- NZNOG - lists.nznog.org

Android "stagefright" bug, aka "The Android End Times"
by Mike Forbes 27 Jul '15

27 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Seems this is pretty hot right now. Basically every single android device - and it seems very difficult to imagine a scenario where all those devices could be patched. Suggestions for mitigating include disabling the "Auto download / Auto retrieve" portion of your MMS app and/or disabling the MMS APN in your mobile settings. Though, of course the vulnerability is in the media library so assume the malicious code could be sent via other means. In talking to @jduck (he's a Kiwicon regular!) he's openly commented that this exploit could be definitely wormable. Sources: http://arstechnica.com/security/2015/07/950-million-android-phones-can-be-h… http://blog.zimperium.com/experts-found-a-unicorn-in-the-heart-of-android/ -----BEGIN PGP SIGNATURE----- iQQcBAEBCgAGBQJVtrdXAAoJENoDRsDWj78uMxwf/0AmB3LCWaPN7JT+9dlyQfUR YGppVe9ehpLXg0hhZod9//IJ0GXXhO1TeYwXVgO3E5fPKjNCy1DBv4eCrp/HAnBS 13r04j+H7H4tFy+KjPUHj546+U0KxAk8K4R08NGsyhpnSL4vIrm4m8D2MsOzlU/n YuiVHqCsxyO3YQ+FZDh24tLGCnoy+HrhFa+ry/i1KNOPdRFZmtrHwET5BBKX9q0I n/Dfgo1z4Lbfs6D5QmH1A2AhHXQx8fUiW0mNdOfd/SW4Thmwj7xPJVo36PGimYPQ 8qznIlLJLX9BgFZ10uVmCJaQEH2M1ZD1cV8WhnAgznSISTx8oopo5A3Qgk/D3Ltg LXApd09pv8fQbjq15fUmDc1buAYB/On7lkpboWxFSo2UHV3ua5YK0rz9Yag4TaBU Ii3+6a2dwW933qUQlLn7JR0ibv+yKsHeK/zjnd0WC8iaDGb+I33hdf+fL9DU7re/ DF0k0ku7E8Uf7209A+yz+2kW0qrE9guldvn4M3mGC4ptG0QQvRPEiTynxARO9pjW iWTix+zDkD8qlyUw2aiK9yTaXhdYQRUHcoBmVrs+HCQABLgQmpdZ/8FBZGFE3F0F KHRmLaPuhTeeKprHti2JoVU98/5OYGNMzYrRs13jV1I399vJSVP6grUIPIpk7M8i zI8vqsXmBNAK2CYK++WHINccjkFfZf6hJ1V59Ajv1VjeSkmFfuEveO2+AIjOvrBr Bv3ZcflxTZsmqxHrOhrU/VclpT8qprc8GoFYMLSpLmQsLqGG5H9ih5vLhz8H7wXe lDuwjXZbtRmAh4BtfCGZoR20KJExNipgoZlFN0zD46Y91F/CFYvMGOlQlmi978i/ 1CrQ6MAU/7krFGPGUXnf4ChXfDzxH41E90Sb02xHsl6542Cf21z9yjdTqavGln2R z6nnDhIM+FfbGdh/IxdBBQT334Dlaby+HDnHfv9z8NzmA+g6l4rnZn7g04O0r5oq 68odwxL59mUyC1Uhp1NIxcTSxgD+Rj8ZWs98auQkYFOrUoW2QlsmIAvqbZIQY0sT /isSYpsP/pO74mBt62fjz/dcrDwiPypDdT0iZxmgfeD+Jjlo78KxoVCpLxxBtKUw ykxvD3yhqsY4nJf6KkyRMJ3CgkNTNifmdJ/LhJ+0pbO9+zh8gL0kWO/S5WLg2nt4 CtRfOeQ4WwPX7PEmmtSs38L1oA3YUcRBYq2eseg0915WFO6tXjx/9Ej/Fj3lZ0jZ vWzF/PcTxkohBZk2CrnWBXxhbAgGtSNPzHzxDFMcu2kkLrDR0dn7efd5TDbbzRTe Dur1XFAmcGMh8KuW2HxqkOMu/fPLmbgufjxNcy7PG2CWZy7Xn8TwnGAyNnrvcCI= =cyK6 -----END PGP SIGNATURE-----

