- NZNOG - lists.nznog.org

New and unacknowledged Exchange / Win2k SMTP vulnerability?
by Neil Gardner 21 May '03

21 May '03

Hi guys - for the last few weeks I've been working with Microsoft to try and track down why on Earth a correctly configured Exchange 2000 Server has been relaying. All of the standard sites report that it's closed, my own telnetting to it says it's closed, and yes, I've accounted for trojans on the LAN - but we're still going to try unplugging the rest of the LAN at some stage for a while and see what happens. But still, it's relaying. I add the IPs as I see them to a blacklist and it quietens down for a while, and MS keep promising they'll find the problem - but I send them SMTP logs, System and App logs and nothing adds up. All tests show it's closed, and all Logs (and complaining recipients) prove it's open for at least one attacker. Most of the reported sender addresses are in the format SMTPxxxx.YAHOO.COM (where xxxx is a random 4 digit number) But all resolve to chinanet or something. Recently though (today), they have been reporting as just 'exploder' or 'range' This is screaming 'vulnerability' to me, but MS refuse to acknowledge anything. I have heard in the last 20 minutes that a different organisation in Wgtn (with a different integrator) is having exactly the same problem, and that "Telecom is talking to Microsoft about it, but is getting nowhere" - I can't substantiate that yet though. No, the client isn't using an SMTP AV gateway, or firewall, Yes, they should be - and this will may in fact be the straw that broke the Financial Controllers back. But my current question is does anyone know WHAT this attack is, or if there's a configuration workaround I can do short of sticking a non win2k SMTP gateway between the net and Exchange? I can't post the SMTP logs publically because of a confidentiality agreement, but if anyone has an idea and would like to see a sample, please let me know and I'll see if the IT admin of the affected site will allow it. Cheers - Neil G.

1 0

Netforum 2003
by Roger De Salis 20 May '03

20 May '03

/* Early bird registrations close on 30th May, so please make sure you have your bookings in, we only have so much space.. */ The following additional talks have been scheduled for the conference Simon Lyall has kindly volunteered a talk about SPAM from an ISP perspective ----------------------------- - Filtering Products and and technology - Customer expectations - Managing Customer expectations ------------------------------------------------------- David Harris, of Pegasus fame is travelling all the way from Dunedin to talk about spam from the MUA persepctive and join a panel discussion on SPAM, and possible ISP and User solutions(?) to SPAM, which we all know is reaching epidemic proportions..... (should there be a small programming competition, the best 5 line perl program which can generate the most eloquent version of "my name is Enkidei Duee, son of Fred Duee, who has some implausible sum in the bank, and needs.....") ----------------------------------------------------------- David Hawke from Genaware is talking about GIS on Linux, and will no doubt have some comments about Linux on the desktop as opposed to linux in a server environment. ------------------------------------------------------------- KC Claffy from Caida in San Diego has indicated a willingness to join us in Auckland, and talk about some of the stuff CAIDA get up to. ------------------------------------------------------------ The flight simulator demo will include a discussion about the power of the internet to accelerate development, and particularly hooking the display (3-5 projectors) to live telemetry data and radio channels, thus effectively hooking yourself into the cockpit of a 737 currently landing at Auckland Airport. ------------------------------------------------------------ As we get closer to the conference, I shall be sending out small notes weekly to add the various talks and information as it comes to hand.. Rgds Roger De Salis -- \_ Roger De Salis rdesalis(a)fx.net.nz </' FX Networks +64 25 481 452 /) Wellington, New Zealand roger(a)desalis.gen.nz (/ ` DSL - the 56k modem technology of 2004

1 0

Sun RAQ's
by Matthew G Brown 20 May '03

20 May '03

Who in NZ distributes Sun's Cobalt range Web Hosting Appliances? Any admins have a good contact ? Best Regards Matthew G Brown B & R Holdings LTD http://www.brh.co.nz

2 1

RE: [nznog] XTRA Primary DNS Funkiness?
by Neil Gardner 19 May '03

19 May '03

Well, after 5 days of constant hassling, someone from Xtra finally rang me back and said they had fixed the TCP query problem on alien, and it does appear to be ok (for me at least) now... They also mentioned off the record that alien was slow this morning but didn't elaborate. They did say they were looking at it though. Cheers - N. -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Tuesday, 20 May 2003 10:47 a.m. To: Neil Gardner; nznog(a)list.waikato.ac.nz Subject: Re: [nznog] XTRA Primary DNS Funkiness? At 17:26 15/05/03 +1200, Neil Gardner wrote: >Hi guys - has anyone noticed anything funky with Xtra's DNS over the >last 2 or 3 days? I have a client that had periodic mail buildups on >outbound SMTP and the error was 'Unable to bind to the destination >server in DNS'. After lots of false starts I got to Xtra DNS... Just checked both Xtra's DNS servers now for other reasons (tracking down an incorrect authorative dns record) and noticed that 202.27.184.3 is sometimes not responding at all - just getting a timeout rather than incomplete data. 202.27.184.5 seems ok. Regards, Simon

1 0

Re: [nznog] XTRA Primary DNS Funkiness?
by Simon Byrnand 19 May '03

19 May '03

At 17:26 15/05/03 +1200, Neil Gardner wrote: >Hi guys - has anyone noticed anything funky with Xtra's DNS over the >last 2 or 3 days? I have a client that had periodic mail buildups on >outbound SMTP and the error was 'Unable to bind to the destination >server in DNS'. After lots of false starts I got to Xtra DNS... Just checked both Xtra's DNS servers now for other reasons (tracking down an incorrect authorative dns record) and noticed that 202.27.184.3 is sometimes not responding at all - just getting a timeout rather than incomplete data. 202.27.184.5 seems ok. Regards, Simon

1 0

Anti Spam software
by Terence Bllyth 19 May '03

19 May '03

Can anyone tell me what the name of the Linux spam stopping software is, some one mentioned it a while ago, Email senders have to send a reply to it before it will pass on the email. (I know this description is vague). Thanks Terence Blyth Managing Director Computer Technologies Ltd 19 Alma Street Box 584, Nelson New Zealand Phone ++ 643 545 9001 Fax ++ 643 545 9002 www.ctec.co.nz PRIVILEGED - PRIVATE AND CONFIDENTIAL This email and any files transmitted with it are intended solely for the use of the addressee(s) and may contain information, which is confidential or privileged. If you receive this email and you are not the addressee (or responsible for delivery of the email to the addressee), please disregard the contents of the email, delete the email and notify the author immediately.

