- NZNOG - lists.nznog.org

worldwide DDOS (sql server fun)
by Joe Abley 25 Jan '03

25 Jan '03

http://www.nextgenss.com/advisories/mssql-udp.txt Time to start applying some filters at your edges. This has taken some big networks off the air in the US (and at least one in NZ). term deny-dos { from { packet-length 404; protocol udp; destination-port 1434; } then { count codered-4; discard; } } term allow-rest { then accept; } - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: worldwide DDOS (sql server fun)
by Ewen McNeill 25 Jan '03

25 Jan '03

In message <005701c2c4b1$165b1a80$0c01a8c0(a)saarinen.org>, "Juha Saarinen" writes: >Joe Abley <jabley(a)automagic.org> wrote: >> http://www.nextgenss.com/advisories/mssql-udp.txt > >http://news.bbc.co.uk/1/hi/technology/2693925.stm >Although I remain dubious about this claim: >"Unlike viruses, the worm exists only in memory, so it cannot be detected by >traditional anti-virus scanners." I'm not sure which bit you're dubious about: the "only in memory" or the "cannot be detected by traditional anti-virus scanners". The only in memory has been identified by various people starting to disassemble it. Various useful links (that have come through Bugtraq): >From "Jay D. Dyson" <jdyson(a)treachery.net>: http://www.kb.cert.org/vuls/id/370308 http://www.kb.cert.org/vuls/id/399260 http://www.kb.cert.org/vuls/id/484891 >From H D Moore <sflist(a)digitaloffense.net>: http://www.digitaloffense.net/worms/mssql_udp_worm/ (which contains some disassembly screen shots, and a unannotated disassembly) >From cstone <cstone(a)pobox.com> http://www.boredom.org/~cstone/worm-annotated.txt (which contains an annotated disassembly) >From what I can tell it's just a worm, spreading itself as fast as it can. Presumably the vulnerable hosts thus identified are then prime targets for something else to come in as a second wave. There's nothing in the annotated disassembly that indicates writing/sending data anywhere other than the Internet, hence "only in memory". Various people report that the infection can be cleared by stopping SQL server and/or rebooting -- with the obvious caveat that if it's not disconnected/firewalled from possible sources, it'll be reinfected quickly. As for "cannot be detected by traditional anti-virus scanners", that's probably a fall out of not writing anything to disk (which could be scanned), and memory protection in modern OS (which means the "memory scan" phase of DOS-based virus scanners is limited to the memory space the anti virus scanner is running in, without kernel support). Presumably a debug API or similar could be used to scan all memory, but I don't recall seeing that type of technique in (m)any anti-virus programs. Ewen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: 2LD Review for *.nz ?
by Frank March 22 Jan '03

22 Jan '03

Although this matter is off-topic for this list, it might pay for me to clarify matters here. InternetNZ has a clearly laid out set of procedures for reviewing policies relating to .nz administration - please see the Domain Name Commissioners website at http://www.dnc.org.nz/ for more information. Included in these is the process for determining and reviewing policies and procedures. Briefly the review process requires the establishment of a review committee whose task it is, inter alia, to carry out a process of wide public consultation. In this case, the review committee composition has been discussed with the InternetNZ Council who have delegated final membership determination to the .nz Oversight Committee. It should be noted that the notice (and accompanying press release) went out on 13 December which is, even by the relaxed NZ standards at this time of the year, a reasonable time before Christmas/New Year. The review terms of reference have yet to be decided but will be wide (see http://www.dnc.org.nz/story/30064-35-1.html) The public consultation, apart from online discussions, will involve at least one forum session of some type, probably co-incident with a broader discussion of other InternetNZ matters of public interest, to be organised late in the first half of this year. Unfortunately, I cannot be more specific about dates and location as this is a matter for the InternetNZ Council and the new Executive Director to sort out. Best wishes, Frank March Chair, .nz Oversight Committee --- Frank March Senior Specialist Adviser, IT Policy Group Ministry of Economic Development, PO Box 1473, Wellington, New Zealand Phone (+64 4) 474 2908; Fax (+64 4) 474 2659; Mobile (+64) 21 042 9205 -----Original Message----- From: Paul Brislen [mailto:Paul_Brislen(a)idg.co.nz] Sent: Thursday, 23 January 2003 13:26 To: Mark Foster Cc: nznog(a)list.waikato.ac.nz Subject: Re: 2LD Review for *.nz ? I would be interested to hear from anyone who has applied as well - I thought the nomination process was a bit quick, especially with the Christmas/New Year/Holiday of your choice season smack in the middle of it. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog http://www.govt.nz - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Economic Development. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: 2LD Review for *.nz ?
by Paul Brislen 22 Jan '03

