.0/20 le 24 Other potentially useful details follow: ASN 17412 APE IP 192.203.154.49 WIX IP 202.7.0.50 For those of you who are not currently peering with us and would like to arrange direct peering sessions, please contact me offlist, or on +64-9-522-3699, ext 618. -- Nathan Ward

2 1

Election Night Statistics
by Richard Naylor 20 Sep '05

20 Sep '05

Election Night Webcasting Statistics On Election night, 2005, CityLink/R2 was involved in assisting a number of broadcasters with their streaming requirements. This was in addition to the normal webcasting activites being carried out with other TV and radio stations. Particular focus was placed on TV-One (TVNZ) TV-3 NewstalkZB National Radio The streaming was carried out using servers located in Auckland, Wellington and Palo Alto (USA). Encoding was carried out by TVNZ and CityLink/R2. In terms of number of viewers, the 2003 Lord of the Rings premiere has been regarded as the biggest event webcast to date. The election night figures passed that by approximately 50%. On election night, some servers used anycast routing to spread traffic between servers, so that viewers connected to the server closest to them by Internet topology. Because not all servers used anycasting, we experienced congestion on the link feeding the US based server. As a result, some viewers used the link to NZ servers, further overloading the International capacity. In hindsight, we should have fed the US server via an alternate route to ensure the quality of its streams. In terms of traffic, the average bandwidth being consumed was Auckland (2 servers) = 110 Mbps Wellington (1 server) = 50 Mbps USA (1 server) = 50 Mbps Total average bandwidth = 210 Mbps Peaks were of course much higher. Estimates are that approximately 450Gbytes of data was transferred during the event of 6 hours. 98% of this data was carried by the anycast routing architecture. At 10 cents per megabyte this data represents approximately $45,000. CityLink delivered this event for free as a public service. Lessons Learned Our experience suggests that for large events, anycast routing delivers high performance. However, the source feed to the US servers needs to be isolated from any other traffic into or out of NZ. We could have done this using our satellite capacity or by strictly enforcing anycast routing. This would have meant that NZ ISPs not peering at NZ Internet exchanges would have to bring significant traffic into NZ on their International circuits.

1 0

Re: [nznog] New phish - Westpac
by Nic Wise 20 Sep '05

20 Sep '05

> BNZ tried using certs in 2000 for IB for public - was a > nightmare - far too early for browser compatibility usual > portability of certs etc. Ah, I might have had my banks mixed up. > And of course, and this will come > as a surprise to some, certs aren't very good for > authentication remember - their power in is in persistently > marking transactions/data or whatever That BNZ system was > tried to get round key loggers but as you say anything that > needs specific machine setups/configs will fail for retail > banking. And there are screen grabbers now anyway. Oh, I found that even without the threat of phishers etc, the pain of using it (Even after I installed Java) was just too high. > 2-factor also does not solve the problem and can introduce > more. Netcode relies on a now-defunct, unsupported product > from RSA - it was dropped from the RSA product line due to > the issues with SMS delivery and security - ask yourself how > secure the SMS network is, would you know, do you know ? I Well, personally, I'd find it more secure that not having it at all. Without something like it, anyone can get in with my username + pwd. With it, atleast if they ALSO intercept my cell transmission, they can get it for what, 10 mins (assuming they have my UN+PW as well). That's a fairly small window, and better than the current situation. > would be more concerned about that than anything. Also, the > banks cannot control SMS delivery nor guarantee anything and > therefore don't like it. 2 factor is relatively complex to > manage in big deployments, expensive (relatively compared to > a password) and probably overkill for retail but spot on for > business - which of course you'll know has been used in for a > number of years now by most banks.... I think ASB got around that by having something in there saying "if you don't get the text within X mins, call us on 0800 WHATEVER, quote ID 123456 and we'll check your details like we normally do". > Remember though - you can use a computer - most people who > use retail Internet Banking can't - IB is the pinnacle of > their PC knowledge VERY good point. Smartcards + reader look interesting, but there again - hardware compatability. Does it works on a Mac? Does it work on my mothers old P166 without USB? Etc. > And anyway banks don;t make any money from retail banking so > until phishing and e-banking scams become sufficiently common > they still pale in comparison to manual frauds. The real > answer is to remove some functionality but of course we'd all > moan...Free beers for life for the person that cracks the > portability vs security conundrum ! Very true. As long as they keep refunding people when they get all their money nicked, it's not THAT huge a long-term problem. Short term, and for the person who's cash is (for a while) gone, it's a bit of a stresser. :) Good discussion to have, me thinks, especially given the types of people on this list. :) Now, lunch and Beer :) Is it Friday yet? N

