- NZNOG - lists.nznog.org

Credit card fraudsters......
by Steve Withers 02 Feb '04

02 Feb '04

In my e-mail this morning, with a clickable button to take me to their 'secure site': From: security(a)visa-security.com Dear Sir/Madam, We were informed that your credit card is used by another person or stolen. It could happen if you have been shopping on-line, and someone got your "Billing information" including your credit card number. To avoid and prevent any further fraud and billing mistakes and to refund your credit card, it is strongly recommended to proceed filling in the secure form on our site and applying for our Zero Liability program. Program is free and it will help us to confirm the fact of fraud and investigate this accident as soon as possible. Sincerely yours, Visa Support Assistant, Alwin Desagun.

5 5

The Internet for n00bs
by Ewen McNeill 02 Feb '04

02 Feb '04

One of the things discussed at the (excellent, thanks everyone) NZNOG 2004 conference was that the Internet sucks, and that a large portion of this suckage is due to ignorant n00bs who do the wrong thing, get 0wned, etc. It was suggested that the "only" fix to this problem was to kill the end to end Internet, making the "Internet" a core exchange network (a la telco style), and allowing users only access to a local proxy at their ISP for a very limited set of services. Aside from my objection that this won't help much except in the short term (plenty of protocols already tunnel around such firewall limitations -- eg, look at everything that's been tunneled through HTTP), this really sucks for the l33t who find it awfully restrictive. An alternative approach to that type of thing is possibly just to heavily firewall -- at the ISP end of the link -- connections to all "potential n00b" users (SMTP to ISP mail server, POP/IMAP/HTTP/HTTPS to whereever and a few other common things) by default. And then provide an "opt out" system that anyone with a clue can use to disable the default firewalling. I would suggest: telnet ihaveaclue.$ISP where you have to enter "My name is $NAME, and I have a clue" (with $NAME expanded, but otherwise literally). Possibly that setting could be sticky; possibly it would need to be done on each reconnection.[0] The remaining aspect is that anyone who claimed to have a clue in this manner and then lets something on their connection get 0wned or otherwise abuses the privilege, (a) loses the ability to unblock themselves, and (b) gets their name published on a list of shame. This could pretty much be implemented today by anyone with a firewall (or customer facing ACLs) which can be set on a per-customer basis. Various RAS boxes have this sort of facility already; at least one ISP I know of firewalls accounts that are over due so they can reach the accounting website and that's about it. The alternative seems to be that the clueful will just tunnel everything through whatever still works. Tunnelling through DNS requests is painful but doable; tunnelling through most other things is almost tolerably efficient by comparision. And I guess bandwidth is cheap enough now that we can cope with a 20-50% overhead due to tunnelling.[1] Ewen [0] Anyone who can't automate doing it on each reconnection doesn't have a clue. [1] Still, it'll make the ATM tax look cheap.

12 16

RE: [nznog] The Internet for n00bs
by Regan Murphy 01 Feb '04

01 Feb '04

> From: Seton Wingfield [mailto:SWingfield(a)atl.co.nz] > Sent: Sunday, 1 February 2004 7:00 p.m. > > I recently read the "Changes to Functionality in Microsoft > Windows XP Service Pack 2" and in it, it states that the > Internet Connection Firewall will be turned on by default. > Changes like this and Microsoft's long term commitment to > security via their "Trustworthy Computing" initiative may > make the problems that you are trying to solve a thing of the past. > Unfotunately it will be a long time until all net people shift from Windows 95 et al and move to WinXP etc. Also with the growth of linux variants can we expect the same default security options to be set there as well (remember all the sendmail exploits and the redhat vunerabilities)? Beyond that there are a lot of people that like to run programs such as p2p file sharing applications and irc and ftp and these unfortunately don't work too well with misconfigured firewalls. The typical answer to "how do I get p2p app working?" is "oh, you're running XP? Then disable the default firewall and it will all work". i.e. n00bs will always unwittingly impact the internet through miseducation and ignorance -- Regan

