- NZNOG - lists.nznog.org

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> I don't buy this line of reasoning any more. Don't open attachments > from people you don't know. Don't open attachments from people you do > know. Don't open attachments that have innocent looking icons like a > text file. Don't preview emails that have attachments. Now we're in an > arms race where trying to send any email attachments around the internet > is a sure fire way of getting someone to blackhole your entire email for > "malicious content"[1]. Even experienced users running around with all > the latest antivirus and ad zappers and everything can *still* > occasionally get infected with spyware.[2] How do you expect users to > keep up? I agree with this comment. If user education worked, ISP's wouldn't be hit with high call volumes when the big viruses hits. ISP's wouldn't need to have big virus/spam servers in front of their mail farms. Too many stupid users, and when those stupid users become educated, there are new stupid users who take their place. It's a never ending cycle. Every time a user rings the helpdesk, it hits the ISP's bottom line, hence why a lot of ISP's are in favour of blocking phising/virus ports etc. But I don't understand why carriers block stuff. Simon Allard ihug Limited P +64 9 962 9827 M +64 21 456 412 E simon.allard(a)staff.ihug.co.nz > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] New phish - Westpac
by Gordon Smith 18 Sep '05

18 Sep '05

It's a typical spammer setup that's using zombies to provide DNS. Makes it more difficult to shut them down. The web server is located in India. We've already notified them of the compromised host, and also asked joker.com to pull the domains. Both this domain, and the domains that the nameservers respond to, are bogus. I'm not going to hold my breath waiting for joker to act though :-) Cheers, Gordon

5 5

Re: [nznog] New phish - Westpac
by Gavin Legge 18 Sep '05

18 Sep '05

<start drivvel> well well we have come full circle.. So who's going to gauge what will and wont get through ay. I'm all for letting people choose themselves. If they don't like what they see - they can unplug. It's a big scary world out there ay... It's like the isp's/transport providers are the highways. If people wanna walk out in front of a car on your highway (even though it's obviously a big truck that's gonna run them down badly disguised as a phishing scam.. - well - they have been warned. They had to learn to walk in real life- maybe they should learn to 'walk' in 'our virtual world' ie fall over some of the pitfalls - just like we all have done at some time.. You cant protect everyone all the time. So many standards of wrong and right and possibly no right answer. </end drivvel> This is the bit where I go quiet again - after all I don't even work for an ISP any more! Shudder... -----Original Message----- From: David Robb [mailto:ender(a)paradise.gen.nz] Sent: Monday, 19 September 2005 4:28 p.m. To: Russell Sharpe Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] New phish - Westpac On Mon, 19 Sep 2005, Russell Sharpe wrote: > I guess from a morality point of view... > Is it in an ISP's best interest to protect its customers interests? If you want to involve morality... many people don't like pornography. There's lots of it out there. Should we block it? --David _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean. MailScanner thanks transtec Computers for their support. MailScanner Supplied by ITS-HelpDesk. ext 4001 or email helpdesk(a)irl.cri.nz-- This electronic transmission and any documents accompanying this electronic transmission contain confidential information belonging to the sender. This information may be legally privileged. The information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance on or regarding the contents of this electronically transmitted information is strictly prohibited.

1 0

Re: [nznog] New phish - Westpac
by neil gardner 18 Sep '05

18 Sep '05

>>>> Andy Linton <asjl(a)citylink.co.nz> 19/09/2005 4:15 p.m. >>> >> So you say it's ok for bank phishing. What about ebay/trademe/other >> auction/sales sites? > >Perhaps the correct response is some (more) user education and then allow >evolution to take over - those people who are too stupid to work this out lose >all their money and then they can't use the Internet any more. While ISPs will >lose revenue from them they're probably the ones who cause 90% of the help >desk calls and so profitability goes up and we all get more time for beer. On a more general level it's a simple economic problem and we shouldn't be expending that much energy into finding a technical solution. The current level of bank fraud is _obviously_ acceptable to the banking institutions (1)... When it becomes unacceptable then we'll see more secure (yes, less convenient) methods of conducting e-banking. We'll probably also see the banks seriously publicise the issues and most importantly, we'll see the banks start shying away from accepting financial responsibility for these phished transactions - currently they wear most of the losses. Regards Neil Gardner (1) They are obviously acceptable because we haven't seen the banks go ballistic to close this down from their end - don't think they don't know how, or can't afford it... It's just more trouble than it's currently worth. If we keep trying to solve the problem from a technical perspective, the attacks just get better, and the banks get to sit (relatively) idly by and not have to solve the root problems. Neil Gardner Product Manager - Product Line Management Allied Telesyn Research Ltd New Zealand +64 3 339-9509 (ph) +64 3 339-3001 (fax) NOTICE: This message contains privileged and confidential information intended only for the use of the addressee named above. If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it. If you have received this message in error please notify Allied Telesyn Research Ltd immediately. Any views expressed in this message are those of the individual sender, except where the sender has the authority to issue and specifically states them to be the views of Allied Telesyn Research.

