- NZNOG - lists.nznog.org

RE: [nznog] Domain Names NZ scam
by Paul Adshead 28 Oct '03

28 Oct '03

Deja vu anyone: http://www.domainz.net.nz/Domainz.asp?Content=news21 http://www.dnc.org.nz/story/30127-32-1.html http://www.comcom.govt.nz/publications/display_mr.cfm?mr_id=1219 Paul Adshead OTL Software Ltd www.otl.co.nz paul.adshead(a)otl.co.nz Tel +64 9 373 9920 Fax +64 9 303 9129 -----Original Message----- From: jfp [mailto:jfp(a)clearfield.com] Sent: Wednesday, 29 October 2003 10:42 To: nznog(a)list.waikato.ac.nz Subject: [nznog] Domain Names NZ scam Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Domain Names NZ scam
by jfp 28 Oct '03

28 Oct '03

Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------

1 0

How to get deliberately attacked?
by Neil Gardner 28 Oct '03

28 Oct '03

Hi guys, I am testing a firewall here at work with a DHCP spoofing ADSL router and I wanted to check the integrity of the reporting with the attacks it can recognise... I don't really want to spend too much work time jumping into hacky IRC channels and annoying people to generate some attack traffic (plus I don't want to be attacked for too long :-) so I thought I'd ask here to see if anyone knows of any web based attack generators or could indulge me and hit me with a few things (short of classic DOS - I'm testing the firewall, not my ADSL line :-) Anyway - answers on the back of a postcard please, or email me direct. Oh, it's not this IP, so please don't just start attacking - please contact me and we'll work something out :-) -- Cheers - Neil Gardner Networking and Security Support Engineer Renaissance Brands Ltd (09) 968-3681 / (021) 746-345

4 3

Orcon Internet Prefix List Update (2003-10-19)
by Craig Whitmore 27 Oct '03

27 Oct '03

For all those peering with Orcon Internet (AS17746) Nationally, please update your prefix lists with the following networks as in attached file. Thanks Craig Whitmore Systems Administrator Orcon Internet http://www.orcon.net.nz

1 0

RE: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 27 Oct '03

27 Oct '03

Thanks Matt I haven't started on the 218's as some of those are here in Australia also. Geoff Williams -----Original Message----- From: Matt Camp [mailto:gargoyle(a)noise.net.nz] Sent: Tuesday, 28 October 2003 9:59 PM To: Geoff Williams Cc: Joe Abley; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? On Tue, 28 Oct 2003, Geoff Williams wrote: > The bulk of the 218.0.0.0 Class A range is allocated to provincial > entities in the PRC. Except for the /17's out of this class A which are allocated to NZ entities such as TelstraClear. Blocking this would be inadvisable. --- Matt Camp This email is confidential and intended for the recipient only. If you receive it in error please delete it immediately.

1 0

RE: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 27 Oct '03

27 Oct '03

The bulk of the 218.0.0.0 Class A range is allocated to provincial entities in the PRC. The other big source of addresses I have seen is the 61.0.0.0 subnet which is spread between India and the PRC, again in the PRC it seems to be allocated to provincial entities. The 61.11 range in India has been very active trying to fish passwords but strangely whoever is doing it is coming from right across the whole A range. Snip of repeated ORF event below: NOTIFICATION - Open Relay Filter Enterprise Edition =================================================================== The following event has occurred: Class : Block Severity : Info Source : SMTPSVC-1 Related IP : 61.11.47.52 Text description: ================= Blocked. Recipient address (user3(a)989888.com) is not listed in the Active Directory. Sender: test(a)yahoo.com. SMTP response: End snip. This particular event just won't stop. Geoff Williams -----Original Message----- From: Joe Abley [mailto:jabley(a)isc.org] Sent: Tuesday, 28 October 2003 12:41 PM To: Geoff Williams Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? On 27 Oct 2003, at 17:25, Geoff Williams wrote: > I had originally blocked 2 Class A IP ranges at our router after > watching the traffic and finding that they were allocated to a > provider in China. Which class A networks do you think are allocated to a provider in China? This email is confidential and intended for the recipient only. If you receive it in error please delete it immediately.

3 2

FW: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 27 Oct '03

27 Oct '03

Further to my earlier post, Neil G has pointed me correctly to an SMTP AUTH attack. I have used the logs of the ORF tool to pinpoint which accounts have been compromised. Strangely the spammers are trying to work out why, even if they authenticate, they can't relay, so there is a lot of traffic to watch and learn from. A large number of their connections are being blocked by the IP blacklists I have selected. I had originally blocked 2 Class A IP ranges at our router after watching the traffic and finding that they were allocated to a provider in China. But I am not 100% sure that IP addresses are not being spoofed as they seem to have a huge range of Class A and B addresses available to them and I was really chasing my tail trying to block them at that level. So now I have a new password generator and will start training the mind to work with 12 or more character passwords. Hope this is of assistance to others. Geoff Williams -----Original Message----- From: Geoff Williams Sent: Monday, 27 October 2003 11:01 PM To: nznog(a)list.waikato.ac.nz Subject: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 _____ This email is confidential and intended for the recipient only. If you have received it in error please delete it immediately.

