- NZNOG - lists.nznog.org

RE: [nznog] The Internet for n00bs
by Seton Wingfield 31 Jan '04

31 Jan '04

In my experience its never the people that find an exploit that end up causing the mayhem. If the flow of information from the exploit finders to the script kiddies could be stopped so would the majority of worms etc. I know this is old thinking but it seems like a easier option than firewalling off the Internet. I recently read the "Changes to Functionality in Microsoft Windows XP Service Pack 2" and in it, it states that the Internet Connection Firewall will be turned on by default. Changes like this and Microsoft's long term commitment to security via their "Trustworthy Computing" initiative may make the problems that you are trying to solve a thing of the past. http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-40b6… http://www.microsoft.com/mscorp/innovation/twc/twc_whitepaper.asp The documents are MS Word format. -----Original Message----- From: Ewen McNeill [mailto:ewen(a)naos.co.nz] Sent: Sunday, 1 February 2004 11:17 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] The Internet for n00bs One of the things discussed at the (excellent, thanks everyone) NZNOG 2004 conference was that the Internet sucks, and that a large portion of this suckage is due to ignorant n00bs who do the wrong thing, get 0wned, etc. It was suggested that the "only" fix to this problem was to kill the end to end Internet, making the "Internet" a core exchange network (a la telco style), and allowing users only access to a local proxy at their ISP for a very limited set of services. Aside from my objection that this won't help much except in the short term (plenty of protocols already tunnel around such firewall limitations -- eg, look at everything that's been tunneled through HTTP), this really sucks for the l33t who find it awfully restrictive. An alternative approach to that type of thing is possibly just to heavily firewall -- at the ISP end of the link -- connections to all "potential n00b" users (SMTP to ISP mail server, POP/IMAP/HTTP/HTTPS to whereever and a few other common things) by default. And then provide an "opt out" system that anyone with a clue can use to disable the default firewalling. I would suggest: telnet ihaveaclue.$ISP where you have to enter "My name is $NAME, and I have a clue" (with $NAME expanded, but otherwise literally). Possibly that setting could be sticky; possibly it would need to be done on each reconnection.[0] The remaining aspect is that anyone who claimed to have a clue in this manner and then lets something on their connection get 0wned or otherwise abuses the privilege, (a) loses the ability to unblock themselves, and (b) gets their name published on a list of shame. This could pretty much be implemented today by anyone with a firewall (or customer facing ACLs) which can be set on a per-customer basis. Various RAS boxes have this sort of facility already; at least one ISP I know of firewalls accounts that are over due so they can reach the accounting website and that's about it. The alternative seems to be that the clueful will just tunnel everything through whatever still works. Tunnelling through DNS requests is painful but doable; tunnelling through most other things is almost tolerably efficient by comparision. And I guess bandwidth is cheap enough now that we can cope with a 20-50% overhead due to tunnelling.[1] Ewen [0] Anyone who can't automate doing it on each reconnection doesn't have a clue. [1] Still, it'll make the ATM tax look cheap. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Commerce Commission - bitstream etc.
by Simon Lyall 31 Jan '04

31 Jan '04

I was having a look though the documents here: http://www.comcom.govt.nz/telecommunications/localloop.cfm I was a bit disappointed at the lack of Local Loop access but there seemed to be some positive talk about the Bitstream service. However the last three pages (Appendix 5) of the Final Report Appendices basically define this as a 128up/256down service with VOIP, video and similar functionality specifically excluded. In other words Telecom will only have to open up a minimal level ADSL service slightly faster than Jetstart (with a recommended provisioning cost of $185 ) . I also see nothing about removing the requirement for all home customers with DSL to also have a voice phone line so I presume it's still in there which means that their be no option to replace home customer's main phone line with a VOIP system (like some people are doing in the US) or for people just to use their cellphones. Which overall looks like at least another couple of years of "more of the same" with respect to high speed Internet for most people. Or have I misinterpreted the recommendations? -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

9 18

For Spamassassin users fed up with AV notifications
by Juha Saarinen 29 Jan '04

29 Jan '04

Apropos the recent storm of AV notifications caused by MyDoom... found this gem on the Exim-users list: http://www.timj.co.uk/linux/bogus-virus-warnings.cf Put it in e.g. /etc/mail/spamassassin, restart SA, and it loads the file. -- Juha

1 0

RE: [nznog] Conference Videocast
by Chris Hellberg 29 Jan '04

29 Jan '04

I'm another watcher and thumbs up for the video quality! Lots of the interlude music seems to be in minor keys. It's almost as if it's funeral music to play for the foresaken networks :) ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

RE: [nznog] Credit card fraudsters......
by Stephen Andrew 29 Jan '04

29 Jan '04

On Friday, 30 January 2004 9:42 AM, Steve Withers <mailto:swithers(a)mmp.org.nz> wrote: > In my e-mail this morning, with a clickable button to take me to their > 'secure site': > > From: security(a)visa-security.com > > Dear Sir/Madam, [snip] A similar thing had an "honourable" mention in Bruce Schneier's CryptoGram this month. Nice pice of social engineering - the victim already believes there are unauthorised transactions on their card which are being dealt with by Visa and so doesn't chase them up when they appear on their statement. http://www.schneier.com/crypto-gram-0401.html#10 -- Andrew This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way.