1 0

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> > Wait until the phishers catchup with the normal spammers and make the IP > of their websites move every 10 minutes. Personally I'm surprised it > hasn't happened already, certainly it will happen if people get efficient > at blocking single IPs. That's why it's better done at the ISP level. If they have web caches which transparently proxy everything. (dunno how many isp's still do this). But the URL itself can be blocked rather than the IP. Carriers shouldn't block IP's IMHO. Simon Allard ihug Limited P +64 9 962 9827 M +64 21 456 412 E simon.allard(a)staff.ihug.co.nz

1 0

Re: [nznog] New phish - Westpac
by Simon Allard 18 Sep '05

18 Sep '05

> > > traceroute secwestpac.com > traceroute to secwestpac.com (210.212.134.2), 64 hops max, 44 byte packets > 1 drew.router.bw (10.4.6.254) 0.709 ms 0.474 ms 0.533 ms > 2 dsl.bw (10.10.69.254) 1.703 ms 1.554 ms 1.505 ms > 3 219-88-160-1.jetstream.xtra.co.nz (219.88.160.1) 139.575 ms 73.358 > ms 143.285 ms > 4 203.96.122.59 (203.96.122.59) 77.224 ms 184.149 ms 105.514 ms > 5 fid-int.tkbr4.global-gateway.net.nz (202.50.245.198) 60.790 ms > 65.843 ms 59.394 ms > 6 vlan-283.tkbr4.global-gateway.net.nz (202.50.245.197) 59.068 ms > 58.437 ms 59.557 ms > 7 210.55.202.65 (210.55.202.65) 59.215 ms !H * 59.743 ms We have also killed the routes to the sites on our borders. Simon Allard - CCNA Senior Systems Programmer ihug Limited P +64 9 962 9827 M +64 21 456 412 E simon.allard(a)staff.ihug.co.nz

1 0

Sponsorship - packages or tiers?
by Lin Nah 18 Sep '05

18 Sep '05

I do admit that I don't know much about this and some of my conclusions are based on observations of what other conferences / events have done. So feel free to shoot parts or any of this down if need be. Tiers of sponsors: The reason why I say we are too small to have tiers of sponsors is because essentially the number of sponsors we can have in a small event such as this is small. To me tiers of sponsor implies the sort you see at the ballet etc where it says if you pay a certain amount you are listed as a sponsor at that level. This however doesn't specify what they are sponsoring. ie we'd be out there each of us asking ppl to sponsor $x for Tier1 and sponsor y for tier 2. With those sorts of sponsorships (form what I have seen) there is a list of perks they get with it. eg tier 1 = 3delegates, logo on bag and shirt, etc. Tier 2 = 2 delegates and logo on notepad To have this we'd have to have ability to work towards obtaining enough sponsors, and figure out what to do if we don't get enough. I know that's like normal sponsorship. Howver it is a bigger risk if some or many of our potential big sponsors decide to go for a lower tier. So instead of tiers, we have a shopping list of stuff we want and find sponsors for a combination of them. The reason why we would package them is because some stuff is more "sexy" and so more easy to find a sponsor. The idea with the package is to ensure at the end of the day we aren't left with a list of the stuff that is hard to find a sponsor for and yet is important for the conference. It is also harder perhaps to find sponsors for an overseas speaker as the $ amounts are higher For example it won't be hard to sell the idea of sponsoring a bar tab but you may find it harder to get someone to sponsor stuff like the AV gear (mics, laser pointers etc). It will be like tiers of sponsors in the fact they are sponsoring $x means we give them certain benefits. With each item in the shopping list we should perhaps add a certain markup to cover costs of some of the other non sponsorable stuff. or make sure they sponsor more than one thing. eg speaker + AV hire. Bandwidth + bags The thing with the big ticket items is we should try to give them something in return. Something that their management can understand as a return. Some of those speakers can speak on more than one topic. So we could perhaps ask them to also do a public lecture (perhaps at a uni campus somewhere) and an interview with idg or herald technology. Thus the sponsor has a bigger exposure for that amount given. List of items that are sponsorable Overseas Speaker(s) - Travel & Accommodation Local Speaker(s) - Travel & Accommodation Venue costs (room hire) Main Dinner Bar Tab Bag (generic term - could be backpack/satchel/folder etc) Lunch Bandwidth Networking (wireless hubs) Streaming AV Gear (mics, data projectors, laser pointers) Coke Fridge. Fridge hire & filling it with drinks (we perhaps get stickers for each can with the sponsor's logo? or just a poster on the fridge door, say size of door with sponsor's logo) First night dinner (usually not part of nznog) Costs So far all I have is what has been posted to this list I have no idea what other sutff cost in the past but things like t-shirt and bag, I could easily ring round for quotesi f need be. Bandwidth: 2005: The conference network carried just over 32GB of traffic, including the video streaming, but not traffic to www.nznog.org. Coke: 2005: 495 cans of soft drink (incl 275 coke and 100 diet coke), 2004: 420 cans soft drink (there was fridge filled with coke, diet coke, sprite, fanta, and other soft drinks. No V or red bull) Tea, Coffee, OJ, Biscuits 2005: over 60L of juice and nearly 4kg of ground coffee. 2004: 80 ltrs OJ (morning tea/coffee and lunch) Food bill: 2004: $5800 (I am not sure what that included. Tony - did this include dinner or just lunch, morning tea&coffee) Bar Tab 2005: $1500 ($1000 by 2day and $500 by WAND) 2004: $1000 2002: $1000 Anyway I am sure there are ppl in here who are more experienced than I about these sorts of things. Do we want tiers of sponsors as in look for people to contribute certain sums of money? eg $10000, $5000, $1000. OR do we want sponsors to sponsor specific items. ie all stuff we need is listed as sponsorable items? regards lin