2 1

httpd traffic with ie 5.5
by Barry Murphy 27 Oct '03

27 Oct '03

Howdy, Anyone noticing a lot of traffic in the httpd-access logs? I have had the following unique hits to my catch domain: August: 5401 September: 10950 October: 18535 Can't see much in tcpdump but they all seem to be windows 98 IE 5.5. 65.95.18.179 - - [28/Oct/2003:11:11:33 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 82.37.50.69 - - [28/Oct/2003:11:11:45 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 24.125.71.52 - - [28/Oct/2003:11:11:52 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 24.85.14.211 - - [28/Oct/2003:11:12:03 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 24.207.23.172 - - [28/Oct/2003:11:12:22 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 68.117.32.241 - - [28/Oct/2003:11:12:30 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" 68.114.179.170 - - [28/Oct/2003:11:12:37 +1300] "GET / HTTP/1.1" 200 3677 "-" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" Cheers Barry

2 1

Re: [nznog] Cloaked SPAM hosting service
by Richard Cox 26 Oct '03

26 Oct '03

On 25 Oct 2003 12:00:07 +1300 (NZDT) Simon Byrnand <simon(a)igrin.co.nz> asked NZ-NOG: > Correct me if I'm wrong but isn't this idea just a reverse proxy farm? >From what investigators have seen there is more to this exploit than just a reverse-proxy. I'm reluctant to say too much, even here, since investigations are continuing. The previous well-reported exploit which was known as "Super-Zonda" simply packaged reverse-proxying with a set of custom DNS tricks designed so that only the designated proxies could get the IP address of the real source of the website. Two strains of virus - "Fizzer" and "Sobig" each deliver a payload that compromises the infected computer, and in many cases the compromise can survive normal "cleansing" operations. This leaves a suite of abusive tools on the victim's computer that can, without the owner's knowledge or permission, be used by the attacker. Fizzer is known to install a spam sender and Denial-of-Service module, both of which "phone home" and listen for remote instructions. This means they can lie dormant for days, even weeks, without being activated. When they are activated to spam, they will usually only send out a small quantity of messages at one time, and then become silent again; the whole point is that as there are so many of them available to the spammer, there is no need for any one infected machine to send any great quantity. This, in turn, means that it is unlikely to trigger any traffic-based alarms, and any spam reports which reach abuse desks - if they even get that far - will often be treated as either misdirected or ill-informed, because "if it really was a spam source there would inevitably be many more complaints" That is exactly what the malware-writer intended ISPs to think, so don't be caught by it! Some Abuse desks may even go as far as looking for any open ports, and finding none, will take the view that the machines are secure. Not so! As all the trojans "phone home" for their instructions, there will not be any need for open ports, and none to find. The trojan may open some ports when ordered to, but generally will appear to be completely locked down (well, as much as any Windows machine can be!). There is one thing I want to stress here, as many of you will have no doubt read about the various DDoS attacks on various targets - Cisco, and some of the anti-spam resources being the ones that got publicity. If you get (a small number of) reports of spamming from a customer IP and you are tempted to disbelieve or ignore those reports, please don't. Regardless of your views on spam, those reports may be the only warning you will get that you have a malware-attacked box on your netblock, and that box is then fully equipped and ready to take part in a Distributed Denial of Service (DDoS) attack on a target at a moment's notice. | Sounds like the author of the article doesn't understand round robin | dns, expressing surprise that every time they checked the site the ip | address was different...(well duh :) Er, no. That's not the primary point of this exploit, even though Round Robin DNS is certainly used in it. Remember - we are talking about large quantities of boxes here, and a different zombie can be activated in seconds. The compromised machines are able to act as DNS servers as well as web servers - and they do. The key is that the DNS servers are in the .biz TLD and that registry offers its customers the ability to update their DNS in real time, rather than having to wait for a timed update as with the .com/.net environment. Thus as machines are booted, come online, and "phone home", some of them are put in the queue for their IPs to be sent to the root .biz servers. Anyone monitoring the zonefiles for the latest .biz domain that these spammers are using (they change domains regularly, of course ...) will see the IPs of both the nameservers and A records change on a regular basis, and the location of those IPs will tend to follow the sunrise - so at one time of day there will be some in Europe, a few hours later they will mostly be on the US East Coast, later the US West Coast, and some hours after that NZ, then Australia, then Japan, and so on. > In other words said spammers host the actual site on a real server > somewhere, use round robin dns with hundreds (?) of dns entries > pointing to different hijacked computers, that then forward the > requests to the real servers as a reverse proxy. If they did that, the operation could be closed down by terminating (or bogussing) all the DNS servers that hold the round-robin DNS list. As ordinary user machines (mainly broadband) are being used as these servers, they can change almost as often as the A records do, and so any that are disabled are immediately replaceable. While admittedly tempting, it is hardly practical to bogus out the entire .biz root! The contact details for the domains used in this exploit vary from "suspicious" to "proven fake" but you could say the same about rather a lot of domains at the moment. The ICANN promises of a clean-up have not materialised, and given ICANN's (lack of) authority in general, some would say that any clean-up can only be cosmetic until there is general international agreement to enforce new rules. What may be of interest is that quite a few of these domains we've looked into turned out to have been registered with "DomainDiscover" in San Diego, USA (http://www.domaindiscover.com/) Even if DomainDiscover closed down all those domains immediately, the spammers would just move across to another Registrar and carry on. The only effective way to stop THIS particular exploit would need the root .biz registry to be persuaded to withdraw the real-time DNS updating feature in .biz. You may well conjecture on the likelihood of that ever happening! The zombies installed by the SoBig series of viruses also install an FTP server (TFTP) on first infection, which is used to fetch the rest of the SoBig payload some days later, and that means that absolutely anything can be subsequently downloaded to those machines - so unless you actually remove the infection and compromise, a machine that scans as completely clean today may be a Webserver serving up kiddie-porn by this time tomorrow. Yes, Tikiri, this one *is* more alarming. -- Richard Cox Mandarin

2 1

New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Geoff Williams 26 Oct '03

26 Oct '03

Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 This email is confidential and intended for the recipient only. If you receive it in error please delete it immediately.

1 0