22 Jan '03

Sadly, it's too late - nominations/applications closed first week of January... Mark Foster <blakjak(a)blakjak.net>@list.waikato.ac.nz on 23/01/2003 12:03:11 Sent by: owner-nznog(a)list.waikato.ac.nz To: nznog(a)list.waikato.ac.nz cc: Subject: 2LD Review for *.nz ? http://www.idg.co.nz/webhome.nsf/UNID/E021027AAA37CF2DCC256CB6000704F1!open… (Apologies for any offtopicness, but I know there will be people here very interested in this...) Anyone going to volunteer? - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

Re: 2LD Review for *.nz ?
by Paul Brislen 22 Jan '03

22 Jan '03

I would be interested to hear from anyone who has applied as well - I thought the nomination process was a bit quick, especially with the Christmas/New Year/Holiday of your choice season smack in the middle of it. Let me know off list if you like - I'm as far off topic as I like to get. Cheers, Paul PS - yes, I'm the reporter for IDGNet. Mark Foster <blakjak(a)blakjak.net> on 23/01/2003 13:36:03 To: "Paul Brislen" <Paul_Brislen(a)idg.co.nz> cc: nznog(a)list.waikato.ac.nz Subject: Re: 2LD Review for *.nz ? "The nominations for interest in being involved have closed and InternetNZ's oversight committee will meet in early February to select the four other participants." Oops.. Maybe ill rephrase. Anyone involved with NZNOG involved with this? The implications will impact alot of us here, I imagine. Thanks Paul, Mark. At 11:53 23/01/2003 +1300, Paul Brislen wrote: >Sadly, it's too late - nominations/applications closed first week of >January... - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

2LD Review for *.nz ?
by Mark Foster 22 Jan '03

22 Jan '03

http://www.idg.co.nz/webhome.nsf/UNID/E021027AAA37CF2DCC256CB6000704F1!open… (Apologies for any offtopicness, but I know there will be people here very interested in this...) Anyone going to volunteer? - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

The green green grass of home...
by Dean Pemberton 21 Jan '03

21 Jan '03

Hi all; I've been overseas for almost 5 years now, and it's time to come back home to New Zealand. I do however need a job. I've spoken to my current employer about this of course. While they acknowledge that it is technically possible for me to get a transfer to NZ, they can not see it happening in the near future. This is unfortunate, but does nothing to dampen my desire to return home. SO; If anyone out there has a position they need filled, or know of someone else who does, then can you drop me a line. My preference is for permanent work in Wellington, but I'm also happy to consider contract work and other locations. I'm also open to negotiation regarding salary, so don't worry about that to begin with. I'm basically keeping an open mind. So if you have something pass it on. I have a current CV at http://deanpemberton.com/cv/ Feel free to pass it along to anyone who might be interested. Thanks Dean - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Talk about 'Network Measurements at Sprint, AS 1239'
by Nevil Brownlee 21 Jan '03

21 Jan '03

Hi Jamie: > Have you come across a similar project by RIPE? > http://www.ripe.net/test-traffic/ > > Are the two trying to achieve the same objectives with different approaches > in terms of scale and distribution? (Though to me RIPE has the edge as is > appears to measure IPDV) Yes. RIPE test traffic provides data about Internet links between their 'test boxes;' RIPE NCC offer it as a (charged for) service to ISPs who are RIPE members. I agree, it's an interesting project - their web pages http://www.ripe.net/ttm/index.html are well worth a look. The Sprint work is concerned with measuring and understanding the way traffic behaves in their backbone, and how that information can be used to imnprove backbone behaviour, for example by using it to tune IS-IS link weights. > Nevertheless, some very interesting statistical information found at > http://ipmon.sprint.com Cheers, Nevil ----------------------------------------------------------------------- Nevil Brownlee Director, Technology Development Phone: +64 9 373 7599 x88941 ITSS, The University of Auckland FAX: +64 9 373 7021 Private Bag 92019, Auckland, New Zealand ------------------------------------------------- This mail sent through University of Auckland http://www.auckland.ac.nz/ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

more on the PDP-11
by Richard Naylor 20 Jan '03

20 Jan '03

I should have mentioned its not small. The basic 2 disk machine is a 1.2m rack. I normally stack the 3rd disk and floppy on top, making a 5 foot rack. In my box of bits there maybe some MicroVax cpus as well. Theres also a few backplanes, so you can probably build a 2nd or 3rd machine. There is also a real DEC VT100 And for those of you who think "in car computers" (&MP3 players) are cool, I had an in car PDP-11 probably before you were born. rich - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

6 7

Anyone looking to 2U cases ?
by Mark Frater 20 Jan '03

20 Jan '03

Hi List, I've tried getting 2U 19" wide by (only) 19" deep cases from Procase, but they don't have any and can't get them. Unless anyone knows a NZ source for these, I am intending to get some from Taiwan. US$200 including 400W PSU. Takes standard ATX mobo, comes with 3PCI riser card. We have some units in production already and they have been fine. Contact me off list if you are interested and we can split the shipping and import charges. Mark Frater Quicksilver Internet ph 9160300 - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0