1 0

Re: [nznog] New phish - Westpac
by Nic Wise 20 Sep '05

20 Sep '05

> I'm not a application Security expert, but why can the banks > issue a authentication Certificate, and only allow > connections to those who are authenticated? > Certs would help, but they are a PITA to get working reliably. I know of one place that does use them (www.vir.co.nz - only for dealers) - but Banks are very much mass-market, and mom-and-pop would have a lot of troulbe working it out. I think one of the banks (ANZ??) tried it a while back. Not sure what they use now tho. The worst I have used was BNZ - they had a Java applet, and you had to CLICK on your password, on a keyboard on the screen. Wow, how secure, if someone is shoulder surfing, or capturing mouse clicks. And, it was just crap to use, especially if you didn't have Java (you just couldn't get in without Java!) 2-factor authentication is one of the few ways they could tighten up on security. ASB already does this, to some extent, with NetCode (ditto BankDirect - same company tho). They send you a text to confirm (you have to enter the code in the text) if the amount is over a specific value ($2500 per day). Works great. Why not do it on ALL transactions under a certain value (eg, $50)? Want to log in and check accounts? Fine. Usename + password. Want to move money? You then MUST use 2-factor authentication. I'd say that 99% of people with computers, also have cellphones, so text messages is a good way. Going overseas? Get one of those fancy SecureID cards on loan. I'm SURE that a load of people on this list know those cards - credit card sized "random" number generators on their keyrings. Same idea could be implemented for LESS cost than the banks usually loose.... Of course, the banks have to be motivated to do it.... And they are not, really, at the moment. It might still give the phishermen entry, but only within a VERY small window (60 seconds to 5 mins, usually), which would solve most of the problems. Of course, you'd need to sync it up with the Beer Tap at the pub somehow..... Maybe give the "keys" away free with every pint sold? Righto. Back to work :) Nic -- Nic Wise - Senior Developer - Microsoft MVP (.NET) t. +64.21.676.418 w. http://www.aftermail.com/ e. nic.wise(a)aftermail.com b. http://www.fastchicken.co.nz/blog/

4 4

Re: [nznog] New phish - Westpac
by David Robb 20 Sep '05

20 Sep '05

On Mon, 19 Sep 2005, Jeremy Strachan wrote: > > Given the alternative is our users bank accounts being cleaned out - I'm > all for Telco and/or ISP's blocking access to the site. So you say it's ok for bank phishing. What about ebay/trademe/other auction/sales sites? What if it were for Live Journal? --David

15 20

Notification of NZRR Database changes
by NZRR Database Notifications 19 Sep '05

19 Sep '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS23655 descr: advertised to AS9439 by Snap Internet Limited - AS23655 members: 132.181.0.0/16^16-29, 202.124.96.0/19^19-29, 203.97.28.0/22^22-29, 202.27.186.0/23^23-29, 202.36.178.0/23^23-29, 202.36.218.0/23^23-29, 202.37.100.0/23^23-29, 202.37.124.0/23^23-29, 210.55.30.0/23^23-29, 210.55.206.0/23^23-29, 192.156.225.0/24^24-29, 202.50.117.0/24^24-29, 202.50.169.0/24^24-29, 210.54.15.0/24^24-29, 210.55.4.0/24^24-29, 210.55.7.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)snap.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050913 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS23655 descr: advertised to AS9439 by Snap Internet Limited - AS23655 members: 132.181.0.0/16^16-29, 202.124.96.0/20^20-29, 203.97.28.0/22^22-29, 202.27.186.0/23^23-29, 202.36.178.0/23^23-29, 202.36.218.0/23^23-29, 202.36.220.0/23^23-29, 202.37.100.0/23^23-29, 202.37.124.0/23^23-29, 202.49.120.0/23^23-29, 210.55.30.0/23^23-29, 210.55.206.0/23^23-29, 192.156.225.0/24^24-29, 202.49.115.0/24^24-29, 202.49.125.0/24^24-29, 202.50.117.0/24^24-29, 202.50.169.0/24^24-29, 203.96.112.0/24^24-29, 210.54.15.0/24^24-29, 210.55.4.0/24^24-29, 210.55.7.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)snap.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050920 source: NZRR

