- NZNOG - lists.nznog.org

Revamp of WIX website
by Andy Linton 15 Nov '03

15 Nov '03

We've redone the WIX website http://www.wix.net.nz/ and it now has links to the Looking Glass tool as well as some explanations of how we do things. I'm working on a similar revamp of the APE website and will announce in due course. andy

5 12

Update to ihug prefixes
by Simon Lyall 14 Nov '03

14 Nov '03

We're updated our prefixes. Current list is attached or available at the following URL: http://www.ihug.net/ihug-prefix-list -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz Ihug Ltd, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz

1 0

Re: [nznog] IPv6 Peering on the WIX
by Simon Lyall 14 Nov '03

14 Nov '03

On Fri, 14 Nov 2003, Joe Abley wrote: > If you want to be able to reach the rest of the IPv6 internet, you will > need a transit provider of some kind. Since it sounds like nobody in > New Zealand is offering IPv6 transit, you'll need to look outside the > country and gain v6 transit via a tunnel plumbed over IPv4. Sprint appear to provide a ipv6, it's via tunnels but they provide direct ipv4 connectivity into NZ so you don't have multiple providers. http://www.sprintv6.net/ http://www.sprintv6.net/Sprintv6.html "Sprint has IPv6 speaking routers in New York City, Washington DC, Seattle, Ft. Worth, and San Jose in the US, and routers in Brussels, Belgium, and Stockholm, Sweden, in Europe. Customers who wish to connect to Sprint's IPv6 backbone may do so, by building a tunnel from their CPE (or any device inside their network) to the nearest Sprint IPv6 router. " -- Simon J. Lyall. | Very Busy | Mail: simon(a)darkmere.gen.nz "To stay awake all night adds a day to your life" - Stilgar | eMT.

1 0

FW: Windows 2000/XP Remote exploit - High Severity
by Barry Murphy 12 Nov '03

12 Nov '03

Thought people would like to be advised. Kindest Regards Barry Murphy Subject: Windows 2000/XP Remote exploit - High Severity Dear Barry Murphy, Summary ------- Products affected: Windows 2000/Windows XP Severity: High (Remote Execution) Ports: 139,445 (TCP) Patch: http://www.microsoft.com/technet/security/bulletin/MS03-049.asp Read more: http://www.eeye.com/html/Research/Advisories/AD20031111.html Discovered by: EEYE Digital Security EEYE Digital Security has discovered a bug in the Windows Workstation Service. This bug can lead to the remote exploitation of any Windows 2000 or Windows XP machines. The attacker needs access to ports 139/445. These ports are by default open on a Windows 2000 or XP host. SensePost has access to a proof of concept script that will determine if a host is vulnerable. For more information about the script please contact research(a)sensepost.com. Let's get this hole plugged before the next worm comes along. Regards, SensePost Research Team. ======================================================= SensePost Research research(a)sensepost.com http://www.sensepost.com (tel) +27 12 667 4737 =======================================================

2 1

For postmaster at asiaonline
by jfp 11 Nov '03

11 Nov '03

I have tried sending this to the proper channels and have been ignored. mail.asiaonline.net.nz's spam filter instead of rejecting emails it doesn't like defers them which mean they sit in our mail queue for a week retrying every 4 hours and clogging our and their mailservers. This seems to me like a rather nonsensical thing to do. > Sep 3 15:26:33 tiny sendmail[26020]: h7V3CIlM028321: > to=<ADDRESSREMOVED>, delay=3+00:13:59, > xdelay=00:00:06, mailer=esmtp, pri=25950368, > relay=mail.asiaonline.net.nz., dsn=4.0.0, stat=Deferred: 450 > <Feeljl(a)163.net>... 163.net,Known spam domain PS: This went thru our mailserver because we are forwarding that email address and obviously have different spam filter's than asiaonline. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

2 1

Route announcements on APE and WIX
by Andy Linton 10 Nov '03

10 Nov '03

Citylink are announcing the following networks on APE from AS23755: 202.7.4.0/24, 203.118.144.80/28 and on WIX from AS23755: 202.7.4.0/24 The 202.7.4.0/24 block will be used to host the webcam and MMS sites associated with the Lord of the Rings premiere during the period leading up to 1 December. Last year we moved around 600 Gbytes of data in the fortnight preceding the premiere and around 4 Tbytes on the day itself. To avoid a potentially higher traffic bill this year we are making arrangements to use anycast (for more details see http://www.isc.org/tn/isc-tn-2003-1.html) to make 202.7.4.0/24 available in three locations, North America, Auckland via the APE route servers and in Wellington via the WIX route servers. We will not be advertising this block via any of the ISPs who provide us with transit. If you are not peering locally in New Zealand and your users access this content they will retrieve it from servers in North America with potential overload of your international circuits. You should consider peering with the APE and/or WIX route servers and accepting these prefixes. In addition, the 203.118.144.80/28 network is used to host media content for NZOOM. While this traffic is available via IHUG, listening to this announcement will optimise your customer's experience.