1 0

Any 2talk NOC lurking?
by Pete Mundy 27 Jul '15

27 Jul '15

Hi 2talk Just on the off-chance any of your guys are lurking on this list? You seem to have dropped a route and all traffic bound to your NS is going nowhere as of shortly after 6am today. I've tried lookups and pings from connections on quite a range of ISPs and they all show the same thing. Some traceroute examples are included below just as a reference. It's not the first time the route to the network hosting your NS has dropped. Have you ever considered having a tertiary NS elsewhere, say maybe on AWS or something? Just a thought. Anyway just a heads up since I can't access your live portal to lodge a ticket ;) (and a warning for others on list in case they are affected by it too). Cheers, Pete [from a Spark link] Host Loss% Snt Last Avg Best Wrst StDev 1. dsl-router.lan 0.0% 3 1.5 1.4 1.3 1.5 0.1 2. 122-56.78-178.n4l.sparkdigital.co.nz 0.0% 3 59.1 24.6 7.2 59.1 29.9 3. 122-56-99-251.n4l.sparkdigital.co.nz 0.0% 3 15.0 30.4 15.0 60.8 26.3 4. 122-56-99-250.n4l.sparkdigital.co.nz 0.0% 3 15.5 17.6 15.5 21.6 3.5 5. 122-56-99-253.n4l.sparkdigital.co.nz 0.0% 3 15.8 15.4 14.9 15.8 0.5 6. ??? 7. ae8-10.akbr6.global-gateway.net.nz 0.0% 2 25.8 25.8 25.8 25.8 0.0 8. ??? [from a Snap link] fpl-rpi17 (0.0.0.0) Tue Jul 28 07:16:35 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. fritz.box 0.0% 6 1.0 1.0 1.0 1.1 0.1 2. 133.7.69.111.static.snap.net.nz 0.0% 6 2.8 5.1 2.8 13.5 4.2 3. ??? [from a Solarix link] vvm2.fiberphone.co.nz (0.0.0.0) Tue Jul 28 07:17:14 2015 Keys: Help Display mode Restart statistics Order of fields quit Packets Pings Host Loss% Snt Last Avg Best Wrst StDev 1. ge-1-1-1-340.core-0.ive.chc.unleash.net.nz 0.0% 6 1.0 1.0 0.6 2.1 0.6 2. ae1-22.core-0.sho.chc.unleash.net.nz 0.0% 6 1.1 1.5 0.8 3.3 0.9 3. ae0-3221.core-0.que.akl.unleash.net.nz 0.0% 6 17.1 17.3 16.8 18.3 0.5 4. 116.90.129.203 0.0% 5 17.8 17.2 16.7 17.8 0.4 5. ten-0-3-0-500.bdr01.akl05.akl.VOCUS.net.nz 0.0% 5 17.1 17.4 17.1 17.5 0.2 6. ???

3 2

National Broadband Map launched yesterday
by Sebastian Castro 23 Jul '15

23 Jul '15

Hello members of the NZNOG community: NZRS launched the National Broadband Map (https://broadbandmap.nz) yesterday with the participation of Hon. Amy Adams. We had an overwhelming response and our team had to clock some extra hours to scale up everything nicely to cope with the load. We are getting calls and messages noting the accuracy in certain border cases. We are working with our data suppliers to ensure the information we're presenting is as accurate as possible, and new data will be added in the next weeks to improve it. We are open to receiving your comments and feedback, and definitely planning a presentation about the process for the next NZNOG meeting. Kind Regards, -- Sebastian Castro Technical Research Manager NZRS Ltd. desk: +64 4 495 2337 mobile: +64 21 400535