1 0

Conference Videocast
by Tony McGregor 28 Jan '04

28 Jan '04

The good folks at CityLink will be multicasting the talks from the conference tomorrow and Friday. So if you can't be here, check out www.r2.co.nz. There are pictures from today's sessions on the conference page. www.nznog.org. Tony ---------------------------------------------------------------------------- Tony McGregor Mail: T.McGregor(a)cs.waikato.ac.nz Department of Computer Science Phone: +64 7 838 4651 Waikato University Fax: +64 7 858 5095(w) +64 7 825 5047(h) Private Bag 3105 Home: +64 7 825 5040 mobile: (021)313004 Hamilton, New Zealand www: http://www.cs.waikato.ac.nz/~tonym ----------------------------------------------------------------------------

7 9

Recent worm infestations
by Juha Saarinen 28 Jan '04

28 Jan '04

For those who haven't noticed the flood of emailed viruses and bounces caused by the dictionary attack the new Windows worm(s) create(s), read and weep: http://www.kaspersky.com/news.html?id=3614506 http://www.datafellows.com/v-descs/novarg.shtml Plus the usual AV sites. Looks like it's running amok in NZ. -- Juha

7 11

RE: [nznog] Conference Videocast
by Finnigan, Jamie (NZ - Wellington) 28 Jan '04

28 Jan '04

> We had 12 viewers a few minutes ago, but I'm not sure they weren't all > just Citylink staff wanting to see the light glinting off Carl's head > :-) I'm another .. but I'm only here for the fantastic music that gets played during intervals. :) Jamie -- CAUTION: This e-mail and any attachment(s) contains information that is both confidential and possibly legally privileged. No reader may make any use of its content unless that use is approved by Deloitte separately in writing. Any opinion, advice or information contained in this e-mail and any attachment(s) is to be treated as interim and provisional only and for the strictly limited purpose of the recipient as communicated to us. Neither the recipient nor any other person should act upon it without our separate written authorisation of reliance. Deloitte is a member firm of Deloitte Touche Tohmatsu. Deloitte Touche Tohmatsu is a Swiss Verein (association), and, as such, neither Deloitte Touche Tohmatsu nor any of its member firms has any liability for each other's acts or omissions. Each of the member firms is a separate and independent legal entity operating under the names "Deloitte," "Deloitte & Touche," "Deloitte Touche Tohmatsu," or other related names. Services are provided by the member firms and not by the Deloitte Touche Tohmatsu Verein. If you have received this message in error please notify us immediately and destroy this message. Thank you. Deloitte Internet: www.deloitte.co.nz

1 0

RE: [nznog] Conference Videocast
by Richards, David 28 Jan '04

28 Jan '04

Ah the sound is fixed now! Well done! -- David Richards, Senior Network Engineer IT Services Unit - 'Enabling people through technology' Christchurch City Council, New Zealand Phone: +64 3 941 8689 | Fax: +64 3 941 8989 | Mobile: +64 27 242 7689 email: David.Richards(a)ccc.govt.nz -----Original Message----- From: Jamie Curtis [mailto:jamie(a)pointless.co.nz] Sent: Thursday, 29 January 2004 15:29 To: nznog(a)nznog.org Subject: Re: [nznog] Conference Videocast > And only if RIch can get from AKL to HAM in time to get everyuthing set up > and a public IP is available, etc. We also have minor logistics issues of > getting the van close enough, running a lot of cables, power, etc. > > If everything goes OK, there MAY be 3 cameras (and operators) as well as a > scan converter on the inevitable power point thingies. After a bit of playing around Rich and Simon seem to have got it all working. The streams are all available from: http://www.r2.co.nz/20040129/ We are currently trying to work on clearing up the sound but otherwise all is going well. Thanks heaps to Rich and all the Citylink guys for making this happen. All the captures are also being recorded and may be available later. Cheers, Jamie _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog ********************************************************************** This electronic email and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. The views expressed in this message are those of the individual sender and may not necessarily reflect the views of the Christchurch City Council. If you are not the correct recipient of this email please advise the sender and delete. Christchurch City Council http://www.ccc.govt.nz **********************************************************************

1 0

Open Discussion at BGP'04
by Donald Neal 27 Jan '04

27 Jan '04

NZNOG People, The last item on the programme (http://www.nznog.org/programme.php) for the conference now getting under way is "Open Discussion". This isn't a BOF. I intend to use this session to ask for feedback from attendees on a number of issues. For a start, I plan to ask for comments on the conference then concluding - what went well, what could be improved. I also intend to try to have those present agree a committee to handle NZNOG's part of the organisation of the next conference, and to ask whether those assembled have any shared views about that conference - where, when, how much beer Roger should pay for. In seeking to do this, I'm assuming that NZNOG will remain a loose association and not a formally-organised society. That's an assumption with which people are welcome to disagree. I'd welcome email directly to me by Thursday night from people planning to attend the conference if there's any other issue they'd like discussed then. If there are a lot of topics people want discussed I'll put together a formal agenda. If you're not planning to attend that session but would be willing to help in NZNOG's part of conference organisation, please also get back to me by Thursday night. I'm also on the lookout for at least one more person to act as administrator for this mailing list. The last time this was discussed on this list a number of names were mentioned, but there seemed to me little sign of a coherent view. Again, if you're interested in taking on that role (or have strong views on who should or should not have that role) but won't be at Friday's session, please email me directly by Thursday night. Donald Neal | "Fiasco - an unsuccessful Technical Specialist | wall painting." Operations Engineering | Integration & Services Divn. | - Sandi Toksvig Alcatel NZ Ltd | All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0