1 0

The New Zealand Network Operators' Group
by Donald Neal 31 Jan '04

31 Jan '04

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. At present it consists of the subscribers to this mailing list, which anyone is free to join. This month Donald Neal is joined as list administrator by Simon Blake and Simon Lyall. The aim of the increased head count is to provide better coverage in terms of time, and to reduce the list's reliance on any individual. Meetings See http://www.nznog.org/ for details of the conference which has just finished. Another fairly similar gathering seems likely to be held early next year. Also see http://thursdaynightcurry.com/about.html if you live in or near Wellington or Auckland. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators rather than by most customers. Internet Exchanges See http://www.ape.net.nz/ for details of the Auckland Peering Exchange and those connected there. See http://www.wix.net.nz/ for the Wellington Internet Exchange. And possibly http://www.citylink.co.nz/information/news/nr1068413489.html . About This Mailing List This list has around six hundred addresses subscribed. You may only post to the list from a subscribed address. A number of people subscribe addresses which do not receive email purely to allow posting from them. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by employees of Alcatel NZ Ltd, Citylink and ihug Ltd. None of these organisations, nor any administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/archives/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrators remain happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. One way to search the archive is to use google and prefix your search with site:list.waikato.ac.nz . Subscribing to the List See http://list.waikato.ac.nz/mailman/listinfo/nznog to subscribe. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

RE: [nznog] Conference Videocast
by mark.harris＠ssc.govt.nz 31 Jan '04

31 Jan '04

Richard Naylor wrote: > > Yes - all on DVD, but missed the start of Geoffs talk - > couldn't climb over > Si to get to DVD-R. Must get bigger van..... or a smaller Si ... ;-) mark

3 2

Re: [nznog] The Internet for n00bs
by Ewen McNeill 31 Jan '04

31 Jan '04

In message <1075610074.2007.305.camel(a)localhost>, Steve Withers writes: >On Sun, 2004-02-01 at 15:11, Anaru Hartley wrote: >> I kind of sense a "one track mind" approach to the >> issue at hand. There are plenty of alternatives, >> personally I don't think tightning the rope is going >> to help improve the Internet. The point was that some people (Dean cited his Nana as an example) really don't want to deal with all the complexity of keeping their system patched against the security hole du jour -- they just want an appliance that will let them talk to their grandchildren and maybe check a few details on their latest group's meetings. A 21st century telephone. The suggestion was then made (in a later talk) that the "only" solution to the mass of people who just wanted an applicance and were unwilling/unable to deal with the "dangerous" place that is the modern Internet, was an Internet-Lite -- the Internet for n00bs. The major part of its architecture was, essentially, a bunch of application proxies at the ISP with everything else firewalled off. The aim of this was to (dramatically) reduce the pool of reachable, unpatched, systems on the 'net. The current batch of worms to install open relays would be immunised against pretty much immediately for two reasons (couldn't reach open relays once established, couldn't reach remote hosts to infect them). >True. All you need is one ISP who offers "real" Internet....and everyone >would flock there. I know I would, if that was the choice. Yes, but you're l33t Steve. You'd flock there. Most people here would flock there. Much as I don't want to see "the Internet" become a dumbed down IntaWeb clone, I recognise that's just me ("when I want to be wrapped in cotton wool, I know where to find it"). There's a whole bunch of people, probably the majority by an order of magnitude, for whom the Internet, Large As Life, is scary, and intruding on their ability to just do the things they want to (eg, their machine keeps getting infected). So The Internet for n00bs will probably happen eventually. I just hope it isn't done in such a way that the only way to join the Real Internet (tm) is to qualify for your own ASN or by building tunnels through increasingly inappropriate application level protocols. A "walled garden" (to use the Citylink description of CafeNet) would be more appropriate -- with a way out for those that can figure out the gate, and a rule that they don't get to complain (or get out again) if they get run over by the traffic outside. Ewen