1 0

Price list from kevin
by Kevn Wong 18 Sep '05

18 Sep '05

Dear sir, How is your weekend? I'm kevin from Pcarcher data Technology Ltd. We are a manufacturer and Exporter from china, we make and sell the VGA Card and networking products. We have our own factory, the factory are with 4 STM product line, and all products go out the door of factory after double QA and QC, so we can deliever the goods to our client within 4 working day after we get client's payment, and we can supply 13 months warranty to our client, hope that we can do the business with you, I believe we will become your good supplier, and supply the best products and service to you. Enclosed is our price list of these products, please check it, hope that you can find some you products which you like, looking forward to hearing from you again, anyways thanks for your support. My msn is w_qifan(a)hotmail.com. Cisco 1721 US$300.00/Pcs WS-C2950-24 US$310.00/Pcs WS-C2950T-24 US$450.00/Pcs 2610XM US$700.00/Pcs 2620XM US$710.00/Pcs 2621XM US$710.00.Pcs BTW now we have the DI-524 and DI-624 in stock, they are original products, and our offer are follows, please check it. DI-524 US$29.0/Pcs 54Mbps http://www.dlink.com/products/?pid=316 DI-624 US$40.5/Pcs 108Mbps http://www.dlink.com/products/?pid=6 Have a nice day Best Regards Kevin Pcarcher Data Tehcnology Ltd Room 2106, BaoAn Plaza, ShenNan Road,Shen Zhen City,China Tel: +86 755 82818860 Fax: +86 755 82818640

2 1

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> > Phising is no different to putting a skimmer and camera onto an ATM > machine and stealing the card details and pin numbers. Infact, how many of you check for skimmers and cameras before putting your card into an ATM or make sure the clerk behind the desk doesn't skim your credit card before giving it back? I would say not many people would. How is that any different from an average internet person and a phising website?

1 0

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> > You will need to come into the branch and do it there. > > > > If you do follow links and get stung then we'll treat it along the same > lines > > as "so you met this guy in a pub and he said 'can I borrow your ATM card > and > > pin number for ten minutes'.....". You can't compare a Phising site to that. The user doesn't know they are entering details into a trojaned website. Phising is no different to putting a skimmer and camera onto an ATM machine and stealing the card details and pin numbers.

1 0

Re: [nznog] New phish - Westpac
by Joel Van Velden 18 Sep '05

18 Sep '05

> >> >> Wait until the phishers catchup with the normal spammers and make the > IP >> of their websites move every 10 minutes. Personally I'm surprised it >> hasn't happened already, certainly it will happen if people get > efficient >> at blocking single IPs. > > That's why it's better done at the ISP level. > > If they have web caches which transparently proxy everything. (dunno how > many isp's still do this). But the URL itself can be blocked rather than > the IP. > > Carriers shouldn't block IP's IMHO. Can't ISP's just intercept http traffic destined for phishers' sites (based on url matching, not ip) and display a nice html message to the user how their bank account would have been cleaned out if it hadn't been for their nice friendly isp? :) Certainly blatantly blocking ip's at carrier level is rather nasty. what happens if that IP is a large virtual host server? Replacing content (as above) at least allows you to make it obvious to all users whats happening. -Joel > > Simon Allard > ihug Limited > > P +64 9 962 9827 > M +64 21 456 412 > E simon.allard(a)staff.ihug.co.nz > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

2 1