- NZNOG - lists.nznog.org

RE: [nznog] blaster worm
by Nathan Mercer 15 Aug '03

15 Aug '03

You're correct. We never used windowsupdate.com for anything, none of our stuff points to it at all - it was only a redirect site. There was a redirect in place going from windowupdate.com to windowsupdate.microsoft.com up until about 9pm NZ time last night. Cheers Nathan -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Saturday, 16 August 2003 9:33 a.m. To: Kerry Thompson Cc: NZ NOG Subject: RE: [nznog] blaster worm > windowsupdate.com has been pulled my MS. > See > > http://slashdot.org/article.pl?sid=03/08/15/1730200&mode=thread&tid=109& tid=126&tid=172&tid=187 > > I believe they've shifted to windowsupdate.microsoft.com I wouldn't say they've "shifted" to windowsupdate.microsoft.com. As far as I'm aware, thats always been the actual URL of windows update pretty much since day one. I've been using windowsupdate.microsoft.com as the URL for years now.... Maybe they had a redirection page at windowsupdate.com or just mirrored that URL as well. If the worm really targets windowsupdate.com and not windowsupdate.microsoft.com then the worm author isn't as smart as they'd like to think they are :) (big surprise there huh....) Regards, Simon _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

6 5

Nauru
by Jon Leeman 15 Aug '03

15 Aug '03

>What is Nauru? and do you connect via telstra clear; they the only ISP i >know that connect via reach. That's the fourth, private query from members of this list I've had..............look north from NZ and it's just below the equator..........Nauru is known as the 'smallest' sovereign nation (if you discount the Vatican) on the planet...........google for Nauru + "phosphate" (or "John Howard's Pacific Solution", "Money Laundering", etc.. Internet access is via a 64/64 Kbps link with an F3 IDR ES using IntelSat and Telstra Reach. I'm an Oz 'expat' resident (14+ years). Rgds., Jon Jon Leeman .nr ccTLD Technicial Contact ISP Technician CenpacNet Inc. Republic of Nauru e: jleeman(a)cenpac.net.nr w: www.cenpac.net.nr

1 0

APE route servers
by Andy Linton 15 Aug '03

15 Aug '03

Those of you who use our route servers should use the Looking Glass at http://www.wix.net.nz/cgi-bin/mrlg-ape.cgi to check that you are peering with both route servers. Some of you have a session with rs1 but not with rs2. It would make sense for you to add the second server for redundancy. The configuration details are identical apart from the IP address of the BGP peer. 192.203.154.2 instead of 192.203.154.1.

3 2

Re: [nznog] blaster worm
by Malcolm Lockyer 14 Aug '03

14 Aug '03

--snippity-- >Subject: Re: [nznog] blaster worm >Date: 15 Aug 2003 21:56:15 +1200 > >--snippity-- > >Make www.windowsupdate.com point to 127.0.0.1 so it doesn't do anything >or what? Except that it makes it a more effective DOS. Because then NOBODY can reach windowsupdate regardless - instead of just painfully slowly - or decently for whatever Akamai based reason. Time to hold onto whatever body part you guys value - here comes the storm. Although on a side note I hope the blaster infections are lower than I think they are - because all of you have been blocking netbios / 139tcp / etc. since this thing broke out. Right? Should be a more interesting 24 hours then eh? :-| m > >Thanks >Craig Whitmore >Orcon Internet >http://www.orcon.net.nz > --snippity-- _________________________________________________________________ Download MSN Messenger @ http://messenger.xtramsn.co.nz - talk to family and friends overseas!

2 1

OT: MP3 Players
by Dan Clark 12 Aug '03

12 Aug '03

Hey did anyone else get one of these MP3 players My version of the manual has no page 9 and 2 page 10's incl 2 covers ?? Also, how do ya get it to be recognised in WinXP? Kind Regards, Dan Clark Network Manager Scarfies.Net Ltd

6 5

ISPs / Sites blocking IPs?
by Steve Withers 10 Aug '03

10 Aug '03

All I'm on a TelstraClear / paradsie cable modem. When I try to access the web site for the "Indepednent" in the UK, I get: Access Denied You don't have permission to access "http://news.independent.co.uk/uk/environment/story.jsp?" on this server. I'm thinking they have started blocking IPs they may consider possible sources of SPAM.... Has anyone else seen this? Can everyone else access this site from their networks? I'm on 203.96.144.119. -- Steve Withers <swithers(a)mmp.org.nz>

4 3

Full URL
by Steve Withers 10 Aug '03

10 Aug '03

Sorry...the full URL is: http://news.independent.co.uk/uk/environment/story.jsp?story=431319 -- Steve Withers <swithers(a)mmp.org.nz>

1 0

Error
by Sahil Gupta - NET4U LIMITED 10 Aug '03

10 Aug '03

Apologies, the network is 202.50.167.0/24 and not 202.50.267.0/24 Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

Prefix-List Update for Net4U Limited (AS23746)
by Sahil Gupta - NET4U LIMITED 10 Aug '03

10 Aug '03

Hi, Could ISP's currently peering with Net4U at APE kindly add the below listed network to the net4u's current prefix-list: 202.50.267.0/24 A full prefix-list is attached. Regards, Sahil Gupta Senior Account Manager NET4U LIMITED Phone: 0508-263-848 Fax: 07-8582659 Mobile: 029-366-6375

1 0

RE: [nznog] Re:Domain Name Scams
by Paul Adshead 10 Aug '03

10 Aug '03

It is to be fair, incredibly simple to find out most of the information regarding the allocation of a domain. Just go to the main DomaiNZ page: www.domainz.net.nz and enter your (NZ) domain name into the search box on the left. After selecting OK, then a warning about not being able to use this information for any other purpose appears - and this warning automatically disappears after a few seconds anyway. After this, then all of the details for the queried domain appear! As the warning message automatically disappears, then the content of the warning is probably not legally enforceable anyway - you could have been looking away from your screen at that point! They should have a "Yes I've read the above agreement" checkbox before you can proceed... Possible ways that the scam has found out the contact info: - if you knew enough about HTML, ASP and VB, it would be simple enough to write a program that once every five seconds sent a request to the DomaiNZ webserver starting at "a.co.nz" and finishing at "zzzzzzz999.net.nz", to find out the information for the various domains - it would take a while though; - you could use an 'electronic dictionary' of words in order to cut down on the unlikely examples; - there is also probably an online listing somewhere, of all of the currently active companies in New Zealand, you could then just try "<company name>.co.nz" and "<company name>.net.nz". There are far too many ways that people could have done it. I'm not condoning what has happened and have not done so myself, I'm just trying to explain how easy it is to do so. I was hit with three renewals too... Paul Adshead Network and Systems Manager OTL Software Ltd www.otl.co.nz -----Original Message----- From: Juha Saarinen [mailto:juha(a)saarinen.org] Sent: Friday, 8 August 2003 13:04 To: PhoneNet Cc: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Re:Domain Name Scams On Fri, 8 Aug 2003, PhoneNet wrote: > I have today received 5 letters from The Domain Registry of America, > Melbourne (posted in UK) asking me to re-register some of my domains as > they are due to expire - so they are at it also. Got one here as well, and what bothers me is that although the domain in question is registered under my own name, the letter was addressed to my company, which doesn't appear in whois data anywhere. Somebody's been trawling... -- Juha Saarinen _______________________________________________ Nznog mailing list Nznog(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

5 5