- NZNOG - lists.nznog.org

Re: [nznog] Bankdirect phish - perl script
by Webmaster 29 Sep '05

29 Sep '05

I'd suggest that the loop have a longish sleep - say 10 seconds or so - so that it does not look like a denial of service attack. R >>> Liz Q <liz(a)debian.co.nz> 30/09/2005 09:49 >>> If a few of you were to run this in a loop it may screw things up for them #!/usr/bin/perl -w my $url = "http://www.bankdlrect.co.nz/Logon.html"; use WWW::Mechanize; use String::Random; $randstuff = new String::Random; my $fakeuser = $randstuff->randregex('\d\d\d\d\d\d\d\d'); # Prints random digits my $fakepass = $randstuff->randpattern("........"); # Prints random printable characters my $mech = WWW::Mechanize->new(); $mech->get( $url ); #$mech->follow_link( n => 3 ); #$mech->follow_link( text_regex => qr/download this/i ); #$mech->follow_link( url => 'http://host.com/index.html' ); $mech->submit_form( form_number => 1, fields => { username => '$fakeuser', password => 'fakepass', } ); print "Logging into $url with $fakeuser and $fakepass\n"; Liz On Fri, 30 Sep 2005 08:55, James Clark wrote: > Craig Box wrote: > > Just got a phish for BankDirect. The telling part: "<a > > href="http://www.bankdlrect.co.nz/index_secure.asp" >" > > I've seen this phish aswell. > > Cheers, > James. > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog -- It's a poor sort of memory that only works backwards. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

3 2

Re: [nznog] Bankdirect phish
by Webmaster 29 Sep '05

29 Sep '05

It has just occured to me that a good way to 'deal' with phishing sites prior to them being shut down might be to have a script that submits random usernames and passwords. Thousands of them. It would certainly make it much harder for the phisher. cheers, Richard >>> "Craig Box" <Craig(a)itpartners.co.nz> 30/09/2005 08:52 >>> Just got a phish for BankDirect. The telling part: "<a href="http://www.bankdlrect.co.nz/index_secure.asp" >" - notice the 'l' where the I should be. Hopefully as this is inside .nz DNS we can get this one shut down quickly. The domain is registered with DiscountDomains.co.nz to a RODNEY GUISTWITE. admin_contact_name: RODNEY GUISTWITE admin_contact_address1: 9740 CONIFER LANE admin_contact_city: MURRELLS INLET admin_contact_country: US (UNITED STATES) admin_contact_phone: +84 3 6501641 admin_contact_email: directmain(a)yahoo.com The email headers: Received: from firewall.itpartners.co.nz ([10.7.0.254]) by penfold.itpartners.co.nz with Microsoft SMTPSVC(6.0.3790.1830); Fri, 30 Sep 2005 08:46:23 +1200 Received: from [218.233.125.18] (helo=-1208382648) by firewall.itpartners.co.nz with smtp (Exim 4.34) id 1EL5Iv-0007GJ-5u for craig(a)itpartners.co.nz; Fri, 30 Sep 2005 08:47:04 +1200 Received: from bankdirect.co.nz (-1208528168 [-1208791160]) by google.com (Qmailv1) with ESMTP id 554E5D0054 for <craig(a)itpartners.co.nz>; Thu, 29 Sep 2005 13:13:12 -0700 Date: Thu, 29 Sep 2005 13:13:12 -0700 From: Bankdirect Accounts <accounts(a)bankdirect.co.nz> X-Mailer: The Bat! (v2.00.8) Personal X-Priority: 3 Message-ID: <5432025998.20050929131312(a)bankdirect.co.nz> To: Craig <craig(a)itpartners.co.nz> Subject: New Fraud-Prevention system. MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------C0723C19AFB5862" X-Virus-Scanned: Symantec AntiVirus Scan Engine X-Spam-Score: -5.8 {-----} X-Spam-Report: No, hits=-5.8 required=5.0 tests=ALL_TRUSTED,BAYES_00,HTML_MESSAGE,HTML_TAG_EXIST_TBODY autolearn=ham version=3.0.2 Return-Path: accounts(a)bankdirect.co.nz X-OriginalArrivalTime: 29 Sep 2005 20:46:23.0798 (UTC) FILETIME=[DAB2BD60:01C5C536] Craig Box Phone 07 957 2653 IT Partners Ltd Fax 07 957 2659 PO Box 9361 Mobile 021 475 869 Hamilton, New Zealand _________________________________________________________________ #include <standard-disclaimer.h> _________________________________________________________________ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

9 9

Re: [nznog] Bankdirect phish
by Craig Box 29 Sep '05

29 Sep '05

> Anyone want to donate a large chunk of bandwidth to the cause? I'm sure a well placed phone call could probably achieve a better end result. :) > Well, the phish website is still up and running, and it is *very* well > done. I didn't get any certificate warning when going to the https site, > and it looks exactly like the real one. They even promote the NetCODE > security system, and all of the links on the page point to the real site. That's because the site is actually only http:// - go to the https:// site and you get an expired cert for localhost.localdomain. Craig

1 0

Re: [nznog] Bankdirect phish
by Kerry Thompson 29 Sep '05

29 Sep '05

Craig Box said: > Just got a phish for BankDirect. The telling part: "<a > href="http://www.bankdlrect.co.nz/index_secure.asp" >" - notice the 'l' where the I should be. Hopefully as this is inside .nz DNS we can get this one shut down quickly. Well, the phish website is still up and running, and it is *very* well done. I didn't get any certificate warning when going to the https site, and it looks exactly like the real one. They even promote the NetCODE security system, and all of the links on the page point to the real site. -- Kerry Thompson IT Security Consultant http://www.crypt.gen.nz