2 1

CallPlus Routes / Akamai Coming via Vocus / AKL-IX??
by Liam Farr 22 Jul '15

22 Jul '15

Hey, Anyone else seeing this, routes to CallPlus are being advertised to AKL-IX by Vocus rather than by CallPlus direct. As an example this is breaking 'www.stuff.co.nz' for me. The path by Vocus seems really 'fucked' (like its aggressively shaped down to nothing) so HTTP takes forever to load. Liams-MacBook-Pro:~ liamfarr$ traceroute www.stuff.co.nz > traceroute: Warning: www.stuff.co.nz has multiple addresses; using > 119.224.143.41 > traceroute to a1784.g.akamai.net (119.224.143.41), 64 hops max, 52 byte > packets > 1 192.168.6.1 (192.168.6.1) 0.710 ms 0.394 ms 0.332 ms > 2 unallocated.maxumdata.net (103.247.154.2) 0.427 ms 0.434 ms 0.397 > ms > 3 vl0901.core2.qs220.maxumdata.net (103.247.154.141) 0.585 ms 0.651 > ms 0.586 ms > 4 vl0233.edge1.qs220.maxumdata.net (103.247.154.38) 0.645 ms 0.672 > ms 0.613 ms > 5 43.243.21.6 (43.243.21.6) 1.580 ms 1.459 ms 1.529 ms > 6 ten-0-1-0-2.cor01.akl05.akl.vocus.net.nz (114.31.202.122) 2.139 ms > 2.088 ms 2.294 ms > 7 bundle-10.bdr02.akl05.akl.vocus.net.nz (114.31.202.101) 2.560 ms > 2.764 ms 2.314 ms > 8 as4610.cust.bdr02.akl05.akl.vocus.net.nz (175.45.102.66) 24.271 ms > 24.166 ms 24.251 ms > 9 pts-n.cpcak4-r1.tranzpeer.net (101.98.5.20) 2.297 ms 2.175 ms > 2.254 ms > 10 p1.akamai.callplus.net.nz (119.224.143.1) 1.488 ms 1.633 ms 2.441 > ms > 11 p41.akamai.callplus.net.nz (119.224.143.41) 1.624 ms 2.116 ms > 2.334 ms liam(a)QS220-EDGE1:~$ show ip bgp 119.224.143.41 > BGP routing table entry for 119.224.142.0/23 > Paths: (4 available, best #3, table Default-IP-Routing-Table) > Advertised to non peer-group peers: > 103.247.154.37 103.247.154.42 103.247.154.186 192.203.154.150 > 2403:4d00:fff:ffff:ffff:ffff:20:2 > 45177 4610 9790 > 103.247.152.241 from 103.247.152.241 (14.1.32.4) > Origin IGP, localpref 50, valid, external > Community: 55785:502 > Extended Community: RT:45177:1117 > Last update: Thu Jul 9 06:37:46 2015 > 45177 4610 9790 > 103.247.152.213 from 103.247.152.213 (14.1.32.4) > Origin IGP, localpref 50, valid, external > Community: 55785:502 > Extended Community: RT:45177:1117 > Last update: Thu Jul 9 06:34:55 2015 > > > > > * 4826 4610 9790 43.243.21.6 from 43.243.21.1 (43.243.21.1) > Origin IGP, localpref 100, valid, external, best Community: 55785:202 > Last update: Wed Jun 24 04:15:20 2015* > 23655 9560 9790 > 111.69.34.225 from 111.69.34.225 (43.225.200.2) > Origin IGP, localpref 90, valid, external > Community: 55785:302 > Last update: Sat Mar 28 03:36:00 2015 As CallPlus peer on AKL-IX I would have expected to see them advertising their own routes, rather than just advertising these to Vocus who are then 'breaking them'. Perhaps someone from CallPlus could fix their advertisements, and someone from Vocus could either fix their 'bottleneck' or stop advertising the routes. -- Kind Regards Liam Farr Maxum Data +64-9-950-5302