2 1

Re: [nznog] Procedure for making an ISP take responsibility ?
by Ewen McNeill 06 Nov '03

06 Nov '03

In message <003601c3a4f2$449210d0$230515ac(a)JOVE>, "jfp" writes: >Obviously that ISP is not going to do anything, So: >- Permanently block said ISP to your linux box. That and/or properly patching/securing the Windows box would be my first two suggestions. Trying to get "hackers" shut down is a bit like wack a mole even at the best of times. >- I assume you are using ipchains on your linux box, I would recommend >upgrading to iptables which would mean not having to open incoming ports >above 1024 as the session tracking should take care of that. H.323 (and friends), as used by NetMeeting, etc, are rather difficult to firewall well, because it opens connections in arbitrary directions to arbitrary ports (as negotiated through a control channel) -- a bit like FTP, but worse. The control channel is encoded via ASN.1 (ie, binary) rather than being text like FTP. IMHO it's shameful that a "modern" protocol isn't designed for at least easy state tracking if not to work easily with outgoing-only firewalls and NAT boxes. There is an (experimental) H.323 tracking module for Linux iptables which can be downloaded and compiled up (from some of the netfilter development sites), but it's a bit of a hack. I've not tried it, but have read that it works reasonably well for a single H.323 endpoint behind the firewall. Alternatively application layer proxying may be more appropriate. GNU Gatekeeper, Open H.323 Proxy, Asterisk, etc, are capable of proxying H.323 sessions at the application level. Some of them (eg, Asterisk) are pretty much voice only (Asterisk is fundamentally PBX software which supports H.323 amongst other things), and some of them (eg, GNU Gatekeeper) will proxy video as well. Ewen

1 0

Max TNT Two IP Pools
by vashdev talk 06 Nov '03

06 Nov '03

Hi I have Two Dialin Number (UIN) for my two PRIs (E1). I want to assign different ip pool to different UIN Number. Can any one guide me how can i do this on Max TNT Vashdev http://www.malhinet.com --------------------------------- Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard

1 0

Procedure for making an ISP take responsibility ?
by Tikiri Wicks 06 Nov '03

06 Nov '03

Hi Is there a procedure for forcing an ISP to take responsibility for hackers on their network ? I've got this one windows PC hidden behind a unix box. Ports above 1024 are forwarded from the Linux box to the windows box because of netmeeting and a few other things. This PC keeps getting hacked from a subscriber on an Israeli ISP. I've cleaned it 3 times now. Essentially the machine gets compromised with a hacktool and then opens a channel to the IP in Israel after which there is a continous stream at 40 kbps. Dialup modem speed perhaps ? I've emailed the ISP ( barak.net.il ) a couple times and get absolutely no response. Forum messages also indicate that this ISP does not respond to such messages. Norton Antivirus picks up a hack tool only when the pc is scanned but even then cannot identify it beyond stating that it is a hacktool. The filename is disguised as scan.exe in one of the winnt\installer folders If anyone is interested please email me off the list and I'll email you the packet logs. The following is the state of the afected PC when the firewall is not blocking traffic to 82-166-172-38.barak.net.il Example 1 winmgnt.exe:1200 TCP zoo:1337 82-166-172-38.barak.net.il:4241 ESTABLISHED winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:4273 TIME_WAIT winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:4276 ESTABLISHED winmgnt.exe:1200 TCP zoo:1337 zoo:0 LISTENING winmgnt.exe:1200 TCP zoo:43958 zoo:0 LISTENING Example 2 winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:2388 TIME_WAIT winmgnt.exe:1200 TCP zoo:1337 82-166-172-38.barak.net.il:2542 ESTABLISHED winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:2579 TIME_WAIT winmgnt.exe:1200 TCP zoo:1336 82-166-172-38.barak.net.il:2586 ESTABLISHED winmgnt.exe:1200 TCP zoo:1337 zoo:0 LISTENING winmgnt.exe:1200 TCP zoo:43958 zoo:0 LISTENING Once traffic to 82.166.172.38/24 is blocked then the trojan kept attempting a connection once every few seconds as follows System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4530 SYN_RCVD 3 seconds later System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4569 SYN_RCVD 3 seconds later System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4607 SYN_RCVD 3 seconds later System:8 TCP zoo:1337 82-166-172-38.barak.net.il:4640 SYN_RCVD and so on.

3 2

RE: [nznog] Procedure for making an ISP take responsibility ?
by jfp 06 Nov '03

06 Nov '03

My 2 cents worth. Obviously that ISP is not going to do anything, So: - Permanently block said ISP to your linux box. - I assume you are using ipchains on your linux box, I would recommend upgrading to iptables which would mean not having to open incoming ports above 1024 as the session tracking should take care of that. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

1 0