1 0

Re: [nznog] Bankdirect phish
by Craig Box 29 Sep '05

29 Sep '05

> The email headers: The offending message can be found in full at http://www.hs.net.nz/~crb/New_Fraud_Prevention_system_.msg. Craig

1 0

CFP: Systems Administration Miniconf, linux.conf.au 2006.
by Simon Lyall 29 Sep '05

29 Sep '05

Call for Presentations Systems Administration Miniconf, linux.conf.au 2006. This is a call for presentations for a 2 day Linux Systems Administration mini conference that will be held as part of the linux.conf.au conference in January 2006. The conference will be held in Dunedin, New Zealand. Miniconferences are held on the first two days, prior to the main programme. Please see our website at http://sysadmin.miniconf.org/ for details. The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf. Topics for presentations could include (but are not limited to) Samba, Databases, Backups, Firewalls, AAA, Troubleshooting, Buying Decisions, VPN, Virtual machines (Xen, UML, VMware), Monitoring Software, Web/Mail/LDAP/etc Server software, Wikis, PHP, Spam and Virus Filtering, VOIP, Trouble Ticket System, Best Practices, New Developments, Clustering/High Availability , Automated Installs, Automated configuration, Packaging Local Software. Speakers should assume that members of the audience have at least a couple of years experience in Unix/Linux administration. Format of Presentations ----------------------- Presentations of between 30 and 120 minutes (including questions) are currently being sought. We will also be holding a lightning talks session, with a list of 5-10 minutes short presentations.. Submitting talks ---------------- Please note that in order to give a presentation you must be register to attend the main linux.conf.au conference. In order to submit a talk please see our Call for Presentations webpage at: http://sysadmin.miniconf.org/cfp.html Submissions (or any questions) should be sent to: contact @ sysadmin.miniconf.org. Dates and Deadlines ------------------- To encourage early submissions around half the programme will be filled from presentations submitted before the 31st of October. 31 Oct 2005 - Deadline for early submissions 18 Nov 2005 - Deadline for late submissions Contact and Questions --------------------- Please see our website at http://sysadmin.miniconf.org/ for more information on the miniconf and presenting at it. If you have any questions please feel free to email the organisers at: contact @ sysadmin.miniconf.org

1 0

Re: [nznog] Waiuku/ glen brook area wireless access
by Paul Norton 28 Sep '05

28 Sep '05

you could give satellite a go.. http://www.stuff.co.nz/stuff/0,2106,3423872a28,00.html ________________________________ From: Jeremy Strachan [mailto:JeremyS(a)cclnz.co.nz] Sent: Thursday, 29 September 2005 14:20 To: Garrett Stoupe Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Waiuku/ glen brook area wireless access Iridium Satellite phone?!! and you thought we lived in a developed country... ________________________________ From: Garrett Stoupe [mailto:garretts(a)te.co.nz] Sent: Thursday, 29 September 2005 2:16 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Waiuku/ glen brook area wireless access Hey guys My parents have just recently moved out to the country, how ever telecom has stated they will not be able to install a phone line for them until December or early next year. How ever they require internet access, they have already approached woosh, woosh has said they do not cover that area, wired country they have also contacted and they said they need to be in view of the pukekohe hills, in this case my parents aren't Is anyone aware of any other wireless internet service that covers the gelnbrook, waiuku , pukekohe area? Garrett Stoupe "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002."

1 0

Re: [nznog] Waiuku/ glen brook area wireless access
by Jeremy Strachan 28 Sep '05

28 Sep '05

Iridium Satellite phone?!! and you thought we lived in a developed country... ________________________________ From: Garrett Stoupe [mailto:garretts(a)te.co.nz] Sent: Thursday, 29 September 2005 2:16 p.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Waiuku/ glen brook area wireless access Hey guys My parents have just recently moved out to the country, how ever telecom has stated they will not be able to install a phone line for them until December or early next year. How ever they require internet access, they have already approached woosh, woosh has said they do not cover that area, wired country they have also contacted and they said they need to be in view of the pukekohe hills, in this case my parents aren't Is anyone aware of any other wireless internet service that covers the gelnbrook, waiuku , pukekohe area? Garrett Stoupe

1 0

Audio Streaming
by Webmaster 28 Sep '05

28 Sep '05

Radio NZ is nearing the end of the testing phase of the live audio streams of National Radio and Concert FM. As a result of feedback from the tests we have removed the 16 kbs cap from our US server. This means that the streams can go up to 48 kbs stereo (National Radio) and 64 kbs (Concert FM) for ALL end users regardless of their location. At present about 40% of the traffic from this server is NZ bound. The streams are also available via NZ exchange points should operators wish to avoid the more expensive international route. regards, Richard Hulse

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 25 Sep '05

25 Sep '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS23754 descr: advertised to AS9439 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 198.32.71.0/24^24-29, 203.118.144.0/24^24-29, 202.7.4.32/28^28-29, 203.97.231.224/28^28-29, 203.79.85.80/29, 203.109.195.72/29, 210.48.103.0/29, 210.48.103.112/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050708 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS23754 descr: advertised to AS9439 by CityLink - AS23754 members: 198.48.0.0/22^22-29, 202.8.44.0/22^22-29, 198.32.71.0/24^24-29, 203.118.144.0/24^24-29, 202.7.4.32/28^28-29, 202.7.7.88/29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)citylink.co.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050926 source: NZRR

1 0