8 8

Junos and RPKI validation
by Dave Mill 16 Jul '15

16 Jul '15

Hi all NZNOG, and especially Michael Fincham and Tim Hoffman, had done a big push both at our conferences and on this list to get people using RPKI route validation. We were a test customer using the NZRS service at http://validator.rpki.net.nz/rtr-sessions . Someone with an observant eye may have noticed that we silently stopped using this validator a few weeks ago. We hit a 'minor' issue where Junos would restart _all_ routing daemons and produce a core dump when running a session to a RPKI validator. It affects 12.3R9 12.3X48-D10 13.3R4 14.1R3 14.2R1 15.1R1 and happens on J-series, M-series, T-series, MX-series, EX Series, SRX Series. PR for those with a Juniper login - https://prsearch.juniper.net/InfoCenter/index?page=prcontent&id=PR1010216 Upgrade to a recent release of your choosing to fix. Just figured I'd share for anyone else who is doing RPKI validation on one of these releases. For now we've stopped doing RPKI validation until we can arrange an upgrade of the routers involved. Cheers Dave

2 1

dual sim (3g) routers
by Jodi Thomson 12 Jul '15

12 Jul '15

Hi Folks We're on the hunt for a dual-sim (3g) router. Have done some googling but not sure what may or may not work with our 3/4G networks. Primary objective is to have 2nd 3G link as failover to second network (eg spark -> vodafone), but aggregation would be helpful also if networks support it (eg vodafone-vodafone) Wondering if anyone on the list knows what is available in NZ? Off list replies welcome to prevent clutter Cheers Jodi PS Beer -- Jodi Thomson Systems & Networks Web Connect Ltd Unit 1, 501 Heretaunga Street West Hastings, 4122 Ph: (06) 281 2324 (ext 802) http://www.webconnect.nz

1 1

Whither NzWrt?
by Dave Taht 12 Jul '15

12 Jul '15

I am curious if the NZWrt idea ever got any traction? It certainly seemed saner for me for a set of ISPs to agree on one specific hardware type, get software that met their needs, make it stable as heck, and to maintain it themselves.... -- Dave Täht worldwide bufferbloat report: http://www.dslreports.com/speedtest/results/bufferbloat And: What will it take to vastly improve wifi for everyone? https://plus.google.com/u/0/explore/makewififast

3 2

NZ TCF very bad SSL FYI
by Tony Wicks 08 Jul '15

08 Jul '15

HI guys, one of my users reported being unable access the IPMS platform this morning and it appears Firefox and Chrome are calling bul### on the really bad SSL on the TCF website and blocking access. IE still works but really shouldn't. Anyone on the TCF on this list, please sort your your technical people, this is just not good enough ! https://www.ssllabs.com/ssltest/analyze.html?d=ipms-prod.tcf.org.nz

1 1

4-wire SHDSL routers in NZ
by Dmitry Konchanin 06 Jul '15

06 Jul '15

Hi all We are suddenly in need of a couple 4-wire SHDSL EFM routers. There is basically no retail market for shdsl devices, ones we found are only 2-wires or have to be ordered with a lead time of couple of weeks (except pricy Cisco 888E option). If somebody has an access to stocked supply of such devices, could you please contact me off the list. -- Kind regards, Dmitry Konchanin

3 2

Intac program
by Dean Pemberton 02 Jul '15

02 Jul '15

Hi all, The Programme for this year's InTAC is now up: http://2015.nethui.nz/programme/day-0-intac This year there is a focus on "The Netflix Effect; Organic Growth or Step Change?" What does the changing face of user demand look like? What happens when people who previously only used their home connections for email and web, start using it for multiple 4-5Mbps streams? What happens when everyone on their street does that? Take a drive down any New Zealand street and look at all the Sky dishes on the roof â€“ what if every one of those houses was trying to pull 20Mbps during primetime instead? What would our network do with all that demand? We take a look at his problem, from the people at one end to the content delivery at the other. Registrations for this and the rest of the NetHui programme are still open here: https://nethui2015.lilregie.com/step1 See you next week! Dean -- -- Dean Pemberton Technical Policy Advisor InternetNZ +64 21 920 363 (mob) dean(a)internetnz.net.nz To promote the Internet's benefits and uses, and protect its potential.

2 1