2 1

RE: [nznog] The Internet for n00bs
by Seton Wingfield 31 Jan '04

31 Jan '04

In my experience its never the people that find an exploit that end up causing the mayhem. If the flow of information from the exploit finders to the script kiddies could be stopped so would the majority of worms etc. I know this is old thinking but it seems like a easier option than firewalling off the Internet. I recently read the "Changes to Functionality in Microsoft Windows XP Service Pack 2" and in it, it states that the Internet Connection Firewall will be turned on by default. Changes like this and Microsoft's long term commitment to security via their "Trustworthy Computing" initiative may make the problems that you are trying to solve a thing of the past. http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6… http://www.microsoft.com/mscorp/innovation/twc/twc_whitepaper.asp The documents are MS Word format. -----Original Message----- From: Ewen McNeill [mailto:ewen(a)naos.co.nz] Sent: Sunday, 1 February 2004 11:17 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] The Internet for n00bs One of the things discussed at the (excellent, thanks everyone) NZNOG 2004 conference was that the Internet sucks, and that a large portion of this suckage is due to ignorant n00bs who do the wrong thing, get 0wned, etc. It was suggested that the "only" fix to this problem was to kill the end to end Internet, making the "Internet" a core exchange network (a la telco style), and allowing users only access to a local proxy at their ISP for a very limited set of services. Aside from my objection that this won't help much except in the short term (plenty of protocols already tunnel around such firewall limitations -- eg, look at everything that's been tunneled through HTTP), this really sucks for the l33t who find it awfully restrictive. An alternative approach to that type of thing is possibly just to heavily firewall -- at the ISP end of the link -- connections to all "potential n00b" users (SMTP to ISP mail server, POP/IMAP/HTTP/HTTPS to whereever and a few other common things) by default. And then provide an "opt out" system that anyone with a clue can use to disable the default firewalling. I would suggest: telnet ihaveaclue.$ISP where you have to enter "My name is $NAME, and I have a clue" (with $NAME expanded, but otherwise literally). Possibly that setting could be sticky; possibly it would need to be done on each reconnection.[0] The remaining aspect is that anyone who claimed to have a clue in this manner and then lets something on their connection get 0wned or otherwise abuses the privilege, (a) loses the ability to unblock themselves, and (b) gets their name published on a list of shame. This could pretty much be implemented today by anyone with a firewall (or customer facing ACLs) which can be set on a per-customer basis. Various RAS boxes have this sort of facility already; at least one ISP I know of firewalls accounts that are over due so they can reach the accounting website and that's about it. The alternative seems to be that the clueful will just tunnel everything through whatever still works. Tunnelling through DNS requests is painful but doable; tunnelling through most other things is almost tolerably efficient by comparision. And I guess bandwidth is cheap enough now that we can cope with a 20-50% overhead due to tunnelling.[1] Ewen [0] Anyone who can't automate doing it on each reconnection doesn't have a clue. [1] Still, it'll make the ATM tax look cheap. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Commerce Commission - bitstream etc.
by Simon Lyall 31 Jan '04

31 Jan '04

I was having a look though the documents here: http://www.comcom.govt.nz/telecommunications/localloop.cfm I was a bit disappointed at the lack of Local Loop access but there seemed to be some positive talk about the Bitstream service. However the last three pages (Appendix 5) of the Final Report Appendices basically define this as a 128up/256down service with VOIP, video and similar functionality specifically excluded. In other words Telecom will only have to open up a minimal level ADSL service slightly faster than Jetstart (with a recommended provisioning cost of $185 ) . I also see nothing about removing the requirement for all home customers with DSL to also have a voice phone line so I presume it's still in there which means that their be no option to replace home customer's main phone line with a VOIP system (like some people are doing in the US) or for people just to use their cellphones. Which overall looks like at least another couple of years of "more of the same" with respect to high speed Internet for most people. Or have I misinterpreted the recommendations? -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

9 18

For Spamassassin users fed up with AV notifications
by Juha Saarinen 29 Jan '04

29 Jan '04

Apropos the recent storm of AV notifications caused by MyDoom... found this gem on the Exim-users list: http://www.timj.co.uk/linux/bogus-virus-warnings.cf Put it in e.g. /etc/mail/spamassassin, restart SA, and it loads the file. -- Juha

1 0

RE: [nznog] Conference Videocast
by Chris Hellberg 29 Jan '04

29 Jan '04

I'm another watcher and thumbs up for the video quality! Lots of the interlude music seems to be in minor keys. It's almost as if it's funeral music to play for the foresaken networks :) ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0