1 1

Subject: Changes to registration of .govt.nz domains
by keith.mclean＠ssc.govt.nz 18 Sep '05

18 Sep '05

Hello NZNOG, As part of the moderation of the .govt.nz domain, the State Services Commission (SSC) has become a .nz registrar. On October 3rd any new .govt.nz domains will need to be created through the SSC registrar at <http://www.dns.govt.nz/>. Over the next few months, the existing .govt.nz domains will be transferred to the new registrar. We will make contact with existing registrars and registrants of .govt.nz names before any transfer occurs. No delegation will change during the transfer. If you are providing name-service for a .govt.nz name this should continue, as should any billing for this service. The SSC Registrar will not complete with other .nz registrars in non-government namespaces. Further details are available on the website at <http://www.dns.govt.nz/terms_and_conditions.php> If you have any concerns about the upcoming transfers, please contact transfers(a)dns.govt.nz or call 0508 GOVTNZ (468869) Unfortunately moderation rules prohibit the registration of beer.govt.nz, but consumption is acceptable. Regards Keith McLean Keith McLean, State Services Commission. DDI (04) 495 2861.Mobile (027) 6096779 Caution: If you have received this message in error please notify the sender immediately and then delete this message.

1 0

linux.jetstreamgames.co.nz
by Matthew Poole 18 Sep '05

18 Sep '05

Does anyone on here know the status of this server? Is it down for good, or just for protracted maintenance? Thanks -- Matthew Poole "Don't use force. Get a bigger hammer."

1 0

New phish - Westpac
by Alastair Johnson 18 Sep '05

18 Sep '05

Morning If anyone from Westpac Security monitors NZNOG, and for those that want to update their mail rulesets appropriately, there appears to be a new phish this morning for Westpac. I've received 6 in the last 10 minutes. All originate from 219.128.152.213, a Chinanet host or 82.229.209.178. The body refers people to http://secwestpac.com/IOLB/newSession . The hostname is similar to their correct "sec.westpac.co.nz". The domain hasn't yet been pushed into WHOIS, but is in the GTLD servers. The body of the message is HTML, with Westpac graphics. The text is: Processing error We were unable to process your recent transactions on your account. To ensure that your account is not suspended, please update your information Headers below. aj From - Mon Sep 19 10:28:31 2005 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: <update(a)westpac.co.nz> X-Original-To: aj(a)sonic.sneep.net Delivered-To: aj(a)sonic.sneep.net Received: by sonic.sneep.net (Postfix, from userid 668) id 8E13A21CFB; Mon, 19 Sep 2005 10:19:50 +1200 (NZST) Received: from smtp01.maxnet.net.nz (smtp01.maxnet.net.nz [202.89.32.6]) by sonic.sneep.net (Postfix) with ESMTP id B9D3E21CEE for <aj(a)sneep.net>; Mon, 19 Sep 2005 10:19:39 +1200 (NZST) Received: from mailfilter01.maxnet.net.nz (mailfilter01.maxnet.net.nz [202.89.32.8]) by smtp01.maxnet.net.nz (Postfix) with ESMTP id 323D2406A2E for <aj(a)sneep.net>; Mon, 19 Sep 2005 10:21:14 +1200 (NZST) Received: from stolichnaya.maxnet.net.nz (stolichnaya.maxnet.net.nz [209.123.221.169]) by mailfilter01.maxnet.net.nz (Postfix) with ESMTP id CF02384E40 for <aj(a)win.co.nz>; Mon, 19 Sep 2005 10:21:55 +1200 (NZST) Received: from -1211395320 (cha92-7-82-229-209-178.fbx.proxad.net [82.229.209.178]) by stolichnaya.maxnet.net.nz (Postfix) with SMTP id DA3B65325E0 for <aj(a)win.co.nz>; Mon, 19 Sep 2005 10:19:37 +1200 (NZST) Received: from westpac.co.nz (142870456 [137878400]) by cha92-7-82-229-209-178.fbx.proxad.net (Qmailv1) with ESMTP id A18855DD6F for <aj(a)win.co.nz>; Sun, 18 Sep 2005 14:46:52 -0700 Date: Sun, 18 Sep 2005 14:46:52 -0700 From: Update <update(a)westpac.co.nz> X-Mailer: The Bat! (v2.00.6) Personal X-Priority: 3 Message-ID: <4793089069.20050918144652(a)westpac.co.nz> To: Aj <aj(a)win.co.nz> Subject: Anti-fraud notification MIME-Version: 1.0 Content-Type: multipart/related; boundary="----------572BB2C4F688976"

2 1