6 5

[c-announce] The InternetNZ Festival of Technology and AGM June 18-20 2003
by Peter Macaulay 19 May '03

19 May '03

(Informal announcement!) Please plan to be in Wellington for at least some part of these three days. The InternetNZ team, Industry NZ, the Next Generation Internet, and TUANZ in partnership with most of our sibling organisations has assembled an event which will deliver impact and value for every member of the internet community. The festival is is a work in progress and your input is welcome. To see the draft program. www.internetnz.net.nz/members/agm2003/festival_of_technology.html We will keep you informed through the discussion list as we develop the event. Please let any of your associates and friends now about our event. Registration will be available in the next week. We have appointed Martin Foster ( martin(a)internetnz.net.nz )as Festival Maestro. -- Peter Macaulay Executive Director InternetNZ Direct +64 4 495 2113 _______________________________________________

1 0

XTRA Primary DNS Funkiness?
by Neil Gardner 18 May '03

18 May '03

Hi guys - has anyone noticed anything funky with Xtra's DNS over the last 2 or 3 days? I have a client that had periodic mail buildups on outbound SMTP and the error was 'Unable to bind to the destination server in DNS'. After lots of false starts I got to Xtra DNS... >Nslookup >Set vc (to force TCP which is I think SMTP's default lookup protocol) >Set q=mx >Server 202.27.184.3 I tried that and got much strangeness when I put in >swiftlink.co.nz I should have gotten... >Server: alien.xtra.co.nz >Address: 202.27.184.3 > >Non-authoritative answer: >swiftlink.co.nz MX preference = 10, mail exchanger = mail.swiftlink.co.nz > >swiftlink.co.nz nameserver = dns1.clear.net.nz >swiftlink.co.nz nameserver = dns2.clear.net.nz >mail.swiftlink.co.nz internet address = 203.167.202.72 >dns1.clear.net.nz internet address = 203.97.33.1 >dns2.clear.net.nz internet address = 203.97.37.1 And in fact, I often do, but I also get... >Server: alien.xtra.co.nz >Address: 202.27.184.3 > >Non-authoritative answer: That's right, end of report - I have received stranger though - how about this??? >Server: alien.xtra.co.nz >Address: 202.27.184.3 >Non-authoritative answer: >swiftlink.co.nz MX preference = 10, mail exchanger = mail.swiftlink.co.nz >swiftlink.co.nz nameserver = Invalid Name at offset 66! >*** Error: record size incorrect (-326254 != 17) >Non-authoritative answer: >swiftlink.co.nz MX preference = 10, mail exchanger = mail.swiftlink.co.nz >swiftlink.co.nz nameserver = Invalid Name at offset 66! >*** Error: record size incorrect (-326254 != 17) >*** alien.xtra.co.nz can't find swiftlink.co.nz: Unspecified error (Blank lines removed for readability - sorry if they were important) I have reproduced these results from 3 different Internet connections, 2 Jetstreams (Both with Xtra) and a Jetstart with Attica. Same results at all 3 places... Oh, if I type >server 203.97.33.14 It all works perfectly... I rang Xtra and did speak to someone that sounded as if they knew what they were talking about, and even emailed copies of the above logs, and they claimed that nothing was wrong. Have I missed something blindingly obvious? Also, omitting 'set vc' to leave it on UDP makes alien.xtra.co.nz play nice again. Late discovery - 202.27.184.5 seems ok - this makes me suspect Xtra has problems even more, but my problems have been manifest over the last 3-4 days and they have denied any problems. Cheers - Neil Gardner Swiftlink NZ.

9 8

RE: [nznog] XTRA mail system
by Neil Gardner 18 May '03

18 May '03

Well, I was having big problems with Mail delivery from an Xtra ADSL connection a few days ago and it turned out to be a misbehaving alien.xtra.co.nz - it was intermittently returning empty results or actual errors. Xtra fobbed me off and said there was nothing wrong with it, even in the face of logs showing actual errors... Any chance they are related? Am I going to get a bunch of calls from clients with Xtra this morning? Cheers - Neil G Simon Lyall wrote: >A quick look at the logs shows it's been dead since around 23:56 last night >apart from a couple of 10 minute wondows around an hour ago. A few errors >before that even. The online Network status even shows a problem so it must >be really bad (I've got a theory that Theresa has to approve these herself) > >They were advertising for a mail admin a couple of months ago so maybe the >new guy pressed the wrong button.

2 1

Correction....
by rdesalis＠paradise.net.nz 17 May '03

17 May '03

That should have read...... /* Early bird registrations close on the 30th MAY......" sorry about that... brain thinking 30 words ahead of fingers... Also John H'ng from APNIC will be providing a full days training on Wednesday the 9th July, to complement Joe Ableys tutorials... I'll be away from my mail for the next couple of days but my phone number is 025 481 452 should anyone have any queries about the conference.. Rgds Roger De Salis

1 0